last executing test programs: 2.613309239s ago: executing program 1 (id=9231): mmap$auto(0x0, 0xff, 0x4000000000df, 0xeb1, 0x401, 0x8000) r0 = socket(0x2, 0x1, 0x0) setsockopt$auto(r0, 0x6, 0x24, 0x0, 0x40) 2.264539718s ago: executing program 1 (id=9235): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x168, r1, 0x1b, 0x70bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_ACTIONS={0x14c, 0x3, 0x0, 0x1, [@nested={0x148, 0x1, 0x0, 0x1, [@nested={0x141, 0x12d, 0x0, 0x1, [@typed={0x8, 0x128, 0x0, 0x0, @u32=0x4}, @typed={0x8, 0xb5, 0x0, 0x0, @pid}, @generic="b04e844ea904ebea1961b006b1", @generic="f4786414515be8eb668dae1537305b2b85146fa0a185fbc8dc178799ba2fa6240a8d748b1a446d7a475487d45d152708908224ab", @nested={0xe9, 0x8a, 0x0, 0x1, [@generic="7897c7ca660c", @generic="5e22dfb544bb1e556e2c79d947066b0502973dec091fef0790b61f07b31c3dd2ee5f0529fc8077e62f87badfe0ab4b46e9623926cd375613c4bde5cdc817bcaad729bd4888bc4133", @generic="073dc8e8e4805d30b44c3466894fd34be815563254488b27ebb9b6e710fddc", @typed={0x76, 0xf1, 0x0, 0x0, @binary="67ab35ede9f24221fdc80dd31a37d3c1256b43654c3a3b85edbcac47d71a14432c0662ea40898e214313ed0218f47a1f36a442d15fb111fe40341b601829dc1642c2eb2a94efbed2538400819d9b1abc52df9fb7de60d64a2bc46918afa2fde42a5dbbca34c81f55e0b0dc3837c5acde968e"}]}]}]}]}, @OVS_PACKET_ATTR_ACTIONS={0x4}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x168}, 0x1, 0x0, 0x0, 0x4004040}, 0x4000844) 1.953266427s ago: executing program 3 (id=9241): mmap$auto(0x0, 0x400408, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0xa, 0x1, 0x84) setsockopt$auto(r0, 0x0, 0x60, 0x0, 0x6f7250c4) 1.906818009s ago: executing program 1 (id=9242): r0 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000001900), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_MACSEC_CMD_GET_TXSC(r1, &(0x7f00000000c0)={0x0, 0xf000, &(0x7f0000000000)={&(0x7f0000000740)={0x14, r0, 0x186f202170196f7b, 0x703d26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x200008d0}, 0x40080c4) 1.711124354s ago: executing program 0 (id=9244): r0 = socket(0xa, 0x1, 0x84) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) getsockopt$auto(r0, 0x84, 0x1, 0x0, &(0x7f0000000000)=0x9d) 1.610289283s ago: executing program 1 (id=9245): close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0x1, 0xb9, 0xf, 0x7, 0x400004, 0xffffffffffffffff, 0x7, "00000000000000e3ffffffffffffff00", 0x0, 0xffffffffffffffff, 0x5, 0x7, 0xe5, 0x3}, 0x10) bpf$auto(0x1a, &(0x7f0000000380)=@link_create={@map_fd, @target_ifindex=r0, 0x3, 0x81, @uprobe_multi={0x81, 0x1fd, 0x9, 0x8, 0x1, 0x4}}, 0x92) 1.572813653s ago: executing program 0 (id=9246): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ovs_meter(&(0x7f0000002340), 0xffffffffffffffff) sendmsg$auto_OVS_METER_CMD_SET(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000002440)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@OVS_METER_ATTR_KBPS={0x4}, @OVS_METER_ATTR_BANDS={0xc, 0x4, 0x0, 0x1, [@nested={0x4, 0x45}, @generic='\x00\x00\x00\x00']}, @OVS_METER_ATTR_ID={0x8, 0x1, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48000}, 0x0) 1.55443841s ago: executing program 3 (id=9247): mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) io_setup$auto(0x1, 0x0) mincore$auto(0x1000, 0x8001, 0x0) 1.446770247s ago: executing program 0 (id=9248): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/platform/vhci_hcd.0/detach\x00', 0x101001, 0x0) mmap$auto(0x0, 0x2020009, 0x100003, 0xeb1, 0xfffffffffffffffa, 0x8000) writev$auto(0x3, &(0x7f0000000080)={0x0, 0x1}, 0x3) 1.392797866s ago: executing program 3 (id=9249): r0 = openat$auto_proc_fault_inject_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/make-it-fail\x00', 0x282, 0x0) exit$auto(0x4) read$auto_proc_fault_inject_operations_base(r0, 0x0, 0x0) 1.300861303s ago: executing program 0 (id=9250): semget$auto(0x0, 0x13c, 0x1ff) semtimedop$auto(0x0, &(0x7f0000000000)={0x7, 0x8000, 0x36ec}, 0x1, 0x0) semop$auto(0x6, &(0x7f0000000040)={0x1, 0xffff, 0x7fff}, 0x6) 952.609704ms ago: executing program 1 (id=9254): r0 = socket(0x10, 0x2, 0xc) r1 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$auto_CTRL_CMD_GETPOLICY(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x24, r1, 0x10, 0x70bd2c, 0x25dfdbfa, {0xa, 0x0, 0xa00}, [@CTRL_ATTR_FAMILY_NAME={0x0, 0x2, '%/\x00\xe2\xa8\\A\xe7Z\x02q[-\x00\x00\x00\x10\x00\xdf(\xff\xfee\xc3\x17py\x9f\xda\xb88\xaa\xf6q*\x82\xe6(\xc9\xe6B\x9aJ82\v-i(c\x92{\xd7D\xb4\xf7\xb4\t\xb2\x98b\xd3%vu\xd4\xfd\t\xd7J\x83\x19)\xb1\x00[\xdd(\xef?\xc5\xae(\x84\xefjx\xfe\xdb\xeb\xbceaAw\x1eW\x12Bh\xc3y2\xc9\x0e\xc9\x99#\x92j\x97\xbbDOi\x03\xa4\x11\x02F [ 288.480865][ T5828] dump_stack_lvl+0x100/0x190 [ 288.480926][ T5828] dump_header+0xfb/0x606 [ 288.480962][ T5828] oom_kill_process.cold+0xd/0x330 [ 288.480997][ T5828] out_of_memory+0x340/0x14f0 [ 288.481050][ T5828] ? __pfx_out_of_memory+0x10/0x10 [ 288.481105][ T5828] mem_cgroup_out_of_memory+0xc6/0x130 [ 288.481146][ T5828] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 288.481182][ T5828] ? find_held_lock+0x2b/0x80 [ 288.481218][ T5828] ? do_raw_spin_unlock+0x145/0x1e0 [ 288.481262][ T5828] ? _raw_spin_unlock+0x28/0x50 [ 288.481301][ T5828] try_charge_memcg+0x652/0xc90 [ 288.481341][ T5828] ? __pfx_try_charge_memcg+0x10/0x10 [ 288.481380][ T5828] ? find_held_lock+0x2b/0x80 [ 288.481406][ T5828] ? rcu_read_unlock+0x17/0x60 [ 288.481436][ T5828] ? rcu_read_unlock+0x17/0x60 [ 288.481470][ T5828] charge_memcg+0xa6/0x280 [ 288.481500][ T5828] mem_cgroup_swapin_charge_folio+0xeb/0x470 [ 288.481539][ T5828] __swap_cache_prepare_and_add+0x528/0x9e0 [ 288.481597][ T5828] ? __pfx___swap_cache_prepare_and_add+0x10/0x10 [ 288.481635][ T5828] ? __pfx_swap_entry_swapped+0x10/0x10 [ 288.481675][ T5828] swap_cache_alloc_folio+0x1cb/0x300 [ 288.481715][ T5828] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 288.481754][ T5828] ? mark_held_locks+0x40/0x70 [ 288.481788][ T5828] ? finish_task_switch.isra.0+0x205/0xb80 [ 288.481818][ T5828] ? lockdep_hardirqs_on+0x78/0x100 [ 288.481861][ T5828] swap_cluster_readahead+0x53b/0x770 [ 288.481923][ T5828] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 288.481968][ T5828] ? update_cfs_rq_load_avg+0x51/0x550 [ 288.482007][ T5828] ? get_vma_policy+0x23f/0x3b0 [ 288.482035][ T5828] swapin_readahead+0x160/0x12c0 [ 288.482076][ T5828] ? __pfx_swapin_readahead+0x10/0x10 [ 288.482106][ T5828] ? find_held_lock+0x2b/0x80 [ 288.482125][ T5828] ? swap_table_get+0x103/0x2c0 [ 288.482152][ T5828] ? swap_table_get+0x103/0x2c0 [ 288.482187][ T5828] ? swap_table_get+0x10d/0x2c0 [ 288.482216][ T5828] ? swap_cache_get_folio+0x1ae/0x600 [ 288.482248][ T5828] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 288.482275][ T5828] ? __pfx_get_swap_device+0x10/0x10 [ 288.482304][ T5828] ? do_swap_page+0xb2e/0x6900 [ 288.482331][ T5828] do_swap_page+0xb2e/0x6900 [ 288.482377][ T5828] ? __pfx_do_swap_page+0x10/0x10 [ 288.482407][ T5828] ? __free_object+0x2a8/0x400 [ 288.482439][ T5828] ? lockdep_hardirqs_on+0x78/0x100 [ 288.482473][ T5828] ? rcu_is_watching+0x12/0xc0 [ 288.482506][ T5828] ? __pte_offset_map+0x179/0x310 [ 288.482533][ T5828] __handle_mm_fault+0x18c1/0x2b60 [ 288.482569][ T5828] ? reacquire_held_locks+0xce/0x1e0 [ 288.482598][ T5828] ? __pfx___handle_mm_fault+0x10/0x10 [ 288.482633][ T5828] ? lock_vma_under_rcu+0x17c/0x590 [ 288.482682][ T5828] handle_mm_fault+0x36d/0xa20 [ 288.482719][ T5828] do_user_addr_fault+0x5a3/0x12f0 [ 288.482764][ T5828] exc_page_fault+0x6f/0xd0 [ 288.482794][ T5828] asm_exc_page_fault+0x26/0x30 [ 288.482816][ T5828] RIP: 0033:0x7f1b1eb5cfce [ 288.482836][ T5828] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 288.482857][ T5828] RSP: 002b:00007ffe37930ac8 EFLAGS: 00010246 [ 288.482875][ T5828] RAX: 0000000000000000 RBX: 00005555790cc500 RCX: 00007f1b1eb5cfce [ 288.482890][ T5828] RDX: 00007ffe37930b20 RSI: 0000000000000000 RDI: 0000000000000000 [ 288.482910][ T5828] RBP: 00007ffe37930b8c R08: 0000000000000000 R09: 0000000000000000 [ 288.482923][ T5828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 288.482936][ T5828] R13: 00000000000927c0 R14: 000000000004659d R15: 00007ffe37930be0 [ 288.482968][ T5828] [ 288.483824][ T5828] memory: usage 3072kB, limit 3072kB, failcnt 6218 [ 288.944195][ T5828] memory+swap: usage 3240kB, limit 9007199254740988kB, failcnt 0 [ 288.963023][ T5828] kmem: usage 3048kB, limit 9007199254740988kB, failcnt 0 [ 288.993058][ T5828] Memory cgroup stats for /syz2: [ 288.993531][ T5828] cache 0 [ 289.030964][ T5828] rss 0 [ 289.033793][ T5828] rss_huge 0 [ 289.051685][ T5828] shmem 0 [ 289.055398][ T5828] mapped_file 0 [ 289.072695][ T5828] dirty 0 [ 289.082098][ T5828] writeback 0 [ 289.085576][ T5828] workingset_refault_anon 402 [ 289.094779][ T5828] workingset_refault_file 3309 [ 289.100173][ T5828] swap 172032 [ 289.103588][ T5828] swapcached 18604032 [ 289.109354][ T5828] pgpgin 68267 [ 289.113117][ T5828] pgpgout 68261 [ 289.120198][ T5828] pgfault 101974 [ 289.123794][ T5828] pgmajfault 284 [ 289.137216][ T5828] inactive_anon 20480 [ 289.141290][ T5828] active_anon 4096 [ 289.145172][ T5828] inactive_file 0 [ 289.152987][ T5828] active_file 0 [ 289.157029][ T5828] unevictable 0 [ 289.160699][ T5828] hierarchical_memory_limit 3145728 [ 289.164652][T13467] synth uevent: /bus/hid/drivers/zeroplus: unknown uevent action string [ 289.166329][ T5828] hierarchical_memsw_limit 9223372036854771712 [ 289.181797][ T5828] total_cache 0 [ 289.185743][ T5828] total_rss 0 [ 289.202135][ T5828] total_rss_huge 0 [ 289.215329][ T5828] total_shmem 0 [ 289.218969][ T5828] total_mapped_file 0 [ 289.223003][ T5828] total_dirty 0 [ 289.255752][ T5828] total_writeback 0 [ 289.259725][ T5828] total_workingset_refault_anon 402 [ 289.295228][ T5828] total_workingset_refault_file 3309 [ 289.301323][ T5828] total_swap 172032 [ 289.314094][ T5828] total_swapcached 18604032 [ 289.338820][ T5828] total_pgpgin 68267 [ 289.343053][ T5828] total_pgpgout 68261 [ 289.358755][ T5828] total_pgfault 101974 [ 289.363059][ T5828] total_pgmajfault 284 [ 289.384813][ T5828] total_inactive_anon 20480 [ 289.389663][ T5828] total_active_anon 4096 [ 289.424293][ T5828] total_inactive_file 0 [ 289.431547][ T5828] total_active_file 0 [ 289.444188][ T5828] total_unevictable 0 [ 289.449860][ T5828] anon_cost 0 [ 289.453302][ T5828] file_cost 0 [ 289.474142][ T5828] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.3635,pid=13421,uid=0 [ 289.520249][ T5828] Memory cgroup out of memory: Killed process 13421 (syz.2.3635) total-vm:104276kB, anon-rss:1240kB, file-rss:21580kB, shmem-rss:0kB, UID:0 pgtables:124kB oom_score_adj:1000 [ 290.580679][T13519] smpboot: CPU 1 is now offline [ 291.142980][T13535] Process accounting paused [ 291.306007][T13548] Format for unlinking a device is "netnsfd:ifidx" (int uint). [ 291.874227][ T5844] Bluetooth: hci1: unexpected event 0x3e length: 0 < 1 [ 295.776870][ T5844] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 295.784807][ T5844] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 295.795164][ T5844] CPU: 0 UID: 0 PID: 5844 Comm: kworker/u9:8 Tainted: G U syzkaller #0 PREEMPT(full) [ 295.795195][ T5844] Tainted: [U]=USER [ 295.795201][ T5844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 295.795214][ T5844] Workqueue: hci0 hci_rx_work [ 295.795239][ T5844] Call Trace: [ 295.795246][ T5844] [ 295.795253][ T5844] dump_stack_lvl+0x100/0x190 [ 295.795282][ T5844] sysfs_warn_dup.cold+0x1c/0x28 [ 295.795307][ T5844] sysfs_create_dir_ns+0x24b/0x2b0 [ 295.795332][ T5844] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 295.795355][ T5844] ? find_held_lock+0x2b/0x80 [ 295.795372][ T5844] ? kobject_add_internal+0x25f/0x930 [ 295.795400][ T5844] ? kobject_add_internal+0x25f/0x930 [ 295.795431][ T5844] ? do_raw_spin_unlock+0x145/0x1e0 [ 295.795459][ T5844] kobject_add_internal+0x2c8/0x930 [ 295.795492][ T5844] kobject_add+0x16a/0x1e0 [ 295.795508][ T5844] ? __pfx_kobject_add+0x10/0x10 [ 295.795524][ T5844] ? class_to_subsys+0x10f/0x150 [ 295.795549][ T5844] ? kobject_put+0xb9/0x640 [ 295.795574][ T5844] ? _raw_spin_unlock+0x28/0x50 [ 295.795601][ T5844] device_add+0x294/0x1950 [ 295.795621][ T5844] ? __pfx_dev_set_name+0x10/0x10 [ 295.795645][ T5844] ? __pfx_device_add+0x10/0x10 [ 295.795666][ T5844] ? mgmt_send_event_skb+0x2fb/0x460 [ 295.795692][ T5844] hci_conn_add_sysfs+0x1a3/0x260 [ 295.795718][ T5844] le_conn_complete_evt+0x11cb/0x1f40 [ 295.795745][ T5844] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 295.795764][ T5844] ? __pfx_bt_warn+0x10/0x10 [ 295.795790][ T5844] hci_le_conn_complete_evt+0x23c/0x3a0 [ 295.795812][ T5844] ? skb_pull_data+0x15f/0x1e0 [ 295.795843][ T5844] hci_le_meta_evt+0x34a/0x5f0 [ 295.795866][ T5844] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 295.795892][ T5844] hci_event_packet+0x682/0x11c0 [ 295.795913][ T5844] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 295.795937][ T5844] ? __pfx_hci_event_packet+0x10/0x10 [ 295.795962][ T5844] ? kcov_remote_start+0x374/0x660 [ 295.795979][ T5844] ? lockdep_hardirqs_on+0x78/0x100 [ 295.796010][ T5844] hci_rx_work+0x451/0xfc0 [ 295.796035][ T5844] process_one_work+0xa23/0x19a0 [ 295.796070][ T5844] ? __pfx_process_one_work+0x10/0x10 [ 295.796102][ T5844] ? __pfx_hci_rx_work+0x10/0x10 [ 295.796126][ T5844] worker_thread+0x5ef/0xe50 [ 295.796157][ T5844] ? __pfx_worker_thread+0x10/0x10 [ 295.796183][ T5844] ? kthread+0x13a/0x450 [ 295.796204][ T5844] ? __pfx_worker_thread+0x10/0x10 [ 295.796228][ T5844] kthread+0x370/0x450 [ 295.796250][ T5844] ? __pfx_kthread+0x10/0x10 [ 295.796275][ T5844] ret_from_fork+0x754/0xd80 [ 295.796302][ T5844] ? __pfx_ret_from_fork+0x10/0x10 [ 295.796330][ T5844] ? __switch_to+0x7b4/0x1120 [ 295.796349][ T5844] ? __pfx_kthread+0x10/0x10 [ 295.796374][ T5844] ret_from_fork_asm+0x1a/0x30 [ 295.796404][ T5844] [ 295.796425][ T5844] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 296.114504][ T5844] Bluetooth: hci0: failed to register connection device [ 298.150537][ T5844] Bluetooth: hci0: command 0x0406 tx timeout [ 299.825632][T13852] usb usb37: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 299.874000][T13852] vhci_hcd vhci_hcd.2: invalid port number 0 [ 300.189733][T13866] __vm_enough_memory: pid: 13866, comm: syz.2.3851, bytes: 9223372036854775808 not enough memory for the allocation [ 300.223171][ T5844] Bluetooth: hci0: command 0x0406 tx timeout [ 303.672332][T13995] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 305.354024][T14065] random: crng reseeded on system resumption [ 306.039487][ T5844] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 307.970810][T14168] Setting dangerous option i915.mitigations - tainting kernel [ 308.383266][ T30] audit: type=1800 audit(1843104660.230:16): pid=14187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4008" name="dbroot" dev="configfs" ino=33716 res=0 errno=0 [ 309.995056][T14243] syz.1.4030 (14243): attempted to duplicate a private mapping with mremap. This is not supported. [ 310.426439][T14260] bond0: invalid ARP target specified [ 311.552670][T14303] block2mtd: illegal erase size [ 311.585128][T14306] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 312.496304][T14340] delete_channel: no stack [ 313.208534][T14370] Setting dangerous option i915.mitigations - tainting kernel [ 313.459633][T14379] mmap: syz.1.4103 (14379) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 315.351384][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 315.357843][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.066208][T14469] ima: policy update failed [ 316.071390][ T30] audit: type=1802 audit(1843104667.960:17): pid=14469 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.4147" res=0 errno=0 [ 317.140791][T14512] ubi31: attaching mtd0 [ 317.159266][T14512] ubi31: scanning is finished [ 317.186583][T14512] ubi31: empty MTD device detected [ 317.396041][T14512] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 317.453688][T14512] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3518 bytes [ 317.509071][T14512] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 317.569165][T14512] ubi31: VID header offset: 514 (aligned 514), data offset: 578 [ 317.618423][T14512] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 317.657727][T14512] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 20 [ 317.710141][T14512] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 474476378 [ 317.780810][T14533] vhci_hcd: not connected 4 [ 317.789334][T14512] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 317.867215][T14525] ubi31: background thread "ubi_bgt31d" started, PID 14525 [ 319.152887][T14579] ubi: mtd0 is already attached to ubi31 [ 319.574987][T14597] vhci_hcd vhci_hcd.1: invalid port number 16 [ 319.607711][T14597] vhci_hcd vhci_hcd.1: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 320.263720][T14626] binder: 14625:14626 ioctl c0046209 9 returned -22 [ 321.068252][T14658] warning: `syz.1.4238' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 321.163635][T14661] Process accounting resumed [ 321.730430][T14681] vhci_hcd vhci_hcd.2: invalid port number 194 [ 321.758158][T14681] vhci_hcd vhci_hcd.2: invalid port number 194 [ 326.332886][T14860] bonding: no command found in bonding_masters - use +ifname or -ifname [ 328.662777][ T30] audit: type=1400 audit(1843104680.606:18): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14971 comm="syz.2.4380" [ 328.756397][T14976] kAFS: Invalid Command on /proc/fs/afs/cells file [ 329.961603][T15021] ima: policy update failed [ 329.996748][ T30] audit: type=1802 audit(1843104681.942:19): pid=15021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.0.4402" res=0 errno=0 [ 330.802492][T15055] syz.1.4415 uses obsolete (PF_INET,SOCK_PACKET) [ 332.218565][T15108] bcache: register_bcache() error : failed to open device [ 332.684720][T15130] usb usb36: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 332.739217][T15130] vhci_hcd vhci_hcd.1: default hub control req: 0000 v0000 i0000 l0 [ 332.782518][T15136] ICMPv6: process `syz.0.4448' is using deprecated sysctl (syscall) net.ipv6.neigh.ipvlan1.retrans_time - use net.ipv6.neigh.ipvlan1.retrans_time_ms instead [ 335.240948][T15250] block2mtd: illegal erase size [ 335.686219][T15270] batman_adv: Routing algorithm '7' is not supported [ 336.202273][ T30] audit: type=1800 audit(1843123032.194:20): pid=15296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4511" name="sr0" dev="devtmpfs" ino=2868 res=0 errno=0 [ 336.585134][T15310] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888078001dc0 pfn:0x78001 [ 336.623550][T15310] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 336.658884][T15310] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 336.709861][T15310] raw: ffff888078001dc0 0000000000000000 00000001ffffffff 0000000000000000 [ 336.773767][T15310] page dumped because: unmovable page [ 336.802350][T15310] page_owner tracks the page as allocated [ 336.818868][T15323] kAFS: Invalid Command on /proc/fs/afs/cells file [ 336.829682][T15310] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 5828, tgid 5828 (syz-executor), ts 133886825579, free_ts 133885287636 [ 336.908799][T15310] post_alloc_hook+0x153/0x170 [ 336.936756][T15310] get_page_from_freelist+0x111d/0x3140 [ 336.981379][T15310] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 337.016188][T15310] alloc_pages_bulk_noprof+0x782/0x1490 [ 337.046681][T15310] __kasan_populate_vmalloc+0xf0/0x210 [ 337.065503][T15310] alloc_vmap_area+0x95d/0x2bd0 [ 337.103988][T15310] __get_vm_area_node+0x1ca/0x330 [ 337.117392][T15310] __vmalloc_node_range_noprof+0x213/0x1530 [ 337.138946][T15310] __vmalloc_node_noprof+0xad/0xf0 [ 337.157287][T15310] do_ip6t_get_ctl+0x632/0xa50 [ 337.167810][T15310] nf_getsockopt+0x7c/0xe0 [ 337.180364][T15310] ipv6_getsockopt+0x207/0x2a0 [ 337.190875][T15310] tcp_getsockopt+0xa1/0x110 [ 337.206307][T15310] do_sock_getsockopt+0x259/0x3d0 [ 337.227663][T15310] __sys_getsockopt+0x133/0x1d0 [ 337.244821][T15310] __x64_sys_getsockopt+0xbd/0x160 [ 337.256921][T15310] page last free pid 5828 tgid 5828 stack trace: [ 337.271601][T15310] __free_frozen_pages+0x7e1/0x10d0 [ 337.287192][T15310] __kasan_populate_vmalloc+0x164/0x210 [ 337.303579][T15310] alloc_vmap_area+0x95d/0x2bd0 [ 337.359418][T15310] __get_vm_area_node+0x1ca/0x330 [ 337.379096][T15310] __vmalloc_node_range_noprof+0x213/0x1530 [ 337.393965][T15310] __vmalloc_node_noprof+0xad/0xf0 [ 337.410630][T15310] do_ipt_get_ctl+0x632/0xa10 [ 337.425174][T15310] nf_getsockopt+0x7c/0xe0 [ 337.446964][T15310] ip_getsockopt+0x192/0x1e0 [ 337.457007][T15310] tcp_getsockopt+0xa1/0x110 [ 337.468343][T15310] do_sock_getsockopt+0x259/0x3d0 [ 337.475822][T15310] __sys_getsockopt+0x133/0x1d0 [ 337.483152][T15310] __x64_sys_getsockopt+0xbd/0x160 [ 337.489083][T15310] do_syscall_64+0x106/0xf80 [ 337.494012][T15310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.546118][T15439] blkio.reset_stats is deprecated [ 340.278434][T15475] ICMPv6: process `syz.3.4579' is using deprecated sysctl (syscall) net.ipv6.neigh.veth0_to_bridge.base_reachable_time - use net.ipv6.neigh.veth0_to_bridge.base_reachable_time_ms instead [ 341.522067][ T30] audit: type=1804 audit(1843123037.542:21): pid=15542 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.4606" name="/newroot/sys/kernel/debug/tracing/events/vmalloc/alloc_vmap_area/filter" dev="tracefs" ino=19680823 res=1 errno=0 [ 344.039510][T15662] QAT: failed to copy from user. [ 347.674559][ T5839] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 348.601388][T15915] i2c i2c-0: new_device: Can't parse I2C address [ 349.226325][ T30] audit: type=1800 audit(1843123045.292:22): pid=15948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.4752" name="members" dev="configfs" ino=38595 res=0 errno=0 [ 349.721774][ T5839] Bluetooth: hci3: command 0x0406 tx timeout [ 351.188565][T16035] Process accounting paused [ 351.791485][ T5844] Bluetooth: hci3: command 0x0406 tx timeout [ 353.460473][T16154] kAFS: unparsable volume name [ 353.817458][ T30] audit: type=1800 audit(1843123049.886:23): pid=16174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4840" name="lu_gp_id" dev="configfs" ino=39158 res=0 errno=0 [ 354.046047][ T5839] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 354.055884][ T5839] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 354.065633][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:3 Tainted: G U syzkaller #0 PREEMPT(full) [ 354.065663][ T5839] Tainted: [U]=USER [ 354.065669][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 354.065682][ T5839] Workqueue: hci1 hci_rx_work [ 354.065708][ T5839] Call Trace: [ 354.065715][ T5839] [ 354.065723][ T5839] dump_stack_lvl+0x100/0x190 [ 354.065752][ T5839] sysfs_warn_dup.cold+0x1c/0x28 [ 354.065778][ T5839] sysfs_create_dir_ns+0x24b/0x2b0 [ 354.065803][ T5839] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 354.065833][ T5839] ? find_held_lock+0x2b/0x80 [ 354.065850][ T5839] ? kobject_add_internal+0x25f/0x930 [ 354.065879][ T5839] ? kobject_add_internal+0x25f/0x930 [ 354.065910][ T5839] ? do_raw_spin_unlock+0x145/0x1e0 [ 354.065937][ T5839] kobject_add_internal+0x2c8/0x930 [ 354.065970][ T5839] kobject_add+0x16a/0x1e0 [ 354.065986][ T5839] ? __pfx_kobject_add+0x10/0x10 [ 354.066001][ T5839] ? class_to_subsys+0x10f/0x150 [ 354.066027][ T5839] ? kobject_put+0xb9/0x640 [ 354.066052][ T5839] ? _raw_spin_unlock+0x28/0x50 [ 354.066080][ T5839] device_add+0x294/0x1950 [ 354.066108][ T5839] ? __pfx_dev_set_name+0x10/0x10 [ 354.066132][ T5839] ? __pfx_device_add+0x10/0x10 [ 354.066153][ T5839] ? mgmt_send_event_skb+0x2fb/0x460 [ 354.066180][ T5839] hci_conn_add_sysfs+0x1a3/0x260 [ 354.066206][ T5839] le_conn_complete_evt+0x11cb/0x1f40 [ 354.066233][ T5839] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 354.066252][ T5839] ? __pfx_bt_warn+0x10/0x10 [ 354.066277][ T5839] hci_le_conn_complete_evt+0x23c/0x3a0 [ 354.066300][ T5839] ? skb_pull_data+0x15f/0x1e0 [ 354.066322][ T5839] hci_le_meta_evt+0x34a/0x5f0 [ 354.066345][ T5839] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 354.066370][ T5839] hci_event_packet+0x682/0x11c0 [ 354.066391][ T5839] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 354.066415][ T5839] ? __pfx_hci_event_packet+0x10/0x10 [ 354.066439][ T5839] ? kcov_remote_start+0x374/0x660 [ 354.066455][ T5839] ? lockdep_hardirqs_on+0x78/0x100 [ 354.066485][ T5839] hci_rx_work+0x451/0xfc0 [ 354.066510][ T5839] process_one_work+0xa23/0x19a0 [ 354.066545][ T5839] ? __pfx_process_one_work+0x10/0x10 [ 354.066577][ T5839] ? __pfx_hci_rx_work+0x10/0x10 [ 354.066600][ T5839] worker_thread+0x5ef/0xe50 [ 354.066634][ T5839] ? kthread+0x13a/0x450 [ 354.066655][ T5839] ? __pfx_worker_thread+0x10/0x10 [ 354.066679][ T5839] kthread+0x370/0x450 [ 354.066701][ T5839] ? __pfx_kthread+0x10/0x10 [ 354.066726][ T5839] ret_from_fork+0x754/0xd80 [ 354.066752][ T5839] ? __pfx_ret_from_fork+0x10/0x10 [ 354.066778][ T5839] ? rcu_is_watching+0x12/0xc0 [ 354.066811][ T5839] ? __switch_to+0x7b4/0x1120 [ 354.066830][ T5839] ? __pfx_kthread+0x10/0x10 [ 354.066855][ T5839] ret_from_fork_asm+0x1a/0x30 [ 354.066884][ T5839] [ 354.066907][ T5839] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 354.371768][ T5839] Bluetooth: hci1: failed to register connection device [ 356.406292][ T5844] Bluetooth: hci1: command 0x0406 tx timeout [ 358.353460][T16380] block2mtd: illegal erase size [ 358.476372][ T5844] Bluetooth: hci1: command 0x0406 tx timeout [ 358.580076][T16392] < [ 358.848165][ T5839] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 358.858712][ T5839] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 358.872501][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:3 Tainted: G U syzkaller #0 PREEMPT(full) [ 358.872530][ T5839] Tainted: [U]=USER [ 358.872536][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 358.872548][ T5839] Workqueue: hci0 hci_rx_work [ 358.872573][ T5839] Call Trace: [ 358.872579][ T5839] [ 358.872586][ T5839] dump_stack_lvl+0x100/0x190 [ 358.872616][ T5839] sysfs_warn_dup.cold+0x1c/0x28 [ 358.872641][ T5839] sysfs_create_dir_ns+0x24b/0x2b0 [ 358.872667][ T5839] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 358.872690][ T5839] ? find_held_lock+0x2b/0x80 [ 358.872707][ T5839] ? kobject_add_internal+0x25f/0x930 [ 358.872735][ T5839] ? kobject_add_internal+0x25f/0x930 [ 358.872765][ T5839] ? do_raw_spin_unlock+0x145/0x1e0 [ 358.872802][ T5839] kobject_add_internal+0x2c8/0x930 [ 358.872835][ T5839] kobject_add+0x16a/0x1e0 [ 358.872851][ T5839] ? __pfx_kobject_add+0x10/0x10 [ 358.872866][ T5839] ? class_to_subsys+0x10f/0x150 [ 358.872892][ T5839] ? kobject_put+0xb9/0x640 [ 358.872918][ T5839] ? _raw_spin_unlock+0x28/0x50 [ 358.872953][ T5839] device_add+0x294/0x1950 [ 358.872973][ T5839] ? __pfx_dev_set_name+0x10/0x10 [ 358.873003][ T5839] ? __pfx_device_add+0x10/0x10 [ 358.873029][ T5839] ? mgmt_send_event_skb+0x2fb/0x460 [ 358.873057][ T5839] hci_conn_add_sysfs+0x1a3/0x260 [ 358.873083][ T5839] le_conn_complete_evt+0x11cb/0x1f40 [ 358.873111][ T5839] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 358.873130][ T5839] ? __pfx_bt_warn+0x10/0x10 [ 358.873156][ T5839] hci_le_conn_complete_evt+0x23c/0x3a0 [ 358.873180][ T5839] ? skb_pull_data+0x15f/0x1e0 [ 358.873201][ T5839] hci_le_meta_evt+0x34a/0x5f0 [ 358.873225][ T5839] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 358.873250][ T5839] hci_event_packet+0x682/0x11c0 [ 358.873271][ T5839] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 358.873295][ T5839] ? __pfx_hci_event_packet+0x10/0x10 [ 358.873319][ T5839] ? kcov_remote_start+0x374/0x660 [ 358.873336][ T5839] ? lockdep_hardirqs_on+0x78/0x100 [ 358.873366][ T5839] hci_rx_work+0x451/0xfc0 [ 358.873391][ T5839] process_one_work+0xa23/0x19a0 [ 358.873426][ T5839] ? __pfx_process_one_work+0x10/0x10 [ 358.873459][ T5839] ? __pfx_hci_rx_work+0x10/0x10 [ 358.873482][ T5839] worker_thread+0x5ef/0xe50 [ 358.873516][ T5839] ? kthread+0x13a/0x450 [ 358.873537][ T5839] ? __pfx_worker_thread+0x10/0x10 [ 358.873561][ T5839] kthread+0x370/0x450 [ 358.873583][ T5839] ? __pfx_kthread+0x10/0x10 [ 358.873608][ T5839] ret_from_fork+0x754/0xd80 [ 358.873635][ T5839] ? __pfx_ret_from_fork+0x10/0x10 [ 358.873661][ T5839] ? rcu_is_watching+0x12/0xc0 [ 358.873688][ T5839] ? __switch_to+0x7b4/0x1120 [ 358.873707][ T5839] ? __pfx_kthread+0x10/0x10 [ 358.873732][ T5839] ret_from_fork_asm+0x1a/0x30 [ 358.873763][ T5839] [ 359.223123][ T5839] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 359.238511][ T5839] Bluetooth: hci0: failed to register connection device [ 360.849702][ T5839] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 361.260995][ T5844] Bluetooth: hci0: command 0x0406 tx timeout [ 361.301180][ T30] audit: type=1807 audit(1843123057.415:24): UNKNOWN=0"]$|1j0B|dӉO+/xWӦ^gq%ḦrO res=0 [ 361.322640][T16518] ima: policy update failed [ 361.360225][ T30] audit: type=1802 audit(1843123057.445:25): pid=16519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.1.4952" res=0 errno=0 [ 361.501293][ T30] audit: type=1802 audit(1843123057.455:26): pid=16518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.4952" res=0 errno=0 [ 362.082681][T16552] usb usb24: usbfs: process 16552 (syz.0.4963) did not claim interface 0 before use [ 362.852849][T16537] Bluetooth: hci2: command 0x0c1a tx timeout [ 363.334953][T16584] Bluetooth: hci0: command 0x0406 tx timeout [ 364.312715][T16663] phram: not enough arguments [ 364.933318][T16584] Bluetooth: hci2: command 0x0c1a tx timeout [ 365.007396][ T30] audit: type=1800 audit(1843123061.134:27): pid=16696 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.5012" name="features" dev="configfs" ino=40377 res=0 errno=0 [ 365.041171][T16695] bond0: no command found in slaves file - use +ifname or -ifname [ 366.426664][T16765] binder: 16762:16765 ioctl 40046205 0 returned -22 [ 366.849105][T16785] Format for deleting device is "id" (uint). [ 366.960257][T16537] Bluetooth: hci0: unexpected event 0x14 length: 16 > 6 [ 367.298163][T16801] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.626556][T16909] zram0: detected capacity change from 0 to 16 [ 371.877195][T16537] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 374.030841][T17145] ======================================================= [ 374.030841][T17145] WARNING: The mand mount option has been deprecated and [ 374.030841][T17145] and is ignored by this kernel. Remove the mand [ 374.030841][T17145] option from the mount to silence this warning. [ 374.030841][T17145] ======================================================= [ 375.358059][T17188] bond0: option mode: unable to set because the bond device is up [ 376.046395][T17211] ima: Unable to open file: /suritRy/integrity?iqa/policy (-2) [ 376.046859][T17210] ima: policy update failed [ 376.125919][ T30] audit: type=1802 audit(1843123072.322:28): pid=17210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.0.5205" res=0 errno=0 [ 377.267686][T17241] block2mtd: error: cannot open device inX±jFBB>U;߸Ilk [ 377.751508][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.759317][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.288499][T17392] Invalid input. Must be >= 4608 [ 381.351492][T17386] Process accounting resumed [ 381.645239][T17403] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 382.198630][T17429] QAT: Device 250 not found [ 382.332586][T17433] zswap: compressor ^`#ߗ(2NAV1`Wnf\'J돆#If&ͦ5j)٥Kp$'\&9r y*paۄH,T{Kf_SQAW not available [ 383.068656][T17461] sctp: Changing rto_alpha or rto_beta may lead to suboptimal rtt/srtt estimations! [ 383.720124][ T30] audit: type=1400 audit(1843123079.951:29): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=17485 comm="syz.1.5310" [ 385.762581][T17562] usb usb2: usbfs: process 17562 (syz.0.5340) did not claim interface 4 before use [ 386.767652][T17598] Line length is too long: Should be less than 4094 [ 386.998242][T17610] kafs: addr_prefs: Invalid Command [ 387.927373][T17655] block2mtd: device name too long [ 389.048089][T17708] RDS: rds_bind could not find a transport for 7bc:c94c:4e37:70c4::, load rds_tcp or rds_rdma? [ 389.798120][T17741] ptrace attach of "./syz-executor exec"[5831] was attempted by "./syz-executor exec"[17741] [ 395.015469][T17969] block nbd0: NBD_DISCONNECT [ 396.228406][T18026] [U] 0="/ [ 396.246182][T18026] [U] [ 396.268768][T18026] [U] EeQ@ [ 396.296563][T18025] [U]  [ 399.174927][T18151] program syz.0.5572 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 401.375219][T18252] kafs: addr_prefs: Too many elements in string [ 402.805293][T18312] random: crng reseeded on system resumption [ 404.548951][T18325] syz.1.5638 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 404.744984][T18325] CPU: 0 UID: 0 PID: 18325 Comm: syz.1.5638 Tainted: G U L syzkaller #0 PREEMPT(full) [ 404.745017][T18325] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 404.745023][T18325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 404.745033][T18325] Call Trace: [ 404.745040][T18325] [ 404.745046][T18325] dump_stack_lvl+0x100/0x190 [ 404.745078][T18325] dump_header+0xfb/0x606 [ 404.745098][T18325] oom_kill_process.cold+0xd/0x330 [ 404.745119][T18325] out_of_memory+0x340/0x14f0 [ 404.745151][T18325] ? __pfx_out_of_memory+0x10/0x10 [ 404.745184][T18325] mem_cgroup_out_of_memory+0xc6/0x130 [ 404.745208][T18325] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 404.745231][T18325] ? find_held_lock+0x2b/0x80 [ 404.745252][T18325] ? do_raw_spin_unlock+0x145/0x1e0 [ 404.745279][T18325] ? _raw_spin_unlock+0x28/0x50 [ 404.745303][T18325] try_charge_memcg+0x652/0xc90 [ 404.745326][T18325] ? __pfx_try_charge_memcg+0x10/0x10 [ 404.745344][T18325] ? find_held_lock+0x2b/0x80 [ 404.745360][T18325] ? rcu_read_unlock+0x17/0x60 [ 404.745378][T18325] ? rcu_read_unlock+0x17/0x60 [ 404.745404][T18325] charge_memcg+0xa6/0x280 [ 404.745422][T18325] __mem_cgroup_charge+0x2b/0x1e0 [ 404.745445][T18325] filemap_add_folio+0xe7/0x690 [ 404.745474][T18325] ? __pfx_filemap_add_folio+0x10/0x10 [ 404.745508][T18325] __filemap_get_folio_mpol+0x5d5/0xe70 [ 404.745542][T18325] filemap_fault+0x8a2/0x2eb0 [ 404.745576][T18325] ? __pfx_filemap_fault+0x10/0x10 [ 404.745607][T18325] ? __pfx_filemap_map_pages+0x10/0x10 [ 404.745640][T18325] __do_fault+0x10d/0x550 [ 404.745659][T18325] do_fault+0xabb/0x1990 [ 404.745682][T18325] __handle_mm_fault+0x180f/0x2b60 [ 404.745721][T18325] ? __pfx___handle_mm_fault+0x10/0x10 [ 404.745746][T18325] ? pte_offset_map_lock+0x174/0x320 [ 404.745765][T18325] ? find_held_lock+0x2b/0x80 [ 404.745789][T18325] ? follow_page_pte+0x5b3/0x1400 [ 404.745813][T18325] handle_mm_fault+0x36d/0xa20 [ 404.745841][T18325] __get_user_pages+0xf9c/0x34d0 [ 404.745870][T18325] ? __pfx___get_user_pages+0x10/0x10 [ 404.745896][T18325] populate_vma_page_range+0x267/0x3f0 [ 404.745919][T18325] ? __pfx_populate_vma_page_range+0x10/0x10 [ 404.745940][T18325] ? __pfx_find_vma_intersection+0x10/0x10 [ 404.745959][T18325] ? __pfx_apply_mlockall_flags.isra.0+0x10/0x10 [ 404.745990][T18325] __mm_populate+0x107/0x3a0 [ 404.746012][T18325] ? __pfx___mm_populate+0x10/0x10 [ 404.746035][T18325] ? up_write+0x290/0x4f0 [ 404.746062][T18325] __do_sys_mlockall+0x4f4/0x5d0 [ 404.746091][T18325] do_syscall_64+0x106/0xf80 [ 404.746114][T18325] ? clear_bhb_loop+0x40/0x90 [ 404.746136][T18325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.746154][T18325] RIP: 0033:0x7f7981d9c799 [ 404.746169][T18325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.746185][T18325] RSP: 002b:00007f7982b85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000097 [ 404.746203][T18325] RAX: ffffffffffffffda RBX: 00007f7982015fa0 RCX: 00007f7981d9c799 [ 404.746214][T18325] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 404.746223][T18325] RBP: 00007f7981e32c99 R08: 0000000000000000 R09: 0000000000000000 [ 404.746233][T18325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 404.746242][T18325] R13: 00007f7982016038 R14: 00007f7982015fa0 R15: 00007ffc5bf616b8 [ 404.746265][T18325] [ 404.747007][T18325] memory: usage 3072kB, limit 3072kB, failcnt 7694 [ 405.505385][T18396] random: crng reseeded on system resumption [ 406.084429][T18417] random: crng reseeded on system resumption [ 406.428158][T18325] memory+swap: usage 3092kB, limit 9007199254740988kB, failcnt 0 [ 406.489059][T18325] kmem: usage 572kB, limit 9007199254740988kB, failcnt 0 [ 406.517469][T18325] Memory cgroup stats for /syz1: [ 406.517687][T18325] cache 2371584 [ 406.575147][T18325] rss 180224 [ 406.578427][T18325] rss_huge 0 [ 406.581703][T18325] shmem 0 [ 406.584804][T18325] mapped_file 2371584 [ 406.656146][T18325] dirty 0 [ 406.659236][T18325] writeback 0 [ 406.662535][T18325] workingset_refault_anon 249 [ 406.730345][T18325] workingset_refault_file 4247 [ 406.761312][T18325] swap 20480 [ 406.778697][T18325] swapcached 17821696 [ 406.807888][T18325] pgpgin 86793 [ 406.811400][T18325] pgpgout 86168 [ 406.848430][T18325] pgfault 164131 [ 406.874185][T18325] pgmajfault 174 [ 406.878048][T18325] inactive_anon 8192 [ 406.929909][T18325] active_anon 0 [ 406.958331][T18325] inactive_file 0 [ 406.962191][T18325] active_file 0 [ 407.006547][T18325] unevictable 2551808 [ 407.010717][T18325] hierarchical_memory_limit 3145728 [ 407.076502][T18325] hierarchical_memsw_limit 9223372036854771712 [ 407.120836][T18325] total_cache 2371584 [ 407.152950][T18325] total_rss 180224 [ 407.156716][T18325] total_rss_huge 0 [ 407.194089][T18325] total_shmem 0 [ 407.197954][T18325] total_mapped_file 2371584 [ 407.241627][T18325] total_dirty 0 [ 407.277934][T18325] total_writeback 0 [ 407.299880][T18325] total_workingset_refault_anon 249 [ 407.341831][T18325] total_workingset_refault_file 4247 [ 407.371192][T18325] total_swap 20480 [ 407.374959][T18325] total_swapcached 17821696 [ 407.379455][T18325] total_pgpgin 86793 [ 407.468342][T18325] total_pgpgout 86168 [ 407.476051][T18325] total_pgfault 164131 [ 407.501893][T18325] total_pgmajfault 174 [ 407.506081][T18325] total_inactive_anon 8192 [ 407.540079][T18325] total_active_anon 0 [ 407.544210][T18325] total_inactive_file 0 [ 407.548748][T18325] total_active_file 0 [ 407.639521][T18325] total_unevictable 2551808 [ 407.656911][T18325] anon_cost 2 [ 407.695957][T18325] file_cost 0 [ 407.703670][T18325] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.5638,pid=18324,uid=0 [ 407.803002][T18325] Memory cgroup out of memory: Killed process 18324 (syz.1.5638) total-vm:104408kB, anon-rss:1416kB, file-rss:55876kB, shmem-rss:0kB, UID:0 pgtables:204kB oom_score_adj:1000 [ 411.426110][T18595] Process accounting paused [ 412.174386][T18628] ecryptfs_miscdev_write: Invalid packet size [192] [ 413.037025][T18663] usbcore.quirks: string doesn't fit in 127 chars. [ 414.423308][T18719] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 414.980673][T18743] ecryptfs_parse_packet_length: Five-byte packet length not supported [ 415.024901][T18743] ecryptfs_miscdev_write: Error parsing packet length; rc = [-22] [ 415.811181][T17093] syz.2.5156 (17093) used greatest stack depth: 18040 bytes left [ 416.690375][T18822] : Can't lookup blockdev [ 416.997603][ T30] audit: type=1800 audit(1843123113.394:30): pid=18836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.5831" name="members" dev="configfs" ino=45723 res=0 errno=0 [ 417.714225][T18874] binder: binder_mmap: 18870 0-1000 bad vm_flags failed -1 [ 418.662679][T18912] random: crng reseeded on system resumption [ 419.562858][ T30] audit: type=1800 audit(1843123115.988:31): pid=18959 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5884" name="SYSV00000008" dev="hugetlbfs" ino=0 res=0 errno=0 [ 419.964903][T18978] syz.2.5893 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 421.663754][T19062] EXT4-fs error (device sda1): trigger_test_error:130: comm syz.0.5930: 7 [ 422.861119][T19117] synth uevent: /devices/virtual/tty/ttyz1: unknown uevent action string [ 422.901032][T19117] tty ttyz1: uevent: failed to send synthetic uevent: -22 [ 424.771491][T19212] qrtr: Invalid version 0 [ 425.264591][T19236] rnbd_client L202: map_device: Unknown parameter or missing value '7' [ 426.255152][T19288] program syz.2.6030 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 428.898764][T19395] virtio-pci 0000:00:04.0: [Firmware Bug]: Overriding NUMA node to -1. Contact your vendor for updates. [ 430.310589][T19465] i8042 aux 00:02: in use; can't configure [ 430.680296][T19484] QAT: failed to copy from user cfg_data. [ 431.334450][T19516] program syz.1.6129 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 431.888480][T19541] synth uevent: /devices/platform/dummy_hcd.3/usb4/ep_00: unknown uevent action string [ 431.949929][T19541] ep_00: uevent: failed to send synthetic uevent: -22 [ 435.459777][T19688] hub 3-0:1.0: USB hub found [ 435.496437][T19688] hub 3-0:1.0: 1 port detected [ 435.568468][T19688] usb usb3: authorized to connect [ 436.057558][T19702] could not allocate digest TFM handle [ 436.252953][T19718] [U] ^\ [ 438.864006][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 438.874382][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.867643][T19913] ecryptfs_miscdev_write: Acceptable packet size range is [6-531], but amount of data written is [1]. [ 441.476390][T19931] Process accounting resumed [ 443.045104][T19997] [U] ^Z [ 443.248870][T20009] usb usb4: usbfs: process 20009 (syz.2.6335) did not claim interface 0 before use [ 444.077807][T20038] cougar: G6 mapped to F18 [ 446.208645][T20134] Invalid ELF header magic: != ELF [ 447.821985][T20199] : Can't lookup blockdev [ 449.047798][T20248] : Can't lookup blockdev [ 450.376489][ T5828] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 450.479421][ T5828] CPU: 0 UID: 0 PID: 5828 Comm: syz-executor Tainted: G U I L syzkaller #0 PREEMPT(full) [ 450.479454][ T5828] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 450.479462][ T5828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 450.479472][ T5828] Call Trace: [ 450.479478][ T5828] [ 450.479485][ T5828] dump_stack_lvl+0x100/0x190 [ 450.479523][ T5828] dump_header+0xfb/0x606 [ 450.479543][ T5828] oom_kill_process.cold+0xd/0x330 [ 450.479570][ T5828] out_of_memory+0x340/0x14f0 [ 450.479602][ T5828] ? __pfx_out_of_memory+0x10/0x10 [ 450.479635][ T5828] mem_cgroup_out_of_memory+0xc6/0x130 [ 450.479660][ T5828] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 450.479683][ T5828] ? find_held_lock+0x2b/0x80 [ 450.479703][ T5828] ? do_raw_spin_unlock+0x145/0x1e0 [ 450.479730][ T5828] ? _raw_spin_unlock+0x28/0x50 [ 450.479754][ T5828] try_charge_memcg+0x652/0xc90 [ 450.479777][ T5828] ? __pfx_try_charge_memcg+0x10/0x10 [ 450.479804][ T5828] ? find_held_lock+0x2b/0x80 [ 450.479826][ T5828] ? rcu_read_unlock+0x17/0x60 [ 450.479850][ T5828] ? rcu_read_unlock+0x17/0x60 [ 450.479876][ T5828] charge_memcg+0xa6/0x280 [ 450.479894][ T5828] mem_cgroup_swapin_charge_folio+0xeb/0x470 [ 450.479919][ T5828] __swap_cache_prepare_and_add+0x528/0x9e0 [ 450.479954][ T5828] ? __pfx___swap_cache_prepare_and_add+0x10/0x10 [ 450.479979][ T5828] ? __pfx_swap_entry_swapped+0x10/0x10 [ 450.480003][ T5828] swap_cache_alloc_folio+0x1cb/0x300 [ 450.480029][ T5828] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 450.480057][ T5828] ? rcu_is_watching+0x12/0xc0 [ 450.480086][ T5828] swap_cluster_readahead+0x411/0x770 [ 450.480118][ T5828] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 450.480155][ T5828] ? update_cfs_rq_load_avg+0x51/0x550 [ 450.480180][ T5828] ? __lock_acquire+0x4a5/0x2630 [ 450.480204][ T5828] ? get_vma_policy+0x23f/0x3b0 [ 450.480225][ T5828] swapin_readahead+0x160/0x12c0 [ 450.480262][ T5828] ? __pfx_swapin_readahead+0x10/0x10 [ 450.480286][ T5828] ? find_held_lock+0x2b/0x80 [ 450.480301][ T5828] ? swap_table_get+0x103/0x2c0 [ 450.480323][ T5828] ? swap_table_get+0x103/0x2c0 [ 450.480350][ T5828] ? swap_table_get+0x10d/0x2c0 [ 450.480373][ T5828] ? swap_cache_get_folio+0x1ae/0x600 [ 450.480398][ T5828] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 450.480421][ T5828] ? __pfx_get_swap_device+0x10/0x10 [ 450.480443][ T5828] ? do_swap_page+0xb2e/0x6900 [ 450.480465][ T5828] do_swap_page+0xb2e/0x6900 [ 450.480500][ T5828] ? __pfx_do_swap_page+0x10/0x10 [ 450.480524][ T5828] ? __free_object+0x2a8/0x400 [ 450.480550][ T5828] ? lockdep_hardirqs_on+0x78/0x100 [ 450.480582][ T5828] ? rcu_is_watching+0x12/0xc0 [ 450.480609][ T5828] ? __pte_offset_map+0x179/0x310 [ 450.480629][ T5828] __handle_mm_fault+0x18c1/0x2b60 [ 450.480658][ T5828] ? reacquire_held_locks+0xce/0x1e0 [ 450.480681][ T5828] ? __pfx___handle_mm_fault+0x10/0x10 [ 450.480708][ T5828] ? lock_vma_under_rcu+0x17c/0x590 [ 450.480746][ T5828] handle_mm_fault+0x36d/0xa20 [ 450.480774][ T5828] do_user_addr_fault+0x5a3/0x12f0 [ 450.480809][ T5828] exc_page_fault+0x6f/0xd0 [ 450.480834][ T5828] asm_exc_page_fault+0x26/0x30 [ 450.480851][ T5828] RIP: 0033:0x7f1b1eb5cfce [ 450.480866][ T5828] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 450.480882][ T5828] RSP: 002b:00007ffe37930ac8 EFLAGS: 00010246 [ 450.480897][ T5828] RAX: 0000000000000000 RBX: 00005555790cc500 RCX: 00007f1b1eb5cfce [ 450.480908][ T5828] RDX: 00007ffe37930b20 RSI: 0000000000000000 RDI: 0000000000000000 [ 450.480918][ T5828] RBP: 00007ffe37930b8c R08: 0000000000000000 R09: 0000000000000000 [ 450.480927][ T5828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 450.480937][ T5828] R13: 00000000000927c0 R14: 000000000006e35d R15: 00007ffe37930be0 [ 450.480960][ T5828] [ 450.895248][ T5828] memory: usage 732kB, limit 3072kB, failcnt 34980 [ 450.901942][ T5828] memory+swap: usage 892kB, limit 9007199254740988kB, failcnt 0 [ 450.909674][ T5828] kmem: usage 512kB, limit 9007199254740988kB, failcnt 0 [ 450.917205][ T5828] Memory cgroup stats for /syz2: [ 450.917332][ T5828] cache 0 [ 450.925417][ T5828] rss 28672 [ 450.928708][ T5828] rss_huge 0 [ 450.932036][ T5828] shmem 0 [ 450.935045][ T5828] mapped_file 0 [ 450.938506][ T5828] dirty 0 [ 450.941525][ T5828] writeback 0 [ 450.945138][ T5828] workingset_refault_anon 1020 [ 450.949914][ T5828] workingset_refault_file 16100 [ 450.955134][ T5828] swap 163840 [ 450.958447][ T5828] swapcached 95232000 [ 450.963922][ T5828] pgpgin 128771 [ 450.967565][ T5828] pgpgout 128762 [ 450.971328][ T5828] pgfault 172991 [ 450.975061][ T5828] pgmajfault 690 [ 450.978629][ T5828] inactive_anon 4096 [ 450.982590][ T5828] active_anon 28672 [ 450.986533][ T5828] inactive_file 0 [ 450.990257][ T5828] active_file 0 [ 450.993743][ T5828] unevictable 0 [ 450.997439][ T5828] hierarchical_memory_limit 3145728 [ 451.002790][ T5828] hierarchical_memsw_limit 9223372036854771712 [ 451.009014][ T5828] total_cache 0 [ 451.012468][ T5828] total_rss 28672 [ 451.016122][ T5828] total_rss_huge 0 [ 451.019930][ T5828] total_shmem 0 [ 451.023440][ T5828] total_mapped_file 0 [ 451.027652][ T5828] total_dirty 0 [ 451.031103][ T5828] total_writeback 0 [ 451.034959][ T5828] total_workingset_refault_anon 1020 [ 451.040322][ T5828] total_workingset_refault_file 16100 [ 451.045789][ T5828] total_swap 163840 [ 451.050400][ T5828] total_swapcached 95232000 [ 451.055149][ T5828] total_pgpgin 128771 [ 451.059159][ T5828] total_pgpgout 128762 [ 451.064195][ T5828] total_pgfault 172991 [ 451.068266][ T5828] total_pgmajfault 690 [ 451.072342][ T5828] total_inactive_anon 4096 [ 451.077590][ T5828] total_active_anon 28672 [ 451.081918][ T5828] total_inactive_file 0 [ 451.086316][ T5828] total_active_file 0 [ 451.090319][ T5828] total_unevictable 0 [ 451.094788][ T5828] anon_cost 72 [ 451.098147][ T5828] file_cost 0 [ 451.101635][ T5828] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.6453,pid=20284,uid=0 [ 451.116805][ T5828] Memory cgroup out of memory: Killed process 20284 (syz.2.6453) total-vm:102228kB, anon-rss:1268kB, file-rss:22096kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 451.207516][T20310] vhci_hcd vhci_hcd.0: ClearPortFeature: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 451.616382][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 451.623816][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 452.240983][T20351] synth uevent: /bus/mei: unknown uevent action string [ 452.705542][T20370] sd 0:0:1:0: PR command failed: 1026 [ 452.726950][T20370] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 452.759239][T20370] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 455.387571][T16537] Bluetooth: hci0: unexpected subevent 0x0c length: 118 > 5 [ 456.135007][T20489] usb usb13: check_ctrlrecip: process 20489 (syz.2.6541) requesting ep 01 but needs 81 [ 456.186329][T20489] usb usb13: usbfs: process 20489 (syz.2.6541) did not claim interface 0 before use [ 457.053960][T20528] uvcvideo: [Deprecated]: nodrop parameter will be eventually removed. [ 458.558802][T20591] unchecked MSR access error: WRMSR to 0x418 (tried to write 0x0000000000000322) at rIP: 0xffffffff81b10f9a (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 458.575218][T20591] Call Trace: [ 458.578621][T20591] [ 458.581588][T20591] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 458.588306][T20591] ? __pfx_debug_object_deactivate+0x10/0x10 [ 458.594524][T20591] mce_cpu_restart+0xd5/0x1f0 [ 458.599516][T20591] ? __pfx_mce_cpu_restart+0x10/0x10 [ 458.605186][T20591] smp_call_function_many_cond+0x11fc/0x1500 [ 458.611619][T20591] ? __pfx_mce_cpu_restart+0x10/0x10 [ 458.616952][T20591] ? mark_held_locks+0x40/0x70 [ 458.621848][T20591] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 458.627778][T20591] ? lockdep_hardirqs_on+0x78/0x100 [ 458.633085][T20591] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 458.639168][T20591] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 458.645607][T20591] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 458.651620][T20591] ? __timer_delete_sync+0x151/0x1c0 [ 458.656937][T20591] ? __pfx_mce_cpu_restart+0x10/0x10 [ 458.662243][T20591] on_each_cpu_cond_mask+0x40/0x90 [ 458.667546][T20591] set_bank+0x240/0x3a0 [ 458.671810][T20591] ? __pfx_set_bank+0x10/0x10 [ 458.676523][T20591] ? find_held_lock+0x2b/0x80 [ 458.681202][T20591] ? sysfs_file_kobj+0xe4/0x290 [ 458.686062][T20591] ? sysfs_file_kobj+0xe4/0x290 [ 458.691017][T20591] ? __pfx_set_bank+0x10/0x10 [ 458.695807][T20591] dev_attr_store+0x58/0x80 [ 458.700499][T20591] ? __pfx_dev_attr_store+0x10/0x10 [ 458.705714][T20591] sysfs_kf_write+0xf2/0x150 [ 458.710319][T20591] kernfs_fop_write_iter+0x3e0/0x5f0 [ 458.715872][T20591] ? __pfx_sysfs_kf_write+0x10/0x10 [ 458.721338][T20591] vfs_write+0x6ac/0x1070 [ 458.725678][T20591] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 458.731488][T20591] ? __pfx_vfs_write+0x10/0x10 [ 458.736393][T20591] ksys_write+0x12a/0x250 [ 458.740829][T20591] ? __pfx_ksys_write+0x10/0x10 [ 458.745794][T20591] do_syscall_64+0x106/0xf80 [ 458.750482][T20591] ? clear_bhb_loop+0x40/0x90 [ 458.755339][T20591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.761330][T20591] RIP: 0033:0x7f9ecd59c799 [ 458.766137][T20591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 458.786137][T20591] RSP: 002b:00007f9ece4a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 458.794690][T20591] RAX: ffffffffffffffda RBX: 00007f9ecd815fa0 RCX: 00007f9ecd59c799 [ 458.802738][T20591] RDX: 0000000000000003 RSI: 0000200000000240 RDI: 0000000000000003 [ 458.810929][T20591] RBP: 00007f9ecd632c99 R08: 0000000000000000 R09: 0000000000000000 [ 458.819389][T20591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 458.827559][T20591] R13: 00007f9ecd816038 R14: 00007f9ecd815fa0 R15: 00007ffd860a2f78 [ 458.835640][T20591] [ 459.064559][T20599] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 459.825857][T20628] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 460.375691][T20642] delete_channel: no stack [ 462.837986][T20695] zswap: compressor - not available [ 463.996004][T20765] bond0: option slaves: interface -]=,Don?I|a CB does not exist! [ 464.151818][T20760] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input35 [ 464.230260][T20787] scsi_strcpy_devinfo: vendor string '/&c~n] | [ 464.230260][T20787] M' is too long [ 464.274717][T20787] scsi_strcpy_devinfo: model string 'Dd5 K2b [ 464.274717][T20787] W ' is too long [ 465.792937][T20855] QAT: Stopping all acceleration devices. [ 466.349118][T20879] i2c i2c-0: new_device: Missing parameters [ 467.759761][T20926] usb usb3: usbfs: process 20926 (syz.2.6698) did not claim interface 0 before use [ 468.184848][T16537] Bluetooth: hci2: ACL packet too small [ 468.567127][T20960] sd 0:0:1:0: PR command failed: 1026 [ 468.597515][T20960] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 468.624251][T20960] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 468.643144][T20964] netlink: 'syz.0.6715': attribute type 2 has an invalid length. [ 469.906540][T21004] Zero length message leads to an empty skb [ 469.917337][T21006] bond0: option arp_validate: invalid value () [ 470.222239][T21017] Unable to find swap-space signature [ 470.336890][T21021] bonding: no command found in bonding_masters - use +ifname or -ifname [ 470.732351][ T30] audit: type=1107 audit(1843123167.414:32): pid=21029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 470.803590][ T30] audit: type=1107 audit(1843123167.444:33): pid=21029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 471.211824][T21043] netlink: 'syz.2.6746': attribute type 1 has an invalid length. [ 471.369456][T21045] Process accounting paused [ 471.980578][T21071] tc_dump_action: action bad kind [ 472.970977][T21105] FAULT_INJECTION: forcing a failure. [ 472.970977][T21105] name fail_futex, interval 1, probability 0, space 0, times 1 [ 473.026502][T21105] CPU: 0 UID: 0 PID: 21105 Comm: syz.0.6771 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 473.026537][T21105] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 473.026545][T21105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 473.026555][T21105] Call Trace: [ 473.026562][T21105] [ 473.026569][T21105] dump_stack_lvl+0x100/0x190 [ 473.026612][T21105] should_fail_ex.cold+0x5/0xa [ 473.026629][T21105] ? __pfx_keyring_search+0x10/0x10 [ 473.026656][T21105] get_futex_key+0x1d2/0x1620 [ 473.026681][T21105] ? __pfx_get_futex_key+0x10/0x10 [ 473.026703][T21105] ? up_write+0x290/0x4f0 [ 473.026733][T21105] futex_wake+0xea/0x530 [ 473.026760][T21105] ? __pfx_look_up_user_keyrings+0x10/0x10 [ 473.026780][T21105] ? __pfx_futex_wake+0x10/0x10 [ 473.026804][T21105] ? bpf_lsm_key_permission+0x9/0x10 [ 473.026828][T21105] ? lookup_user_key+0x3f3/0x1300 [ 473.026849][T21105] do_futex+0x32b/0x350 [ 473.026872][T21105] ? __pfx_do_futex+0x10/0x10 [ 473.026900][T21105] __x64_sys_futex+0x34f/0x4d0 [ 473.026926][T21105] ? __pfx___x64_sys_futex+0x10/0x10 [ 473.026950][T21105] ? key_put+0x62/0x2e0 [ 473.026974][T21105] do_syscall_64+0x106/0xf80 [ 473.026999][T21105] ? clear_bhb_loop+0x40/0x90 [ 473.027027][T21105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.027045][T21105] RIP: 0033:0x7f757ff9c799 [ 473.027061][T21105] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.027077][T21105] RSP: 002b:00007f7580e990e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 473.027095][T21105] RAX: ffffffffffffffda RBX: 00007f7580215fa8 RCX: 00007f757ff9c799 [ 473.027106][T21105] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7580215fac [ 473.027116][T21105] RBP: 00007f7580215fa0 R08: 0000000000000000 R09: 0000000000000000 [ 473.027126][T21105] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 473.027136][T21105] R13: 00007f7580216038 R14: 00007fff0b3bb4b0 R15: 00007fff0b3bb598 [ 473.027158][T21105] [ 477.767594][T21263] netlink: 'syz.1.6836': attribute type 1 has an invalid length. [ 478.508088][T21294] openvswitch: netlink: Flow actions attr not present in new flow. [ 478.793169][ T30] audit: type=1326 audit(1843123175.526:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21309 comm="syz.1.6854" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7981d9c799 code=0x0 [ 479.513498][T21346] netlink: zone id is out of range [ 479.528455][T21346] netlink: zone id is out of range [ 479.548236][T21346] netlink: zone id is out of range [ 479.565351][T21346] netlink: zone id is out of range [ 479.602805][T21346] netlink: zone id is out of range [ 479.615902][T21346] netlink: zone id is out of range [ 479.655186][T21346] netlink: zone id is out of range [ 479.672271][T21346] netlink: zone id is out of range [ 479.697413][T21346] netlink: zone id is out of range [ 480.283958][T21380] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !PjE r҄y*"l-y– [ 482.792586][T21483] input input36: cannot allocate more than FF_MAX_EFFECTS effects [ 484.624765][T21555] net_ratelimit: 21 callbacks suppressed [ 484.624784][T21555] netlink: Unknown conntrack attr (type=257, max=9) [ 484.704893][T21551] NFSD: Failed to start, no listeners configured. [ 484.869984][T21566] netlink: 'syz.0.6950': attribute type 1 has an invalid length. [ 485.942917][T21618] openvswitch: netlink: Message has 20 unknown bytes. [ 486.161633][T21629] netlink: 'syz.2.6976': attribute type 11 has an invalid length. [ 486.199092][T21629] netlink: 'syz.2.6976': attribute type 11 has an invalid length. [ 486.249054][T21629] netlink: 'syz.2.6976': attribute type 11 has an invalid length. [ 487.222448][T21671] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 487.862863][T21716] aoe: copy from user failed [ 487.867682][T21716] aoe: could not set interface list: too many interfaces [ 489.086495][T21770] netlink: zone id is out of range [ 489.110321][T21770] netlink: zone id is out of range [ 489.175752][T21770] netlink: set zone limit has 8 unknown bytes [ 490.261033][T21816] NFSD: Failed to start, no listeners configured. [ 492.980870][T21919] FAULT_INJECTION: forcing a failure. [ 492.980870][T21919] name failslab, interval 1, probability 0, space 0, times 1 [ 493.066429][T21919] CPU: 0 UID: 0 PID: 21919 Comm: syz.3.7080 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 493.066464][T21919] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 493.066472][T21919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 493.066482][T21919] Call Trace: [ 493.066488][T21919] [ 493.066495][T21919] dump_stack_lvl+0x100/0x190 [ 493.066537][T21919] should_fail_ex.cold+0x5/0xa [ 493.066558][T21919] should_failslab+0xc2/0x120 [ 493.066578][T21919] __kmalloc_cache_noprof+0x7a/0x6f0 [ 493.066602][T21919] ? key_user_lookup+0x1a3/0x5a0 [ 493.066629][T21919] key_user_lookup+0x1a3/0x5a0 [ 493.066651][T21919] ? __pfx_key_user_lookup+0x10/0x10 [ 493.066673][T21919] ? bpf_lsm_capable+0x9/0x10 [ 493.066692][T21919] ? security_capable+0x80/0x260 [ 493.066722][T21919] keyctl_chown_key+0x358/0x1010 [ 493.066752][T21919] ? __x64_sys_futex+0x34f/0x4d0 [ 493.066774][T21919] ? __x64_sys_futex+0x358/0x4d0 [ 493.066798][T21919] ? __pfx_keyctl_chown_key+0x10/0x10 [ 493.066826][T21919] ? xfd_validate_state+0x129/0x190 [ 493.066856][T21919] __do_sys_keyctl+0x1e8/0x5a0 [ 493.066874][T21919] do_syscall_64+0x106/0xf80 [ 493.066899][T21919] ? clear_bhb_loop+0x40/0x90 [ 493.066921][T21919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.066938][T21919] RIP: 0033:0x7f9ecd59c799 [ 493.066954][T21919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.066970][T21919] RSP: 002b:00007f9ece4a1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 493.066988][T21919] RAX: ffffffffffffffda RBX: 00007f9ecd815fa0 RCX: 00007f9ecd59c799 [ 493.066999][T21919] RDX: 0000000000000006 RSI: 00000000fffffffe RDI: 0000000000000004 [ 493.067009][T21919] RBP: 00007f9ecd632c99 R08: 000000000000000e R09: 0000000000000000 [ 493.067022][T21919] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 493.067033][T21919] R13: 00007f9ecd816038 R14: 00007f9ecd815fa0 R15: 00007ffd860a2f78 [ 493.067055][T21919] [ 493.647842][T21933] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 493.926849][T21942] FAULT_INJECTION: forcing a failure. [ 493.926849][T21942] name failslab, interval 1, probability 0, space 0, times 0 [ 493.994616][T21942] CPU: 0 UID: 0 PID: 21942 Comm: syz.2.7092 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 493.994651][T21942] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 493.994660][T21942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 493.994670][T21942] Call Trace: [ 493.994676][T21942] [ 493.994683][T21942] dump_stack_lvl+0x100/0x190 [ 493.994714][T21942] should_fail_ex.cold+0x5/0xa [ 493.994735][T21942] should_failslab+0xc2/0x120 [ 493.994755][T21942] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 493.994782][T21942] ? __d_alloc+0x34/0xa80 [ 493.994801][T21942] ? make_vfsgid+0xf1/0x140 [ 493.994828][T21942] __d_alloc+0x34/0xa80 [ 493.994846][T21942] ? bpf_lsm_inode_permission+0x9/0x10 [ 493.994874][T21942] d_alloc+0x4a/0x1e0 [ 493.994895][T21942] vfs_tmpfile+0x148/0x9a0 [ 493.994919][T21942] path_openat+0x164e/0x31a0 [ 493.994936][T21942] ? kasan_save_stack+0x3f/0x50 [ 493.994962][T21942] ? kasan_save_stack+0x30/0x50 [ 493.994988][T21942] ? __kasan_slab_alloc+0x89/0x90 [ 493.995004][T21942] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 493.995029][T21942] ? do_getname+0x35/0x390 [ 493.995051][T21942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.995072][T21942] ? __pfx_path_openat+0x10/0x10 [ 493.995097][T21942] do_file_open+0x20e/0x430 [ 493.995117][T21942] ? __pfx_do_file_open+0x10/0x10 [ 493.995150][T21942] ? _raw_spin_unlock+0x28/0x50 [ 493.995171][T21942] ? alloc_fd+0x476/0x790 [ 493.995195][T21942] do_sys_openat2+0x10d/0x1e0 [ 493.995218][T21942] ? __pfx_do_sys_openat2+0x10/0x10 [ 493.995249][T21942] __x64_sys_open+0xfe/0x1d0 [ 493.995273][T21942] ? __pfx___x64_sys_open+0x10/0x10 [ 493.995304][T21942] do_syscall_64+0x106/0xf80 [ 493.995328][T21942] ? clear_bhb_loop+0x40/0x90 [ 493.995349][T21942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.995367][T21942] RIP: 0033:0x7f1b1eb9c799 [ 493.995382][T21942] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.995399][T21942] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 493.995416][T21942] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 493.995427][T21942] RDX: 0000000000000408 RSI: 0000000000595002 RDI: 0000200000000100 [ 493.995437][T21942] RBP: 00007f1b1ec32c99 R08: 0000000000000000 R09: 0000000000000000 [ 493.995447][T21942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 493.995457][T21942] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 493.995479][T21942] [ 494.678755][T21951] tc_dump_action: action bad kind [ 495.212720][T21986] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 495.212720][T21986] The task syz.3.7101 (21986) triggered the difference, watch for misbehavior. [ 496.145659][T22014] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 498.012286][T22097] tc_dump_action: action bad kind [ 498.658069][T22124] vivid-007: ================= START STATUS ================= [ 498.692891][T22124] vivid-007: Enable Output Cropping: true grabbed [ 498.742146][T22124] vivid-007: Enable Output Composing: true grabbed [ 498.780909][T22124] vivid-007: Enable Output Scaler: true grabbed [ 498.812335][T22124] vivid-007: Tx RGB Quantization Range: Automatic grabbed [ 498.857066][T22124] vivid-007: Transmit Mode: HDMI grabbed [ 498.889792][T22124] vivid-007: Hotplug Present: 0x00000000 [ 498.939722][T22124] vivid-007: RxSense Present: 0x00000000 [ 498.975984][T22124] vivid-007: EDID Present: 0x00000000 [ 498.982071][T22131] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 499.011574][T22124] vivid-007: ================== END STATUS ================== [ 499.991627][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 499.999858][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.348274][T22194] Process accounting resumed [ 501.466731][T22199] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7172'. [ 501.846554][T22223] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 503.537801][T22293] device-mapper: ioctl: Invalid ioctl structure: name , dev 3ff [ 503.735564][ T30] audit: type=1326 audit(1843123200.595:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22300 comm="syz.2.7202" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1b1eb9c799 code=0x0 [ 506.908759][T22442] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7244'. [ 507.157808][T22450] FAULT_INJECTION: forcing a failure. [ 507.157808][T22450] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 507.258127][T22450] CPU: 0 UID: 0 PID: 22450 Comm: syz.3.7247 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 507.258163][T22450] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 507.258171][T22450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 507.258183][T22450] Call Trace: [ 507.258189][T22450] [ 507.258196][T22450] dump_stack_lvl+0x100/0x190 [ 507.258227][T22450] should_fail_ex.cold+0x5/0xa [ 507.258245][T22450] ? prepare_alloc_pages+0x16d/0x5f0 [ 507.258268][T22450] should_fail_alloc_page+0xeb/0x140 [ 507.258290][T22450] prepare_alloc_pages+0x1f0/0x5f0 [ 507.258313][T22450] ? bpf_ksym_find+0x124/0x1c0 [ 507.258337][T22450] __alloc_frozen_pages_noprof+0x19a/0x2ba0 [ 507.258366][T22450] ? __kernel_text_address+0xd/0x30 [ 507.258391][T22450] ? unwind_get_return_address+0x59/0xa0 [ 507.258410][T22450] ? arch_stack_walk+0xa6/0xf0 [ 507.258435][T22450] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 507.258462][T22450] ? stack_trace_save+0x8e/0xc0 [ 507.258479][T22450] ? __pfx_stack_trace_save+0x10/0x10 [ 507.258497][T22450] ? stack_depot_save_flags+0x27/0x9d0 [ 507.258519][T22450] ? mas_store_prealloc+0x893/0xfb0 [ 507.258539][T22450] ? kasan_save_stack+0x30/0x50 [ 507.258565][T22450] ? kasan_save_track+0x14/0x30 [ 507.258591][T22450] ? __kasan_slab_alloc+0x89/0x90 [ 507.258606][T22450] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 507.258632][T22450] ? __pmd_alloc+0xbf/0x950 [ 507.258651][T22450] ? __handle_mm_fault+0xa99/0x2b60 [ 507.258674][T22450] ? handle_mm_fault+0x36d/0xa20 [ 507.258707][T22450] ? __get_user_pages+0xf9c/0x34d0 [ 507.258726][T22450] ? populate_vma_page_range+0x267/0x3f0 [ 507.258746][T22450] ? __mm_populate+0x107/0x3a0 [ 507.258765][T22450] ? vm_mmap_pgoff+0x37f/0x470 [ 507.258784][T22450] ? ksys_mmap_pgoff+0xe1/0x650 [ 507.258800][T22450] ? __x64_sys_mmap+0x125/0x190 [ 507.258826][T22450] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 507.258857][T22450] ? policy_nodemask+0xed/0x4f0 [ 507.258880][T22450] alloc_pages_mpol+0x1fb/0x550 [ 507.258900][T22450] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 507.258925][T22450] alloc_pages_noprof+0x131/0x390 [ 507.258945][T22450] pte_alloc_one+0x1c/0x3d0 [ 507.258965][T22450] __pte_alloc+0x6d/0x3e0 [ 507.258982][T22450] ? __pfx___pte_alloc+0x10/0x10 [ 507.259001][T22450] ? do_raw_spin_lock+0x128/0x260 [ 507.259026][T22450] ? find_held_lock+0x2b/0x80 [ 507.259044][T22450] do_anonymous_page+0x13cc/0x1fb0 [ 507.259069][T22450] ? do_raw_spin_unlock+0x145/0x1e0 [ 507.259095][T22450] ? _raw_spin_unlock+0x28/0x50 [ 507.259117][T22450] ? __pmd_alloc+0x3fb/0x950 [ 507.259139][T22450] __handle_mm_fault+0x1d42/0x2b60 [ 507.259166][T22450] ? mt_find+0x45e/0x8e0 [ 507.259193][T22450] ? __pfx___handle_mm_fault+0x10/0x10 [ 507.259216][T22450] ? __pfx_mt_find+0x10/0x10 [ 507.259260][T22450] handle_mm_fault+0x36d/0xa20 [ 507.259289][T22450] __get_user_pages+0xf9c/0x34d0 [ 507.259318][T22450] ? __pfx___get_user_pages+0x10/0x10 [ 507.259344][T22450] populate_vma_page_range+0x267/0x3f0 [ 507.259367][T22450] ? __pfx_populate_vma_page_range+0x10/0x10 [ 507.259388][T22450] ? __pfx_find_vma_intersection+0x10/0x10 [ 507.259407][T22450] ? do_mmap+0x93f/0x12f0 [ 507.259429][T22450] __mm_populate+0x107/0x3a0 [ 507.259451][T22450] ? __pfx___mm_populate+0x10/0x10 [ 507.259473][T22450] ? up_write+0x290/0x4f0 [ 507.259501][T22450] vm_mmap_pgoff+0x37f/0x470 [ 507.259523][T22450] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 507.259544][T22450] ? do_futex+0x192/0x350 [ 507.259567][T22450] ? __pfx_do_futex+0x10/0x10 [ 507.259594][T22450] ksys_mmap_pgoff+0xe1/0x650 [ 507.259613][T22450] ? __x64_sys_futex+0x34f/0x4d0 [ 507.259634][T22450] ? __x64_sys_futex+0x358/0x4d0 [ 507.259658][T22450] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 507.259676][T22450] ? xfd_validate_state+0x129/0x190 [ 507.259713][T22450] __x64_sys_mmap+0x125/0x190 [ 507.259742][T22450] do_syscall_64+0x106/0xf80 [ 507.259765][T22450] ? clear_bhb_loop+0x40/0x90 [ 507.259788][T22450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.259807][T22450] RIP: 0033:0x7f9ecd59c799 [ 507.259823][T22450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.259839][T22450] RSP: 002b:00007f9ece4a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 507.259857][T22450] RAX: ffffffffffffffda RBX: 00007f9ecd815fa0 RCX: 00007f9ecd59c799 [ 507.259868][T22450] RDX: 00000000000000df RSI: 0000000000400008 RDI: 0000000000000000 [ 507.259879][T22450] RBP: 00007f9ecd632c99 R08: 0000000000000002 R09: 0000000000008000 [ 507.259889][T22450] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 507.259900][T22450] R13: 00007f9ecd816038 R14: 00007f9ecd815fa0 R15: 00007ffd860a2f78 [ 507.259923][T22450] [ 509.187293][T22491] openvswitch: netlink: IP tunnel dst address not specified [ 510.960505][T22565] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7295'. [ 510.975034][T22558] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 511.396645][T22582] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xeffffd12 [ 512.327120][T22615] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7313'. [ 512.913097][T22656] nbd: must specify a device to reconfigure [ 512.979847][T22654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7320'. [ 513.575608][T22678] .^: entered promiscuous mode [ 515.249534][T22756] sctp: [Deprecated]: syz.0.7355 (pid 22756) Use of int in max_burst socket option deprecated. [ 515.249534][T22756] Use struct sctp_assoc_value instead [ 516.906681][T22813] No such timeout policy "" [ 516.947607][T22813] netlink: Failed to associated timeout policy '' [ 517.555547][T22834] capability: warning: `syz.0.7381' uses 32-bit capabilities (legacy support in use) [ 517.644527][T22838] netlink: 'syz.3.7382': attribute type 3 has an invalid length. [ 518.491533][T22867] openvswitch: netlink: Multiple metadata blocks provided [ 519.040821][T22885] tipc: Started in network mode [ 519.046013][T22885] tipc: Node identity ee00, cluster identity 4711 [ 519.094330][T22885] tipc: Node number set to 60928 [ 520.064653][T22922] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 520.679248][T22940] openvswitch: netlink: Key 15 has unexpected len 16 expected 4 [ 522.354166][T22990] netlink: 'syz.2.7441': attribute type 1 has an invalid length. [ 522.814524][T23005] HfR: entered promiscuous mode [ 523.138923][T23016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7450'. [ 523.298216][T23021] EXT4-fs error (device sda1): trigger_test_error:130: comm syz.2.7453: 7 [ 523.431857][T23026] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 523.667072][T23033] FAULT_INJECTION: forcing a failure. [ 523.667072][T23033] name failslab, interval 1, probability 0, space 0, times 0 [ 523.729924][T23033] CPU: 0 UID: 0 PID: 23033 Comm: syz.0.7458 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 523.729960][T23033] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 523.729969][T23033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 523.729979][T23033] Call Trace: [ 523.729985][T23033] [ 523.729993][T23033] dump_stack_lvl+0x100/0x190 [ 523.730024][T23033] should_fail_ex.cold+0x5/0xa [ 523.730044][T23033] should_failslab+0xc2/0x120 [ 523.730064][T23033] __kmalloc_cache_noprof+0x7a/0x6f0 [ 523.730088][T23033] ? sctp_endpoint_new+0xfc/0xb20 [ 523.730120][T23033] sctp_endpoint_new+0xfc/0xb20 [ 523.730148][T23033] ? __pfx_sctp_endpoint_new+0x10/0x10 [ 523.730174][T23033] ? lockdep_init_map_type+0x5c/0x250 [ 523.730198][T23033] ? lockdep_init_map_type+0x5c/0x250 [ 523.730219][T23033] ? lockdep_init_map_type+0x5c/0x250 [ 523.730242][T23033] ? lockdep_init_map_type+0x5c/0x250 [ 523.730275][T23033] sctp_init_sock+0xe2b/0x1300 [ 523.730303][T23033] ? __pfx_sctp_init_sock+0x10/0x10 [ 523.730329][T23033] inet_create+0x94c/0x1060 [ 523.730348][T23033] ? inet_create+0x94/0x1060 [ 523.730370][T23033] __sock_create+0x339/0x860 [ 523.730392][T23033] __sys_socket+0x14d/0x260 [ 523.730412][T23033] ? __pfx___sys_socket+0x10/0x10 [ 523.730438][T23033] __x64_sys_socket+0x72/0xb0 [ 523.730456][T23033] ? lockdep_hardirqs_on+0x78/0x100 [ 523.730481][T23033] do_syscall_64+0x106/0xf80 [ 523.730505][T23033] ? clear_bhb_loop+0x40/0x90 [ 523.730526][T23033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.730545][T23033] RIP: 0033:0x7f757ff9c799 [ 523.730559][T23033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 523.730576][T23033] RSP: 002b:00007f7580e99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 523.730593][T23033] RAX: ffffffffffffffda RBX: 00007f7580215fa0 RCX: 00007f757ff9c799 [ 523.730605][T23033] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000002 [ 523.730614][T23033] RBP: 00007f7580032c99 R08: 0000000000000000 R09: 0000000000000000 [ 523.730624][T23033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 523.730634][T23033] R13: 00007f7580216038 R14: 00007f7580215fa0 R15: 00007fff0b3bb598 [ 523.730655][T23033] [ 524.349797][T23041] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 524.729336][T23052] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7466'. [ 526.572624][T23136] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 526.742021][T23145] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7504'. [ 526.898165][T23150] openvswitch: netlink: Flow key attribute not present in set flow. [ 527.055742][T23155] netlink: Unknown nat attribute (0) [ 528.493056][T23207] mmap: syz.1.7529 (23207): VmData 37597184 exceed data ulimit 3. Update limits or use boot option ignore_rlimit_data. [ 528.568511][T23212] openvswitch: netlink: Key type 29 is not supported [ 529.168296][T23241] openvswitch: netlink: IP tunnel dst address not specified [ 530.460451][T23292] netlink: 504 bytes leftover after parsing attributes in process `syz.3.7562'. [ 531.033988][T23311] FAULT_INJECTION: forcing a failure. [ 531.033988][T23311] name failslab, interval 1, probability 0, space 0, times 0 [ 531.110032][T23311] CPU: 0 UID: 0 PID: 23311 Comm: syz.3.7571 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 531.110068][T23311] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 531.110077][T23311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 531.110087][T23311] Call Trace: [ 531.110093][T23311] [ 531.110100][T23311] dump_stack_lvl+0x100/0x190 [ 531.110132][T23311] should_fail_ex.cold+0x5/0xa [ 531.110153][T23311] should_failslab+0xc2/0x120 [ 531.110181][T23311] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 531.110208][T23311] ? alloc_empty_file+0x55/0x1c0 [ 531.110234][T23311] alloc_empty_file+0x55/0x1c0 [ 531.110257][T23311] alloc_file_pseudo+0x13a/0x230 [ 531.110281][T23311] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 531.110305][T23311] ? security_inode_init_security_anon+0x7b/0x230 [ 531.110331][T23311] __anon_inode_getfile+0xe8/0x280 [ 531.110355][T23311] new_userfaultfd+0x255/0x400 [ 531.110382][T23311] __x64_sys_userfaultfd+0x4b/0xb0 [ 531.110412][T23311] do_syscall_64+0x106/0xf80 [ 531.110436][T23311] ? clear_bhb_loop+0x40/0x90 [ 531.110457][T23311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.110482][T23311] RIP: 0033:0x7f9ecd59c799 [ 531.110498][T23311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 531.110515][T23311] RSP: 002b:00007f9ece4a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 531.110533][T23311] RAX: ffffffffffffffda RBX: 00007f9ecd815fa0 RCX: 00007f9ecd59c799 [ 531.110544][T23311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 531.110553][T23311] RBP: 00007f9ecd632c99 R08: 0000000000000000 R09: 0000000000000000 [ 531.110563][T23311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 531.110573][T23311] R13: 00007f9ecd816038 R14: 00007f9ecd815fa0 R15: 00007ffd860a2f78 [ 531.110594][T23311] [ 531.360106][T23311] Process accounting paused [ 531.854183][T23335] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 531.860991][T23335] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 532.031161][T23344] openvswitch: netlink: IPv4 tunnel dst address is zero [ 532.072925][T23346] program syz.1.7586 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 533.153399][T23384] netlink: 206 bytes leftover after parsing attributes in process `syz.1.7602'. [ 533.652310][T16537] Bluetooth: hci1: unexpected event 0x3e length: 726 > 260 [ 533.652337][T16537] Bluetooth: hci1: unexpected subevent 0x0d length: 725 > 260 [ 533.671617][T16537] Bluetooth: hci1: Unknown advertising packet type: 0x7f [ 533.671640][T16537] Bluetooth: hci1: Unknown advertising packet type: 0x52 [ 533.682628][T16537] Bluetooth: hci1: adv larger than maximum supported [ 533.690361][T16537] Bluetooth: hci1: Unknown advertising packet type: 0x1c [ 533.697913][T16537] Bluetooth: hci1: Malformed LE Event: 0x0d [ 534.066240][T16537] Bluetooth: hci2: unexpected event 0x36 length: 123 > 7 [ 535.861656][T23493] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 535.994306][T23499] netlink: 'syz.3.7643': attribute type 12 has an invalid length. [ 537.476201][T23544] process 'syz.0.7660' launched '/dev/fd/3' with NULL argv: empty string added [ 537.924065][T23563] FAULT_INJECTION: forcing a failure. [ 537.924065][T23563] name failslab, interval 1, probability 0, space 0, times 0 [ 537.991886][T23563] CPU: 0 UID: 0 PID: 23563 Comm: syz.2.7676 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 537.991921][T23563] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 537.991929][T23563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 537.991939][T23563] Call Trace: [ 537.991946][T23563] [ 537.991954][T23563] dump_stack_lvl+0x100/0x190 [ 537.991985][T23563] should_fail_ex.cold+0x5/0xa [ 537.992006][T23563] should_failslab+0xc2/0x120 [ 537.992026][T23563] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 537.992053][T23563] ? sock_alloc_inode+0x25/0x1c0 [ 537.992071][T23563] ? __debug_object_init+0x2de/0x3d0 [ 537.992100][T23563] ? __pfx_sock_alloc_inode+0x10/0x10 [ 537.992117][T23563] sock_alloc_inode+0x25/0x1c0 [ 537.992133][T23563] alloc_inode+0x68/0x250 [ 537.992157][T23563] sock_alloc+0x44/0x280 [ 537.992181][T23563] ? security_socket_create+0x7f/0x250 [ 537.992210][T23563] __sock_create+0xc2/0x860 [ 537.992232][T23563] smc_create_clcsk+0x37/0xd0 [ 537.992254][T23563] ? __pfx_smc_inet_init_sock+0x10/0x10 [ 537.992281][T23563] inet6_create+0xb21/0x12b0 [ 537.992308][T23563] ? inet6_create+0x7f/0x12b0 [ 537.992335][T23563] __sock_create+0x339/0x860 [ 537.992357][T23563] __sys_socket+0x14d/0x260 [ 537.992377][T23563] ? __pfx___sys_socket+0x10/0x10 [ 537.992403][T23563] __x64_sys_socket+0x72/0xb0 [ 537.992422][T23563] ? lockdep_hardirqs_on+0x78/0x100 [ 537.992447][T23563] do_syscall_64+0x106/0xf80 [ 537.992470][T23563] ? clear_bhb_loop+0x40/0x90 [ 537.992492][T23563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.992510][T23563] RIP: 0033:0x7f1b1eb9c799 [ 537.992525][T23563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.992542][T23563] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 537.992559][T23563] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 537.992570][T23563] RDX: 0000000000000100 RSI: 0000000000000001 RDI: 000000000000000a [ 537.992580][T23563] RBP: 00007f1b1ec32c99 R08: 0000000000000000 R09: 0000000000000000 [ 537.992590][T23563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 537.992600][T23563] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 537.992621][T23563] [ 537.992630][T23563] socket: no more sockets [ 539.004287][T23594] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 540.636294][T16537] Bluetooth: hci3: unexpected event 0x3e length: 726 > 260 [ 540.636322][T16537] Bluetooth: hci3: unexpected subevent 0x0d length: 725 > 260 [ 540.653599][T16537] Bluetooth: hci3: Unknown advertising packet type: 0x7f [ 540.653621][T16537] Bluetooth: hci3: Unknown advertising packet type: 0x3d [ 540.662088][T16537] Bluetooth: hci3: adv larger than maximum supported [ 540.669484][T16537] Bluetooth: hci3: Malformed LE Event: 0x0d [ 541.283525][T16537] Bluetooth: hci2: unexpected event 0x3e length: 508 > 260 [ 541.283553][T16537] Bluetooth: hci2: unexpected subevent 0x02 length: 507 > 260 [ 541.300758][T16537] Bluetooth: hci2: Dropping invalid advertising data [ 541.309529][T16537] Bluetooth: hci2: unknown advertising packet type: 0xe9 [ 541.309554][T16537] Bluetooth: hci2: Dropping invalid advertising data [ 541.326506][T16537] Bluetooth: hci2: Malformed LE Event: 0x02 [ 541.752725][T23707] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 541.935712][T23707] CIFS mount error: No usable UNC path provided in device string! [ 541.935712][T23707] [ 541.994263][T23707] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 542.153796][T23716] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 542.431280][T23724] debugfs: '!PjE r҄y*"l-y–L̓]' already exists in 'ieee80211' [ 542.603945][T23713] syz.2.7721 invoked oom-killer: gfp_mask=0x402cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 542.759873][T23713] CPU: 0 UID: 0 PID: 23713 Comm: syz.2.7721 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 542.759908][T23713] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 542.759917][T23713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 542.759927][T23713] Call Trace: [ 542.759933][T23713] [ 542.759941][T23713] dump_stack_lvl+0x100/0x190 [ 542.759972][T23713] dump_header+0xfb/0x606 [ 542.759992][T23713] oom_kill_process.cold+0xd/0x330 [ 542.760013][T23713] out_of_memory+0x340/0x14f0 [ 542.760044][T23713] ? __pfx_out_of_memory+0x10/0x10 [ 542.760089][T23713] mem_cgroup_out_of_memory+0xc6/0x130 [ 542.760118][T23713] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 542.760141][T23713] ? find_held_lock+0x2b/0x80 [ 542.760162][T23713] ? do_raw_spin_unlock+0x145/0x1e0 [ 542.760189][T23713] ? _raw_spin_unlock+0x28/0x50 [ 542.760212][T23713] try_charge_memcg+0x652/0xc90 [ 542.760235][T23713] ? __pfx_try_charge_memcg+0x10/0x10 [ 542.760252][T23713] ? rcu_read_unlock+0x17/0x60 [ 542.760271][T23713] ? rcu_read_unlock+0x17/0x60 [ 542.760294][T23713] ? get_mem_cgroup_from_objcg+0xd3/0x330 [ 542.760322][T23713] __memcg_kmem_charge_page+0xd0/0x530 [ 542.760345][T23713] __alloc_frozen_pages_noprof+0x328/0x2ba0 [ 542.760376][T23713] ? __pfx_vmap_small_pages_range_noflush+0x10/0x10 [ 542.760395][T23713] ? __split_page_owner+0x1f9/0x350 [ 542.760416][T23713] ? alloc_pages_bulk_noprof+0x811/0x1490 [ 542.760444][T23713] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 542.760474][T23713] ? __kasan_unpoison_vmalloc+0x22/0x30 [ 542.760500][T23713] ? __vmalloc_node_range_noprof+0x11eb/0x1530 [ 542.760522][T23713] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 542.760551][T23713] ? __lock_acquire+0x4a5/0x2630 [ 542.760575][T23713] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 542.760606][T23713] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 542.760636][T23713] ? policy_nodemask+0xed/0x4f0 [ 542.760656][T23713] alloc_pages_mpol+0x1fb/0x550 [ 542.760676][T23713] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 542.760696][T23713] ? rcu_read_unlock+0x17/0x60 [ 542.760724][T23713] alloc_pages_noprof+0x131/0x390 [ 542.760744][T23713] __vmalloc_node_range_noprof+0xa1d/0x1530 [ 542.760772][T23713] ? __do_sys_listmount+0x289/0xee0 [ 542.760806][T23713] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 542.760832][T23713] ? rcu_is_watching+0x12/0xc0 [ 542.760864][T23713] __kvmalloc_node_noprof+0x3de/0xa00 [ 542.760892][T23713] ? __do_sys_listmount+0x289/0xee0 [ 542.760919][T23713] ? __do_sys_listmount+0x289/0xee0 [ 542.760947][T23713] ? _copy_from_user+0x59/0xd0 [ 542.760973][T23713] ? copy_mnt_id_req+0x1b1/0x350 [ 542.760998][T23713] __do_sys_listmount+0x289/0xee0 [ 542.761025][T23713] ? __pfx_do_futex+0x10/0x10 [ 542.761052][T23713] ? __pfx___do_sys_listmount+0x10/0x10 [ 542.761095][T23713] do_syscall_64+0x106/0xf80 [ 542.761118][T23713] ? clear_bhb_loop+0x40/0x90 [ 542.761140][T23713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.761158][T23713] RIP: 0033:0x7f1b1eb9c799 [ 542.761173][T23713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.761190][T23713] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ca [ 542.761207][T23713] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 542.761218][T23713] RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000200000000100 [ 542.761228][T23713] RBP: 00007f1b1ec32c99 R08: 0000000000000000 R09: 0000000000000000 [ 542.761238][T23713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 542.761247][T23713] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 542.761270][T23713] [ 543.139164][T23713] memory: usage 3072kB, limit 3072kB, failcnt 45863 [ 543.150402][T23713] memory+swap: usage 3524kB, limit 9007199254740988kB, failcnt 0 [ 543.161242][T23713] kmem: usage 2984kB, limit 9007199254740988kB, failcnt 0 [ 543.168484][T23713] Memory cgroup stats for /syz2: [ 543.168703][T23713] cache 0 [ 543.177181][T23713] rss 0 [ 543.180118][T23713] rss_huge 0 [ 543.183397][T23713] shmem 0 [ 543.187083][T23713] mapped_file 0 [ 543.190917][T23713] dirty 0 [ 543.193949][T23713] writeback 0 [ 543.197488][T23713] workingset_refault_anon 1743 [ 543.202309][T23713] workingset_refault_file 17165 [ 543.207449][T23713] swap 466944 [ 543.210944][T23713] swapcached 135561216 [ 543.215079][T23713] pgpgin 158339 [ 543.218626][T23713] pgpgout 158318 [ 543.222298][T23713] pgfault 227282 [ 543.226012][T23713] pgmajfault 1134 [ 543.229781][T23713] inactive_anon 86016 [ 543.233868][T23713] active_anon 0 [ 543.237454][T23713] inactive_file 0 [ 543.241553][T23713] active_file 0 [ 543.245183][T23713] unevictable 0 [ 543.248657][T23713] hierarchical_memory_limit 3145728 [ 543.254051][T23713] hierarchical_memsw_limit 9223372036854771712 [ 543.261868][T23713] total_cache 0 [ 543.265411][T23713] total_rss 0 [ 543.268885][T23713] total_rss_huge 0 [ 543.273311][T23713] total_shmem 0 [ 543.276870][T23713] total_mapped_file 0 [ 543.280960][T23713] total_dirty 0 [ 543.284578][T23713] total_writeback 0 [ 543.288432][T23713] total_workingset_refault_anon 1743 [ 543.293824][T23713] total_workingset_refault_file 17165 [ 543.299465][T23713] total_swap 466944 [ 543.303558][T23713] total_swapcached 135561216 [ 543.308190][T23713] total_pgpgin 158339 [ 543.312182][T23713] total_pgpgout 158318 [ 543.316338][T23713] total_pgfault 227282 [ 543.320437][T23713] total_pgmajfault 1134 [ 543.324622][T23713] total_inactive_anon 86016 [ 543.329230][T23713] total_active_anon 0 [ 543.333228][T23713] total_inactive_file 0 [ 543.337497][T23713] total_active_file 0 [ 543.341572][T23713] total_unevictable 0 [ 543.345685][T23713] anon_cost 15 [ 543.349165][T23713] file_cost 0 [ 543.352452][T23713] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.7721,pid=23712,uid=0 [ 543.371126][T23713] Memory cgroup out of memory: Killed process 23712 (syz.2.7721) total-vm:104408kB, anon-rss:1240kB, file-rss:22768kB, shmem-rss:0kB, UID:0 pgtables:144kB oom_score_adj:1000 [ 543.583214][T23740] netlink: NAT attribute has 4 unknown bytes [ 543.635502][ T5828] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 543.658323][ T5828] CPU: 0 UID: 0 PID: 5828 Comm: syz-executor Tainted: G U I L syzkaller #0 PREEMPT(full) [ 543.658360][ T5828] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 543.658368][ T5828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 543.658378][ T5828] Call Trace: [ 543.658386][ T5828] [ 543.658394][ T5828] dump_stack_lvl+0x100/0x190 [ 543.658426][ T5828] dump_header+0xfb/0x606 [ 543.658446][ T5828] oom_kill_process.cold+0xd/0x330 [ 543.658467][ T5828] out_of_memory+0x340/0x14f0 [ 543.658498][ T5828] ? __pfx_out_of_memory+0x10/0x10 [ 543.658540][ T5828] mem_cgroup_out_of_memory+0xc6/0x130 [ 543.658565][ T5828] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 543.658588][ T5828] ? find_held_lock+0x2b/0x80 [ 543.658609][ T5828] ? do_raw_spin_unlock+0x145/0x1e0 [ 543.658636][ T5828] ? _raw_spin_unlock+0x28/0x50 [ 543.658660][ T5828] try_charge_memcg+0x652/0xc90 [ 543.658683][ T5828] ? __pfx_try_charge_memcg+0x10/0x10 [ 543.658713][ T5828] ? find_held_lock+0x2b/0x80 [ 543.658729][ T5828] ? rcu_read_unlock+0x17/0x60 [ 543.658747][ T5828] ? rcu_read_unlock+0x17/0x60 [ 543.658769][ T5828] charge_memcg+0xa6/0x280 [ 543.658787][ T5828] mem_cgroup_swapin_charge_folio+0xeb/0x470 [ 543.658812][ T5828] __swap_cache_prepare_and_add+0x528/0x9e0 [ 543.658847][ T5828] ? __pfx___swap_cache_prepare_and_add+0x10/0x10 [ 543.658879][ T5828] ? __pfx_swap_entry_swapped+0x10/0x10 [ 543.658904][ T5828] swap_cache_alloc_folio+0x1cb/0x300 [ 543.658930][ T5828] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 543.658968][ T5828] swap_cluster_readahead+0x411/0x770 [ 543.658999][ T5828] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 543.659028][ T5828] ? update_cfs_rq_load_avg+0x51/0x550 [ 543.659053][ T5828] ? __lock_acquire+0x4a5/0x2630 [ 543.659077][ T5828] ? get_vma_policy+0x23f/0x3b0 [ 543.659099][ T5828] swapin_readahead+0x160/0x12c0 [ 543.659132][ T5828] ? __pfx_swapin_readahead+0x10/0x10 [ 543.659156][ T5828] ? find_held_lock+0x2b/0x80 [ 543.659172][ T5828] ? swap_table_get+0x103/0x2c0 [ 543.659194][ T5828] ? swap_table_get+0x103/0x2c0 [ 543.659220][ T5828] ? swap_table_get+0x10d/0x2c0 [ 543.659244][ T5828] ? swap_cache_get_folio+0x1ae/0x600 [ 543.659269][ T5828] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 543.659292][ T5828] ? __pfx_get_swap_device+0x10/0x10 [ 543.659313][ T5828] ? do_swap_page+0xb2e/0x6900 [ 543.659336][ T5828] do_swap_page+0xb2e/0x6900 [ 543.659370][ T5828] ? __pfx_do_swap_page+0x10/0x10 [ 543.659395][ T5828] ? __free_object+0x2a8/0x400 [ 543.659420][ T5828] ? lockdep_hardirqs_on+0x78/0x100 [ 543.659447][ T5828] ? rcu_is_watching+0x12/0xc0 [ 543.659473][ T5828] ? __pte_offset_map+0x179/0x310 [ 543.659494][ T5828] __handle_mm_fault+0x18c1/0x2b60 [ 543.659522][ T5828] ? reacquire_held_locks+0xce/0x1e0 [ 543.659545][ T5828] ? __pfx___handle_mm_fault+0x10/0x10 [ 543.659574][ T5828] ? lock_vma_under_rcu+0x17c/0x590 [ 543.659610][ T5828] handle_mm_fault+0x36d/0xa20 [ 543.659639][ T5828] do_user_addr_fault+0x5a3/0x12f0 [ 543.659680][ T5828] exc_page_fault+0x6f/0xd0 [ 543.659711][ T5828] asm_exc_page_fault+0x26/0x30 [ 543.659728][ T5828] RIP: 0033:0x7f1b1eb5cfce [ 543.659745][ T5828] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 543.659762][ T5828] RSP: 002b:00007ffe37930ac8 EFLAGS: 00010246 [ 543.659776][ T5828] RAX: 0000000000000000 RBX: 00005555790cc500 RCX: 00007f1b1eb5cfce [ 543.659792][ T5828] RDX: 00007ffe37930b20 RSI: 0000000000000000 RDI: 0000000000000000 [ 543.659802][ T5828] RBP: 00007ffe37930b8c R08: 0000000000000000 R09: 0000000000000000 [ 543.659842][ T5828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 543.659852][ T5828] R13: 00000000000927c0 R14: 0000000000084d1c R15: 00007ffe37930be0 [ 543.659875][ T5828] [ 543.659887][ T5828] memory: usage 3072kB, limit 3072kB, failcnt 46236 [ 544.198797][T23746] netlink: 'syz.3.7733': attribute type 2 has an invalid length. [ 544.655681][ T5828] memory+swap: usage 2484kB, limit 9007199254740988kB, failcnt 0 [ 544.694996][ T5828] kmem: usage 1764kB, limit 9007199254740988kB, failcnt 0 [ 544.742720][ T5828] Memory cgroup stats for /syz2: [ 544.742842][ T5828] cache 0 [ 544.786662][ T5828] rss 0 [ 544.808738][ T5828] rss_huge 0 [ 544.830289][ T5828] shmem 0 [ 544.833418][ T5828] mapped_file 0 [ 544.855938][ T5828] dirty 0 [ 544.867973][ T5828] writeback 0 [ 544.889707][ T5828] workingset_refault_anon 1744 [ 544.914292][ T5828] workingset_refault_file 17165 [ 544.968832][ T5828] swap 462848 [ 544.972282][ T5828] swapcached 135561216 [ 544.996566][ T5828] pgpgin 158340 [ 545.000324][ T5828] pgpgout 158318 [ 545.003954][ T5828] pgfault 227284 [ 545.048894][ T5828] pgmajfault 1134 [ 545.052589][ T5828] inactive_anon 0 [ 545.080436][ T5828] active_anon 90112 [ 545.084385][ T5828] inactive_file 0 [ 545.128815][ T5828] active_file 0 [ 545.132411][ T5828] unevictable 0 [ 545.176204][ T5828] hierarchical_memory_limit 3145728 [ 545.181599][ T5828] hierarchical_memsw_limit 9223372036854771712 [ 545.221922][ T5828] total_cache 0 [ 545.243887][ T5828] total_rss 0 [ 545.254118][ T5828] total_rss_huge 0 [ 545.264367][ T5828] total_shmem 0 [ 545.267892][ T5828] total_mapped_file 0 [ 545.303740][ T5828] total_dirty 0 [ 545.317435][ T5828] total_writeback 0 [ 545.321499][ T5828] total_workingset_refault_anon 1744 [ 545.363439][ T5828] total_workingset_refault_file 17165 [ 545.368951][ T5828] total_swap 462848 [ 545.372760][ T5828] total_swapcached 135561216 [ 545.439931][ T5828] total_pgpgin 158340 [ 545.457868][ T5828] total_pgpgout 158318 [ 545.462215][ T5828] total_pgfault 227284 [ 545.504850][ T5828] total_pgmajfault 1134 [ 545.509076][ T5828] total_inactive_anon 0 [ 545.532952][ T32] oom_reaper: reaped process 23712 (syz.2.7721), now anon-rss:0kB, file-rss:21676kB, shmem-rss:0kB [ 545.552635][ T5828] total_active_anon 90112 [ 545.556998][ T5828] total_inactive_file 0 [ 545.561366][ T5828] total_active_file 0 [ 545.624140][ T5828] total_unevictable 0 [ 545.644291][ T5828] anon_cost 14 [ 545.647793][ T5828] file_cost 0 [ 545.651108][ T5828] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.7502,pid=23142,uid=0 [ 545.752040][ T5828] Memory cgroup out of memory: Killed process 23142 (syz.2.7502) total-vm:108372kB, anon-rss:1240kB, file-rss:20740kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 545.791360][T23800] delete_channel: no stack [ 546.468401][T23827] openvswitch: netlink: IP tunnel dst address not specified [ 546.657099][T23830] openvswitch: netlink: IP tunnel dst address not specified [ 548.097558][T23895] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 548.568607][T16537] Bluetooth: hci1: unexpected event 0x3e length: 508 > 260 [ 548.568634][T16537] Bluetooth: hci1: unexpected subevent 0x02 length: 507 > 260 [ 548.583731][T16537] Bluetooth: hci1: Dropping invalid advertising data [ 548.591486][T16537] Bluetooth: hci1: unknown advertising packet type: 0xe9 [ 548.591514][T16537] Bluetooth: hci1: Dropping invalid advertising data [ 548.605956][T16537] Bluetooth: hci1: Malformed LE Event: 0x02 [ 550.873774][T24015] FAULT_INJECTION: forcing a failure. [ 550.873774][T24015] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 550.952274][T24015] CPU: 0 UID: 0 PID: 24015 Comm: syz.2.7831 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 550.952309][T24015] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 550.952318][T24015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 550.952328][T24015] Call Trace: [ 550.952334][T24015] [ 550.952342][T24015] dump_stack_lvl+0x100/0x190 [ 550.952374][T24015] should_fail_ex.cold+0x5/0xa [ 550.952404][T24015] core_sys_select+0x9b9/0xbb0 [ 550.952439][T24015] ? __pfx_core_sys_select+0x10/0x10 [ 550.952490][T24015] ? ktime_get_ts64+0x2d2/0x3f0 [ 550.952511][T24015] ? read_tsc+0x9/0x20 [ 550.952530][T24015] ? ktime_get_ts64+0x256/0x3f0 [ 550.952552][T24015] kern_select+0x20c/0x270 [ 550.952582][T24015] ? __pfx_kern_select+0x10/0x10 [ 550.952618][T24015] __x64_sys_select+0xbd/0x160 [ 550.952634][T24015] ? do_syscall_64+0x95/0xf80 [ 550.952658][T24015] ? lockdep_hardirqs_on+0x78/0x100 [ 550.952683][T24015] do_syscall_64+0x106/0xf80 [ 550.952707][T24015] ? clear_bhb_loop+0x40/0x90 [ 550.952728][T24015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.952747][T24015] RIP: 0033:0x7f1b1eb9c799 [ 550.952763][T24015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.952782][T24015] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000017 [ 550.952800][T24015] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 550.952811][T24015] RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 0000000000000001 [ 550.952821][T24015] RBP: 00007f1b1ec32c99 R08: 00002000000001c0 R09: 0000000000000000 [ 550.952832][T24015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 550.952842][T24015] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 550.952864][T24015] [ 551.534911][T24035] netlink: 342 bytes leftover after parsing attributes in process `syz.0.7840'. [ 553.134967][T24101] binder: 24100:24101 ioctl c0306201 200000000000 returned -14 [ 553.161032][T24104] openvswitch: netlink: IP tunnel dst address not specified [ 554.246072][T24134] &#$@\]\-: entered promiscuous mode [ 554.481296][T24146] netlink: ct_mark mask cannot be 0 [ 554.839645][T24161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7888'. [ 554.891056][T24163] netlink: 'syz.2.7890': attribute type 11 has an invalid length. [ 555.303306][T24179] netlink: NAT attribute type 0 has unexpected length (4 != 0) [ 555.741918][T24197] openvswitch: netlink: Duplicate or invalid key (type 0). [ 555.948065][T24200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7906'. [ 556.709953][T24230] NFSD: Failed to start, no listeners configured. [ 559.301527][T24315] NFSD: Failed to start, no listeners configured. [ 559.588243][T24332] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 560.158269][T24356] ksmbd: Unknown IPC event: 14, ignore. [ 561.032199][T24383] NFSD: Failed to start, no listeners configured. [ 561.108028][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 561.114476][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 561.379755][T24396] Process accounting resumed [ 561.964931][T24427] netlink: 'syz.1.7988': attribute type 1 has an invalid length. [ 565.026309][T24552] synth uevent: /bus/usb/drivers/cdc_mbim: unknown uevent action string [ 565.040776][T24548] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE r҄y*"l-y–L̓]' [ 565.097722][T24548] CPU: 0 UID: 0 PID: 24548 Comm: syz.1.8041 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 565.097758][T24548] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 565.097767][T24548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 565.097777][T24548] Call Trace: [ 565.097784][T24548] [ 565.097792][T24548] dump_stack_lvl+0x100/0x190 [ 565.097823][T24548] sysfs_warn_dup.cold+0x1c/0x28 [ 565.097850][T24548] sysfs_do_create_link_sd+0x113/0x140 [ 565.097878][T24548] sysfs_create_link+0x61/0xc0 [ 565.097904][T24548] device_add+0x675/0x1950 [ 565.097928][T24548] ? __pfx_device_add+0x10/0x10 [ 565.097948][T24548] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 565.097979][T24548] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 565.098008][T24548] wiphy_register+0x1e5b/0x2d30 [ 565.098036][T24548] ? __rtnl_unlock+0xb9/0xf0 [ 565.098064][T24548] ? netdev_run_todo+0x7a0/0x12c0 [ 565.098094][T24548] ? __pfx_wiphy_register+0x10/0x10 [ 565.098124][T24548] ? __asan_memset+0x23/0x50 [ 565.098149][T24548] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 565.098185][T24548] ieee80211_register_hw+0x2cfd/0x4140 [ 565.098224][T24548] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 565.098252][T24548] ? __pfx___debug_object_init+0x10/0x10 [ 565.098286][T24548] ? find_held_lock+0x2b/0x80 [ 565.098305][T24548] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 565.098336][T24548] ? __hrtimer_setup+0x178/0x280 [ 565.098363][T24548] mac80211_hwsim_new_radio+0x2847/0x57d0 [ 565.098406][T24548] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 565.098451][T24548] hwsim_new_radio_nl+0xc1f/0x1340 [ 565.098483][T24548] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 565.098520][T24548] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1a0/0x280 [ 565.098540][T24548] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1aa/0x280 [ 565.098564][T24548] genl_family_rcv_msg_doit+0x214/0x300 [ 565.098586][T24548] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 565.098604][T24548] ? genl_get_cmd+0x3ef/0x720 [ 565.098627][T24548] ? bpf_lsm_capable+0x9/0x10 [ 565.098646][T24548] ? security_capable+0x80/0x260 [ 565.098674][T24548] ? ns_capable+0xd2/0xf0 [ 565.098694][T24548] genl_rcv_msg+0x560/0x800 [ 565.098715][T24548] ? __pfx_genl_rcv_msg+0x10/0x10 [ 565.098734][T24548] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 565.098771][T24548] netlink_rcv_skb+0x159/0x420 [ 565.098799][T24548] ? __pfx_genl_rcv_msg+0x10/0x10 [ 565.098818][T24548] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 565.098854][T24548] ? netlink_deliver_tap+0x1ae/0xcc0 [ 565.098884][T24548] genl_rcv+0x28/0x40 [ 565.098899][T24548] netlink_unicast+0x5aa/0x870 [ 565.098930][T24548] ? __pfx_netlink_unicast+0x10/0x10 [ 565.098967][T24548] netlink_sendmsg+0x8b0/0xda0 [ 565.098998][T24548] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.099025][T24548] ? __import_iovec+0x1d2/0x640 [ 565.099049][T24548] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 565.099081][T24548] ____sys_sendmsg+0x9e1/0xb70 [ 565.099098][T24548] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.099128][T24548] ? __pfx_____sys_sendmsg+0x10/0x10 [ 565.099152][T24548] ? __pfx_futex_wake_mark+0x10/0x10 [ 565.099182][T24548] ___sys_sendmsg+0x190/0x1e0 [ 565.099204][T24548] ? __pfx____sys_sendmsg+0x10/0x10 [ 565.099251][T24548] __sys_sendmsg+0x170/0x220 [ 565.099277][T24548] ? __pfx___sys_sendmsg+0x10/0x10 [ 565.099302][T24548] ? __x64_sys_futex+0x34f/0x4d0 [ 565.099339][T24548] do_syscall_64+0x106/0xf80 [ 565.099364][T24548] ? clear_bhb_loop+0x40/0x90 [ 565.099387][T24548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.099405][T24548] RIP: 0033:0x7f7981d9c799 [ 565.099421][T24548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.099445][T24548] RSP: 002b:00007f7982b85028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 565.099463][T24548] RAX: ffffffffffffffda RBX: 00007f7982015fa0 RCX: 00007f7981d9c799 [ 565.099474][T24548] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 565.099485][T24548] RBP: 00007f7981e32c99 R08: 0000000000000000 R09: 0000000000000000 [ 565.099496][T24548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 565.099506][T24548] R13: 00007f7982016038 R14: 00007f7982015fa0 R15: 00007ffc5bf616b8 [ 565.099530][T24548] [ 567.874176][T24673] netlink: zone id is out of range [ 568.050996][T24677] .^: entered promiscuous mode [ 568.210064][T24688] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.128.4294967291), cmd(3) [ 568.476798][T24704] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8103'. [ 570.548080][T24768] netlink: Setting conntrack mark requires 'commit' flag. [ 571.048807][T24780] netlink: 'syz.3.8133': attribute type 11 has an invalid length. [ 571.103322][T24780] netlink: 'syz.3.8133': attribute type 11 has an invalid length. [ 571.129314][T24780] netlink: 'syz.3.8133': attribute type 11 has an invalid length. [ 571.402877][ T5829] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 571.478099][ T5829] CPU: 0 UID: 0 PID: 5829 Comm: syz-executor Tainted: G U I L syzkaller #0 PREEMPT(full) [ 571.478134][ T5829] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 571.478143][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 571.478153][ T5829] Call Trace: [ 571.478159][ T5829] [ 571.478166][ T5829] dump_stack_lvl+0x100/0x190 [ 571.478196][ T5829] dump_header+0xfb/0x606 [ 571.478216][ T5829] oom_kill_process.cold+0xd/0x330 [ 571.478238][ T5829] out_of_memory+0x340/0x14f0 [ 571.478269][ T5829] ? __pfx_out_of_memory+0x10/0x10 [ 571.478301][ T5829] mem_cgroup_out_of_memory+0xc6/0x130 [ 571.478327][ T5829] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 571.478358][ T5829] ? find_held_lock+0x2b/0x80 [ 571.478379][ T5829] ? do_raw_spin_unlock+0x145/0x1e0 [ 571.478406][ T5829] ? _raw_spin_unlock+0x28/0x50 [ 571.478430][ T5829] try_charge_memcg+0x652/0xc90 [ 571.478453][ T5829] ? __pfx_try_charge_memcg+0x10/0x10 [ 571.478476][ T5829] ? find_held_lock+0x2b/0x80 [ 571.478492][ T5829] ? rcu_read_unlock+0x17/0x60 [ 571.478510][ T5829] ? rcu_read_unlock+0x17/0x60 [ 571.478532][ T5829] charge_memcg+0xa6/0x280 [ 571.478550][ T5829] mem_cgroup_swapin_charge_folio+0xeb/0x470 [ 571.478581][ T5829] __swap_cache_prepare_and_add+0x528/0x9e0 [ 571.478616][ T5829] ? __pfx___swap_cache_prepare_and_add+0x10/0x10 [ 571.478641][ T5829] ? __pfx_swap_entry_swapped+0x10/0x10 [ 571.478664][ T5829] swap_cache_alloc_folio+0x1cb/0x300 [ 571.478691][ T5829] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 571.478724][ T5829] swap_cluster_readahead+0x411/0x770 [ 571.478755][ T5829] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 571.478784][ T5829] ? update_cfs_rq_load_avg+0x51/0x550 [ 571.478809][ T5829] ? __lock_acquire+0x4a5/0x2630 [ 571.478834][ T5829] ? get_vma_policy+0x23f/0x3b0 [ 571.478855][ T5829] swapin_readahead+0x160/0x12c0 [ 571.478888][ T5829] ? __pfx_swapin_readahead+0x10/0x10 [ 571.478916][ T5829] ? find_held_lock+0x2b/0x80 [ 571.478931][ T5829] ? swap_table_get+0x103/0x2c0 [ 571.478953][ T5829] ? swap_table_get+0x103/0x2c0 [ 571.478980][ T5829] ? swap_table_get+0x10d/0x2c0 [ 571.479004][ T5829] ? swap_cache_get_folio+0x1ae/0x600 [ 571.479030][ T5829] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 571.479053][ T5829] ? __pfx_get_swap_device+0x10/0x10 [ 571.479074][ T5829] ? do_swap_page+0xb2e/0x6900 [ 571.479097][ T5829] do_swap_page+0xb2e/0x6900 [ 571.479132][ T5829] ? __pfx_do_swap_page+0x10/0x10 [ 571.479157][ T5829] ? __free_object+0x2a8/0x400 [ 571.479182][ T5829] ? lockdep_hardirqs_on+0x78/0x100 [ 571.479209][ T5829] ? rcu_is_watching+0x12/0xc0 [ 571.479235][ T5829] ? __pte_offset_map+0x179/0x310 [ 571.479262][ T5829] __handle_mm_fault+0x18c1/0x2b60 [ 571.479290][ T5829] ? reacquire_held_locks+0xce/0x1e0 [ 571.479314][ T5829] ? __pfx___handle_mm_fault+0x10/0x10 [ 571.479347][ T5829] ? lock_vma_under_rcu+0x17c/0x590 [ 571.479385][ T5829] handle_mm_fault+0x36d/0xa20 [ 571.479414][ T5829] do_user_addr_fault+0x5a3/0x12f0 [ 571.479449][ T5829] exc_page_fault+0x6f/0xd0 [ 571.479474][ T5829] asm_exc_page_fault+0x26/0x30 [ 571.479491][ T5829] RIP: 0033:0x7f7981d5cfce [ 571.479506][ T5829] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 571.479523][ T5829] RSP: 002b:00007ffc5bf61998 EFLAGS: 00010246 [ 571.479538][ T5829] RAX: 0000000000000000 RBX: 0000555580d96500 RCX: 00007f7981d5cfce [ 571.479549][ T5829] RDX: 00007ffc5bf619f0 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.479559][ T5829] RBP: 00007ffc5bf61a5c R08: 0000000000000000 R09: 0000000000000000 [ 571.479569][ T5829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 571.479579][ T5829] R13: 00000000000927c0 R14: 000000000008bf25 R15: 00007ffc5bf61ab0 [ 571.479602][ T5829] [ 571.484837][ T5829] memory: usage 1252kB, limit 3072kB, failcnt 80258 [ 572.101907][T24804] netlink: 'syz.2.8142': attribute type 23 has an invalid length. [ 572.507703][T24817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8148'. [ 572.847843][ T5829] memory+swap: usage 1480kB, limit 9007199254740988kB, failcnt 0 [ 572.869754][ T5829] kmem: usage 1164kB, limit 9007199254740988kB, failcnt 0 [ 572.910431][ T5829] Memory cgroup stats for /syz1: [ 572.910561][ T5829] cache 0 [ 572.930024][ T5829] rss 24576 [ 572.933204][ T5829] rss_huge 0 [ 572.959257][ T5829] shmem 0 [ 572.973476][ T5829] mapped_file 0 [ 572.977245][ T5829] dirty 0 [ 573.004835][ T5829] writeback 0 [ 573.032248][ T5829] workingset_refault_anon 3352 [ 573.037327][ T5829] workingset_refault_file 34628 [ 573.073974][ T5829] swap 233472 [ 573.077396][ T5829] swapcached 209412096 [ 573.105583][ T5829] pgpgin 195857 [ 573.122141][ T5829] pgpgout 195843 [ 573.125724][ T5829] pgfault 242426 [ 573.156372][ T5829] pgmajfault 1538 [ 573.170596][ T5829] inactive_anon 24576 [ 573.203010][ T5829] active_anon 32768 [ 573.233016][ T5829] inactive_file 0 [ 573.236792][ T5829] active_file 0 [ 573.272481][ T5829] unevictable 0 [ 573.276066][ T5829] hierarchical_memory_limit 3145728 [ 573.318636][ T5829] hierarchical_memsw_limit 9223372036854771712 [ 573.342484][ T5829] total_cache 0 [ 573.346018][ T5829] total_rss 24576 [ 573.368909][ T5829] total_rss_huge 0 [ 573.382873][ T5829] total_shmem 0 [ 573.386415][ T5829] total_mapped_file 0 [ 573.401323][ T5829] total_dirty 0 [ 573.425529][ T5829] total_writeback 0 [ 573.435629][ T5829] total_workingset_refault_anon 3352 [ 573.466159][ T5829] total_workingset_refault_file 34628 [ 573.496969][ T5829] total_swap 233472 [ 573.500902][ T5829] total_swapcached 209412096 [ 573.539192][ T5829] total_pgpgin 195857 [ 573.543331][ T5829] total_pgpgout 195843 [ 573.581203][ T5829] total_pgfault 242426 [ 573.585319][ T5829] total_pgmajfault 1538 [ 573.629561][ T5829] total_inactive_anon 24576 [ 573.634126][ T5829] total_active_anon 32768 [ 573.666167][ T5829] total_inactive_file 0 [ 573.680731][ T5829] total_active_file 0 [ 573.698528][ T5829] total_unevictable 0 [ 573.702545][ T5829] anon_cost 26 [ 573.746856][ T5829] file_cost 0 [ 573.750748][ T5829] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.7001,pid=21713,uid=0 [ 573.835274][ T5829] Memory cgroup out of memory: Killed process 21713 (syz.1.7001) total-vm:104276kB, anon-rss:1244kB, file-rss:20800kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 573.881161][T24856] openvswitch: netlink: Key type 261 is out of range max 32 [ 574.395308][T24875] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8174'. [ 575.340021][T24918] nbd: couldn't find a device at index 35644 [ 575.824107][T24933] netlink: 'syz.3.8199': attribute type 8 has an invalid length. [ 575.994452][T24939] netlink: Unknown NAT attribute (type=262, max=9) [ 577.966682][T25006] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 579.340221][T25056] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8254'. [ 579.685356][T25066] netlink: 'syz.0.8260': attribute type 1 has an invalid length. [ 580.611737][T25104] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 580.862575][T25111] openvswitch: netlink: IP tunnel TTL not specified. [ 582.183730][T25153] : entered promiscuous mode [ 583.114603][T25181] nbd: couldn't find device at index 33904 [ 583.164125][T25185] netlink: 'syz.0.8314': attribute type 1 has an invalid length. [ 583.320517][T25189] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 583.541423][T25197] binder: 25195:25197 ioctl c00c620f 200000000100 returned -22 [ 585.245189][T25269] netlink: Invalid conntrack timeout [ 585.622744][T25284] netlink: 'syz.2.8358': attribute type 1 has an invalid length. [ 586.007780][T25303] sd 0:0:1:0: PR command failed: 1026 [ 586.039236][T25303] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 586.065443][T25303] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 587.860842][T25390] netlink: 'syz.2.8405': attribute type 2 has an invalid length. [ 588.604734][T25423] binder: 25420:25423 ioctl c018620c 0 returned -14 [ 588.613670][T25422] netlink: 'syz.0.8420': attribute type 1 has an invalid length. [ 588.733387][T25426] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8422'. [ 588.756673][T25427] netlink: 'syz.1.8423': attribute type 1 has an invalid length. [ 588.779721][T25426] netlink: 29 bytes leftover after parsing attributes in process `syz.2.8422'. [ 588.982701][T25436] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8427'. [ 589.208042][T25450] netlink: 'syz.3.8432': attribute type 1 has an invalid length. [ 591.016144][T25512] nbd: illegal input index 37139 [ 591.562139][T25514] Process accounting paused [ 594.895272][T25632] netlink: 'syz.3.8513': attribute type 2 has an invalid length. [ 595.792573][T25671] binder_alloc: binder_alloc_mmap_handler: 25669 0-1000 already mapped failed -16 [ 597.432770][T25734] netlink: 'syz.2.8559': attribute type 1 has an invalid length. [ 599.045644][T25777] netlink: Failed to add  helper -22 [ 599.090966][T25784] dlm: non-version read from control device 255 [ 600.119023][T25832] netlink: 'syz.3.8606': attribute type 3 has an invalid length. [ 600.826252][T25860] netlink: 148 bytes leftover after parsing attributes in process `syz.0.8619'. [ 602.006199][T25912] netlink: 'syz.2.8639': attribute type 1 has an invalid length. [ 604.137714][T25984] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8671'. [ 604.617462][T26001] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 604.668063][T26003] netlink: 'syz.1.8681': attribute type 2 has an invalid length. [ 604.858479][T26011] program syz.3.8685 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 605.431136][T26033] netlink: 338 bytes leftover after parsing attributes in process `syz.0.8695'. [ 605.521671][T26033] netlink: 338 bytes leftover after parsing attributes in process `syz.0.8695'. [ 606.170622][T26053] sctp: [Deprecated]: syz.0.8705 (pid 26053) Use of struct sctp_assoc_value in delayed_ack socket option. [ 606.170622][T26053] Use struct sctp_sack_info instead [ 606.676782][T26073] netlink: ct family unspecified [ 606.763412][T26077] netlink: 'syz.2.8716': attribute type 1 has an invalid length. [ 609.234671][T26161] netlink: NAT attribute has 18 unknown bytes [ 610.365076][T26203] blktrace: Concurrent blktraces are not allowed on loop2 [ 611.329559][T26234] netlink: 'syz.2.8791': attribute type 1 has an invalid length. [ 611.723718][T26250] netlink: 'syz.2.8798': attribute type 11 has an invalid length. [ 611.780389][T26250] netlink: 'syz.2.8798': attribute type 11 has an invalid length. [ 611.827758][T26250] netlink: 'syz.2.8798': attribute type 11 has an invalid length. [ 611.873639][T26250] netlink: 'syz.2.8798': attribute type 11 has an invalid length. [ 611.915626][T26249] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 612.614102][T26285] tc_dump_action: action bad kind [ 614.061832][T26331] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xfffffd1f [ 614.427412][T26367] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8841'. [ 616.543132][ T30] audit: type=1800 audit(1843123313.992:36): pid=26439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.8872" name="SYSV00000008" dev="tmpfs" ino=0 res=0 errno=0 [ 618.438818][T26515] nfs: Unknown parameter 'nl802154' [ 621.775241][T26576] nfs: Unknown parameter 'nl802154' [ 622.230517][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 622.239202][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 622.650573][T26581] syz.2.8929 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 622.813570][T26581] CPU: 0 UID: 0 PID: 26581 Comm: syz.2.8929 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 622.813605][T26581] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 622.813613][T26581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 622.813624][T26581] Call Trace: [ 622.813630][T26581] [ 622.813637][T26581] dump_stack_lvl+0x100/0x190 [ 622.813669][T26581] dump_header+0xfb/0x606 [ 622.813689][T26581] oom_kill_process.cold+0xd/0x330 [ 622.813710][T26581] out_of_memory+0x340/0x14f0 [ 622.813741][T26581] ? __pfx_out_of_memory+0x10/0x10 [ 622.813774][T26581] mem_cgroup_out_of_memory+0xc6/0x130 [ 622.813799][T26581] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 622.813822][T26581] ? find_held_lock+0x2b/0x80 [ 622.813843][T26581] ? do_raw_spin_unlock+0x145/0x1e0 [ 622.813869][T26581] ? _raw_spin_unlock+0x28/0x50 [ 622.813894][T26581] try_charge_memcg+0x652/0xc90 [ 622.813916][T26581] ? __pfx_try_charge_memcg+0x10/0x10 [ 622.813939][T26581] ? find_held_lock+0x2b/0x80 [ 622.813955][T26581] ? rcu_read_unlock+0x17/0x60 [ 622.813973][T26581] ? rcu_read_unlock+0x17/0x60 [ 622.813994][T26581] charge_memcg+0xa6/0x280 [ 622.814012][T26581] mem_cgroup_swapin_charge_folio+0xeb/0x470 [ 622.814038][T26581] __swap_cache_prepare_and_add+0x528/0x9e0 [ 622.814072][T26581] ? __pfx___swap_cache_prepare_and_add+0x10/0x10 [ 622.814098][T26581] ? __pfx_swap_entry_swapped+0x10/0x10 [ 622.814122][T26581] swap_cache_alloc_folio+0x1cb/0x300 [ 622.814148][T26581] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 622.814180][T26581] swap_cluster_readahead+0x411/0x770 [ 622.814212][T26581] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 622.814249][T26581] ? update_cfs_rq_load_avg+0x51/0x550 [ 622.814278][T26581] ? get_vma_policy+0x23f/0x3b0 [ 622.814300][T26581] swapin_readahead+0x160/0x12c0 [ 622.814333][T26581] ? __pfx_swapin_readahead+0x10/0x10 [ 622.814357][T26581] ? find_held_lock+0x2b/0x80 [ 622.814372][T26581] ? swap_table_get+0x103/0x2c0 [ 622.814394][T26581] ? swap_table_get+0x103/0x2c0 [ 622.814421][T26581] ? swap_table_get+0x10d/0x2c0 [ 622.814445][T26581] ? swap_cache_get_folio+0x1ae/0x600 [ 622.814472][T26581] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 622.814496][T26581] ? __pfx_get_swap_device+0x10/0x10 [ 622.814518][T26581] ? do_swap_page+0xb2e/0x6900 [ 622.814540][T26581] do_swap_page+0xb2e/0x6900 [ 622.814574][T26581] ? __pfx_do_swap_page+0x10/0x10 [ 622.814599][T26581] ? __free_object+0x2a8/0x400 [ 622.814625][T26581] ? lockdep_hardirqs_on+0x78/0x100 [ 622.814651][T26581] ? rcu_is_watching+0x12/0xc0 [ 622.814678][T26581] ? __pte_offset_map+0x179/0x310 [ 622.814698][T26581] __handle_mm_fault+0x18c1/0x2b60 [ 622.814727][T26581] ? reacquire_held_locks+0xce/0x1e0 [ 622.814750][T26581] ? __pfx___handle_mm_fault+0x10/0x10 [ 622.814778][T26581] ? lock_vma_under_rcu+0x17c/0x590 [ 622.814814][T26581] handle_mm_fault+0x36d/0xa20 [ 622.814843][T26581] do_user_addr_fault+0x5a3/0x12f0 [ 622.814878][T26581] exc_page_fault+0x6f/0xd0 [ 622.814903][T26581] asm_exc_page_fault+0x26/0x30 [ 622.814920][T26581] RIP: 0033:0x7f1b1ea6a14c [ 622.814936][T26581] Code: 8a 31 13 00 eb 24 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 81 c3 f0 00 00 00 48 39 dd 74 24 <80> 7b 20 00 74 ee 8b 43 0c 85 c0 74 e7 48 89 df 48 81 c3 f0 00 00 [ 622.814953][T26581] RSP: 002b:00007ffe37930950 EFLAGS: 00010202 [ 622.814968][T26581] RAX: 0000000000000000 RBX: 00007f1b1ee16090 RCX: 00005555790cc808 [ 622.814979][T26581] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 622.814989][T26581] RBP: 00007f1b1ee17da0 R08: 0000000000000000 R09: 0000000000000000 [ 622.814999][T26581] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000989e0 [ 622.815009][T26581] R13: 00007f1b1ee1609c R14: 0000000000098710 R15: 00007f1b1ee16090 [ 622.815032][T26581] [ 622.815038][T26581] memory: usage 3072kB, limit 3072kB, failcnt 65458 [ 623.855896][T26561] Process accounting resumed [ 624.225978][T26581] memory+swap: usage 3400kB, limit 9007199254740988kB, failcnt 0 [ 624.269041][T26581] kmem: usage 2688kB, limit 9007199254740988kB, failcnt 0 [ 624.290387][T26662] FAULT_INJECTION: forcing a failure. [ 624.290387][T26662] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 624.342936][T26581] Memory cgroup stats for /syz2: [ 624.343064][T26581] cache 4096 [ 624.361039][T26581] rss 4096 [ 624.366827][T26662] CPU: 0 UID: 0 PID: 26662 Comm: syz.0.8949 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 624.366860][T26662] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 624.366868][T26662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 624.366879][T26662] Call Trace: [ 624.366885][T26662] [ 624.366893][T26662] dump_stack_lvl+0x100/0x190 [ 624.366923][T26662] should_fail_ex.cold+0x5/0xa [ 624.366945][T26662] core_sys_select+0x938/0xbb0 [ 624.366979][T26662] ? __pfx_core_sys_select+0x10/0x10 [ 624.367029][T26662] ? ktime_get_ts64+0x2d2/0x3f0 [ 624.367050][T26662] ? read_tsc+0x9/0x20 [ 624.367069][T26662] ? ktime_get_ts64+0x256/0x3f0 [ 624.367096][T26662] kern_select+0x20c/0x270 [ 624.367126][T26662] ? __pfx_kern_select+0x10/0x10 [ 624.367162][T26662] __x64_sys_select+0xbd/0x160 [ 624.367178][T26662] ? do_syscall_64+0x95/0xf80 [ 624.367203][T26662] ? lockdep_hardirqs_on+0x78/0x100 [ 624.367228][T26662] do_syscall_64+0x106/0xf80 [ 624.367253][T26662] ? clear_bhb_loop+0x40/0x90 [ 624.367275][T26662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.367293][T26662] RIP: 0033:0x7f757ff9c799 [ 624.367308][T26662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.367325][T26662] RSP: 002b:00007f7580e99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000017 [ 624.367350][T26662] RAX: ffffffffffffffda RBX: 00007f7580215fa0 RCX: 00007f757ff9c799 [ 624.367363][T26662] RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 0000000000000001 [ 624.367386][T26662] RBP: 00007f7580032c99 R08: 00002000000001c0 R09: 0000000000000000 [ 624.367397][T26662] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 [ 624.367408][T26662] R13: 00007f7580216038 R14: 00007f7580215fa0 R15: 00007fff0b3bb598 [ 624.367430][T26662] [ 624.587829][T26581] rss_huge 0 [ 624.591105][T26581] shmem 0 [ 624.594136][T26581] mapped_file 4096 [ 624.598132][T26581] dirty 0 [ 624.601385][T26581] writeback 0 [ 624.604683][T26581] workingset_refault_anon 3431 [ 624.609591][T26581] workingset_refault_file 19070 [ 624.615188][T26581] swap 335872 [ 624.618675][T26581] swapcached 208871424 [ 624.623052][T26581] pgpgin 193097 [ 624.626541][T26581] pgpgout 193060 [ 624.630179][T26581] pgfault 282570 [ 624.633943][T26581] pgmajfault 2306 [ 624.637595][T26581] inactive_anon 4096 [ 624.641534][T26581] active_anon 143360 [ 624.645606][T26581] inactive_file 4096 [ 624.649685][T26581] active_file 0 [ 624.654703][T26581] unevictable 0 [ 624.658326][T26581] hierarchical_memory_limit 3145728 [ 624.663721][T26581] hierarchical_memsw_limit 9223372036854771712 [ 624.670162][T26581] total_cache 4096 [ 624.673992][T26581] total_rss 4096 [ 624.677673][T26581] total_rss_huge 0 [ 624.681702][T26581] total_shmem 0 [ 624.685270][T26581] total_mapped_file 4096 [ 624.689572][T26581] total_dirty 0 [ 624.693209][T26581] total_writeback 0 [ 624.697116][T26581] total_workingset_refault_anon 3431 [ 624.702534][T26581] total_workingset_refault_file 19070 [ 624.708084][T26581] total_swap 335872 [ 624.712044][T26581] total_swapcached 208871424 [ 624.716639][T26581] total_pgpgin 193097 [ 624.720738][T26581] total_pgpgout 193060 [ 624.724831][T26581] total_pgfault 282570 [ 624.728984][T26581] total_pgmajfault 2306 [ 624.733232][T26581] total_inactive_anon 4096 [ 624.737922][T26581] total_active_anon 143360 [ 624.742500][T26581] total_inactive_file 4096 [ 624.747253][T26581] total_active_file 0 [ 624.751368][T26581] total_unevictable 0 [ 624.756884][T26581] anon_cost 18 [ 624.771693][T26581] file_cost 0 [ 624.775145][T26581] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.8929,pid=26581,uid=0 [ 624.800103][T26581] Memory cgroup out of memory: Killed process 26581 (syz.2.8929) total-vm:104408kB, anon-rss:1240kB, file-rss:22572kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 625.063409][T26677] netlink: 'syz.0.8956': attribute type 1 has an invalid length. [ 625.839655][T26716] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 629.375064][T26837] NFSD: Failed to start, no listeners configured. [ 632.674900][T26952] Invalid ELF header magic: != ELF [ 632.799306][T26958] ecryptfs_miscdev_write: Dropping miscdev message of unrecognized type [0] [ 633.150143][T26969] netlink: 'syz.0.9067': attribute type 1 has an invalid length. [ 633.195916][T26969] netlink: 'syz.0.9067': attribute type 1 has an invalid length. [ 633.232661][T26969] netlink: 124 bytes leftover after parsing attributes in process `syz.0.9067'. [ 633.270673][T26969] netlink: 100 bytes leftover after parsing attributes in process `syz.0.9067'. [ 634.859018][T27025] netlink: Conntrack attr has 16 unknown bytes [ 635.781098][T27060] openvswitch: netlink: VXLAN extension 64 out of range max 1 [ 636.219636][T16537] Bluetooth: hci1: Unable to find connection for big 0xd2 [ 638.661841][T27151] NFSD: Failed to start, no listeners configured. [ 638.769314][T27163] netlink: 'syz.0.9152': attribute type 1 has an invalid length. [ 638.800856][T27163] netlink: 33 bytes leftover after parsing attributes in process `syz.0.9152'. [ 639.044059][T27174] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 639.596194][T27197] netlink: 'syz.2.9165': attribute type 11 has an invalid length. [ 639.634334][T27197] netlink: 'syz.2.9165': attribute type 11 has an invalid length. [ 639.665455][T27197] netlink: 'syz.2.9165': attribute type 11 has an invalid length. [ 639.713835][T27197] netlink: 'syz.2.9165': attribute type 11 has an invalid length. [ 641.293501][T27255] MTRR 1 not used [ 641.984463][T27274] usb usb36: usbfs: process 27274 (syz.3.9202) did not claim interface 0 before use [ 642.521949][T27294] block nbd2: not configured, cannot reconfigure [ 643.179862][T16537] Bluetooth: hci2: SCO packet too small [ 643.506849][T27327] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9226'. [ 643.944270][T27343] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 645.186085][T27384] netlink: 'syz.2.9252': attribute type 1 has an invalid length. [ 645.203056][T27384] nbd: error processing sock list [ 645.753987][T27396] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9254'. [ 645.885585][T27402] openvswitch: netlink: ct_state flags aa1414ac unsupported [ 646.236268][T27415] netlink: 'syz.0.9266': attribute type 11 has an invalid length. [ 646.278752][T27415] netlink: 'syz.0.9266': attribute type 11 has an invalid length. [ 646.310361][T27415] netlink: 'syz.0.9266': attribute type 11 has an invalid length. [ 646.413615][T27421] ================================================================== [ 646.413630][T27421] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x19fb/0x1d60 [ 646.413663][T27421] Write of size 8 at addr ffffc900042997c0 by task syz.2.9269/27421 [ 646.413679][T27421] [ 646.413691][T27421] CPU: 0 UID: 0 PID: 27421 Comm: syz.2.9269 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 646.413721][T27421] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 646.413730][T27421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 646.413741][T27421] Call Trace: [ 646.413749][T27421] [ 646.413756][T27421] dump_stack_lvl+0x100/0x190 [ 646.413782][T27421] print_report+0x156/0x4c9 [ 646.413806][T27421] ? _raw_spin_lock_irqsave+0x52/0x60 [ 646.413829][T27421] ? __virt_addr_valid+0x81/0x620 [ 646.413852][T27421] ? sys_imageblit+0x19fb/0x1d60 [ 646.413877][T27421] kasan_report+0xdf/0x1e0 [ 646.413895][T27421] ? sys_imageblit+0x19fb/0x1d60 [ 646.413921][T27421] sys_imageblit+0x19fb/0x1d60 [ 646.413948][T27421] ? _prb_read_valid+0x72a/0x880 [ 646.413972][T27421] ? __pfx_sys_imageblit+0x10/0x10 [ 646.413998][T27421] ? __pfx__prb_read_valid+0x10/0x10 [ 646.414021][T27421] ? __asan_memcpy+0x3c/0x60 [ 646.414045][T27421] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 646.414075][T27421] soft_cursor+0x524/0xa10 [ 646.414097][T27421] ? fb_get_color_depth+0x120/0x250 [ 646.414115][T27421] bit_cursor+0xe58/0x16f0 [ 646.414137][T27421] ? __pfx_bit_cursor+0x10/0x10 [ 646.414160][T27421] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 646.414189][T27421] ? get_color+0x1da/0x450 [ 646.414217][T27421] ? __pfx_bit_cursor+0x10/0x10 [ 646.414236][T27421] fbcon_cursor+0x43c/0x5e0 [ 646.414252][T27421] ? mark_held_locks+0x40/0x70 [ 646.414281][T27421] hide_cursor+0x87/0x230 [ 646.414302][T27421] do_con_write+0x23fe/0x8540 [ 646.414328][T27421] ? rcu_is_watching+0x12/0xc0 [ 646.414354][T27421] ? trace_contention_end+0x140/0x180 [ 646.414378][T27421] ? __mutex_lock+0x26a/0x1b90 [ 646.414403][T27421] ? find_held_lock+0x2b/0x80 [ 646.414418][T27421] ? n_tty_write+0x512/0x12d0 [ 646.414436][T27421] ? n_tty_write+0x47e/0x12d0 [ 646.414453][T27421] ? __pfx_do_con_write+0x10/0x10 [ 646.414478][T27421] ? __pfx___mutex_lock+0x10/0x10 [ 646.414503][T27421] ? __mutex_unlock_slowpath+0x15c/0x790 [ 646.414529][T27421] ? __pfx_console_unlock+0x10/0x10 [ 646.414556][T27421] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 646.414584][T27421] con_write+0x23/0xb0 [ 646.414609][T27421] do_output_char+0x63b/0x850 [ 646.414638][T27421] n_tty_write+0x528/0x12d0 [ 646.414659][T27421] ? __pfx_n_tty_write+0x10/0x10 [ 646.414676][T27421] ? __pfx_woken_wake_function+0x10/0x10 [ 646.414704][T27421] ? __pfx___might_resched+0x10/0x10 [ 646.414731][T27421] ? __pfx_n_tty_write+0x10/0x10 [ 646.414748][T27421] file_tty_write.isra.0+0x4d2/0x890 [ 646.414775][T27421] redirected_tty_write+0xd4/0x120 [ 646.414802][T27421] vfs_write+0x6ac/0x1070 [ 646.414817][T27421] ? __pfx_redirected_tty_write+0x10/0x10 [ 646.414843][T27421] ? __pfx_vfs_write+0x10/0x10 [ 646.414870][T27421] ? find_held_lock+0x2b/0x80 [ 646.414891][T27421] ksys_write+0x12a/0x250 [ 646.414905][T27421] ? __pfx_ksys_write+0x10/0x10 [ 646.414923][T27421] do_syscall_64+0x106/0xf80 [ 646.414947][T27421] ? clear_bhb_loop+0x40/0x90 [ 646.414967][T27421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.414985][T27421] RIP: 0033:0x7f1b1eb9c799 [ 646.415000][T27421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 646.415018][T27421] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 646.415036][T27421] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 646.415048][T27421] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000003 [ 646.415059][T27421] RBP: 00007f1b1ec32c99 R08: 0000000000000000 R09: 0000000000000000 [ 646.415069][T27421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 646.415080][T27421] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 646.415095][T27421] [ 646.415102][T27421] [ 646.415107][T27421] The buggy address belongs to a vmalloc virtual mapping [ 646.415121][T27421] Memory state around the buggy address: [ 646.415130][T27421] ffffc90004299680: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 646.415142][T27421] ffffc90004299700: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 646.415154][T27421] >ffffc90004299780: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 646.415164][T27421] ^ [ 646.415173][T27421] ffffc90004299800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 646.415185][T27421] ffffc90004299880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 646.415195][T27421] ================================================================== [ 646.415206][T27421] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 646.415221][T27421] CPU: 0 UID: 0 PID: 27421 Comm: syz.2.9269 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 646.415250][T27421] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 646.415259][T27421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 646.415269][T27421] Call Trace: [ 646.415288][T27421] [ 646.415294][T27421] dump_stack_lvl+0x100/0x190 [ 646.415321][T27421] vpanic+0x552/0x970 [ 646.415337][T27421] ? __pfx_vpanic+0x10/0x10 [ 646.415354][T27421] ? __pfx_vprintk_emit+0x10/0x10 [ 646.415374][T27421] ? sys_imageblit+0x19fb/0x1d60 [ 646.415398][T27421] panic+0xd1/0xe0 [ 646.415414][T27421] ? __pfx_panic+0x10/0x10 [ 646.415433][T27421] ? sys_imageblit+0x19fb/0x1d60 [ 646.415459][T27421] check_panic_on_warn.cold+0x19/0x34 [ 646.415478][T27421] end_report.part.0+0x3a/0x90 [ 646.415502][T27421] kasan_report.cold+0xe/0x18 [ 646.415528][T27421] ? sys_imageblit+0x19fb/0x1d60 [ 646.415555][T27421] sys_imageblit+0x19fb/0x1d60 [ 646.415580][T27421] ? _prb_read_valid+0x72a/0x880 [ 646.415604][T27421] ? __pfx_sys_imageblit+0x10/0x10 [ 646.415629][T27421] ? __pfx__prb_read_valid+0x10/0x10 [ 646.415652][T27421] ? __asan_memcpy+0x3c/0x60 [ 646.415676][T27421] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 646.415706][T27421] soft_cursor+0x524/0xa10 [ 646.415728][T27421] ? fb_get_color_depth+0x120/0x250 [ 646.415747][T27421] bit_cursor+0xe58/0x16f0 [ 646.415769][T27421] ? __pfx_bit_cursor+0x10/0x10 [ 646.415792][T27421] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 646.415821][T27421] ? get_color+0x1da/0x450 [ 646.415849][T27421] ? __pfx_bit_cursor+0x10/0x10 [ 646.415868][T27421] fbcon_cursor+0x43c/0x5e0 [ 646.415885][T27421] ? mark_held_locks+0x40/0x70 [ 646.415906][T27421] hide_cursor+0x87/0x230 [ 646.415927][T27421] do_con_write+0x23fe/0x8540 [ 646.415954][T27421] ? rcu_is_watching+0x12/0xc0 [ 646.415980][T27421] ? trace_contention_end+0x140/0x180 [ 646.416004][T27421] ? __mutex_lock+0x26a/0x1b90 [ 646.416029][T27421] ? find_held_lock+0x2b/0x80 [ 646.416045][T27421] ? n_tty_write+0x512/0x12d0 [ 646.416061][T27421] ? n_tty_write+0x47e/0x12d0 [ 646.416079][T27421] ? __pfx_do_con_write+0x10/0x10 [ 646.416104][T27421] ? __pfx___mutex_lock+0x10/0x10 [ 646.416129][T27421] ? __mutex_unlock_slowpath+0x15c/0x790 [ 646.416156][T27421] ? __pfx_console_unlock+0x10/0x10 [ 646.416183][T27421] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 646.416210][T27421] con_write+0x23/0xb0 [ 646.416236][T27421] do_output_char+0x63b/0x850 [ 646.416265][T27421] n_tty_write+0x528/0x12d0 [ 646.416293][T27421] ? __pfx_n_tty_write+0x10/0x10 [ 646.416311][T27421] ? __pfx_woken_wake_function+0x10/0x10 [ 646.416338][T27421] ? __pfx___might_resched+0x10/0x10 [ 646.416364][T27421] ? __pfx_n_tty_write+0x10/0x10 [ 646.416381][T27421] file_tty_write.isra.0+0x4d2/0x890 [ 646.416409][T27421] redirected_tty_write+0xd4/0x120 [ 646.416435][T27421] vfs_write+0x6ac/0x1070 [ 646.416453][T27421] ? __pfx_redirected_tty_write+0x10/0x10 [ 646.416480][T27421] ? __pfx_vfs_write+0x10/0x10 [ 646.416506][T27421] ? find_held_lock+0x2b/0x80 [ 646.416527][T27421] ksys_write+0x12a/0x250 [ 646.416543][T27421] ? __pfx_ksys_write+0x10/0x10 [ 646.416561][T27421] do_syscall_64+0x106/0xf80 [ 646.416584][T27421] ? clear_bhb_loop+0x40/0x90 [ 646.416604][T27421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.416622][T27421] RIP: 0033:0x7f1b1eb9c799 [ 646.416635][T27421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 646.416652][T27421] RSP: 002b:00007f1b1f9a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 646.416672][T27421] RAX: ffffffffffffffda RBX: 00007f1b1ee15fa0 RCX: 00007f1b1eb9c799 [ 646.416686][T27421] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000003 [ 646.416696][T27421] RBP: 00007f1b1ec32c99 R08: 0000000000000000 R09: 0000000000000000 [ 646.416709][T27421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 646.416720][T27421] R13: 00007f1b1ee16038 R14: 00007f1b1ee15fa0 R15: 00007ffe379307e8 [ 646.416741][T27421] [ 646.416807][T27421] Kernel Offset: disabled