last executing test programs: 17.597624301s ago: executing program 0 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='localhost / 2147483647 74754 0 0 0\n', 0x23) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r4, &(0x7f0000000640)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r4) nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000740)='127.0.0.1:/\x00', &(0x7f0000000700)='./mnt\x00', &(0x7f0000000780), 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,vers=4.1,noresvport']) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/testfile\x00', 0x42, 0x1ff) close(r5) 16.049634014s ago: executing program 0 (id=31): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./s\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./s\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./spkr\x00', 0x1ff) mount$bind(&(0x7f00000000c0)='./s/bus/platform/devices/pcspkr\x00', &(0x7f0000000080)='./spkr\x00', &(0x7f0000000100), 0x1000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dwc3\x00', 0x1ff) mount$bind(&(0x7f0000000180)='./s/bus/platform/drivers/dwc3-of-simple\x00', &(0x7f0000000140)='./dwc3\x00', &(0x7f00000001c0), 0x1000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./spkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='dwc3-of-simple\x00', 0xf) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dwc3/bind\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='pcspkr\x00', 0x7) close(r1) 14.399043492s ago: executing program 0 (id=36): ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000100)='+bond0\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r1, &(0x7f0000000100)='-bond_slave', 0xb) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='100\n', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r6, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 14.092001637s ago: executing program 0 (id=39): nanosleep(&(0x7f0000000300)={0x0, 0x11e1a300}, 0x0) 13.614958728s ago: executing program 0 (id=40): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='rdma\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r3, &(0x7f00000004c0)='4420\n', 0x5) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) close(r4) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00') 13.5861377s ago: executing program 0 (id=41): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='devices\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='freeze\n', 0x7) close(r2) 4.325992636s ago: executing program 3 (id=96): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r2) write(0xffffffffffffffff, &(0x7f0000000540)='localhost / 2147483647 74754 0 0 0\n', 0x23) 4.0260956s ago: executing program 3 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(&(0x7f0000000080), &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000180), &(0x7f00000001c0)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='2\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='nfsd 127.0.0.1 2147483647 localhost\n', 0x25) close(r2) write(0xffffffffffffffff, &(0x7f0000000400)='localhost / 2147483647 131072 0 0 0\n', 0x24) 3.627056419s ago: executing program 3 (id=103): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers_autoprobe\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/uevent\x00', 0x1, 0x0) 3.59762967s ago: executing program 1 (id=104): ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000100)='+bond0\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r1, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='100\n', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r6, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 3.38579739s ago: executing program 3 (id=105): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) write(0xffffffffffffffff, &(0x7f0000000280)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000740)='loop\n', 0x5) close(r4) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r5, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r5) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r6, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 3.350199402s ago: executing program 1 (id=106): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='file resource.c +', 0x11) 3.159794021s ago: executing program 1 (id=107): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r2) write(0xffffffffffffffff, &(0x7f0000000540)='localhost / 2147483647 74754 0 0 0\n', 0x23) 2.633157926s ago: executing program 3 (id=110): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./nfsd\x00', &(0x7f0000000500)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='udp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000900)='1\n', 0x2) close(r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000b00)="1234567800000000000000020001878300000003000000020000000000000000000000000000000000000004000000000000000100"/68, 0x38, 0x0, &(0x7f0000000a00)={0x2, 0x801, @loopback}, 0x10) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) 1.683021261s ago: executing program 1 (id=112): r0 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r0, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r0) 1.602179665s ago: executing program 3 (id=113): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 1.344667156s ago: executing program 2 (id=115): ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000100)='+bond0\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r1, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='100\n', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r6, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 1.344370996s ago: executing program 1 (id=116): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x80000}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000780)=@ublk_ctrl_cmd_sqes={0x2e, 0x0, 0x0, r0, 0xc0207518, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', @any_cmd={0x0, 0xffff, 0x18, 0x7f00000007b0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(0x0, r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000001a00)={0x1}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000001a40)={0x1}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x4002) pwrite64$ublk_bdev(r10, &(0x7f0000800000)='\x00'/4096, 0x1000, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) 1.202068773s ago: executing program 2 (id=117): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) 1.132202446s ago: executing program 2 (id=118): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='file resource.c ', 0x10) 1.057580099s ago: executing program 2 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200), 0x0) close(r0) write(0xffffffffffffffff, &(0x7f0000000280)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000740)='loop\n', 0x5) close(r4) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r5, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r5) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r6, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 394.891721ms ago: executing program 1 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000400)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000740)='loop\n', 0x5) close(0xffffffffffffffff) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r4, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r4) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r5, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 339.882264ms ago: executing program 2 (id=121): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='localhost / 2147483647 74754 0 0 0\n', 0x23) 0s ago: executing program 2 (id=122): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(&(0x7f0000000080), &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000180), &(0x7f00000001c0)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='2\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='nfsd 127.0.0.1 2147483647 localhost\n', 0x25) close(r2) write(0xffffffffffffffff, &(0x7f0000000400)='localhost / 2147483647 131072 0 0 0\n', 0x24) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.192' (ED25519) to the list of known hosts. [ 80.198721][ T5762] cgroup: Unknown subsys name 'net' [ 80.364227][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.091185][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.829033][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.837191][ T5784] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.853470][ T5780] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.857813][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.869391][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.876640][ T5780] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.877554][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.891885][ T5789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.901745][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.909669][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.916890][ T5789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.926147][ T5789] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.934383][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 83.941830][ T5789] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.950145][ T5789] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 83.951146][ T5790] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.959517][ T5789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.971354][ T5790] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 83.974173][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.979048][ T5790] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.987841][ T5789] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.004499][ T5789] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.016904][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 84.079553][ T5788] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.492229][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 84.597038][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 84.662908][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 84.731923][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.740706][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.749806][ T5776] bridge_slave_0: entered allmulticast mode [ 84.757962][ T5776] bridge_slave_0: entered promiscuous mode [ 84.767801][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.774952][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.782491][ T5776] bridge_slave_1: entered allmulticast mode [ 84.790400][ T5776] bridge_slave_1: entered promiscuous mode [ 84.851176][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.863031][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.890620][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 84.937854][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.945578][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.953081][ T5777] bridge_slave_0: entered allmulticast mode [ 84.960590][ T5777] bridge_slave_0: entered promiscuous mode [ 85.005986][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.013315][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.020934][ T5777] bridge_slave_1: entered allmulticast mode [ 85.028424][ T5777] bridge_slave_1: entered promiscuous mode [ 85.062099][ T5776] team0: Port device team_slave_0 added [ 85.102560][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.111954][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.122486][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.129787][ T5773] bridge_slave_0: entered allmulticast mode [ 85.138996][ T5773] bridge_slave_0: entered promiscuous mode [ 85.149812][ T5776] team0: Port device team_slave_1 added [ 85.176107][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.186055][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.193318][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.200845][ T5773] bridge_slave_1: entered allmulticast mode [ 85.208337][ T5773] bridge_slave_1: entered promiscuous mode [ 85.237638][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.244634][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.273242][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.331970][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.339111][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.365246][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.394625][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.404657][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.413059][ T5774] bridge_slave_0: entered allmulticast mode [ 85.422641][ T5774] bridge_slave_0: entered promiscuous mode [ 85.434140][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.447866][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.490614][ T5777] team0: Port device team_slave_0 added [ 85.496963][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.504183][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.514385][ T5774] bridge_slave_1: entered allmulticast mode [ 85.521570][ T5774] bridge_slave_1: entered promiscuous mode [ 85.563645][ T5773] team0: Port device team_slave_0 added [ 85.574915][ T5773] team0: Port device team_slave_1 added [ 85.583944][ T5777] team0: Port device team_slave_1 added [ 85.608358][ T5776] hsr_slave_0: entered promiscuous mode [ 85.615517][ T5776] hsr_slave_1: entered promiscuous mode [ 85.652543][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.719995][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.741822][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.749292][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.775783][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.789113][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.796235][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.822533][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.836930][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.843911][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.870153][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.883518][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.890584][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.916576][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.972144][ T5774] team0: Port device team_slave_0 added [ 85.980982][ T5774] team0: Port device team_slave_1 added [ 86.060947][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.068036][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.094497][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.119534][ T5788] Bluetooth: hci0: command tx timeout [ 86.119909][ T5784] Bluetooth: hci2: command tx timeout [ 86.125840][ T51] Bluetooth: hci3: command tx timeout [ 86.142316][ T5773] hsr_slave_0: entered promiscuous mode [ 86.149392][ T5773] hsr_slave_1: entered promiscuous mode [ 86.156075][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.163963][ T5773] Cannot create hsr debugfs directory [ 86.195498][ T51] Bluetooth: hci1: command tx timeout [ 86.201908][ T5777] hsr_slave_0: entered promiscuous mode [ 86.210940][ T5777] hsr_slave_1: entered promiscuous mode [ 86.217783][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.226237][ T5777] Cannot create hsr debugfs directory [ 86.232491][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.239724][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.265833][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.413854][ T5774] hsr_slave_0: entered promiscuous mode [ 86.421137][ T5774] hsr_slave_1: entered promiscuous mode [ 86.427801][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.435504][ T5774] Cannot create hsr debugfs directory [ 86.728141][ T5776] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.759387][ T5776] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.781415][ T5776] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.791693][ T5776] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.850117][ T5777] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.865648][ T5777] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.882361][ T5777] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.892310][ T5777] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.009501][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.052831][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.107485][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.122075][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.183217][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.204440][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.236461][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.249787][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.264249][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.287267][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.315825][ T3437] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.323245][ T3437] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.387386][ T3437] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.394536][ T3437] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.578249][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.681321][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.739773][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.758465][ T3437] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.765699][ T3437] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.807215][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.827864][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.835109][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.890565][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.928237][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.953189][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.960436][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.006719][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.013886][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.049137][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.056398][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.099108][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.106366][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.201223][ T51] Bluetooth: hci3: command tx timeout [ 88.201248][ T5784] Bluetooth: hci0: command tx timeout [ 88.207112][ T5788] Bluetooth: hci2: command tx timeout [ 88.237669][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.275440][ T51] Bluetooth: hci1: command tx timeout [ 88.412898][ T5776] veth0_vlan: entered promiscuous mode [ 88.477503][ T5776] veth1_vlan: entered promiscuous mode [ 88.601545][ T5776] veth0_macvtap: entered promiscuous mode [ 88.628980][ T5776] veth1_macvtap: entered promiscuous mode [ 88.695795][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.730197][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.751125][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.772325][ T5776] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.782458][ T5776] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.798441][ T5776] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.807738][ T5776] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.904118][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.022508][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.034626][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.073630][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.119667][ T5777] veth0_vlan: entered promiscuous mode [ 89.134011][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.149147][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.158406][ T5777] veth1_vlan: entered promiscuous mode [ 89.184908][ T5774] veth0_vlan: entered promiscuous mode [ 89.288890][ T5774] veth1_vlan: entered promiscuous mode [ 89.308592][ T5773] veth0_vlan: entered promiscuous mode [ 89.319184][ T5777] veth0_macvtap: entered promiscuous mode [ 89.408626][ T5777] veth1_macvtap: entered promiscuous mode [ 89.424133][ T5773] veth1_vlan: entered promiscuous mode [ 89.487879][ T5774] veth0_macvtap: entered promiscuous mode [ 89.497324][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.508940][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.521758][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.539639][ T5774] veth1_macvtap: entered promiscuous mode [ 89.549801][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.561545][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.578350][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.598504][ T5777] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.608022][ T5777] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.618870][ T5777] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.627771][ T5777] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.667621][ T5773] veth0_macvtap: entered promiscuous mode [ 89.691081][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.702407][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.714806][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.726327][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.736969][ T1907] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 89.750932][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.775441][ T5773] veth1_macvtap: entered promiscuous mode [ 89.784336][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.795313][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.806819][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.818115][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.830606][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.879780][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.889702][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.900562][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.909976][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.958244][ T1907] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 89.968630][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.984945][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.994291][ T1907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.003909][ T1907] usb 3-1: Product: syz [ 90.008593][ T1907] usb 3-1: Manufacturer: syz [ 90.013258][ T1907] usb 3-1: SerialNumber: syz [ 90.023040][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.049503][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.059471][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.070084][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.080040][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.091203][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.104154][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.156926][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.167563][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.179453][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.190536][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.202357][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.213172][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.227854][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.246753][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.256470][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.265309][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.274170][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.283177][ T51] Bluetooth: hci3: command tx timeout [ 90.283209][ T51] Bluetooth: hci2: command tx timeout [ 90.295752][ T5788] Bluetooth: hci0: command tx timeout [ 90.303572][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.355617][ T51] Bluetooth: hci1: command tx timeout [ 90.379974][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.494854][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.509503][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.556011][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.563927][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.626927][ T3437] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.660290][ T3437] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.715503][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.723460][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.935948][ T1907] usb 3-1: failed to set cport flags for port 0 [ 90.943832][ T1907] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 91.004782][ T1907] es2_ap_driver: probe of 3-1:1.0 failed with error -110 [ 91.327762][ T5849] syz.1.2 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), order=0, oom_score_adj=1000 [ 91.340797][ T5849] CPU: 0 PID: 5849 Comm: syz.1.2 Not tainted syzkaller #0 [ 91.347971][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.358086][ T5849] Call Trace: [ 91.361406][ T5849] [ 91.364371][ T5849] dump_stack_lvl+0x18c/0x250 [ 91.369115][ T5849] ? show_regs_print_info+0x20/0x20 [ 91.374375][ T5849] ? load_image+0x420/0x420 [ 91.378927][ T5849] ? ___ratelimit+0x478/0x610 [ 91.383675][ T5849] ? radix_tree_cpu_dead+0x160/0x160 [ 91.389036][ T5849] dump_header+0xd8/0x820 [ 91.393434][ T5849] oom_kill_process+0x390/0x580 [ 91.398346][ T5849] out_of_memory+0xe0e/0x1200 [ 91.403093][ T5849] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 91.408784][ T5849] ? mutex_lock_nested+0x20/0x20 [ 91.413768][ T5849] ? unregister_oom_notifier+0x20/0x20 [ 91.419269][ T5849] mem_cgroup_out_of_memory+0x2c2/0x390 [ 91.424849][ T5849] ? try_charge_memcg+0xc91/0x17c0 [ 91.430018][ T5849] ? drain_local_stock+0x630/0x630 [ 91.435198][ T5849] ? do_raw_spin_unlock+0x121/0x230 [ 91.440432][ T5849] try_charge_memcg+0xca1/0x17c0 [ 91.445409][ T5849] ? __lock_acquire+0x7d80/0x7d80 [ 91.450487][ T5849] ? folio_flags+0x120/0x120 [ 91.455123][ T5849] ? percpu_ref_tryget+0x15/0x180 [ 91.460200][ T5849] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 91.465946][ T5849] ? __memcg_kmem_charge_page+0xeb/0x380 [ 91.471606][ T5849] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 91.477356][ T5849] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 91.483103][ T5849] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 91.488938][ T5849] __memcg_kmem_charge_page+0x224/0x380 [ 91.494513][ T5849] __alloc_pages+0x222/0x460 [ 91.499132][ T5849] ? lock_vma_under_rcu+0x249/0x660 [ 91.504363][ T5849] ? zone_statistics+0x170/0x170 [ 91.509347][ T5849] pte_alloc_one+0x84/0x540 [ 91.513894][ T5849] ? pfn_modify_allowed+0x560/0x560 [ 91.519133][ T5849] ? hugepage_vma_check+0x471/0x560 [ 91.524375][ T5849] handle_mm_fault+0x2f72/0x4a50 [ 91.529353][ T5849] ? handle_mm_fault+0xe6/0x4a50 [ 91.534332][ T5849] ? lock_vma_under_rcu+0x52c/0x660 [ 91.539653][ T5849] ? numa_migrate_prep+0x350/0x350 [ 91.544793][ T5849] ? lock_vma_under_rcu+0xe5/0x660 [ 91.549960][ T5849] ? do_user_addr_fault+0x1cb/0x12d0 [ 91.555280][ T5849] do_user_addr_fault+0xad2/0x12d0 [ 91.560429][ T5849] ? rcu_is_watching+0x15/0xb0 [ 91.565237][ T5849] exc_page_fault+0x64/0x100 [ 91.569865][ T5849] asm_exc_page_fault+0x26/0x30 [ 91.574762][ T5849] RIP: 0033:0x7f867ea72980 [ 91.579230][ T5849] Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 40 40 00 00 0f 85 1f fe ff ff e9 d3 fd ff ff 0f 1f 44 [ 91.598874][ T5849] RSP: 002b:00007ffd4668cc90 EFLAGS: 00010202 [ 91.604969][ T5849] RAX: 000000110c428000 RBX: ffffffff840ce95e RCX: 0000000000000003 [ 91.612971][ T5849] RDX: 000000000000095e RSI: 00000000000033a5 RDI: 0000000000000008 [ 91.621411][ T5849] RBP: 0000000000000000 R08: 00007f867ee10000 R09: 00007f867ee12000 [ 91.629413][ T5849] R10: 00000000840ce962 R11: 0000000000000009 R12: 00007f867ee26038 [ 91.637419][ T5849] R13: 00000000000287ca R14: ffffffff840cebe0 R15: 00007f867f955720 [ 91.645437][ T5849] ? lzo_scompress+0x80/0x180 [ 91.650166][ T5849] ? lzo_decompress+0x6e/0x170 [ 91.654982][ T5849] [ 91.675902][ T5849] memory: usage 4kB, limit 4kB, failcnt 19 [ 91.681875][ T5849] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 91.689450][ T5849] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 91.709597][ T5849] Memory cgroup stats for /syz1/syz_test: [ 91.710378][ T5849] cache 0 [ 91.727744][ T5849] rss 0 [ 91.734698][ T5849] rss_huge 0 [ 91.743328][ T5849] shmem 0 [ 91.748014][ T5849] mapped_file 0 [ 91.751667][ T5849] dirty 0 [ 91.754898][ T5849] writeback 0 [ 91.779552][ T5849] workingset_refault_anon 0 [ 91.804606][ T5849] workingset_refault_file 0 [ 91.811305][ T5849] swap 0 [ 91.814291][ T5849] pgpgin 0 [ 91.822244][ T5849] pgpgout 0 [ 91.827413][ T5849] pgfault 49 [ 91.830651][ T5849] pgmajfault 11 [ 91.834150][ T5849] inactive_anon 0 [ 91.839557][ T5849] active_anon 0 [ 91.843130][ T5849] inactive_file 0 [ 91.847330][ T5849] active_file 0 [ 91.850903][ T5849] unevictable 0 [ 91.854459][ T5849] hierarchical_memory_limit 4096 [ 91.861743][ T5849] hierarchical_memsw_limit 9223372036854771712 [ 91.868106][ T5849] total_cache 0 [ 91.871671][ T5849] total_rss 0 [ 91.900120][ T5849] total_rss_huge 0 [ 91.904330][ T5849] total_shmem 0 [ 91.908404][ T5849] total_mapped_file 0 [ 91.913047][ T5849] total_dirty 0 [ 91.919821][ T5849] total_writeback 0 [ 91.923708][ T5849] total_workingset_refault_anon 0 [ 91.929658][ T5849] total_workingset_refault_file 0 [ 91.934719][ T5849] total_swap 0 [ 91.938256][ T5849] total_pgpgin 0 [ 91.941842][ T5849] total_pgpgout 0 [ 91.946376][ T5849] total_pgfault 49 [ 91.950145][ T5849] total_pgmajfault 11 [ 91.954157][ T5849] total_inactive_anon 0 [ 91.958605][ T5849] total_active_anon 0 [ 91.964005][ T5849] total_inactive_file 0 [ 91.975137][ T5849] total_active_file 0 [ 91.979865][ T5849] total_unevictable 0 [ 91.983908][ T5849] anon_cost 0 [ 91.988151][ T5849] file_cost 0 [ 91.991536][ T5849] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz_test,mems_allowed=0-1,oom_memcg=/syz1/syz_test,task_memcg=/syz1/syz_test,task=syz.1.2,pid=5849,uid=0 [ 92.010526][ T5849] Memory cgroup out of memory: Killed process 5849 (syz.1.2) total-vm:104352kB, anon-rss:1440kB, file-rss:22784kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 92.121358][ T28] cfg80211: failed to load regulatory.db [ 92.133490][ T27] audit: type=1800 audit(1789433544.655:2): pid=5861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.7" name="features" dev="configfs" ino=7778 res=0 errno=0 [ 92.301932][ T5865] (null): rxe_set_mtu: Set mtu to 1024 [ 92.355516][ T5788] Bluetooth: hci2: command tx timeout [ 92.361034][ T5784] Bluetooth: hci3: command tx timeout [ 92.366649][ T51] Bluetooth: hci0: command tx timeout [ 92.445505][ T51] Bluetooth: hci1: command tx timeout [ 92.468520][ T28] usb 3-1: USB disconnect, device number 2 [ 92.529811][ T5865] infiniband syz0: set active [ 92.535167][ T5865] infiniband syz0: added veth0 [ 92.580334][ T1907] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 92.617271][ T5865] RDS/IB: syz0: added [ 92.623900][ T5865] smc: adding ib device syz0 with port count 1 [ 92.630565][ T5865] smc: ib device syz0 port 1 has pnetid [ 92.846776][ T1907] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 93.010813][ T5854] NFSD: attempt to initialize umh client tracking in a container ignored. [ 93.033936][ T5854] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 93.044171][ T5854] NFSD: Unable to initialize client recovery tracking! (-22) [ 93.058162][ T5854] NFSD: starting 90-second grace period (net f00003f0) [ 93.356282][ T1907] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 93.408103][ T5868] ceph: No mds server is up or the cluster is laggy [ 93.915204][ T1907] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 94.107124][ T1907] usb 3-1: New USB device found, idVendor=13d8, idProduct=0010, bcdDevice= 0.00 [ 94.119186][ T1907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.369883][ T1907] usb 3-1: Direct firmware load for usbduxfast_firmware.bin failed with error -2 [ 94.379646][ T1907] usb 3-1: Falling back to sysfs fallback for: usbduxfast_firmware.bin [ 94.655275][ T5875] NFSD: attempt to initialize umh client tracking in a container ignored. [ 94.664037][ T5875] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 94.673002][ T5875] NFSD: Unable to initialize client recovery tracking! (-22) [ 94.681274][ T5875] NFSD: starting 90-second grace period (net f00003f0) [ 94.815124][ T5816] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 94.910593][ T5817] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 94.924316][ T5817] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 95.027367][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.039791][ T5816] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 95.049701][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.060429][ T5816] usb 2-1: config 0 descriptor?? [ 95.145288][ T789] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 95.196316][ T5807] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 95.351196][ T789] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 95.360430][ T789] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.368598][ T789] usb 1-1: Product: syz [ 95.373260][ T789] usb 1-1: Manufacturer: syz [ 95.378310][ T789] usb 1-1: SerialNumber: syz [ 95.483719][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.493185][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.500474][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.507957][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.515210][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.522447][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.529865][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.537387][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.544625][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.553853][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.563977][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.574083][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.581496][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.593971][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.602573][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.615067][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.622288][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.634784][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.642053][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.654317][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.661603][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.670421][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.680181][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.687491][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.697400][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.704637][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.713370][ T5807] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 95.722399][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.730853][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.740296][ T5889] ceph: No mds server is up or the cluster is laggy [ 95.747044][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.766784][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.774020][ T5816] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 95.830156][ T5816] konepure 0003:1E7D:2DBE.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2dbe] on usb-dummy_hcd.1-1/input0 [ 96.112168][ T5902] nfs4: Bad value for 'source' [ 96.136648][ T789] usb 1-1: failed to set cport flags for port 0 [ 96.143141][ T789] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 96.164701][ T789] es2_ap_driver: probe of 1-1:1.0 failed with error -110 [ 96.547984][ T5817] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.692809][ T5906] loop0: detected capacity change from 0 to 32768 [ 96.722776][ T5906] loop1: detected capacity change from 0 to 65536 [ 96.737953][ T5817] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.762304][ T5817] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.789807][ T5817] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 96.806066][ T5817] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.822766][ T5817] usb 4-1: config 0 descriptor?? [ 96.843554][ T5786] usb 2-1: USB disconnect, device number 2 [ 96.852505][ T5908] device-mapper: ioctl: The device has no table. [ 97.076185][ T5779] usb 1-1: USB disconnect, device number 2 [ 97.243502][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.258389][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.266282][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.273470][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.281243][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.290120][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.297704][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.304859][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.312431][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.320224][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.327882][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.335589][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.342871][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.350290][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.357807][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.365220][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.372459][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.380060][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.387620][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.402261][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.409965][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.425051][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.432232][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.439852][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.447438][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.455461][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.462671][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.470312][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.477823][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.487054][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.495859][ T5817] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 97.510181][ T5817] konepure 0003:1E7D:2DBE.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2dbe] on usb-dummy_hcd.3-1/input0 [ 97.599815][ T5916] block2mtd: error: cannot open device /dev/ram0 [ 97.823633][ T5920] comedi comedi0: no supported board found! (req. bus/slot : 0/0) [ 97.969509][ T5924] md: array md0 already has disks! [ 97.976875][ T5924] md: could not open device unknown-block(1,0). [ 97.983361][ T5924] md: md_import_device returned -16 [ 97.990436][ T5924] md: invalid raid superblock magic on ram1 [ 97.996589][ T5924] md: ram1 does not have a valid v0.90 superblock, not importing! [ 98.005507][ T5924] md: md_import_device returned -22 [ 98.485060][ T5817] usb 4-1: USB disconnect, device number 2 [ 99.080923][ T5935] md: array md0 already has disks! [ 99.086916][ T5935] md: could not open device unknown-block(1,0). [ 99.093586][ T5935] md: md_import_device returned -16 [ 99.100738][ T5935] md: invalid raid superblock magic on ram1 [ 99.107674][ T5935] md: ram1 does not have a valid v0.90 superblock, not importing! [ 99.115673][ T5935] md: md_import_device returned -22 [ 99.195432][ T5922] NFSD: attempt to initialize umh client tracking in a container ignored. [ 99.204228][ T5922] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 99.213117][ T5922] NFSD: Unable to initialize client recovery tracking! (-22) [ 99.220869][ T5922] NFSD: starting 90-second grace period (net f00003f0) [ 100.586201][ T5932] NFSD: attempt to initialize umh client tracking in a container ignored. [ 100.595154][ T5932] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 100.603996][ T5932] NFSD: Unable to initialize client recovery tracking! (-22) [ 100.611698][ T5932] NFSD: starting 90-second grace period (net f0000569) [ 100.942000][ T5943] dwc3-of-simple: probe of pcspkr failed with error -22 [ 101.157844][ T5949] bond0: (slave bond_slave_0): Releasing backup interface [ 101.203761][ T5951] bond0: option slaves: interface -bond_slave does not exist! [ 101.220358][ T5949] bond0: option mode: unable to set because the bond device has slaves [ 101.233429][ T11] bond0: (slave bond_slave_1): interface is now down [ 101.251978][ T5949] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.293701][ T5953] null_blk: disk nullb1 created [ 101.311372][ T5953] nvmet: adding nsid 1 to subsystem testsubsys [ 101.366382][ T49] bond0: (slave bond_slave_1): interface is now down [ 101.394269][ T5953] nvmet: transport type 0 not supported [ 101.477326][ T5807] nvmet: connect request for invalid subsystem testsubsys! [ 101.487899][ T5955] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 101.605741][ T79] bond0: (slave bond_slave_0): interface is now down [ 101.613587][ T79] bond0: now running without any active interface! [ 101.726302][ T49] bond0: (slave bond_slave_0): link status definitely up [ 101.739926][ T49] bond0: active interface up! [ 101.879714][ T5963] PM: suspend entry (s2idle) [ 102.106671][ T5968] binder: 5965:5968 ioctl 80045017 200000000400 returned -22 [ 102.185215][ T5970] overlayfs: failed to resolve './file0': -2 [ 102.295619][ T5947] NFSD: attempt to initialize umh client tracking in a container ignored. [ 102.313575][ T49] bond0: (slave bond_slave_0): interface is now down [ 102.369371][ T5947] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 102.411652][ T49] bond0: now running without any active interface! [ 102.486727][ T5947] NFSD: Unable to initialize client recovery tracking! (-22) [ 102.575629][ T5947] NFSD: starting 90-second grace period (net f0000569) [ 103.062616][ T5963] Filesystems sync: 1.176 seconds [ 103.098610][ T5977] dyndbg: bad flag-op r, at start of resou [ 103.105414][ T5977] dyndbg: flags parse failed [ 103.146297][ T5963] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 103.168205][ T5963] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 103.198061][ T5963] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 103.220921][ T5963] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 103.246155][ T5963] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 103.275739][ T5963] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 103.286450][ T5963] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 103.294727][ T5963] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 103.304951][ T5963] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 103.314193][ T5963] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 103.322196][ T5963] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.334062][ T5963] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.386084][ T5807] nvmet: creating nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 103.422111][ T5983] nvme nvme0: creating 2 I/O queues. [ 103.444670][ T5983] nvme nvme0: new ctrl: "testsubsys" [ 103.723249][ T5993] bond0: (slave bond_slave_0): Releasing backup interface [ 103.745906][ T5993] bond0: option slaves: interface -bond_slave does not exist! [ 103.754487][ T5993] bond0: option mode: unable to set because the bond device has slaves [ 103.764645][ T59] bond0: (slave bond_slave_1): interface is now down [ 103.776498][ T5993] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.886270][ T42] bond0: (slave bond_slave_1): interface is now down [ 103.906998][ T5995] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 103.943722][ T5995] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 104.186111][ T59] bond0: (slave bond_slave_0): interface is now down [ 104.211808][ T59] bond0: now running without any active interface! [ 104.225454][ T6006] binder: 6003:6006 ioctl 80045017 200000000400 returned -22 [ 104.288498][ T6008] overlayfs: failed to resolve './file0': -2 [ 104.488737][ T5807] nvmet: creating nvm controller 2 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 104.800267][ T5999] nvme nvme1: creating 2 I/O queues. [ 104.985480][ T5999] nvme nvme1: new ctrl: "testsubsys" [ 105.142772][ T6013] dyndbg: bad flag-op r, at start of resource.c [ 105.149458][ T6013] dyndbg: flags parse failed [ 105.160601][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 105.216781][ T6014] block2mtd: error: cannot open device /dev/ram0 [ 105.236538][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 105.315320][ T51] Bluetooth: hci3: command 0x0c1a tx timeout [ 105.321505][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 105.557022][ T6024] bond0: (slave bond_slave_0): Releasing backup interface [ 105.613173][ T6027] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 105.622617][ T6028] bond0: option slaves: interface -bond_slave does not exist! [ 105.646279][ T6024] bond0: option mode: unable to set because the bond device has slaves [ 105.658052][ T11] bond0: (slave bond_slave_1): interface is now down [ 105.678171][ T6024] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.720051][ T9] nvmet: creating nvm controller 3 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 105.744473][ T6027] nvme nvme2: creating 2 I/O queues. [ 105.760846][ T6027] nvme nvme2: new ctrl: "testsubsys" [ 105.797439][ T42] bond0: (slave bond_slave_1): interface is now down [ 105.835491][ T6036] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 105.850920][ T6036] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 106.001873][ T6040] binder: 6037:6040 ioctl 80045017 200000000400 returned -22 [ 106.051738][ T2875] bond0: (slave bond_slave_0): interface is now down [ 106.070304][ T6042] overlayfs: failed to resolve './file0': -2 [ 106.133044][ T2875] bond0: now running without any active interface! [ 106.751837][ T12] bond0: (slave bond_slave_0): link status definitely up [ 106.798907][ T12] bond0: active interface up! [ 106.998964][ T5816] nvmet: creating nvm controller 4 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 107.018193][ T59] bond0: (slave bond_slave_0): interface is now down [ 107.032080][ T6051] dyndbg: bad flag-op r, at start of resource.c [ 107.046936][ T6046] nvme nvme3: creating 2 I/O queues. [ 107.052891][ T59] bond0: now running without any active interface! [ 107.068949][ T6046] nvme nvme3: new ctrl: "testsubsys" [ 107.070911][ T6051] dyndbg: flags parse failed [ 107.235801][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 107.315485][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 107.392635][ T6061] netlink: 40 bytes leftover after parsing attributes in process `syz.1.69'. [ 107.403416][ T5784] Bluetooth: hci3: command 0x0c1a tx timeout [ 107.409634][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 107.430569][ T6059] block2mtd: error: cannot open device /dev/ram0 [ 107.484340][ T6063] bond0: (slave bond_slave_0): Releasing backup interface [ 107.562516][ T6063] bond0: (slave bond_slave_1): Releasing backup interface [ 107.678412][ T6064] bond0: option mode: unable to set because the bond device is up [ 107.713195][ T6071] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 107.732869][ T6071] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 107.787509][ T6063] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.989840][ T6076] binder: 6074:6076 ioctl 80045017 200000000400 returned -22 [ 108.035044][ T49] bond0: (slave bond_slave_0): interface is now down [ 108.060166][ T6078] overlayfs: failed to resolve './file0': -2 [ 108.208602][ T49] bond0: now running without any active interface! [ 108.785825][ T6082] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 108.956864][ T5779] nvmet: creating nvm controller 5 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 108.976882][ T6082] nvme nvme4: creating 2 I/O queues. [ 108.984194][ T6082] nvme nvme4: new ctrl: "testsubsys" [ 108.989661][ T6088] dyndbg: bad flag-op r, at start of resource.c [ 108.989676][ T6088] dyndbg: flags parse failed [ 109.250789][ T6095] block2mtd: error: cannot open device /dev/ram0 [ 109.315371][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 109.395388][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 109.475416][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 109.482383][ T5784] Bluetooth: hci3: command 0x0c1a tx timeout [ 109.526676][ T6103] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 109.545154][ T5816] nvmet: creating nvm controller 6 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 109.564968][ T6100] nvme nvme5: creating 2 I/O queues. [ 109.579598][ T6103] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 109.603084][ T6100] nvme nvme5: new ctrl: "testsubsys" [ 109.672973][ T6107] bond0: (slave bond_slave_0): Releasing backup interface [ 109.723092][ T6111] bond0: (slave bond_slave_1): Releasing backup interface [ 109.752161][ T6107] bond0: option mode: unable to set because the bond device is up [ 109.767741][ T6107] bond0: ARP target 192.168.1.1 is already present [ 109.775394][ T6107] bond0: option arp_ip_target: invalid value (+192.168.1.1) [ 109.789661][ T6107] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.165433][ T49] bond0: (slave bond_slave_0): interface is now down [ 110.203827][ T49] bond0: now running without any active interface! [ 110.448835][ T6128] Bluetooth: MGMT ver 1.22 [ 110.449442][ T6129] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 110.519593][ T5779] nvmet: creating nvm controller 7 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 110.548948][ T6129] nvme nvme6: creating 2 I/O queues. [ 110.564883][ T6129] nvme nvme6: new ctrl: "testsubsys" [ 110.613530][ T6133] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 110.625473][ T6133] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 110.758629][ T6137] bond0: (slave bond_slave_0): Releasing backup interface [ 110.775184][ T49] bond0: (slave bond_slave_0): link status definitely up [ 110.790369][ T6137] bond0: (slave bond_slave_1): Releasing backup interface [ 110.812667][ T6137] bond0: option mode: unable to set because the bond device is up [ 110.822834][ T6137] bond0: ARP target 192.168.1.1 is already present [ 110.829927][ T6137] bond0: option arp_ip_target: invalid value (+192.168.1.1) [ 110.844611][ T6137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.903354][ T79] bond0: (slave bond_slave_0): link status definitely up [ 110.921417][ T79] bond0: active interface up! [ 110.991511][ T5816] nvmet: creating nvm controller 8 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 111.011529][ T6139] nvme nvme7: creating 2 I/O queues. [ 111.023349][ T6139] nvme nvme7: new ctrl: "testsubsys" [ 111.036743][ T11] bond0: (slave bond_slave_0): interface is now down [ 111.055743][ T11] bond0: now running without any active interface! [ 111.196741][ T79] bond0: (slave bond_slave_0): interface is now down [ 111.204103][ T79] bond0: now running without any active interface! [ 111.656400][ T1090] bond0: (slave bond_slave_0): link status definitely up [ 111.663973][ T1090] bond0: active interface up! [ 111.903693][ T6165] bond0: (slave bond_slave_0): Releasing backup interface [ 111.927389][ T11] bond0: (slave bond_slave_0): interface is now down [ 111.941936][ T11] bond0: now running without any active interface! [ 111.966691][ T6165] bond0: option slaves: invalid value (-bond_slave_1) [ 112.014788][ T6165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.095676][ T6167] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 112.178471][ T9] nvmet: creating nvm controller 9 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 112.203500][ T6167] nvme nvme8: creating 2 I/O queues. [ 112.212712][ T6167] nvme nvme8: new ctrl: "testsubsys" [ 112.386904][ T42] bond0: (slave bond_slave_0): interface is now down [ 112.396305][ T42] bond0: now running without any active interface! [ 112.515060][ T51] Bluetooth: hci3: command 0x0c1a tx timeout [ 112.758965][ T789] nvmet: creating nvm controller 10 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 112.781308][ T6178] nvme nvme9: creating 2 I/O queues. [ 112.789168][ T6178] nvme nvme9: new ctrl: "testsubsys" [ 112.946091][ T2875] bond0: (slave bond_slave_0): link status definitely up [ 112.954356][ T2875] bond0: active interface up! [ 113.186285][ T1090] bond0: (slave bond_slave_0): interface is now down [ 113.193541][ T1090] bond0: now running without any active interface! [ 113.555268][ T6173] NFSD: attempt to initialize umh client tracking in a container ignored. [ 113.564116][ T6173] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 113.574007][ T6173] NFSD: Unable to initialize client recovery tracking! (-22) [ 113.581866][ T6173] NFSD: starting 90-second grace period (net f0000569) [ 114.085520][ T6197] bond0: (slave bond_slave_0): Releasing backup interface [ 114.126274][ T6200] bond0: option slaves: invalid value (-bond_slave_1) [ 114.154176][ T6197] bond0: ARP target 192.168.1.1 is already present [ 114.163930][ T6197] bond0: option arp_ip_target: invalid value (+192.168.1.1) [ 114.181397][ T6197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 114.225260][ T789] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 114.326965][ T6208] dyndbg: bad flag-op r, at start of resource.c [ 114.333226][ T6208] dyndbg: flags parse failed [ 114.402496][ T6210] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 114.423735][ T789] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 114.445823][ T789] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 114.455914][ T789] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 114.468885][ T789] usb 4-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 114.478153][ T789] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 114.486305][ T789] usb 4-1: Product: syz [ 114.491223][ T789] usb 4-1: Manufacturer: syz [ 114.505701][ T6192] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 114.507718][ T2875] bond0: (slave bond_slave_0): interface is now down [ 114.527460][ T2875] bond0: now running without any active interface! [ 114.537904][ T6192] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 114.548922][ T5844] nvmet: creating nvm controller 11 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 114.564081][ T6192] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 114.573264][ T6210] nvme nvme10: creating 2 I/O queues. [ 114.587122][ T6210] nvme nvme10: new ctrl: "testsubsys" [ 115.096878][ T789] redrat3 4-1:1.0: Problem fetching firmware ID [ 115.158798][ T789] redrat3 4-1:1.0: Failed to read timeout from hardware [ 115.163452][ T8] nvmet: creating nvm controller 12 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:a9120102-dc66-4c03-9627-c306199a2ff7. [ 115.195308][ T1090] bond0: (slave bond_slave_0): link status definitely up [ 115.210408][ T1090] bond0: active interface up! [ 115.239569][ T6215] nvme nvme11: creating 2 I/O queues. [ 115.272802][ T6215] nvme nvme11: new ctrl: "testsubsys" [ 115.307489][ T2875] bond0: (slave bond_slave_0): link status definitely up [ 115.316912][ T2875] bond0: active interface up! [ 115.342164][ T789] rc_core: IR keymap rc-hauppauge not found [ 115.355045][ T789] Registered IR keymap rc-empty [ 115.368458][ T789] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/rc/rc0 [ 115.398820][ T789] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/rc/rc0/input5 [ 115.433361][ T789] redrat3 4-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 115.446297][ T789] redrat3 4-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 115.448581][ T1090] bond0: (slave bond_slave_0): interface is now down [ 115.465284][ T789] redrat3 4-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 115.478884][ T1090] bond0: now running without any active interface! [ 115.490562][ T789] redrat3: probe of 4-1:1.0 failed with error -5 [ 115.503691][ T789] usb 4-1: USB disconnect, device number 3 [ 115.522311][ T5139] ================================================================== [ 115.530426][ T5139] BUG: KASAN: slab-use-after-free in string+0x204/0x290 [ 115.537396][ T5139] Read of size 1 at addr ffff88807b835760 by task udevd/5139 [ 115.544790][ T5139] [ 115.547133][ T5139] CPU: 1 PID: 5139 Comm: udevd Not tainted syzkaller #0 [ 115.554092][ T5139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.564172][ T5139] Call Trace: [ 115.567474][ T5139] [ 115.570448][ T5139] dump_stack_lvl+0x18c/0x250 [ 115.575168][ T5139] ? __lock_acquire+0x7d80/0x7d80 [ 115.580220][ T5139] ? show_regs_print_info+0x20/0x20 [ 115.585432][ T5139] ? load_image+0x420/0x420 [ 115.589999][ T5139] ? __virt_addr_valid+0x10c/0x380 [ 115.595155][ T5139] ? __virt_addr_valid+0x10c/0x380 [ 115.597807][ T2910] bond0: (slave bond_slave_0): interface is now down [ 115.600289][ T5139] ? __virt_addr_valid+0x10c/0x380 [ 115.600319][ T5139] print_report+0xa8/0x210 [ 115.616570][ T5139] ? string+0x204/0x290 [ 115.620767][ T5139] kasan_report+0x117/0x150 [ 115.625301][ T5139] ? string+0x204/0x290 [ 115.629494][ T5139] string+0x204/0x290 [ 115.633545][ T5139] vsnprintf+0xf72/0x1ba0 [ 115.637895][ T5139] add_uevent_var+0x1d1/0x460 [ 115.642589][ T5139] ? vfs_read+0x486/0x990 [ 115.646943][ T5139] ? kobject_uevent_env+0x890/0x890 [ 115.652176][ T5139] rc_dev_uevent+0x15f/0x190 [ 115.656785][ T5139] dev_uevent+0x53a/0x7c0 [ 115.661135][ T5139] ? dev_uevent_name+0xa0/0xa0 [ 115.665933][ T5139] uevent_show+0x196/0x300 [ 115.670380][ T5139] dev_attr_show+0x54/0xc0 [ 115.674812][ T5139] sysfs_kf_seq_show+0x34d/0x4c0 [ 115.679772][ T5139] ? device_get_ownership+0xb0/0xb0 [ 115.685000][ T5139] seq_read_iter+0x464/0xc50 [ 115.689639][ T5139] ? common_file_perm+0x198/0x1f0 [ 115.694683][ T5139] vfs_read+0x486/0x990 [ 115.698874][ T5139] ? kernel_read+0x1e0/0x1e0 [ 115.703483][ T5139] ? __x64_sys_newfstat+0x1c4/0x250 [ 115.708691][ T5139] ? do_sys_openat2+0x170/0x1d0 [ 115.713557][ T5139] ? __fdget_pos+0x2ba/0x330 [ 115.718167][ T5139] ksys_read+0x151/0x260 [ 115.722431][ T5139] ? vfs_write+0x9a0/0x9a0 [ 115.726896][ T5139] ? lockdep_hardirqs_on+0x98/0x150 [ 115.732107][ T5139] do_syscall_64+0x55/0xb0 [ 115.736542][ T5139] ? clear_bhb_loop+0x40/0x90 [ 115.741234][ T5139] ? clear_bhb_loop+0x40/0x90 [ 115.745928][ T5139] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.751834][ T5139] RIP: 0033:0x7f61172a7407 [ 115.756271][ T5139] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 115.775888][ T5139] RSP: 002b:00007ffdc0dd72b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 115.784313][ T5139] RAX: ffffffffffffffda RBX: 00007f61179e3880 RCX: 00007f61172a7407 [ 115.792300][ T5139] RDX: 0000000000001000 RSI: 000055c04dc945b0 RDI: 000000000000000c [ 115.800295][ T5139] RBP: 00007f61173efff0 R08: 0000000000000000 R09: 0000000000000000 [ 115.808270][ T5139] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 115.816250][ T5139] R13: 00007f61173efea0 R14: 0000000000000000 R15: 000055c04dc36b60 [ 115.824231][ T5139] [ 115.827265][ T5139] [ 115.829609][ T5139] Allocated by task 789: [ 115.833868][ T5139] kasan_set_track+0x4e/0x70 [ 115.838482][ T5139] __kasan_kmalloc+0x8f/0xa0 [ 115.843080][ T5139] redrat3_dev_probe+0x3f9/0x23d0 [ 115.848140][ T5139] usb_probe_interface+0x6eb/0xcf0 [ 115.853255][ T5139] really_probe+0x247/0xae0 [ 115.857786][ T5139] __driver_probe_device+0x1f5/0x390 [ 115.863083][ T5139] driver_probe_device+0x4f/0x420 [ 115.868119][ T5139] __device_attach_driver+0x2ca/0x510 [ 115.873499][ T5139] bus_for_each_drv+0x252/0x2e0 [ 115.878361][ T5139] __device_attach+0x2c1/0x420 [ 115.883130][ T5139] bus_probe_device+0x180/0x260 [ 115.888000][ T5139] device_add+0x87c/0xc40 [ 115.892366][ T5139] usb_set_configuration+0x1ad0/0x2150 [ 115.897851][ T5139] usb_generic_driver_probe+0x8d/0x150 [ 115.903323][ T5139] usb_probe_device+0x12a/0x260 [ 115.908181][ T5139] really_probe+0x247/0xae0 [ 115.912695][ T5139] __driver_probe_device+0x1f5/0x390 [ 115.917981][ T5139] driver_probe_device+0x4f/0x420 [ 115.923020][ T5139] __device_attach_driver+0x2ca/0x510 [ 115.928436][ T5139] bus_for_each_drv+0x252/0x2e0 [ 115.933303][ T5139] __device_attach+0x2c1/0x420 [ 115.938070][ T5139] bus_probe_device+0x180/0x260 [ 115.942948][ T5139] device_add+0x87c/0xc40 [ 115.947285][ T5139] usb_new_device+0x995/0x1550 [ 115.952063][ T5139] hub_event+0x29d5/0x4a80 [ 115.956498][ T5139] process_scheduled_works+0xa60/0x1600 [ 115.962057][ T5139] worker_thread+0xa5e/0xfe0 [ 115.966661][ T5139] kthread+0x2fa/0x390 [ 115.970740][ T5139] ret_from_fork+0x48/0x80 [ 115.975175][ T5139] ret_from_fork_asm+0x11/0x20 [ 115.979953][ T5139] [ 115.982299][ T5139] Freed by task 789: [ 115.986204][ T5139] kasan_set_track+0x4e/0x70 [ 115.990818][ T5139] kasan_save_free_info+0x28/0x40 [ 115.995856][ T5139] ____kasan_slab_free+0x126/0x1f0 [ 116.000988][ T5139] slab_free_freelist_hook+0x130/0x1a0 [ 116.006471][ T5139] __kmem_cache_free+0xba/0x1f0 [ 116.011342][ T5139] redrat3_dev_probe+0x1b73/0x23d0 [ 116.016488][ T5139] usb_probe_interface+0x6eb/0xcf0 [ 116.021613][ T5139] really_probe+0x247/0xae0 [ 116.026133][ T5139] __driver_probe_device+0x1f5/0x390 [ 116.031437][ T5139] driver_probe_device+0x4f/0x420 [ 116.036559][ T5139] __device_attach_driver+0x2ca/0x510 [ 116.041995][ T5139] bus_for_each_drv+0x252/0x2e0 [ 116.046888][ T5139] __device_attach+0x2c1/0x420 [ 116.051749][ T5139] bus_probe_device+0x180/0x260 [ 116.056625][ T5139] device_add+0x87c/0xc40 [ 116.060988][ T5139] usb_set_configuration+0x1ad0/0x2150 [ 116.066483][ T5139] usb_generic_driver_probe+0x8d/0x150 [ 116.071954][ T5139] usb_probe_device+0x12a/0x260 [ 116.076803][ T5139] really_probe+0x247/0xae0 [ 116.081307][ T5139] __driver_probe_device+0x1f5/0x390 [ 116.086595][ T5139] driver_probe_device+0x4f/0x420 [ 116.091638][ T5139] __device_attach_driver+0x2ca/0x510 [ 116.097024][ T5139] bus_for_each_drv+0x252/0x2e0 [ 116.101902][ T5139] __device_attach+0x2c1/0x420 [ 116.106681][ T5139] bus_probe_device+0x180/0x260 [ 116.111550][ T5139] device_add+0x87c/0xc40 [ 116.115912][ T5139] usb_new_device+0x995/0x1550 [ 116.120683][ T5139] hub_event+0x29d5/0x4a80 [ 116.125119][ T5139] process_scheduled_works+0xa60/0x1600 [ 116.130689][ T5139] worker_thread+0xa5e/0xfe0 [ 116.135290][ T5139] kthread+0x2fa/0x390 [ 116.139401][ T5139] ret_from_fork+0x48/0x80 [ 116.143834][ T5139] ret_from_fork_asm+0x11/0x20 [ 116.148614][ T5139] [ 116.150963][ T5139] The buggy address belongs to the object at ffff88807b835000 [ 116.150963][ T5139] which belongs to the cache kmalloc-2k of size 2048 [ 116.165029][ T5139] The buggy address is located 1888 bytes inside of [ 116.165029][ T5139] freed 2048-byte region [ffff88807b835000, ffff88807b835800) [ 116.179098][ T5139] [ 116.181440][ T5139] The buggy address belongs to the physical page: [ 116.187867][ T5139] page:ffffea0001ee0c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b830 [ 116.198029][ T5139] head:ffffea0001ee0c00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 116.206964][ T5139] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 116.215390][ T5139] page_type: 0xffffffff() [ 116.219740][ T5139] raw: 00fff00000000840 ffff888017c42000 0000000000000000 0000000000000001 [ 116.228334][ T5139] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 116.236930][ T5139] page dumped because: kasan: bad access detected [ 116.243358][ T5139] page_owner tracks the page as allocated [ 116.249082][ T5139] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5773, tgid 5773 (syz-executor), ts 90103138964, free_ts 89943326292 [ 116.271243][ T5139] post_alloc_hook+0x1c1/0x200 [ 116.276035][ T5139] get_page_from_freelist+0x2181/0x22a0 [ 116.281596][ T5139] __alloc_pages+0x1f0/0x460 [ 116.286198][ T5139] alloc_slab_page+0x5d/0x180 [ 116.290908][ T5139] new_slab+0x87/0x2d0 [ 116.294995][ T5139] ___slab_alloc+0xc5c/0x12f0 [ 116.299692][ T5139] __kmem_cache_alloc_node+0x11f/0x250 [ 116.305175][ T5139] __kmalloc_node_track_caller+0xa4/0x230 [ 116.310915][ T5139] kmalloc_reserve+0x116/0x240 [ 116.315698][ T5139] pskb_expand_head+0x17a/0x1150 [ 116.320658][ T5139] netlink_trim+0x180/0x220 [ 116.325179][ T5139] netlink_broadcast_filtered+0x6d/0x1130 [ 116.330922][ T5139] nlmsg_notify+0xe3/0x1a0 [ 116.335372][ T5139] __dev_notify_flags+0xf3/0x310 [ 116.340340][ T5139] dev_change_flags+0xde/0x1a0 [ 116.345121][ T5139] do_setlink+0xb69/0x3f40 [ 116.349571][ T5139] page last free stack trace: [ 116.354249][ T5139] free_unref_page_prepare+0x7d7/0x8f0 [ 116.359721][ T5139] free_unref_page+0x32/0x2e0 [ 116.364411][ T5139] __unfreeze_partials+0x1cf/0x210 [ 116.369537][ T5139] put_cpu_partial+0x17c/0x250 [ 116.374314][ T5139] __slab_free+0x319/0x400 [ 116.378743][ T5139] qlist_free_all+0x75/0xd0 [ 116.383292][ T5139] kasan_quarantine_reduce+0x143/0x160 [ 116.388779][ T5139] __kasan_slab_alloc+0x22/0x80 [ 116.393659][ T5139] slab_post_alloc_hook+0x6a/0x4d0 [ 116.398789][ T5139] kmem_cache_alloc+0x17e/0x2c0 [ 116.403683][ T5139] getname_flags+0xbb/0x500 [ 116.408198][ T5139] do_sys_openat2+0xda/0x1d0 [ 116.412806][ T5139] __x64_sys_openat+0x139/0x160 [ 116.417672][ T5139] do_syscall_64+0x55/0xb0 [ 116.422116][ T5139] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 116.428022][ T5139] [ 116.430349][ T5139] Memory state around the buggy address: [ 116.435985][ T5139] ffff88807b835600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.444055][ T5139] ffff88807b835680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.452121][ T5139] >ffff88807b835700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.460200][ T5139] ^ [ 116.467408][ T5139] ffff88807b835780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.475474][ T5139] ffff88807b835800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 116.483638][ T5139] ================================================================== [ 116.506716][ T2910] bond0: now running without any active interface! [ 116.580949][ T5139] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 116.588196][ T5139] CPU: 1 PID: 5139 Comm: udevd Not tainted syzkaller #0 [ 116.595125][ T5139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 116.605182][ T5139] Call Trace: [ 116.608458][ T5139] [ 116.611383][ T5139] dump_stack_lvl+0x18c/0x250 [ 116.616058][ T5139] ? show_regs_print_info+0x20/0x20 [ 116.621341][ T5139] ? load_image+0x420/0x420 [ 116.625863][ T5139] panic+0x2ca/0x720 [ 116.629779][ T5139] ? bpf_jit_dump+0xd0/0xd0 [ 116.634289][ T5139] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 116.640279][ T5139] ? _raw_spin_unlock+0x40/0x40 [ 116.645146][ T5139] ? print_memory_metadata+0x314/0x400 [ 116.650624][ T5139] ? string+0x204/0x290 [ 116.654778][ T5139] check_panic_on_warn+0x84/0xa0 [ 116.659725][ T5139] ? string+0x204/0x290 [ 116.663888][ T5139] end_report+0x6f/0x130 [ 116.668148][ T5139] kasan_report+0x128/0x150 [ 116.672659][ T5139] ? string+0x204/0x290 [ 116.676836][ T5139] string+0x204/0x290 [ 116.680858][ T5139] vsnprintf+0xf72/0x1ba0 [ 116.685234][ T5139] add_uevent_var+0x1d1/0x460 [ 116.689954][ T5139] ? vfs_read+0x486/0x990 [ 116.694333][ T5139] ? kobject_uevent_env+0x890/0x890 [ 116.699574][ T5139] rc_dev_uevent+0x15f/0x190 [ 116.704194][ T5139] dev_uevent+0x53a/0x7c0 [ 116.708538][ T5139] ? dev_uevent_name+0xa0/0xa0 [ 116.713352][ T5139] uevent_show+0x196/0x300 [ 116.717831][ T5139] dev_attr_show+0x54/0xc0 [ 116.722266][ T5139] sysfs_kf_seq_show+0x34d/0x4c0 [ 116.727216][ T5139] ? device_get_ownership+0xb0/0xb0 [ 116.732456][ T5139] seq_read_iter+0x464/0xc50 [ 116.737071][ T5139] ? common_file_perm+0x198/0x1f0 [ 116.742114][ T5139] vfs_read+0x486/0x990 [ 116.746321][ T5139] ? kernel_read+0x1e0/0x1e0 [ 116.750932][ T5139] ? __x64_sys_newfstat+0x1c4/0x250 [ 116.756146][ T5139] ? do_sys_openat2+0x170/0x1d0 [ 116.761015][ T5139] ? __fdget_pos+0x2ba/0x330 [ 116.765644][ T5139] ksys_read+0x151/0x260 [ 116.769920][ T5139] ? vfs_write+0x9a0/0x9a0 [ 116.774356][ T5139] ? lockdep_hardirqs_on+0x98/0x150 [ 116.779571][ T5139] do_syscall_64+0x55/0xb0 [ 116.784025][ T5139] ? clear_bhb_loop+0x40/0x90 [ 116.788743][ T5139] ? clear_bhb_loop+0x40/0x90 [ 116.793459][ T5139] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 116.799363][ T5139] RIP: 0033:0x7f61172a7407 [ 116.803779][ T5139] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 116.823395][ T5139] RSP: 002b:00007ffdc0dd72b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 116.831826][ T5139] RAX: ffffffffffffffda RBX: 00007f61179e3880 RCX: 00007f61172a7407 [ 116.839826][ T5139] RDX: 0000000000001000 RSI: 000055c04dc945b0 RDI: 000000000000000c [ 116.847829][ T5139] RBP: 00007f61173efff0 R08: 0000000000000000 R09: 0000000000000000 [ 116.855823][ T5139] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 116.863789][ T5139] R13: 00007f61173efea0 R14: 0000000000000000 R15: 000055c04dc36b60 [ 116.871774][ T5139] [ 116.875421][ T5139] Kernel Offset: disabled [ 116.879748][ T5139] Rebooting in 86400 seconds..