last executing test programs: 8.740443423s ago: executing program 1 (id=1716): creat$auto(&(0x7f0000000080)='./file0\x00', 0x6) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) openat$auto_ecryptfs_miscdev_fops_miscdev(0xffffffffffffff9c, &(0x7f000000e680), 0x68182, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) mmap$auto(0x37, 0xda93, 0xdf, 0xeb1, 0x401, 0x8000) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_kmsg_fops_printk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) lseek$auto(0x3, 0x7fffffffffffffff, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) readv$auto(0x3, 0x0, 0x1) socket(0x10, 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xc, 0x0, 0x4) r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x123002, 0x0) write$auto(r1, &(0x7f0000000500)='odev/\xdf\x00\x00\x00\x00H\xde\xe1\xcf\x8ch:\x11\xeah\xf4\xcc\xc6\xa6\xd9\xc3Y\xcb\xf4v6u\\\xd7hD\xfcw\xdb\x05\x11\x96ZP\x81\x87d\xa1#98\xcc\x9d\xc8\x8d\xf6\xdd\x11v(\xb0>$\x96-\xdf\x85(\xa0cq\xc5q\xa4\xad\xae\r\xb5\x8d\x81\xc6?\xd4\x7f\xd3\x1a\xe9\':\xe4\xebd\x97\x8bW^r\xe0\xc8\x85\x03\x04L:\x06\xb6\xe5\x91M\x82\xfeKM\xe0y\xd0\xd5\xb2\xfa\x1do\xa4 \xf6\xdaB\xef\xa6\x1a\x9f\xb6\\\xeb\xa9\x7f\xb3*\xaa9I\x8c,\xefD\x90\x97L!A\xbe\xd13\xc99\x8fF\xc8t\x9c\x06\x90\xb8 \xdc\x9f\x9d\xcaqc4\x10\xc5\xdd\x8c\xe7f{\\D\x86\x10\xe3%n\xbci,:\x8a#', 0x80000000) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) execve$auto(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) execve$auto(&(0x7f0000000040)='./file0\x00', &(0x7f00000004c0)=&(0x7f0000000340)='#\xdc\xfe\xd8E\xc8\x8bu4\xd9n\xcb\xca\xc7zw \x96\x9ejh\xad\x9eEc\xae\x1e\x89\x92\x9a\xbbP[B\xae\x9cf)\x15\xac\x90)l\x06\xf0\t\x12\x05zz\xa6\xb3\xce=\x00\x00\x00\x00\x00/\xc4T\x1f\xe5P\xff\xb4\xb7s0\x02\xc5\x81\x93\xc6\xc8\xb6Sp\x1a{8\xfc\xe0,X\xc7BU\xd0\x97\x7f1\x16\x99\x04\xabu/a(\x02\x7f\xbb\xbd\x906\xa8\xce\xee\xcd\xd7\t\x00\xfb\x83\xc8\x8aO\xe9\xbe=\xf7\xf4\x84,\x06\xd3j\x99b\xe6\xf6Y3A\xbb\xa4\xb2\f\x1b\xc3\x8a,g\xc6\xe8[\xdf\x88\x01\x9f7\xb5\x19m\xd8L\x84j\x8c\xec\xdf\x1a\xbd\xc5\x94\xb9\xb7\xd5\xa4\xc0\f-6\xfe\xa8\xed/u\x81_G\xfeR\xbb\x12\x16\xb8*\xa9\xc9\xe81\x9d\x06\xbbC\x17\xbb\xe6|\x97\xabB4J\xed+-\xf8u0/n\xcf\x8b\x95\x9d\xab\xa8\xc47\xa6\x0e\xdeOq\\\xc3\'{\b\xd3m\x94\xc2\xdd{\xeaO\x0e\xe4\xe0\xb9N:\xd60\x17,\x06\xc7B#Y0\x99\xeb\x874\xab?\xc8\x82\xe5\x8f\xb7\x91\xc2\xbe\xb2\x02\xfe\xd3k\xd5\xdcZ\xdcP\x8e+\xd8\xc7C\xcb\x15\x13c\xbf\xe8\xbd\"\x8f3\"\x14\xf8(\xda\x19\xcd\xec\x03.\xd9^\xc3A\xda\r[\x1a\xda\\#/\xd4\xaf\xd0\xe8\xa2\xdd\xc5{\xfa\xe0\x90\x8f\x99lQ\xec\x84h^\x11+\x93\b\xe0c\xe6\xd22\xf9\xa5', 0x0) ioctl$auto_SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) ioctl$auto(0xc8, 0x800454e1, 0x5c8d) 5.433995621s ago: executing program 3 (id=1729): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/sunrpc/parameters/udp_slot_table_entries\x00', 0x80302, 0x0) sendfile$auto(r0, r0, 0x0, 0x2001) shmctl$auto_SHM_LOCK(0xa4f2, 0xb, &(0x7f0000001240)={{0x80000001, 0xee01, 0xee00, 0x5, 0x0, 0x1, 0x3}, 0x2, 0x8, 0x7, 0x7202, @inferred=0x0, @inferred, 0xfcc, 0x0, &(0x7f0000000180)="d59de99d22f95bb46d5b8e4e7c203c3e36481e7c6b8da970398f6186064d4d3ee932b2917c9439be983340d77931e26323ddc4fca25da0f6c25d2002618c84b70c94e9a3f842ae75e1c04132ef3598dcb1db88516c624514ead01dbcba7eabe78618b2bf39a58d4ae4e1624d7b8e4cc7f3ee058a37b7e27c10b6141067fa", 0x0}) sendmsg$auto_IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x80) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0xffffffffffffffff, 0x8000) r2 = socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) shutdown$auto(0x200000003, 0x400002) ioctl$auto_TIOCSETD2(0xffffffffffffffff, 0x5423, 0x0) read$auto_proc_environ_operations_base(0xffffffffffffffff, 0x0, 0x0) mprotect$auto(0x1000, 0x401000, 0x4) r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) sendmsg$auto_NETDEV_CMD_BIND_RX(0xffffffffffffffff, 0x0, 0x4) r4 = open(&(0x7f0000000000)='./file0\x00', 0x4242, 0xe1d2b27bdc14aab4) writev$auto(r4, &(0x7f0000000180)={0x0, 0x1}, 0x7) ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) madvise$auto(0x0, 0x2000040080000004, 0xe) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) getsockopt$auto_SO_KEEPALIVE(r2, 0x6, 0x9, &(0x7f0000000100)='/sys/module/sunrpc/parameters/udp_slot_table_entries\x00', &(0x7f0000000140)=0x4) r6 = mq_open$auto(0x0, 0x7e, 0x9, 0x0) pidfd_open$auto(r1, 0x5) pwrite64$auto(0xc8, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x88\xa8s\x1cJ\x99\x8a>c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0xe, 0x3) sendmsg$auto_NFC_CMD_GET_TARGET(r6, 0x0, 0x20000001) read$auto(r5, 0x0, 0x8) 4.986136881s ago: executing program 1 (id=1730): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) r0 = openat$auto_ht40allow_map_ops_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/ieee80211/phy1/ht40allow_map\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) tee$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x5, 0x8) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/neigh/vlan1/base_reachable_time\x00', 0x0, 0x0) read$auto(r2, 0x0, 0x1ff) writev$auto(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x7}, 0x3) r3 = openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/buffer_subbuf_size_kb\x00', 0x101502, 0x0) write$auto(r3, 0x0, 0x5) r4 = socket(0x10, 0x2, 0x0) r5 = fcntl$auto_F_DUPFD(r4, 0x0, r4) r6 = syz_genetlink_get_family_id$auto_net_dm(&(0x7f0000000180), r4) mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000) r7 = openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000040), 0x481, 0x0) pwrite64$auto(r7, 0x0, 0x400000, 0xc) sendmsg$auto_NET_DM_CMD_CONFIG(r5, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYRES16=r4], 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmsg$auto_NET_DM_CMD_START(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r6, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@NET_DM_ATTR_TRUNC_LEN={0x8, 0x9, 0x298c}, @NET_DM_ATTR_QUEUE_LEN={0x8, 0xb, 0x8}, @NET_DM_ATTR_SW_DROPS={0x4}, @NET_DM_ATTR_SW_DROPS={0x4}, @NET_DM_ATTR_UNSPEC={0x10, 0x0, "998431a9373a1ab4c6bfde55"}, @NET_DM_ATTR_ALERT_MODE={0x5, 0x1, 0xf}, @NET_DM_ATTR_SW_DROPS={0x4}]}, 0x48}}, 0x4000000) close_range$auto(r0, r0, 0x6) socket(0x2, 0x80002, 0x73) r8 = io_uring_setup$auto(0x406, 0x0) ioctl$auto_VHOST_SET_VRING_ENDIAN(r8, 0x4008af13, &(0x7f0000000000)={0x4}) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/uid_map\x00', 0x2240, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x100000009b72, 0x2, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptya1\x00', 0x20080, 0x0) io_uring_setup$auto(0x1000, 0x0) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 4.852647445s ago: executing program 3 (id=1731): write$auto(0x3, 0x0, 0xfdef) 4.594481043s ago: executing program 3 (id=1732): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x801, 0x0) connect$auto(0x3, &(0x7f00000000c0)=@vsock={0x28, 0x0, 0x2711}, 0x51) ioctl$auto(0x3, 0x541b, 0xffffffffffffffff) mmap$auto(0x0, 0x101, 0x2, 0xeb1, 0x200000401, 0x8000) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$auto(0x4, 0x400, r1, 0x2, 0x8e1) r2 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) waitid$auto_P_PGID(0x2, 0x0, 0x0, 0x6, 0x0) mremap$auto(0x200000000000, 0x40000000004, 0xf5, 0x3, 0xfffffffd) openat$auto_nsim_udp_tunnels_info_reset_fops_udp_tunnels(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/netdevsim/netdevsim7/ports/1/udp_ports_reset\x00', 0x400100, 0x0) fcntl$auto_F_SETSIG(r2, 0xa, 0x7) 4.251513148s ago: executing program 1 (id=1733): close_range$auto(0x2, 0x8, 0x0) setregid$auto(0xffffffffffffffff, 0xfffe) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/smt/active\x00', 0x2e40, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000ac0)=""/4107, 0x100b) r1 = ioctl$auto_TUNGETIFF2(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)=0x5) r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) setreuid$auto(0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000500)={'netdevsim0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001e00)={0x24, r4, 0x1, 0x70bd31, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x24}}, 0x24048084) openat$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/ieee80211/phy6/netdev:wlan1/stations/08:02:11:00:00:00/rc_stats_csv\x00', 0x2000, 0x0) r7 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card0\x00', 0x129800, 0x0) ioctl$auto(r7, 0x9210640a, 0xffffffffffffffff) r8 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_udc.0/udc/dummy_udc.0/soft_connect\x00', 0xc2481, 0x0) write$auto(r8, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) read$auto_proc_pid_maps_operations_internal(0xffffffffffffffff, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) seccomp$auto_SECCOMP_SET_MODE_FILTER(0x1, 0x8, &(0x7f0000000080)="c20c") mprotect$auto(0x110c238000, 0x1, 0x3) madvise$auto(0x110c230000, 0x8031ca, 0x9) close_range$auto(0x2, 0xa, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x102, 0x0) r9 = openat$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/ieee80211/phy6/netdev:wlan1/stations/08:02:11:00:00:00/rc_stats_csv\x00', 0x400000, 0x0) read$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(r9, &(0x7f0000000180)=""/202, 0xca) sendmsg$auto_ETHTOOL_MSG_MM_SET(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r2, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_MM_VERIFY_TIME={0x8, 0x9, 0x10001}, @ETHTOOL_A_MM_VERIFY_TIME={0x8, 0x9, 0x7}, @ETHTOOL_A_MM_TX_MIN_FRAG_SIZE={0x8, 0x5, 0x7}, @ETHTOOL_A_MM_TX_ENABLED={0x5}, @ETHTOOL_A_MM_TX_ENABLED={0x5}, @ETHTOOL_A_MM_TX_ENABLED={0x5, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x4) clone3$auto(0x0, 0x0) mmap$auto(0x1, 0x4020009, 0xdf, 0x16, 0x401, 0x8000) 3.589247931s ago: executing program 0 (id=1735): socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000000)=0x4803d7e3) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000040)=0x9) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000080)=0x9) socketcall$auto_SYS_CONNECT(0x3, &(0x7f00000000c0)=0x4) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000100)=0x27) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000140)=0xffffffffffffbf42) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000180)=0xb) socketcall$auto_SYS_CONNECT(0x3, &(0x7f00000001c0)=0xb9e) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000200)=0xb) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000240)=0x5) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000280)=0x5) socketcall$auto_SYS_CONNECT(0x3, &(0x7f00000002c0)=0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = ioctl$auto_TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000340)=0x5) r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/security/tomoyo/version\x00', 0x48000, 0x0) shmctl$auto_IPC_RMID(0x6, 0x0, &(0x7f00000005c0)={{0x8, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x4, 0x2, 0xc21}, 0x2, 0xbe2a, 0x8, 0x8f4, @raw=0x1, @inferred=0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)="f40e7d59087b6b287fbaaa7d0f8f6b4f25038b87fd4f8df8505d671c9199936a137c04141c9843ab4c29dc5367a9acefbc5887bbb33059df9d4e03e931e62ab160f4f9973c3a9bb60efdf08017abd8f82fb90ef928ca88abcc0390090e93df716da113ce22517fbb355f6bbd5fbd14a9532b7d398a12e303d50006433b2c95e9a8eb473f673d8a89964d4dde4ee4135d8f856f70c8ab60de16d8ef8306fe7ba9393c09246c52eb2d5a536318e4ff74c4e18ebf4f0204afbaaa542ffa8ce140c3649355884e96", &(0x7f00000004c0)="ec760aa0031a3078f9196799a249870b50183db9a913cabccdc490cfa1530eb64540fa27c74ddafebcde59e0e96fdd89279e6154b8312642fb818f4bcf8bd647e786f04ebf79435beb1452035bd10954c2ef455bbd9e72c8da17ed653fb93cfece18e3e478f4d69801f63a23f942181793e6ef60cd96a8091257d15feedf4d72dd42becd89a225d050da1d726150bdb045ca26dc2d44229231ed9950ef9dd8544c528b9a0b9223d7d5f73bd693d4c14ec7897539a2108178dcf64f46ee971a12c999630a22cd6f462251215e8708fe9bdf6357d384cfb6fc513e219702f11228"}) sendmsg$auto_NL80211_CMD_SET_CHANNEL(r0, &(0x7f0000000c40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000640)={0x5c0, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL80211_ATTR_FILS_ERP_USERNAME={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_MLO_LINKS={0x598, 0x138, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, {0x4}, {0x150, 0x0, 0x0, 0x1, [@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_AUTH_DATA={0x89, 0x9c, "86c4527ff36749aad9f275872ca5ec5b56505ab50c4cfbe69ee3a1394aa6965d08f4213bd0376566d41b7eef1a707150d8bff3633d9b14485f5c2daad1aa82a50506ebdf70c353a6749257cc30f5889632fba75e627c74e2470b0b595007736d25d4f206b621adcbcd4fd8d12508ed03b561dada4b7f296fef3a36583d8f6c7cb141bd3215"}, @NL80211_ATTR_HT_CAPABILITY={0xb9, 0x1f, "1a0ec5d44d51a7fd2efdb5da043168f4d7cf6bdaa522e88b468572e5937ea93e9d69439f87ed9ddfd95285f5b5c559ad73b160397e5aa3ab56edbe6bb279dd2396e3a284821b9db6742b0f4f8c79a15c597e5be5b9da0d5fc0786e3d52f7205187c15f0f27ace86ad61f204ce0e87a5f391a48e0f0dd2ea350af362a7303726666eb697578623fad5e40295debb01d78b10deacf9f5478754bae9e3e0020e7c5d837f42a0f4fdb7aff8473fafb7ca51ee4f73246da"}]}, {0x2a4, 0x0, 0x0, 0x1, [@NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x9}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x64}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0xff}, @NL80211_ATTR_NAN_FUNC={0x285, 0xf0, 0x0, 0x1, [@typed={0x8, 0xa3, 0x0, 0x0, @fd=r2}, @nested={0x75, 0x36, 0x0, 0x1, [@generic="3863a5c86b7a85786dc2bc4c5bde563d3ab1d65a3d7cf72d55832e180881e8b4532a359c20550cec22207d04ac119f69af71884613a48d887466aab800397651ce5a1a42f6d75ede2f6d713580f25e597ea5f450c27155b569dfdfdf01a114fca51cc1e5a3bf21ae4a", @typed={0x4, 0xce}, @nested={0x4, 0x12a}]}, @generic="54188f67a4d295203d26cee24c1f1e43c0ef062354164deb99b40d2532775dd01a4a8ca3f582653b29190830bd4942bad2e882cc7e5b1deb5ae13f5efd4739ae5052cd5ad0859a05182e74c9ff2bbd6676f2274bc5a82ecb8585990c10bcba7118424decc8e37d0a66a5820c024ab459a9a1a8005d2f1934453b2dc1607b1976219478955c1f902c8b0a195ac346b56ef658ee47033db9baaf931e6549d64835c8f053ecfa879fd500f503ecf92631f51024336587eceae9d9e077804afdcb18e0e25bf9be6c8bccbe110329acf16da303bbc3dc7d215c0f59aa25b8b6492520438501c88de89a6f8bb0408fe25c8bf1e9dab8bc", @generic="c7867c5b633d0597e3be1ee42580d4e79ac683792eff5d229a78d7332c1d18fea46fca9f703fa59e792879c91483148ebc29ecac2d77b938bddf42f6750dcca1858709018390f7638a9ac3c5b170cf0b5315cde5b1c46333a223c8b50c072ec5c36304de9242b139a8361647a0c11156cc0985a681d2e9f3ae9b27922966c867f0056221272be741e6a084015f187310db1f5f1761197c2ce6bdb8127e3bfaed15c66295beeb84d04d40f1c4e06882c858b5d802a0d513572d7abf98fb99cd89de83f1795e85e25f83c4518dfe411f1dddb73e1448", @nested={0x35, 0x15e, 0x0, 0x1, [@typed={0x8, 0x7, 0x0, 0x0, @uid=r3}, @generic="63ea1fdc8d26cc6a5e3e3673c22f4619f1f1c84b7762803faaa8bf1b91904accc494b1d3474d2fff9c"]}]}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_MLO_TTLM_DLINK={0x35, 0x148, "9de355942e9b2e330899ac1b5088e25da0942ed422f7383b1016f19b7669c8338589052e1711e7d135e04ba22be1df6272"}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS={0x6, 0x143, 0xa1}]}, {0x88, 0x0, 0x0, 0x1, [@NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_FILS_ERP_REALM={0x7c, 0xfa, "78e59d110085b04217dfebbad59bf7da1e238595a2647fb7146ac40982db7e5a9b691adfce3326eecc793d6aef48356c98934896bc7597a07d9628b1b46e1c349ffc3753d90c586ed67f0e78a3dcdce24e003ed063b102764876b860cd8395f14c7ed03a1ce85e9823be0d98d0e46e7e5dc8e6b55f374962"}]}, {0xbc, 0x0, 0x0, 0x1, [@NL80211_ATTR_BSSID={0xa3, 0xf5, "9604fdeeffdfa587a0bea9f3d27f44ef6c1c6e01d68a458415abae0356be253375afdcf13b85d7b896e9f5237ac8b6027ec93f975cd3927cfa2d84b1a12caeb1d2e92575f53448ceee82373bdc37b0d5f7805ac56bcde34033595d129dc811f944dff7b42f767c52aa08ae956fbe67d92341612d05f818e9d263cd403e7ff60f0705d755282efcc05ad3193d30fe4f76a17b6be06e201fa1078a1b29532901"}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x3}, @NL80211_ATTR_STA_WME={0xc, 0x81, 0x0, 0x1, [@NL80211_STA_WME_MAX_SP={0x5}]}]}]}, @NL80211_ATTR_MLO_LINK_ID={0x5, 0x139, 0xc}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x5c0}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000c80)=0x10001) recvfrom$auto(r0, &(0x7f0000000cc0)="4aaf56d303d7bfac11b2a0f0f9d44eaf27e73adfe931b7721d7e085b748e3fd481d3a1f44e2933e296e301bccb626bb4f06ea4574eaf0fb825232d6b56c6d13a7844847298fa40c9a84a7fb253bdead79a4ee5bac3010cd656cf56129bf2c6b29bc19fa70c25f5fa6b2251a2c6c0cbd227ec0d8de8f375efa2e795d58df6b33f015f7618faef34913914adaba94ad6", 0x5, 0x6, &(0x7f0000000d80)=@llc={0x1a, 0x17, 0x4, 0x8, 0x9, 0x5}, &(0x7f0000000dc0)) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000e00)=0x6) r4 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000e40)='/sys/kernel/tracing/trace_clock\x00', 0x50801, 0x0) bpf$auto_BPF_MAP_LOOKUP_BATCH(0x18, &(0x7f0000000e80)=@bpf_attr_0={0x8, 0xc1, 0x8000000, 0x8000, 0x6, r2, 0x6, "5ff7a849feb23e3f1e7a72a8e8905fde", 0x0, r1, 0x7ff, 0x7, 0x3, 0x81, r4, r2}, 0x3) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000f40)=0x5) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000f80)=0x3) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000000fc0)=0x180000) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000001000)=0x4) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000001040)=0x8) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000001080)=0x9) setsockopt$auto(r1, 0xd629, 0x7f, &(0x7f00000010c0)='/sys/kernel/tracing/trace_clock\x00', 0x7) socketcall$auto_SYS_CONNECT(0x3, &(0x7f0000001100)=0x4) 3.435419158s ago: executing program 1 (id=1736): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) r0 = openat$auto_ht40allow_map_ops_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/ieee80211/phy1/ht40allow_map\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x2, 0x0) r3 = fcntl$auto_F_DUPFD(r2, 0x0, r2) r4 = syz_genetlink_get_family_id$auto_net_dm(&(0x7f0000000180), r2) mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000) r5 = openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000040), 0x481, 0x0) pwrite64$auto(r5, 0x0, 0x400000, 0xc) sendmsg$auto_NET_DM_CMD_CONFIG(r3, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYRES16=r2], 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmsg$auto_NET_DM_CMD_START(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r4, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@NET_DM_ATTR_TRUNC_LEN={0x8, 0x9, 0x298c}, @NET_DM_ATTR_QUEUE_LEN={0x8, 0xb, 0x8}, @NET_DM_ATTR_SW_DROPS={0x4}, @NET_DM_ATTR_SW_DROPS={0x4}, @NET_DM_ATTR_UNSPEC={0x10, 0x0, "998431a9373a1ab4c6bfde55"}, @NET_DM_ATTR_ALERT_MODE={0x5, 0x1, 0xf}, @NET_DM_ATTR_SW_DROPS={0x4}]}, 0x48}}, 0x4000000) close_range$auto(r0, r0, 0x6) socket(0x2, 0x80002, 0x73) r6 = io_uring_setup$auto(0x406, 0x0) ioctl$auto_VHOST_SET_VRING_ENDIAN(r6, 0x4008af13, &(0x7f0000000000)={0x4}) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/uid_map\x00', 0x2240, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x100000009b72, 0x2, 0x8000) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptya1\x00', 0x20080, 0x0) r8 = io_uring_setup$auto(0x1000, 0x0) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0) io_uring_setup$auto(0x6, 0x0) ioctl$auto_SNDCTL_TMR_CONTINUE(r7, 0x5408, 0x0) ioctl$auto_SOUND_MIXER_READ_RECSRC(r6, 0x80044dff, &(0x7f0000000040)="f2c1f5a71d56f101b6d18d001ed3fa061991f6f2ea58464935edb5a91c9aee9004674d0477d60f766af95871cf12cc7a95514f6e8c839f80cd092ddfd2858111d7464b3f41f14fcf80ebd023a40a910d6fb9ef8cbf97299b08945798b6fd71ffd0ebbdf2ed8506591d6f027a74d9e93041c3") sendmmsg$auto(r8, &(0x7f0000001700)={{&(0x7f0000000240)="ffaac663fd0d9f", 0x5, &(0x7f0000000340)={&(0x7f00000002c0)='w2h3', 0x6}, 0x6, &(0x7f0000000700)="50b9736bc83ee833ce99112f7705e0c8e29ea1125112b1e9402802a35a1730a73672db0d9eacaad2e8a59c69ed368b15c816e33240a7618016ec0e251c4f3d9bec90cb20bba7d6534be002e4278a4ea2b49291a51ff4b214410d714fbe36069bb21dad33402a2078e69eae30c63e7a9b26c14e539faa4cd9a1657567cc4e75e033b2ff61687dd702e7038488480262a1114a5d318def4f30bd27b09d7b7794d1033e826c9e132822b377f9b9b53c230ed42309ba2fe1336d5c4ce9e1ea1444494d56480ea8bbd451db9cbe1c40e58a5dc3c7852ecaaebcb164de2fdaec18c00aa9ded3b97e5dbf582e8f8648a65d0b97b6ad2042d5ab39c2ce51de92d22ffb8e0c8e08eabbc69afc22e92dce690b10dc61dde97ff0ea2c19103216e3cad9032603a3460ebe802779ac63d1a167f67208544e380054ea97bfb49a19ce92cc889af1da2022f84c84dcb1a7848ae5c8a0193c74add7b950a9036906b396de2eadb6876ed6dcdabf4dfd9f0531c69faa646ecc4e436c4172684fc11d95847c60183279093642241e1d04f25c087a9e39b04736ee9befdc5d266ec81156da1128f457168767733ce74bcaa6c0a078d345c4c5ebbe7dfe545435bc107db5f9cdf388c9b4300a724b404b295b4d9ed306286ca7ec625ac14d3f91e06d5625f95685f6bb3b5eb4202a07c701b26a74b35f3b71ed06e1ffe9381143f371bb70da40549624e2a96040db978773888b1a9054e3d3475ce45afeb61dccbb1384235297bf0365b329a9ec42b2d4448438e069edc6f7109ba8518e6b6ff64704fe33a0b54943391053f9fe6451f837964a6d329912478c11244354ceed098b36d0ac0e0e6817f1d3b0e07616a183789c7b352a9cbff79055298027ef8ba98d26a2a88cded0529be1a85ce218ec4550f55e8683ba0876e1495d3c77ea869f34f0018225cadcd49dd7020f5797b3b1714fcaf67d655fcba8eaa82c8767effc8dd718105eafdae076e298f1be2875cd1b5abeae7c38488fae8a0284aa1c981aed8ed1b46a217b089f5aebc4c23f254278e3f2df6dfcb8270805988f410f7a3884296307f02bf30d752b894d9efc6033f76b6a74251664636b47ec6390220e05e4c0726d04a5982d219ea4f203ba8a6fa757d1a16337221dc62c3858749aff643922b313cc81aed0a0ef6e61d0eb2bc725d68b46d9fdc0e1f9e73195cfaa9d14c68875dd406294a1531b1a0ffe1a68e92c74649f161a1f4479cebd2fd06042bb94aab25e00039fe5fb339c373fa8160555f0f843108250d9a6ea19a9b0ccb0acf9eb0e2d185043a267bc6a8035c46f6250dc748b67ee6bf6111185d9c8a740b71b780261d4ac12165216c1840647b5ec9c9209dfaf091348adc52604333190c48f38f0432add517b09b8c145a8c83a9c0d4a974c53a3d2c23f8ef5daa11f66930b893acdf195f0103d906d0ccc285b44de45c9dbdb35efb9f834a987a2f3311c4474216442199f2d179c525eaed16d3761315e45732d11401984f86640424b6bdcfe7ccbf7e92edd5825e058827c610116a397677207f39bd782ef5899e12e1f39e04766872e94e5c3a24872706632119d51a306312435dbfe377519c51be623fcb097b736d51e85f7a378a9728335863fcd8b1c4cc6fbb081a3852aa3ae9f5e0a532498f959c68ae9f9e4170d02c4e742445841c62b97d0b48c00be4e22cefa992188839ad0055cc9c1f1fbef6a2bb95496ad2cfd94a3a26b7c97e97392f042133e3b95bd7f5baf295521081d1f76e1baedbf73fe335333c466f4392f2e686e8c0eccbd1630786f9a419e4d7255d1d7e2d57fb732506099fbe5bdf573bb25e81cf755288ab516659b902667b017c04d7603229d9c8ba84db81a20fd7b46eb5bc632e6c967ee35b19a0448baa66585c44fcedee9c7b01037e3f1b42268fcb4e52a79ab8792661468c660d08d54f915268aa4556c7ceb91002caf05d8947f6b16d110bea8abca51567aa22a79d3508b8e7bcd52fbef59f3e4b130fbed4372e76ea8f3e0579dfa979b9fef045515ce76c435959afe96ba3abf711b8fb3c2ab168b70b72199a35acdeaebcf9cfed9b70bfa6efec09e9eba147f2b87f0c25c3125c06407f5ad309d799ed607b3d6918a9745330b824b180d58019942fed1d5cecb6fccc91ad8c341d6bbef2fe72afe9e91b94b019a34ab822689801f1a66f5b20cec4fe43754634566b3b0bd6ac43c28a8c17a25d604319efdc32bc294599841dc508567464d7bee06b1057a5fc8c5b5e3f8a55d7e3a6d39b1744090dfeada0cf9904d899ccf7fb7c14ec751fd814ac341932af45586bd821f0d9d70e872818616599aab0898851b18a99c7f0eb4a902b7cd482f5531d5bd0a6ada73096abc1fbc688cf7984ae41d364b0992897e69a573fe11405a535f91956e1d8e489e3744edb0a57cfc212c2b9ffd61ba8d001af4bdb4dc13bd53bdd836cb2261e8611ac0db07ab06b5f774bc3f0c22a330624591b8658def2341742b4dfb415b31578531e8a19858a47ba4de9742fb7e5a0cd49ab60eb4250ae0045b128b48efed354ccc992adad4853504b1dff04a721b0ad1206c6083fd1134e807e8d22f47a6de562d6bbc00b6bb93848d4d27194ccbb2790f22973d45da4480cf21cb18fab48ff62e246f07711a956ae5a84bb5dede513face4dc66cd41ce20df51bd338446713d70ac5d8a801ce03bd3e8bb9dc3d7988a41d38d5cbc49a5232e69d1c3bc7c89fb955d7dff2ff9bd200a6ea56f232eb0d041e30b366ae060fbf454193dbeb4f27b1d8b9e78bdc7edb974fa5cceee1c9d984c6a7854fbe8780cbe2bccad6792227f860a8ec49bbb691d0e2fb06e4cdabcb2a54e56d5fd02a45067a1f13c1e9074d42dff61586d47c13c0cc7ecea46b14725fbf51d3732563a36df9e085e8a311cb8eb2526c6d5bead3bd145fe5ae4eec7ec57c607299b7323ef19300a773b35783cf6e1d06879ab42d262a5bedae31e3869ee729fc78201d3a0dd8ee76a181ea080447fef60581d9e86578b11faff24b22d88e76f70a1a5c617906e296bd044d3044b9834c19d22a5138793017a9e48839ae631268361844e7e3997137d321c70d9669159f4a30ac5932adf6f4b2385423ede8e02db7e6966f6d17fae364f0d08bdcad23195d2396017bc421b6b3a40ffb5bcb0b692cd43846fd98197ccb7619d23afa604235d936e942567c84cbb1b3c24365353be1acd912628790a2477b797db6e0ddb4d6e47e6c286b3ab83c69cf919482b11a1b3c1a652d27ae57b33e5e88b13ac9b9933538266d5dd00c3ec8b4b10759f023a84287c85719c686042460888c75f710edf92e7e02e2553ada89e7b09f45b6ebf8bba206d1f5de71a0c3aa36951900bf76bfea6b238208a66c525f23a365333146a3921f999e2d301e835717ec7b2c143f5d6aa77f681b99c87db16f471ac1c31d3d20bacfc59c249217d9eb006a232dc3ff409dbcc61b16048e49580fbfdcf9ecfe88a94b4f6f86a00b27c70634e9573f613d44b9f1d358c14a14cb4a1a638fed6a15a3f697a76a0b1ac7d6f611a3b36afad7f5858941e5aa44febdff73c03c16d02b79cfef72b85c94417d281b45282b7d7ee9b95cde82e522888d8be7a44452ece42db17a0f06a37b81717a4e7a3ce68a07a1a4c2f49d397d07e35f58b009682ac604192a28a67550e0ad21b04639df6ed468bb5220ab43afef8aed61d346f1083e24f821f62713e1c72a80955b4dc064cf72c340c482ecb53609f5f6fc73d4da6348550417e1597e1ddde5f5d1909d31774f33f973cb7efb021c945cfdc5cb619c6c3a700f8f4d1ff170dd5411595dd15a56d52ba34a66759e68d22a56ab4de1295e769b4cbc97ee865daffeb5e27bc6e6ee21fc6f0f88fb2e00458d2be3619bc2b65bac98806d1e8a6984dd567d6217cb5e1d36af415e8354664a1889e9cbbfd2cb8ef6b125177152852705031a7cb3296e27c6d424f0b0c83f560848fd0ec1ecebf1b4303383b5ae552abef10177f8ee6ff1e330c2baa376ed4c85a797112ed10539ce4fb003435f32ddcfaaf5d2af04185a95aee4683923341256fc37d6b87136e04c046826cd2da67bcb26ba3b7f74669022da3280e3836bbd41bf6679dad9fc9a619887b13b4de734bfa09fb91d00c0a6250046aa0e3f2537d61989d32509de68fa7f77ffdf838e928b6ddbbef9efaf5e8fbaea1924d090c694401a050fd82c4cb39d540e00ac2381d2d9dd5b284c5ce07f41a90ee71239c2d3300c861dd6808c4f3c7d92d0030a7b71916b40dc33321e6736610e1e8dc17456a063aa92c28b13a95b4169287e54c06d365dd91c4d8f819a0cb5a350d95245040ef008f56c74bd874d74301877de644f5f886e4c0696edd50d018d9880f86f8e4eee7b9d9ce4f7a94d3bed728a7cfee0390281f914568e8bb3ea0501f14eb69dfbc1c5fe28c3f7cd5e0b88a9a64b4f678f27a545923a93cedee98abf4aa98e201f89a71fad25d0af298dbe0264fdaa278ea5f0818c8ebf8f0ed204b91ead4ff4b918ba7f2119eacedb85a79aab60e58e1ff8e8a78db52089a5c327ef6a70e075d26ee3fd2ed7c154a6cedbd05f512611d2008ed4729b7d11467a19341aa21a7e46bea7ce60a150f8509b172cc5083f9463dd3dfd6d1a89f01aab7894eca76769376ccced387db22df67380ff9f5b2585bffe3504e9a7a6c6e3c1b6f781408f2708843ef27ab42ace46a4a439be79410ae68ab6ffe39e611c96c67f5e28cd5b9032c11420f2523376656a2007f215d5c60bb10636ebba1ba6faabcf31d8c48588ca04c254c4935d4fa0cb6b57872853c9a86884ff6c409adbf24ebc40e90c5388649de9923193eec402529f390465688f218782857f9f190171e42124efa17351ce9fc4c196c64d0f4f121553fbfc6cfaea9bb7ce978baf99b333becacecdb7d1b5f6a169ee7df124f1dc804585d63c17200dde5853cf0aab8737b25f4c0ca2e5885bdb68c11d0d1598f7b5672b4f51cb0e0fdbb88f06d6613f0a9956420cde492e46f247cbc614f9681a8afc137f32c544f666ac9c86fd6d180f98518055ef65afb4fe1d31365b441af1c2631b032368f463ac8b5f5b336c67558bc673715c81076c989d706fed9d9a29967268943efcfb83ad576310c969d76388add9667c7639b643c8c20f5376e853c43d86a931cbd693110fe4463d6a05542c34a9dc2c52b9b16df16419d7d8503257341f5d5bb300c2d9f0291f68fbd58feb203173f3a77d9d252f7a7738663d5f56bb91ee81bc644098d928254200e944141692b28a68ccb099e0829f58fda53bed65161e2536f96b4c43a4723cd01e8c8bcaff14064b90c72d7b8e247e3429353a175cf634218b78ed57e7809c1be7adb0d4047b441ad3c88efcc279d5b1e6d6a544b7378afe4216fe8ffcfc5fbacc8ff9f57d03f5053428e385845ddba43be3efe7a2b667c1662e9970a8ae5791be3425dd0535816a27ac221d2ca04393f78e7250cea315c05e456a05a7fa5ff84902ce8329c00d7659c860e5c5254ebfdd686317f8fefc2c747ebb3d6068d64738af4b558e15d03a5015959bc40f14840eb99ddaadfad712dd70a1418fd5266eaecf807ff16aed8e8424f3dc526c85ce55f597ed461739ff5873d410d9861e3301fc813f7027675bb126a55d7c8574f2cc44abab3ee67c32d141bff6312d6b4b4c617cd67169a699c4e2fd7dd793463f22bdb58030579327d3135cad1aa735e0185a6a29b8c047f2c1404a742e348feb2e0cf1bcc071763ea69b871678721388e5a5a", 0x7, 0x5}, 0x2}, 0x5, 0x5) getrandom$auto(0x0, 0x6000000, 0x3) 3.34046298s ago: executing program 3 (id=1737): madvise$auto(0x0, 0xffffffffffff0001, 0x15) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sg0\x00', 0x8001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0xffffffffffffffff, 0x20009, 0x804000000000df, 0xeb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vbi4\x00', 0x222a02, 0x0) write$auto(0xffffffffffffffff, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400004, 0xdf, 0x11, 0xffffffffffffffff, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/workqueue/cpumask\x00', 0x2, 0x0) write$auto(r1, &(0x7f0000000180)='1\x00\\\xa0\x04|\x9d$\xdcM)\xb9\xdd\xd6', 0x5) syz_genetlink_get_family_id$auto_nl80211(0x0, r0) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x0, 0x7, 0x2, 0x0, 0x6, 0x3) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x1000, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x1, 0x8, 0xbff, 0x29, 0x2c, 0x2, 0x2}) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) ioctl$auto_SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, &(0x7f0000000080)) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D0\x00', 0x8001, 0x0) msgctl$auto(0x2, 0x1, &(0x7f0000000200)={{0xb2, 0x0, 0xffffffffffffffff, 0x10000, 0x1, 0x1, 0x44}, &(0x7f0000000180)=0xf5, &(0x7f00000001c0)=0x3, 0x2, 0xe7, 0xa2, 0x6, 0xfffffffffffffff9, 0x0, 0xb69, 0xb, @raw=0x6, @raw=0x7}) keyctl$auto(0x1f, 0x1, 0x6, r2, 0x403) mlockall$auto(0x800000000000005) r3 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r3, &(0x7f00000002c0)=""/190, 0xfffffe39) epoll_create$auto(0x4) 3.049517856s ago: executing program 2 (id=1738): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) shmctl$auto_SHM_LOCK(0xa4f2, 0xb, &(0x7f0000001240)={{0x80000001, 0xee01, 0xee00, 0x5, 0x0, 0x1, 0x8}, 0x2, 0x8, 0x7, 0x7202, @inferred, @inferred, 0xfcc, 0x0, &(0x7f0000000180)="d59de99d22f95bb46d5b8e4e7c203c3e36481e7c6b8da970398f6186064d4d3ee932b2917c9439be983340d77931e26323ddc4fca25da0f6c25d2002618c84b70c94e9a3f842ae75e1c04132ef3598dcb1db88516c624514ead01dbcba7eabe78618b2bf39a58d4ae4e1624d7b8e4cc7f3ee058a37b7e27c10b6141067fa", 0x0}) sendmsg$auto_IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x80) socket(0x2, 0x3, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x9, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) mmap$auto(0x0, 0xe983, 0x6, 0xeb1, 0xffffffffffffffff, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) io_submit$auto(0x2, 0xfffffffffffff096, &(0x7f0000000040)=&(0x7f0000000000)={0x2, 0xb, 0x8, 0x3, 0x2, 0x3b, 0xfffffffffffffc00, 0x2, 0x1001, 0x0, 0x6}) writev$auto(0xc8, 0x0, 0x4000000000000009) mmap$auto(0x0, 0x477, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0x22, 0x0, 0x1) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40000, 0x0) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), r0) mmap$auto(0x0, 0x400008, 0x36, 0x1009b72, 0x2, 0x8000) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_TIOCSETD2(0xffffffffffffffff, 0x5423, 0x0) read$auto_proc_environ_operations_base(0xffffffffffffffff, 0x0, 0x0) mprotect$auto(0x1000, 0x401000, 0x4) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) sendmsg$auto_NETDEV_CMD_BIND_RX(0xffffffffffffffff, 0x0, 0x4) r2 = open(&(0x7f0000000000)='./file0\x00', 0x4242, 0xe1d2b27bdc14aab4) writev$auto(r2, &(0x7f0000000180)={0x0, 0x1}, 0x7) ioctl$auto_KVM_CREATE_VM(r1, 0xae01, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) madvise$auto(0x0, 0x2000040080000004, 0xe) 2.896037666s ago: executing program 3 (id=1739): write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) mmap$auto(0x0, 0x8001, 0xdf, 0x100000009b72, 0x2, 0x8000) unshare$auto(0x40000080) openat$auto_proc_timens_offsets_operations_base(0xffffffffffffff9c, &(0x7f0000000080), 0x1c7001, 0x0) sendmsg$auto_NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x40000) r0 = socket(0x0, 0x1, 0x5) setsockopt$auto(0x3, 0x1, 0x3c, 0x0, 0x1) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(0xffffffffffffffff, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x4020009, 0x2, 0xeb1, 0x401, 0x8000) r2 = memfd_create$auto(0x0, 0x4) statx$auto(r2, 0x0, 0x1000, 0xbdfc, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x0) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0x9, 0xb5, 0x2010, 0xb, 0x4, 0xffffffffffffffff, 0xa, "2af051b26b658a20d8dc6b36c83ce63f", 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x7, 0x6}, 0x10) bpf$auto(0x1a, &(0x7f0000000380)=@link_create={@prog_fd, @target_ifindex, 0x3, 0x40081, @uprobe_multi={0x81, 0x1ff, 0x8, 0x0, 0x1, 0x4}}, 0x81) listen$auto(0x3, 0x81) r3 = bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_11={0x21, 0x7, 0x9, 0x4, 0x301, 0x6b, 0x9ddb, 0xe98e}, 0x6f4) sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, "f9530755b7029f3fa5c0404364c0a9046b94db4e930b895815b58f885465cd0c9334426d7715fb236e5ea75795f6d7772511be9b7eb408ee955b"}, 0x50}, 0x1, 0x0, 0x0, 0x2040000}, 0x8090) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x19) read$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000280)=""/120, 0x78) r4 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/pagemap\x00', 0x201, 0x0) ioctl$auto_PAGEMAP_SCAN(r4, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x1, 0xfffffffffffffffe, 0x5, 0x7, 0xbfb, 0x9, 0x400, 0x4, 0x2}) pread64$auto(0xffffffffffffffff, 0x0, 0x80000000, 0x9fffffffd) mmap$auto(0x0, 0x400008, 0xdf, 0x10000009b72, r1, 0x800000005) mseal$auto(0x3, 0x7dda, 0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0) remap_file_pages$auto(0x5, 0x0, 0x401, 0x3ff, 0x3) 2.552804467s ago: executing program 0 (id=1740): write$auto(0x3, 0x0, 0xfdef) 2.339992266s ago: executing program 0 (id=1741): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/card0/pcm0p/sub4/status\x00', 0x8040, 0x0) read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000100)=""/184, 0xb8) 2.244262659s ago: executing program 0 (id=1742): openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sg0\x00', 0x8001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0xffffffffffffffff, 0x20009, 0x804000000000df, 0xeb1, 0x401, 0x8000) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vbi4\x00', 0x222a02, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400004, 0xdf, 0x11, 0xffffffffffffffff, 0x8000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/workqueue/cpumask\x00', 0x2, 0x0) write$auto(r2, &(0x7f0000000180)='1\x00\\\xa0\x04|\x9d$\xdcM)\xb9\xdd\xd6', 0x5) syz_genetlink_get_family_id$auto_nl80211(0x0, r1) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x0, 0x7, 0x2, 0x0, 0x6, 0x3) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x1000, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x1, 0x8, 0xbff, 0x29, 0x2c, 0x2, 0x2}) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) ioctl$auto_SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, &(0x7f0000000080)) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D0\x00', 0x8001, 0x0) msgctl$auto(0x2, 0x1, &(0x7f0000000200)={{0xb2, 0x0, 0xffffffffffffffff, 0x10000, 0x1, 0x1, 0x44}, &(0x7f0000000180)=0xf5, &(0x7f00000001c0)=0x3, 0x2, 0xe7, 0xa2, 0x6, 0xfffffffffffffff9, 0x0, 0xb69, 0xb, @raw=0x6, @raw=0x7}) keyctl$auto(0x1f, 0x1, 0x6, r3, 0x403) mlockall$auto(0x800000000000005) msync$auto(0x1ffff000, 0x1800000ff000000, 0x400000004) r4 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r4, &(0x7f00000002c0)=""/190, 0xfffffe39) openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000000)='/dev/usbmon33\x00', 0x121200, 0x0) r5 = epoll_create$auto(0x4) epoll_pwait$auto(r5, 0x0, 0x800, 0x4d, 0x0, 0x8) close_range$auto(0x2, 0x8, 0x0) 2.043975191s ago: executing program 1 (id=1743): ioctl$auto_TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, &(0x7f0000000040)=0xfffffffb) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) r0 = socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x400c000) r1 = bpf$auto(0x1, &(0x7f0000000000)=@link_detach={r0}, 0x10000) mmap$auto(0x0, 0x20400008, 0x2400000000000, 0x9b72, r1, 0x8000) socket(0x10, 0x2, 0x0) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/midi2\x00', 0x3, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$auto_percpu_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$auto(0x20, 0x400108, 0x3, 0x9b72, 0xffffffffffffffff, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r2 = io_uring_setup$auto(0x406, 0x0) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, r2, 0x0) getrandom$auto(0x0, 0x6000000, 0x3) io_uring_enter$auto(0x3, 0xa84, 0x80000001, 0xa, 0x0, 0x46) io_uring_enter$auto(r2, 0x7, 0x7ffffffb, 0x3, 0x0, 0x3) move_pages$auto(0x0, 0xa, 0x0, 0x0, 0x0, 0x2) io_uring_enter$auto(0x3, 0x8, 0x4000001, 0x4, 0x0, 0x2) mmap$auto(0x0, 0x20009, 0x5, 0xeb2, 0x8, 0x1008000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800) socket(0x10, 0x2, 0x0) sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="01002cbd7000fbdbdf250a"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x20008810) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000) 1.990508166s ago: executing program 2 (id=1744): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) capset$auto(&(0x7f0000000180)={0x19980330}, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/nbd4/queue/scheduler\x00', 0xc2082, 0x0) sendfile$auto(r0, 0x3, 0x0, 0x400000000006) r1 = open(&(0x7f0000000000)='./file0\x00', 0x4242, 0xe1d2b27bdc14aabc) setsockopt$auto(0x3, 0x10000000084, 0x7d, 0x0, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) pipe2$auto(0x0, 0x80) keyctl$auto(0x200000000000020, 0xffffffffffffffff, 0x5, 0x5, 0x3) r2 = socket(0x10, 0x3, 0x6) sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="010028bd7000ffdbdf25050000000c00010003000000000000000c00010003000000000000000c00010001000000000000000c00010004000000000000000c0001007300000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x44048020}, 0x4000000) keyctl$auto(0x1000020, 0xffffffffffffffff, 0x5, 0x5, 0x8) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000) sendfile$auto(0x1, 0xffffffffffffffff, 0x0, 0x8fb5) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0x1, 0x2, 0x8) mmap$auto(0x0, 0x4020009, 0xdf, 0xebd, 0x401, 0x8000) prctl$auto(0x7ecf, 0x1, 0xffffffffffffffff, 0x7, 0x10) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x201, 0x0) ioctl$auto_TIOCSTI2(r3, 0x5412, &(0x7f0000000840)="13") connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) fallocate$auto(r1, 0x0, 0x7, 0x4cbd5d) 1.8349897s ago: executing program 3 (id=1745): creat$auto(&(0x7f0000000080)='./file0\x00', 0x6) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) openat$auto_ecryptfs_miscdev_fops_miscdev(0xffffffffffffff9c, &(0x7f000000e680), 0x68182, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) mmap$auto(0x37, 0xda93, 0xdf, 0xeb1, 0x401, 0x8000) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_kmsg_fops_printk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) lseek$auto(0x3, 0x7fffffffffffffff, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) readv$auto(0x3, 0x0, 0x1) socket(0x10, 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xc, 0x0, 0x4) r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x123002, 0x0) write$auto(r1, &(0x7f0000000500)='odev/\xdf\x00\x00\x00\x00H\xde\xe1\xcf\x8ch:\x11\xeah\xf4\xcc\xc6\xa6\xd9\xc3Y\xcb\xf4v6u\\\xd7hD\xfcw\xdb\x05\x11\x96ZP\x81\x87d\xa1#98\xcc\x9d\xc8\x8d\xf6\xdd\x11v(\xb0>$\x96-\xdf\x85(\xa0cq\xc5q\xa4\xad\xae\r\xb5\x8d\x81\xc6?\xd4\x7f\xd3\x1a\xe9\':\xe4\xebd\x97\x8bW^r\xe0\xc8\x85\x03\x04L:\x06\xb6\xe5\x91M\x82\xfeKM\xe0y\xd0\xd5\xb2\xfa\x1do\xa4 \xf6\xdaB\xef\xa6\x1a\x9f\xb6\\\xeb\xa9\x7f\xb3*\xaa9I\x8c,\xefD\x90\x97L!A\xbe\xd13\xc99\x8fF\xc8t\x9c\x06\x90\xb8 \xdc\x9f\x9d\xcaqc4\x10\xc5\xdd\x8c\xe7f{\\D\x86\x10\xe3%n\xbci,:\x8a#', 0x80000000) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) execve$auto(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) execve$auto(&(0x7f0000000040)='./file0\x00', &(0x7f00000004c0)=&(0x7f0000000340)='#\xdc\xfe\xd8E\xc8\x8bu4\xd9n\xcb\xca\xc7zw \x96\x9ejh\xad\x9eEc\xae\x1e\x89\x92\x9a\xbbP[B\xae\x9cf)\x15\xac\x90)l\x06\xf0\t\x12\x05zz\xa6\xb3\xce=\x00\x00\x00\x00\x00/\xc4T\x1f\xe5P\xff\xb4\xb7s0\x02\xc5\x81\x93\xc6\xc8\xb6Sp\x1a{8\xfc\xe0,X\xc7BU\xd0\x97\x7f1\x16\x99\x04\xabu/a(\x02\x7f\xbb\xbd\x906\xa8\xce\xee\xcd\xd7\t\x00\xfb\x83\xc8\x8aO\xe9\xbe=\xf7\xf4\x84,\x06\xd3j\x99b\xe6\xf6Y3A\xbb\xa4\xb2\f\x1b\xc3\x8a,g\xc6\xe8[\xdf\x88\x01\x9f7\xb5\x19m\xd8L\x84j\x8c\xec\xdf\x1a\xbd\xc5\x94\xb9\xb7\xd5\xa4\xc0\f-6\xfe\xa8\xed/u\x81_G\xfeR\xbb\x12\x16\xb8*\xa9\xc9\xe81\x9d\x06\xbbC\x17\xbb\xe6|\x97\xabB4J\xed+-\xf8u0/n\xcf\x8b\x95\x9d\xab\xa8\xc47\xa6\x0e\xdeOq\\\xc3\'{\b\xd3m\x94\xc2\xdd{\xeaO\x0e\xe4\xe0\xb9N:\xd60\x17,\x06\xc7B#Y0\x99\xeb\x874\xab?\xc8\x82\xe5\x8f\xb7\x91\xc2\xbe\xb2\x02\xfe\xd3k\xd5\xdcZ\xdcP\x8e+\xd8\xc7C\xcb\x15\x13c\xbf\xe8\xbd\"\x8f3\"\x14\xf8(\xda\x19\xcd\xec\x03.\xd9^\xc3A\xda\r[\x1a\xda\\#/\xd4\xaf\xd0\xe8\xa2\xdd\xc5{\xfa\xe0\x90\x8f\x99lQ\xec\x84h^\x11+\x93\b\xe0c\xe6\xd22\xf9\xa5', 0x0) ioctl$auto_SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) ioctl$auto(0xc8, 0x800454e1, 0x5c8d) 1.580877676s ago: executing program 2 (id=1746): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/ipv6_route\x00', 0x80000, 0x0) r1 = socket(0x5, 0x5, 0x12) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0xe, 0x0) lsm_list_modules$auto(0x0, 0x0, 0x0) r2 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000280), 0x141182, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r2, 0x40146f2c, 0x0) r3 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000080), 0x401, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r3, 0x40146f2c, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, 0x0, 0x8202, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'caif0\x00'}) pread64$auto(r0, &(0x7f0000000100)='vJth1@\\\xb0\xbf\x01\xebL?\t\xef\x81/\v\x85\xe6\x15\xc3h\xcf4\x85;\xfe\xc9\x11\x1e&\xf7\xcc#\x8e\x9aqV\xf3\xf9\x0e8\x8f\xe3\xf8\xf3S#\xa0\xce\xe2\x80\a\xd3\x16*\xc5j\xbaxa\x97\xca\x8by\xa4\xc2\xc8\x02\xfb\x0e\x86\xab\xff\x0f\x00\x00\x00\x00\x00\x00p\xb5\xa3\xc3;\x00\x12/\x90o\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x007Z\x10\xf1\xcc\xf5j\x1f\xbfM\xbeK\xd4\xe9J /\x92#8\x8b\xe0h\x17\xc6\xaa\xbc\xf7\x92\xd5Q\xbc^\x1c\xe6)@\xfb\xf5\xc9n\x96\xf2C\xfc=*\x00\x00\x00\x00', 0x7ffffffe, 0x5) ioctl$auto(0xc8, 0x400454ce, 0x5c8d) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/virtual/bdi/31:0/strict_limit\x00', 0xa0666, 0x0) write$auto(r4, &(0x7f00000000c0)='1\x00\xc7k\x00\x00\x00\x00\x00\x00\x00\x00p\x05\xbe\xc8v\x81-ILplM\x98\x88J\xfd\x17\xc8K\xdd\x89;T@d\xa3_\xfcb8\x7fA\x11\xba\xefL\xe1L\x8aE}\xa7\x1d\b\xd7\xe2\xae\xfek\xbbw\x8c\x00\x00\x00\x00\t\x00\x00\x00k\x81\xe4\x1e\x1dS\xf2~>\xb1\xc6\xd1\xee\xc8\x19e\xc1w\xf05%\xd76]\x0f\v\x01\xa4(\xec\xd3\xca\a\x15&nv\xc1}\xfcD', 0x85) sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f00000015c0)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NETDEV_A_QUEUE_ID={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x811) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x11000, 0xe0, 0x8}, 0x18) r5 = prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x7) r6 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), r5) socket(0x2, 0x80802, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) sendmsg$auto_NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f0000000900)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000008c0)={&(0x7f0000000480)={0x3e0, r6, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_FTM_RESPONDER={0x3cc, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0xfe, 0x3, "730cbc99618bb3ad9814f246c53f92440e935621eb0e7d978bb35017cf46b4ffa85111ec3b639bf26a0c56305b3df0b612b01fd48d81f673850ef50a349ac8b7f2d1eab7c741e14c4860d4770d5ee4a74828b203ee5dca6c11f02a1117ffb73442a917a2dc3791a09c421ee166f30a20ce7c6a4e921355a7e95129c30fbb78a06fafa23e0ad529b38b5d0e11dc09b3fff19f6fe5f044168832390258650519aad1447a1073e65b31f381c396b3b5a65a16a171006050e7314432757aa5e0374004eafee2dbc2373f6b998e513ada9732f5bfd05761c371de8165c678f1275c99658110c47432e78d7a62d7d2b8918ac315ba3250de16233bf30f"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xbf, 0x3, "acecaa1df8dc1656d69493e466e33f7abb04dcd17d27cd0e223dd4e970ce026024424b4c76de209e37b0b1376cd1c9f85d076cf426b430161328a8ad1affe1ae2dfb7542e6d0586556c73062b21f979125a4f7e85e72aaa06b891f0883ce6a5667139da1d73028145944b6b4b325700e1e88b8cbbb3039c21d105e2fb729859704451d6fd2a96e017acb27002f6af5cc5f75565e5f008e232b2820b797b3d8955c28b12c17d42568f32bb90ab0f6271df3246662f2799e9c51ef5f"}, @NL80211_FTM_RESP_ATTR_LCI={0x98, 0x2, "27befd03fac8ff16ee519761f83e7fba5b9825f15c513c2a1c5db5b66bf230b0ab966d44e0be8c91e61f095b9d9ffedab2a4883a0a971de3263d4f0dd4b738a6aaa68563e37809a1d931ea165b69d0b2212ef10231d0b6994d8c265aa992fbef83d5f4c05f5029aea03dfc1e85277dfeb296010ad603a3361f1bf07a3e5a71ba66473b8fc03f11863465477b8a945cc6106788ac"}, @NL80211_FTM_RESP_ATTR_LCI={0x87, 0x2, "9d2e1528b15847002eb95fa014db31f5be320548d220f4d1336e18cb6bf4d58840a66781a497aed5efca02790fe149e77f6b67e34da6f2e7e00752a9c3f4d9041ec8c0387066807076ff45576dd2385974eb6a36f96bcf0e7dc83088c2a72459430a7cc4dc7590250234163cc09f01293552f858f4f236cfd90cadc7f1b55d3787a60f"}, @NL80211_FTM_RESP_ATTR_LCI={0xdc, 0x2, "76fb0d6f966e299dc62324326e2c21f98618a232572069ac84d0430d281e2d1a41d822ce25202acf0bf6a43f39f8bf3d7aabfe60aa894cd9cc475217e7a7e32a8d6a1b1a5e509a8c902076515ba8ad52e9133f68d38dda35a863700e191087cb4d81fe665a3f837fc3ca860542604ec4b50e08c576d5f536378107e309449f02e67f3d49c16ac318e9190483d56fcd3cdc9c74fd4bfff71f5648941e97d3f2d1a5c97ca360a75239036eee99be620506dd2b21bdfb49c82d9863588f8dc340455e1ad925a7f99bb0ee643059c4f21a166bcf77755507c4ca"}]}]}, 0x3e0}, 0x1, 0x0, 0x0, 0x850}, 0x20008810) r7 = pidfd_open$auto(0x1, 0x0) setns(r7, 0x60020000) mmap$auto(0x0, 0x2, 0xdf, 0xeb1, 0x401, 0x8000) getcwd$auto(0x0, 0xffffffffffffffff) r8 = ioctl$auto_TUNSETNOCSUM(r7, 0x400454c8, &(0x7f0000000240)=0xe) mount_setattr$auto(r8, 0x0, 0x4675, &(0x7f00000002c0)={0xcecf, 0x9, 0x2}, 0x283) 1.19695843s ago: executing program 2 (id=1747): mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, 0x200000401, 0x8000) mmap$auto(0x200000000, 0x5, 0x8, 0x40009b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) ptrace$auto(0x10, 0x0, 0x1, 0x7ff) ptrace$auto(0xc, 0x0, 0x9, 0xfffffffffffff6de) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r1, 0x5412, &(0x7f0000000040)="158f4a2b") r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r2, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) write$auto(r0, &(0x7f00000002c0)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef`\xd8\x9c\xf7?:\x1a\xc62\x911e\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\b};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xff\x7f\xd0UV\x11\xcb\xdd\x81\xbe\xde\f/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7\x00\x85Z\x06?\x12\x98\x0f)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1;\xe4pd$\xd7\x1b\v\x82\r\f\xd0Hq\xd9\r\x88#\x89\x8d\xcd\x1e\x87N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8HR+\a\xb7R\t\n+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb\xc8^\xa4\xe2\x05\x91|\x123\xc3:\xfd\xee\x04a\xc8\x12\xce\xa2\x12\xcb\x8c\x87f\xebGQ\xe9\x96\xd5E\x13a\xb7\x057<&\xe0\x94\xa7\xfb\x9d;\xfa\xb1\x1b4a,\'\xb2Ym\xe1:\xbf\x8cs\x06\xa3u\x8d!\n\x80-\x9a\xbb;\xf4\xf3\xe1\x97\xfc8\xff\xa7\\\x8b\xf9\x95\x10$\xef\x1a #b\xfb\xfe\xe9\x06fK0\xdd\x84T,\xfa\xb5\x00\x83d\xbba\xd7\n\x92l\xdfAN\x9d\xcb\x96\xc7\xe8\xe6\x8bC\xeb\xc7EZ\xc8\x1a\x81nf\tZ-sZ\x13n\xec\xa9\xbf\xd0$\xb9\xd8\x00\x00\x00\x00\x00\x00\x00', 0xb) getpid() mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) mkdir$auto(&(0x7f00000002c0)='./file0\x00', 0x3) chmod$auto(&(0x7f0000000000)='./file0\x00', 0x6) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x1ac}}, 0x40000) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) modify_ldt$auto(0x1, &(0x7f00000001c0), 0x10) 500.161578ms ago: executing program 1 (id=1748): creat$auto(&(0x7f0000000080)='./file0\x00', 0x6) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) openat$auto_ecryptfs_miscdev_fops_miscdev(0xffffffffffffff9c, &(0x7f000000e680), 0x68182, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) mmap$auto(0x37, 0xda93, 0xdf, 0xeb1, 0x401, 0x8000) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000380)="7a47301037954c081c9a0bb84bb7b04ef84993eab91abe1686f43e43d786e964e8f04455bd620de9f3fb6d65e6c078c1a672c549dbc7876cb528ba081a81d884bfc00dd4eef57cedc0cc4156ff6a5b0aa8ba9511fe2b07c6e7f4732fe36ba218aa5b0ff402f2e6adb8ea60886c1e52c60d7d87e4c0551386501763ad098eb2b9602f83b2a643399f10dfdb0f4018b401be4db675d0acf8d348c26acf338cbe20fcb76439ca602a3c022f4463a8820f1c6f865d24e058af98f0c48bf552c3f6cc28c09d9054347db3c28701c67fa1e57d81b881638b518dd8e24969b7fd10406fcf6eb9bb") mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_kmsg_fops_printk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) lseek$auto(0x3, 0x7fffffffffffffff, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) readv$auto(0x3, 0x0, 0x1) socket(0x10, 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xc, 0x0, 0x4) r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x123002, 0x0) write$auto(r1, &(0x7f0000000500)='odev/\xdf\x00\x00\x00\x00H\xde\xe1\xcf\x8ch:\x11\xeah\xf4\xcc\xc6\xa6\xd9\xc3Y\xcb\xf4v6u\\\xd7hD\xfcw\xdb\x05\x11\x96ZP\x81\x87d\xa1#98\xcc\x9d\xc8\x8d\xf6\xdd\x11v(\xb0>$\x96-\xdf\x85(\xa0cq\xc5q\xa4\xad\xae\r\xb5\x8d\x81\xc6?\xd4\x7f\xd3\x1a\xe9\':\xe4\xebd\x97\x8bW^r\xe0\xc8\x85\x03\x04L:\x06\xb6\xe5\x91M\x82\xfeKM\xe0y\xd0\xd5\xb2\xfa\x1do\xa4 \xf6\xdaB\xef\xa6\x1a\x9f\xb6\\\xeb\xa9\x7f\xb3*\xaa9I\x8c,\xefD\x90\x97L!A\xbe\xd13\xc99\x8fF\xc8t\x9c\x06\x90\xb8 \xdc\x9f\x9d\xcaqc4\x10\xc5\xdd\x8c\xe7f{\\D\x86\x10\xe3%n\xbci,:\x8a#', 0x80000000) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) execve$auto(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) execve$auto(&(0x7f0000000040)='./file0\x00', &(0x7f00000004c0)=&(0x7f0000000340)='#\xdc\xfe\xd8E\xc8\x8bu4\xd9n\xcb\xca\xc7zw \x96\x9ejh\xad\x9eEc\xae\x1e\x89\x92\x9a\xbbP[B\xae\x9cf)\x15\xac\x90)l\x06\xf0\t\x12\x05zz\xa6\xb3\xce=\x00\x00\x00\x00\x00/\xc4T\x1f\xe5P\xff\xb4\xb7s0\x02\xc5\x81\x93\xc6\xc8\xb6Sp\x1a{8\xfc\xe0,X\xc7BU\xd0\x97\x7f1\x16\x99\x04\xabu/a(\x02\x7f\xbb\xbd\x906\xa8\xce\xee\xcd\xd7\t\x00\xfb\x83\xc8\x8aO\xe9\xbe=\xf7\xf4\x84,\x06\xd3j\x99b\xe6\xf6Y3A\xbb\xa4\xb2\f\x1b\xc3\x8a,g\xc6\xe8[\xdf\x88\x01\x9f7\xb5\x19m\xd8L\x84j\x8c\xec\xdf\x1a\xbd\xc5\x94\xb9\xb7\xd5\xa4\xc0\f-6\xfe\xa8\xed/u\x81_G\xfeR\xbb\x12\x16\xb8*\xa9\xc9\xe81\x9d\x06\xbbC\x17\xbb\xe6|\x97\xabB4J\xed+-\xf8u0/n\xcf\x8b\x95\x9d\xab\xa8\xc47\xa6\x0e\xdeOq\\\xc3\'{\b\xd3m\x94\xc2\xdd{\xeaO\x0e\xe4\xe0\xb9N:\xd60\x17,\x06\xc7B#Y0\x99\xeb\x874\xab?\xc8\x82\xe5\x8f\xb7\x91\xc2\xbe\xb2\x02\xfe\xd3k\xd5\xdcZ\xdcP\x8e+\xd8\xc7C\xcb\x15\x13c\xbf\xe8\xbd\"\x8f3\"\x14\xf8(\xda\x19\xcd\xec\x03.\xd9^\xc3A\xda\r[\x1a\xda\\#/\xd4\xaf\xd0\xe8\xa2\xdd\xc5{\xfa\xe0\x90\x8f\x99lQ\xec\x84h^\x11+\x93\b\xe0c\xe6\xd22\xf9\xa5', 0x0) ioctl$auto_SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) ioctl$auto(0xc8, 0x800454e1, 0x5c8d) 498.450676ms ago: executing program 0 (id=1756): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/ipv6_route\x00', 0x80000, 0x0) r1 = socket(0x5, 0x5, 0x12) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0xe, 0x0) lsm_list_modules$auto(0x0, 0x0, 0x0) r2 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000280), 0x141182, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r2, 0x40146f2c, 0x0) r3 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000080), 0x401, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r3, 0x40146f2c, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, 0x0, 0x8202, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'caif0\x00'}) pread64$auto(r0, &(0x7f0000000100)='vJth1@\\\xb0\xbf\x01\xebL?\t\xef\x81/\v\x85\xe6\x15\xc3h\xcf4\x85;\xfe\xc9\x11\x1e&\xf7\xcc#\x8e\x9aqV\xf3\xf9\x0e8\x8f\xe3\xf8\xf3S#\xa0\xce\xe2\x80\a\xd3\x16*\xc5j\xbaxa\x97\xca\x8by\xa4\xc2\xc8\x02\xfb\x0e\x86\xab\xff\x0f\x00\x00\x00\x00\x00\x00p\xb5\xa3\xc3;\x00\x12/\x90o\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x007Z\x10\xf1\xcc\xf5j\x1f\xbfM\xbeK\xd4\xe9J /\x92#8\x8b\xe0h\x17\xc6\xaa\xbc\xf7\x92\xd5Q\xbc^\x1c\xe6)@\xfb\xf5\xc9n\x96\xf2C\xfc=*\x00\x00\x00\x00', 0x7ffffffe, 0x5) ioctl$auto(0xc8, 0x400454ce, 0x5c8d) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/virtual/bdi/31:0/strict_limit\x00', 0xa0666, 0x0) write$auto(r4, &(0x7f00000000c0)='1\x00\xc7k\x00\x00\x00\x00\x00\x00\x00\x00p\x05\xbe\xc8v\x81-ILplM\x98\x88J\xfd\x17\xc8K\xdd\x89;T@d\xa3_\xfcb8\x7fA\x11\xba\xefL\xe1L\x8aE}\xa7\x1d\b\xd7\xe2\xae\xfek\xbbw\x8c\x00\x00\x00\x00\t\x00\x00\x00k\x81\xe4\x1e\x1dS\xf2~>\xb1\xc6\xd1\xee\xc8\x19e\xc1w\xf05%\xd76]\x0f\v\x01\xa4(\xec\xd3\xca\a\x15&nv\xc1}\xfcD', 0x85) sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f00000015c0)={0x1c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NETDEV_A_QUEUE_ID={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x811) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x11000, 0xe0, 0x8}, 0x18) r5 = prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x7) r6 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), r5) socket(0x2, 0x80802, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) sendmsg$auto_NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f0000000900)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000008c0)={&(0x7f0000000480)={0x3e0, r6, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_FTM_RESPONDER={0x3cc, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0xfe, 0x3, "730cbc99618bb3ad9814f246c53f92440e935621eb0e7d978bb35017cf46b4ffa85111ec3b639bf26a0c56305b3df0b612b01fd48d81f673850ef50a349ac8b7f2d1eab7c741e14c4860d4770d5ee4a74828b203ee5dca6c11f02a1117ffb73442a917a2dc3791a09c421ee166f30a20ce7c6a4e921355a7e95129c30fbb78a06fafa23e0ad529b38b5d0e11dc09b3fff19f6fe5f044168832390258650519aad1447a1073e65b31f381c396b3b5a65a16a171006050e7314432757aa5e0374004eafee2dbc2373f6b998e513ada9732f5bfd05761c371de8165c678f1275c99658110c47432e78d7a62d7d2b8918ac315ba3250de16233bf30f"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xbf, 0x3, "acecaa1df8dc1656d69493e466e33f7abb04dcd17d27cd0e223dd4e970ce026024424b4c76de209e37b0b1376cd1c9f85d076cf426b430161328a8ad1affe1ae2dfb7542e6d0586556c73062b21f979125a4f7e85e72aaa06b891f0883ce6a5667139da1d73028145944b6b4b325700e1e88b8cbbb3039c21d105e2fb729859704451d6fd2a96e017acb27002f6af5cc5f75565e5f008e232b2820b797b3d8955c28b12c17d42568f32bb90ab0f6271df3246662f2799e9c51ef5f"}, @NL80211_FTM_RESP_ATTR_LCI={0x98, 0x2, "27befd03fac8ff16ee519761f83e7fba5b9825f15c513c2a1c5db5b66bf230b0ab966d44e0be8c91e61f095b9d9ffedab2a4883a0a971de3263d4f0dd4b738a6aaa68563e37809a1d931ea165b69d0b2212ef10231d0b6994d8c265aa992fbef83d5f4c05f5029aea03dfc1e85277dfeb296010ad603a3361f1bf07a3e5a71ba66473b8fc03f11863465477b8a945cc6106788ac"}, @NL80211_FTM_RESP_ATTR_LCI={0x87, 0x2, "9d2e1528b15847002eb95fa014db31f5be320548d220f4d1336e18cb6bf4d58840a66781a497aed5efca02790fe149e77f6b67e34da6f2e7e00752a9c3f4d9041ec8c0387066807076ff45576dd2385974eb6a36f96bcf0e7dc83088c2a72459430a7cc4dc7590250234163cc09f01293552f858f4f236cfd90cadc7f1b55d3787a60f"}, @NL80211_FTM_RESP_ATTR_LCI={0xdc, 0x2, "76fb0d6f966e299dc62324326e2c21f98618a232572069ac84d0430d281e2d1a41d822ce25202acf0bf6a43f39f8bf3d7aabfe60aa894cd9cc475217e7a7e32a8d6a1b1a5e509a8c902076515ba8ad52e9133f68d38dda35a863700e191087cb4d81fe665a3f837fc3ca860542604ec4b50e08c576d5f536378107e309449f02e67f3d49c16ac318e9190483d56fcd3cdc9c74fd4bfff71f5648941e97d3f2d1a5c97ca360a75239036eee99be620506dd2b21bdfb49c82d9863588f8dc340455e1ad925a7f99bb0ee643059c4f21a166bcf77755507c4ca"}]}]}, 0x3e0}, 0x1, 0x0, 0x0, 0x850}, 0x20008810) r7 = pidfd_open$auto(0x1, 0x0) setns(r7, 0x60020000) mmap$auto(0x0, 0x2, 0xdf, 0xeb1, 0x401, 0x8000) getcwd$auto(0x0, 0xffffffffffffffff) r8 = ioctl$auto_TUNSETNOCSUM(r7, 0x400454c8, &(0x7f0000000240)=0xe) mount_setattr$auto(r8, 0x0, 0x4675, &(0x7f00000002c0)={0xcecf, 0x9, 0x2}, 0x283) 391.188228ms ago: executing program 2 (id=1749): close_range$auto(0x2, 0x8, 0x0) setregid$auto(0xffffffffffffffff, 0xfffe) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/smt/active\x00', 0x2e40, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000ac0)=""/4107, 0x100b) r1 = ioctl$auto_TUNGETIFF2(0xffffffffffffffff, 0x800454d2, &(0x7f0000000000)=0x5) r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) setreuid$auto(0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000500)={'netdevsim0\x00'}) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001e00)={0x18, r4, 0x1, 0x70bd31, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x18}}, 0x24048084) openat$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/ieee80211/phy6/netdev:wlan1/stations/08:02:11:00:00:00/rc_stats_csv\x00', 0x2000, 0x0) r6 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card0\x00', 0x129800, 0x0) ioctl$auto(r6, 0x9210640a, 0xffffffffffffffff) r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/dummy_udc.0/udc/dummy_udc.0/soft_connect\x00', 0xc2481, 0x0) write$auto(r7, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) read$auto_proc_pid_maps_operations_internal(0xffffffffffffffff, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) seccomp$auto_SECCOMP_SET_MODE_FILTER(0x1, 0x8, &(0x7f0000000080)="c20c") mprotect$auto(0x110c238000, 0x1, 0x3) madvise$auto(0x110c230000, 0x8031ca, 0x9) close_range$auto(0x2, 0xa, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x102, 0x0) r8 = openat$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/ieee80211/phy6/netdev:wlan1/stations/08:02:11:00:00:00/rc_stats_csv\x00', 0x400000, 0x0) read$auto_minstrel_ht_stat_csv_fops_rc80211_minstrel_ht_debugfs(r8, &(0x7f0000000180)=""/202, 0xca) sendmsg$auto_ETHTOOL_MSG_MM_SET(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r2, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_MM_VERIFY_TIME={0x8, 0x9, 0x10001}, @ETHTOOL_A_MM_VERIFY_TIME={0x8, 0x9, 0x7}, @ETHTOOL_A_MM_TX_MIN_FRAG_SIZE={0x8, 0x5, 0x7}, @ETHTOOL_A_MM_TX_ENABLED={0x5}, @ETHTOOL_A_MM_TX_ENABLED={0x5}, @ETHTOOL_A_MM_TX_ENABLED={0x5, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x4) clone3$auto(0x0, 0x0) mmap$auto(0x1, 0x4020009, 0xdf, 0x16, 0x401, 0x8000) socket(0x2, 0x1, 0x0) 85.023002ms ago: executing program 0 (id=1750): mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, 0x200000401, 0x8000) mmap$auto(0x200000000, 0x5, 0x8, 0x40009b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) ptrace$auto(0x10, 0x0, 0x1, 0x7ff) ptrace$auto(0xc, 0x0, 0x9, 0xfffffffffffff6de) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r1, 0x5412, &(0x7f0000000040)="158f4a2b") r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r2, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) write$auto(r0, &(0x7f00000002c0)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef`\xd8\x9c\xf7?:\x1a\xc62\x911e\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\b};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xff\x7f\xd0UV\x11\xcb\xdd\x81\xbe\xde\f/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7\x00\x85Z\x06?\x12\x98\x0f)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1;\xe4pd$\xd7\x1b\v\x82\r\f\xd0Hq\xd9\r\x88#\x89\x8d\xcd\x1e\x87N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8HR+\a\xb7R\t\n+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb\xc8^\xa4\xe2\x05\x91|\x123\xc3:\xfd\xee\x04a\xc8\x12\xce\xa2\x12\xcb\x8c\x87f\xebGQ\xe9\x96\xd5E\x13a\xb7\x057<&\xe0\x94\xa7\xfb\x9d;\xfa\xb1\x1b4a,\'\xb2Ym\xe1:\xbf\x8cs\x06\xa3u\x8d!\n\x80-\x9a\xbb;\xf4\xf3\xe1\x97\xfc8\xff\xa7\\\x8b\xf9\x95\x10$\xef\x1a #b\xfb\xfe\xe9\x06fK0\xdd\x84T,\xfa\xb5\x00\x83d\xbba\xd7\n\x92l\xdfAN\x9d\xcb\x96\xc7\xe8\xe6\x8bC\xeb\xc7EZ\xc8\x1a\x81nf\tZ-sZ\x13n\xec\xa9\xbf\xd0$\xb9\xd8\x00\x00\x00\x00\x00\x00\x00', 0xb) getpid() mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) mkdir$auto(&(0x7f00000002c0)='./file0\x00', 0x3) chmod$auto(&(0x7f0000000000)='./file0\x00', 0x6) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x1ac}}, 0x40000) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) modify_ldt$auto(0x1, &(0x7f00000001c0), 0x10) 0s ago: executing program 2 (id=1751): r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv6/conf/bridge0/forwarding\x00', 0x88542, 0x0) bpf$auto_BPF_MAP_FREEZE(0x16, &(0x7f0000000080)=@bpf_attr_1={r0, 0x1, @value=0x7fffffff, 0x1}, 0xfc2) r1 = socket$nl_generic(0x10, 0x3, 0x10) msgsnd$auto(0xc92, &(0x7f00000001c0)={0x7, 0xef}, 0x6, 0x200) setsockopt$auto_SO_MAX_PACING_RATE(r1, 0x1, 0x2f, &(0x7f0000000000)=':-\x00', 0x5) r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/card0/pcm0p/sub4/status\x00', 0x8040, 0x0) read$auto_proc_reg_file_ops_compat_inode(r2, &(0x7f0000000100)=""/184, 0xb8) write$auto(r0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/net/dummy0/tx_queue_len\x00', 0x8522, 0x0) r4 = socket(0xa, 0x5, 0x84) mmap$auto(0x0, 0x8, 0xdf, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x6, 0x0) getsockopt$auto(r4, 0x84, 0x80, 0x0, 0x0) write$auto(r3, &(0x7f0000000000)='9\x00d\t\x00\x00\x00\x00\x00\x00\x00(\xc1\xf8\xff\xff\v\xb5^\xa1/[', 0x1) socket(0x1d, 0x2, 0x6) socket(0x2, 0x2, 0x1) madvise$auto(0x0, 0xffffffffffff0005, 0x17) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) madvise$auto(0x0, 0xffffffffffff0005, 0x17) syz_genetlink_get_family_id$auto_l2tp(0x0, 0xffffffffffffffff) futex$auto(0x0, 0x86, 0x8, 0x0, 0x0, 0x7) openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, 0x0, 0x40900, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_L2TP_CMD_NOOP(r5, 0x0, 0x840) clone$auto(0x100000008, 0x9, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4000006) kernel console output (not intermixed with test programs): n_pages_noprof+0x19a/0x2bc0 [ 334.496422][ T9405] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 334.496464][ T9405] ? is_bpf_text_address+0x94/0x1a0 [ 334.496502][ T9405] ? kernel_text_address+0x8d/0x100 [ 334.496532][ T9405] ? __kernel_text_address+0xd/0x30 [ 334.496561][ T9405] ? unwind_get_return_address+0x59/0xa0 [ 334.496606][ T9405] ? __lock_acquire+0x4a5/0x2630 [ 334.496652][ T9405] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 334.496718][ T9405] ? find_held_lock+0x2b/0x80 [ 334.496753][ T9405] ? aa_file_perm+0x7e4/0x14d0 [ 334.496796][ T9405] ? aa_file_perm+0x7e4/0x14d0 [ 334.496842][ T9405] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 334.496885][ T9405] ? policy_nodemask+0xed/0x4f0 [ 334.496924][ T9405] alloc_pages_mpol+0x1fb/0x540 [ 334.496962][ T9405] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 334.497007][ T9405] ? qrtr_tun_write_iter+0xc1/0x1b0 [ 334.497038][ T9405] ___kmalloc_large_node+0xe5/0x120 [ 334.497079][ T9405] __kmalloc_large_node_noprof+0x1c/0x70 [ 334.497121][ T9405] __kmalloc_noprof+0x5be/0x850 [ 334.497156][ T9405] qrtr_tun_write_iter+0xc1/0x1b0 [ 334.497189][ T9405] vfs_write+0x6ac/0x1070 [ 334.497225][ T9405] ? __pfx_qrtr_tun_write_iter+0x10/0x10 [ 334.497273][ T9405] ? __pfx_vfs_write+0x10/0x10 [ 334.497303][ T9405] ? find_held_lock+0x2b/0x80 [ 334.497363][ T9405] __x64_sys_pwrite64+0x1eb/0x250 [ 334.497401][ T9405] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 334.497442][ T9405] ? rcu_is_watching+0x12/0xc0 [ 334.497481][ T9405] do_syscall_64+0x115/0x840 [ 334.497521][ T9405] ? clear_bhb_loop+0x40/0x90 [ 334.497558][ T9405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.497588][ T9405] RIP: 0033:0x7fd16ff9ce59 [ 334.497614][ T9405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.497651][ T9405] RSP: 002b:00007fd170e88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 334.497680][ T9405] RAX: ffffffffffffffda RBX: 00007fd170215fa0 RCX: 00007fd16ff9ce59 [ 334.497699][ T9405] RDX: 0000000000400000 RSI: 0000000000000000 RDI: 0000000000000007 [ 334.497716][ T9405] RBP: 00007fd170e88090 R08: 0000000000000000 R09: 0000000000000000 [ 334.497732][ T9405] R10: 000000000000000c R11: 0000000000000246 R12: 0000000000000001 [ 334.497749][ T9405] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 334.497788][ T9405] [ 335.441943][ T9410] netlink: 342 bytes leftover after parsing attributes in process `syz.2.787'. [ 338.111267][ T9456] : Can't lookup blockdev [ 338.242931][ T8557] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 338.394751][ T9455] netlink: 218 bytes leftover after parsing attributes in process `syz.3.795'. [ 338.943135][ T9468] netlink: 12 bytes leftover after parsing attributes in process `syz.1.798'. [ 339.580324][ T9477] udc dummy_udc.0: soft-connect without a gadget driver [ 340.044670][ T9467] Process accounting paused [ 340.315410][ T8555] Bluetooth: hci2: command 0x2016 tx timeout [ 340.889169][ T9499] netlink: 4 bytes leftover after parsing attributes in process `syz.0.807'. [ 341.015397][ T9505] FAULT_INJECTION: forcing a failure. [ 341.015397][ T9505] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 341.060712][ T9505] CPU: 1 UID: 0 PID: 9505 Comm: syz.3.808 Tainted: G L syzkaller #0 PREEMPT(full) [ 341.060743][ T9505] Tainted: [L]=SOFTLOCKUP [ 341.060749][ T9505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 341.060760][ T9505] Call Trace: [ 341.060767][ T9505] [ 341.060775][ T9505] dump_stack_lvl+0x100/0x190 [ 341.060811][ T9505] should_fail_ex.cold+0x5/0xa [ 341.060835][ T9505] _copy_from_iter+0x1f4/0x1690 [ 341.060870][ T9505] ? mod_node_page_state+0xe5/0x150 [ 341.060909][ T9505] ? rcu_is_watching+0x12/0xc0 [ 341.060943][ T9505] ? __pfx__copy_from_iter+0x10/0x10 [ 341.060980][ T9505] ? rcu_is_watching+0x12/0xc0 [ 341.061010][ T9505] ? trace_kmalloc+0xe3/0x110 [ 341.061040][ T9505] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 341.061066][ T9505] ? __kmalloc_noprof+0x320/0x850 [ 341.061087][ T9505] qrtr_tun_write_iter+0xe7/0x1b0 [ 341.061111][ T9505] vfs_write+0x6ac/0x1070 [ 341.061133][ T9505] ? __pfx_qrtr_tun_write_iter+0x10/0x10 [ 341.061155][ T9505] ? __pfx_vfs_write+0x10/0x10 [ 341.061174][ T9505] ? find_held_lock+0x2b/0x80 [ 341.061211][ T9505] __x64_sys_pwrite64+0x1eb/0x250 [ 341.061236][ T9505] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 341.061260][ T9505] ? rcu_is_watching+0x12/0xc0 [ 341.061284][ T9505] do_syscall_64+0x115/0x840 [ 341.061310][ T9505] ? clear_bhb_loop+0x40/0x90 [ 341.061333][ T9505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.061352][ T9505] RIP: 0033:0x7f7fb499ce59 [ 341.061368][ T9505] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.061386][ T9505] RSP: 002b:00007f7fb2bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 341.061405][ T9505] RAX: ffffffffffffffda RBX: 00007f7fb4c15fa0 RCX: 00007f7fb499ce59 [ 341.061417][ T9505] RDX: 0000000000400000 RSI: 0000000000000000 RDI: 0000000000000007 [ 341.061427][ T9505] RBP: 00007f7fb2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 341.061438][ T9505] R10: 000000000000000c R11: 0000000000000246 R12: 0000000000000001 [ 341.061449][ T9505] R13: 00007f7fb4c16038 R14: 00007f7fb4c15fa0 R15: 00007ffe938d30e8 [ 341.061471][ T9505] [ 342.384855][ T8557] Bluetooth: hci2: command 0x2016 tx timeout [ 342.537035][ T9522] : Can't lookup blockdev [ 342.557116][ T9521] netlink: 218 bytes leftover after parsing attributes in process `syz.3.811'. [ 342.681633][ T9527] udc dummy_udc.0: soft-connect without a gadget driver [ 343.481705][ T9530] bond0: option xmit_hash_policy: invalid value () [ 343.527260][ T9538] input: jJǸ-¶š9ã%vø“û¨lÐQ  J86Ö‘ as /devices/virtual/input/input32 [ 343.905403][ T9543] sysfs_service_op_show: Client not running :-5: [ 344.421644][ T9563] udc dummy_udc.0: soft-connect without a gadget driver [ 344.730976][ T8555] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 346.076119][ T9587] netlink: 218 bytes leftover after parsing attributes in process `syz.0.827'. [ 346.761501][ T8555] Bluetooth: hci2: command 0x2016 tx timeout [ 347.915474][ T8557] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 347.954724][ T9617] udc dummy_udc.0: soft-connect without a gadget driver [ 348.830772][ T9618] Bluetooth: hci2: command 0x2016 tx timeout [ 349.543811][ T9627] FAULT_INJECTION: forcing a failure. [ 349.543811][ T9627] name failslab, interval 1, probability 0, space 0, times 0 [ 349.567808][ T9627] CPU: 1 UID: 0 PID: 9627 Comm: syz.3.838 Tainted: G L syzkaller #0 PREEMPT(full) [ 349.567857][ T9627] Tainted: [L]=SOFTLOCKUP [ 349.567868][ T9627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 349.567885][ T9627] Call Trace: [ 349.567895][ T9627] [ 349.567907][ T9627] dump_stack_lvl+0x100/0x190 [ 349.567965][ T9627] should_fail_ex.cold+0x5/0xa [ 349.568006][ T9627] should_failslab+0xc2/0x120 [ 349.568044][ T9627] __kmalloc_node_noprof+0xe6/0x850 [ 349.568094][ T9627] ? __rb_allocate_pages+0x399/0x10a0 [ 349.568139][ T9627] __rb_allocate_pages+0x399/0x10a0 [ 349.568188][ T9627] ring_buffer_subbuf_order_set+0x3ef/0x18b0 [ 349.568235][ T9627] ? tracing_stop_tr+0xdf/0x200 [ 349.568274][ T9627] ? __pfx_ring_buffer_subbuf_order_set+0x10/0x10 [ 349.568312][ T9627] ? __pfx___might_resched+0x10/0x10 [ 349.568360][ T9627] ? lock_acquire+0x1b1/0x370 [ 349.568414][ T9627] buffer_subbuf_size_write+0x182/0x280 [ 349.568463][ T9627] ? __pfx_buffer_subbuf_size_write+0x10/0x10 [ 349.568520][ T9627] vfs_write+0x2aa/0x1070 [ 349.568557][ T9627] ? __pfx_buffer_subbuf_size_write+0x10/0x10 [ 349.568602][ T9627] ? __pfx_vfs_write+0x10/0x10 [ 349.568635][ T9627] ? __fget_files+0x215/0x3d0 [ 349.568678][ T9627] ? __fget_files+0x21f/0x3d0 [ 349.568734][ T9627] ksys_write+0x12a/0x250 [ 349.568767][ T9627] ? __pfx_ksys_write+0x10/0x10 [ 349.568805][ T9627] ? rcu_is_watching+0x12/0xc0 [ 349.568847][ T9627] do_syscall_64+0x115/0x840 [ 349.568889][ T9627] ? clear_bhb_loop+0x40/0x90 [ 349.568927][ T9627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.568959][ T9627] RIP: 0033:0x7f7fb499ce59 [ 349.568986][ T9627] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.569012][ T9627] RSP: 002b:00007f7fb2bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 349.569041][ T9627] RAX: ffffffffffffffda RBX: 00007f7fb4c15fa0 RCX: 00007f7fb499ce59 [ 349.569061][ T9627] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000007 [ 349.569079][ T9627] RBP: 00007f7fb4a32d6f R08: 0000000000000000 R09: 0000000000000000 [ 349.569096][ T9627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.569113][ T9627] R13: 00007f7fb4c16038 R14: 00007f7fb4c15fa0 R15: 00007ffe938d30e8 [ 349.569156][ T9627] [ 349.961113][ T8557] Bluetooth: hci1: command 0x2016 tx timeout [ 350.030288][ T9638] FAULT_INJECTION: forcing a failure. [ 350.030288][ T9638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.128532][ T9638] CPU: 0 UID: 0 PID: 9638 Comm: syz.1.841 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.128578][ T9638] Tainted: [L]=SOFTLOCKUP [ 350.128587][ T9638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 350.128603][ T9638] Call Trace: [ 350.128612][ T9638] [ 350.128622][ T9638] dump_stack_lvl+0x100/0x190 [ 350.128676][ T9638] should_fail_ex.cold+0x5/0xa [ 350.128714][ T9638] _copy_to_user+0x32/0xd0 [ 350.128757][ T9638] simple_read_from_buffer+0xcb/0x170 [ 350.128793][ T9638] proc_fail_nth_read+0x1af/0x230 [ 350.128838][ T9638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 350.128880][ T9638] ? rw_verify_area+0xce/0x6d0 [ 350.128899][ T9638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 350.128929][ T9638] vfs_read+0x1e4/0xb30 [ 350.128953][ T9638] ? __pfx_vfs_read+0x10/0x10 [ 350.128973][ T9638] ? __fget_files+0x215/0x3d0 [ 350.128999][ T9638] ? __fget_files+0x21f/0x3d0 [ 350.129027][ T9638] ksys_read+0x12a/0x250 [ 350.129048][ T9638] ? __pfx_ksys_read+0x10/0x10 [ 350.129079][ T9638] ? rcu_is_watching+0x12/0xc0 [ 350.129104][ T9638] do_syscall_64+0x115/0x840 [ 350.129131][ T9638] ? clear_bhb_loop+0x40/0x90 [ 350.129154][ T9638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.129174][ T9638] RIP: 0033:0x7fd16ff5d68e [ 350.129190][ T9638] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 350.129212][ T9638] RSP: 002b:00007fd170e87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 350.129239][ T9638] RAX: ffffffffffffffda RBX: 00007fd170e886c0 RCX: 00007fd16ff5d68e [ 350.129261][ T9638] RDX: 000000000000000f RSI: 00007fd170e880a0 RDI: 0000000000000008 [ 350.129272][ T9638] RBP: 00007fd170e88090 R08: 0000000000000000 R09: 0000000000000000 [ 350.129283][ T9638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 350.129293][ T9638] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 350.129316][ T9638] [ 351.177402][ T9650] netlink: 218 bytes leftover after parsing attributes in process `syz.3.842'. [ 351.505143][ T9662] __vm_enough_memory: pid: 9662, comm: syz.0.845, bytes: 4398046457856 not enough memory for the allocation [ 351.737988][ T8555] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 352.024660][ T8555] Bluetooth: hci1: command 0x2016 tx timeout [ 352.210382][ T9671] : Can't lookup blockdev [ 353.657331][ T9701] input: jJǸ-¶š9ã%vø“û¨lÐQ  J86Ö‘ as /devices/virtual/input/input34 [ 353.765099][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 354.354636][ T9716] net_ratelimit: 2 callbacks suppressed [ 354.354654][ T9716] netlink: Conntrack attr type has unexpected length (type=3, length=0, expected=8) [ 355.834872][ T8557] Bluetooth: hci3: command 0x2016 tx timeout [ 356.334494][ T9748] input: jJǸ-¶š9ã%vø“û¨lÐQ  J86Ö‘ as /devices/virtual/input/input35 [ 359.485439][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 362.292147][ T9848] netlink: 16 bytes leftover after parsing attributes in process `syz.2.892'. [ 363.508660][ T9874] : Can't lookup blockdev [ 363.910639][ T9880] : Can't lookup blockdev [ 365.579434][ T9910] netlink: 8 bytes leftover after parsing attributes in process `syz.1.904'. [ 365.595246][ T9910] netlink: 330 bytes leftover after parsing attributes in process `syz.1.904'. [ 365.670427][ T9910] ›: renamed from sit0 (while UP) [ 366.246504][ T9917] netlink: 218 bytes leftover after parsing attributes in process `syz.2.903'. [ 366.686982][ T9618] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 368.548844][ T9966] FAULT_INJECTION: forcing a failure. [ 368.548844][ T9966] name failslab, interval 1, probability 0, space 0, times 0 [ 368.570036][ T9966] CPU: 1 UID: 0 PID: 9966 Comm: syz.0.917 Tainted: G L syzkaller #0 PREEMPT(full) [ 368.570086][ T9966] Tainted: [L]=SOFTLOCKUP [ 368.570097][ T9966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 368.570123][ T9966] Call Trace: [ 368.570182][ T9966] [ 368.570215][ T9966] dump_stack_lvl+0x100/0x190 [ 368.570340][ T9966] should_fail_ex.cold+0x5/0xa [ 368.570400][ T9966] ? ima_write_template_field_data+0x59/0x1d0 [ 368.570524][ T9966] should_failslab+0xc2/0x120 [ 368.570589][ T9966] __kmalloc_noprof+0xe0/0x850 [ 368.570624][ T9966] ? __x64_sys_openat+0x12d/0x210 [ 368.570685][ T9966] ? do_syscall_64+0x115/0x840 [ 368.570811][ T9966] ima_write_template_field_data+0x59/0x1d0 [ 368.570860][ T9966] ima_eventdigest_init_common+0x158/0x460 [ 368.570907][ T9966] ? __pfx_ima_eventdigest_init_common+0x10/0x10 [ 368.570974][ T9966] ? trace_kmem_cache_alloc+0x100/0x100 [ 368.571009][ T9966] ? __kasan_kmalloc+0xaa/0xb0 [ 368.571040][ T9966] ? __kmalloc_noprof+0x320/0x850 [ 368.571075][ T9966] ima_alloc_init_template+0x399/0x6d0 [ 368.571118][ T9966] ima_store_measurement+0x1e3/0x5b0 [ 368.571155][ T9966] ? __pfx_ima_store_measurement+0x10/0x10 [ 368.571205][ T9966] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 368.571281][ T9966] process_measurement+0x19cc/0x2350 [ 368.571323][ T9966] ? lock_acquire+0x1b1/0x370 [ 368.571396][ T9966] ? __pfx_process_measurement+0x10/0x10 [ 368.571430][ T9966] ? rcu_is_watching+0x12/0xc0 [ 368.571470][ T9966] ? __mutex_lock+0x26d/0x1b10 [ 368.571561][ T9966] ? trace_array_get+0x10c/0x140 [ 368.571656][ T9966] ? trace_array_get+0x10c/0x140 [ 368.571703][ T9966] ima_file_check+0xcc/0x120 [ 368.571743][ T9966] ? __pfx_ima_file_check+0x10/0x10 [ 368.571783][ T9966] security_file_post_open+0xc4/0x210 [ 368.571856][ T9966] path_openat+0x1418/0x31a0 [ 368.571912][ T9966] ? __pfx_path_openat+0x10/0x10 [ 368.571965][ T9966] do_file_open+0x20e/0x430 [ 368.572005][ T9966] ? __pfx_do_file_open+0x10/0x10 [ 368.572072][ T9966] ? alloc_fd+0x476/0x790 [ 368.572121][ T9966] ? do_getname+0x191/0x390 [ 368.572168][ T9966] do_sys_openat2+0x10d/0x1e0 [ 368.572212][ T9966] ? __pfx_do_sys_openat2+0x10/0x10 [ 368.572258][ T9966] ? find_held_lock+0x2b/0x80 [ 368.572304][ T9966] __x64_sys_openat+0x12d/0x210 [ 368.572353][ T9966] ? __pfx___x64_sys_openat+0x10/0x10 [ 368.572408][ T9966] ? rcu_is_watching+0x12/0xc0 [ 368.572448][ T9966] do_syscall_64+0x115/0x840 [ 368.572490][ T9966] ? clear_bhb_loop+0x40/0x90 [ 368.572548][ T9966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.572582][ T9966] RIP: 0033:0x7f37e5f9ce59 [ 368.572608][ T9966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.572638][ T9966] RSP: 002b:00007f37e6e67028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 368.572676][ T9966] RAX: ffffffffffffffda RBX: 00007f37e6215fa0 RCX: 00007f37e5f9ce59 [ 368.572697][ T9966] RDX: 0000000000000400 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 368.572716][ T9966] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 368.572734][ T9966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 368.572752][ T9966] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 368.572794][ T9966] [ 368.575051][ T29] audit: type=1804 audit(1780109949.041:4): pid=9966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz.0.917" name="/newroot/sys/kernel/debug/tracing/trace_marker" dev="tracefs" ino=1407 res=0 errno=0 [ 368.727282][ T8557] Bluetooth: hci0: command 0x2016 tx timeout [ 369.846616][ T9986] netlink: 218 bytes leftover after parsing attributes in process `syz.0.919'. [ 370.271220][ T9979] Process accounting resumed [ 370.933738][ T9997] netlink: 218 bytes leftover after parsing attributes in process `syz.3.923'. [ 370.960658][ T8557] Bluetooth: hci0: command 0x2016 tx timeout [ 371.837816][T10012] netlink: 218 bytes leftover after parsing attributes in process `syz.0.925'. [ 372.189491][T10016] netlink: 218 bytes leftover after parsing attributes in process `syz.2.926'. [ 372.759110][T10020] udc dummy_udc.0: soft-connect without a gadget driver [ 373.635848][T10040] udc dummy_udc.0: soft-connect without a gadget driver [ 374.609132][T10060] : Can't lookup blockdev [ 375.302288][T10077] : Can't lookup blockdev [ 375.968334][T10086] : Can't lookup blockdev [ 378.442690][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.450156][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.518278][T10119] udc dummy_udc.0: soft-connect without a gadget driver [ 379.029497][T10130] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 379.109199][T10135] : Can't lookup blockdev [ 382.062362][T10172] udc dummy_udc.0: soft-connect without a gadget driver [ 383.576948][ T9618] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 384.677006][T10216] netlink: 218 bytes leftover after parsing attributes in process `syz.3.970'. [ 384.861453][T10227] netlink: 218 bytes leftover after parsing attributes in process `syz.1.973'. [ 384.967326][T10232] : Can't lookup blockdev [ 385.487681][T10238] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 385.599738][ T8557] Bluetooth: hci3: command 0x2016 tx timeout [ 387.681110][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 389.700826][T10291] netlink: 218 bytes leftover after parsing attributes in process `syz.3.990'. [ 390.042279][T10296] : Can't lookup blockdev [ 393.412101][T10349] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1003'. [ 395.201634][T10367] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 395.561497][T10374] __vm_enough_memory: pid: 10374, comm: syz.3.1009, bytes: 4398046457856 not enough memory for the allocation [ 397.023115][T10396] FAULT_INJECTION: forcing a failure. [ 397.023115][T10396] name failslab, interval 1, probability 0, space 0, times 0 [ 397.078347][T10396] CPU: 0 UID: 0 PID: 10396 Comm: syz.1.1014 Tainted: G L syzkaller #0 PREEMPT(full) [ 397.078378][T10396] Tainted: [L]=SOFTLOCKUP [ 397.078385][T10396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 397.078395][T10396] Call Trace: [ 397.078401][T10396] [ 397.078409][T10396] dump_stack_lvl+0x100/0x190 [ 397.078449][T10396] should_fail_ex.cold+0x5/0xa [ 397.078474][T10396] should_failslab+0xc2/0x120 [ 397.078498][T10396] __kvmalloc_node_noprof+0xfa/0xa00 [ 397.078517][T10396] ? seq_read_iter+0x819/0x1270 [ 397.078544][T10396] seq_read_iter+0x819/0x1270 [ 397.078563][T10396] ? lock_acquire+0x1b1/0x370 [ 397.078602][T10396] kernfs_fop_read_iter+0x46c/0x610 [ 397.078658][T10396] ? rw_verify_area+0xce/0x6d0 [ 397.078678][T10396] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 397.078714][T10396] vfs_read+0x825/0xb30 [ 397.078738][T10396] ? __pfx_vfs_read+0x10/0x10 [ 397.078772][T10396] ksys_read+0x12a/0x250 [ 397.078793][T10396] ? __pfx_ksys_read+0x10/0x10 [ 397.078816][T10396] ? rcu_is_watching+0x12/0xc0 [ 397.078841][T10396] do_syscall_64+0x115/0x840 [ 397.078870][T10396] ? clear_bhb_loop+0x40/0x90 [ 397.078893][T10396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.078913][T10396] RIP: 0033:0x7fd16ff9ce59 [ 397.078929][T10396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 397.078946][T10396] RSP: 002b:00007fd170e88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 397.078964][T10396] RAX: ffffffffffffffda RBX: 00007fd170215fa0 RCX: 00007fd16ff9ce59 [ 397.078976][T10396] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000006 [ 397.078986][T10396] RBP: 00007fd170e88090 R08: 0000000000000000 R09: 0000000000000000 [ 397.078997][T10396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 397.079008][T10396] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 397.079030][T10396] [ 397.884778][T10391] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1012'. [ 398.128541][T10405] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1016'. [ 398.722165][ T8557] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 399.739695][T10423] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 400.161358][T10436] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 400.173708][T10441] : Can't lookup blockdev [ 400.185335][T10436] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 402.234173][ T8555] Bluetooth: hci2: command 0x2016 tx timeout [ 402.240383][ T8557] Bluetooth: hci1: command 0x2016 tx timeout [ 402.246498][ T8555] Bluetooth: hci0: command 0x2016 tx timeout [ 402.266987][T10436] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 402.302434][T10436] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 402.427217][T10436] Process accounting paused [ 403.052633][T10464] __vm_enough_memory: pid: 10464, comm: syz.1.1028, bytes: 4398046457856 not enough memory for the allocation [ 404.303568][ T8555] Bluetooth: hci2: command 0x2016 tx timeout [ 404.303642][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 405.398115][T10506] FAULT_INJECTION: forcing a failure. [ 405.398115][T10506] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 405.488807][T10506] CPU: 0 UID: 0 PID: 10506 Comm: syz.2.1038 Tainted: G L syzkaller #0 PREEMPT(full) [ 405.488859][T10506] Tainted: [L]=SOFTLOCKUP [ 405.488871][T10506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 405.488888][T10506] Call Trace: [ 405.488899][T10506] [ 405.488910][T10506] dump_stack_lvl+0x100/0x190 [ 405.488966][T10506] should_fail_ex.cold+0x5/0xa [ 405.488996][T10506] ? prepare_alloc_pages+0x16d/0x5f0 [ 405.489038][T10506] should_fail_alloc_page+0xeb/0x140 [ 405.489078][T10506] prepare_alloc_pages+0x1f0/0x5f0 [ 405.489125][T10506] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 405.489190][T10506] ? lock_acquire+0x1b1/0x370 [ 405.489251][T10506] ? find_held_lock+0x2b/0x80 [ 405.489287][T10506] ? page_table_check_set+0x477/0x920 [ 405.489320][T10506] ? page_table_check_set+0x477/0x920 [ 405.489360][T10506] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 405.489411][T10506] ? page_table_check_set+0x486/0x920 [ 405.489454][T10506] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 405.489489][T10506] ? xas_move_index+0xae/0x110 [ 405.489618][T10506] ? find_held_lock+0x2b/0x80 [ 405.489655][T10506] ? find_held_lock+0x2b/0x80 [ 405.489691][T10506] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 405.489760][T10506] ? policy_nodemask+0xed/0x4f0 [ 405.489810][T10506] alloc_pages_mpol+0x1fb/0x540 [ 405.489850][T10506] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 405.489893][T10506] ? __lock_acquire+0x4a5/0x2630 [ 405.489945][T10506] folio_alloc_mpol_noprof+0x36/0x260 [ 405.489991][T10506] vma_alloc_folio_noprof+0xed/0x1d0 [ 405.490034][T10506] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 405.490089][T10506] do_anonymous_page+0xb46/0x2050 [ 405.490136][T10506] ? rcu_read_unlock+0x2d/0xb0 [ 405.490192][T10506] __handle_mm_fault+0x1d2c/0x2a00 [ 405.490263][T10506] ? reacquire_held_locks+0xce/0x1e0 [ 405.490313][T10506] ? __pfx___handle_mm_fault+0x10/0x10 [ 405.490365][T10506] ? lock_vma_under_rcu+0x17c/0x590 [ 405.490435][T10506] handle_mm_fault+0x37b/0xa30 [ 405.490486][T10506] do_user_addr_fault+0x5a3/0x12f0 [ 405.490550][T10506] exc_page_fault+0x6f/0xd0 [ 405.490595][T10506] asm_exc_page_fault+0x26/0x30 [ 405.490625][T10506] RIP: 0033:0x7f4be7a5e60b [ 405.490651][T10506] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 405.490680][T10506] RSP: 002b:00007f4be8a36fa0 EFLAGS: 00010206 [ 405.490705][T10506] RAX: 0000000000000000 RBX: 00007f4be7e15fa0 RCX: 0000000000000000 [ 405.490724][T10506] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 405.490741][T10506] RBP: 00007f4be7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 405.490759][T10506] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 405.490777][T10506] R13: 00007f4be7e16038 R14: 00007f4be7e15fa0 R15: 00007ffe36bf2548 [ 405.490818][T10506] [ 405.786037][T10506] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 411.243631][ T9618] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 411.308228][T10596] __vm_enough_memory: pid: 10596, comm: syz.1.1054, bytes: 4398046457856 not enough memory for the allocation [ 412.792807][T10619] udc dummy_udc.0: soft-connect without a gadget driver [ 413.295699][ T8555] Bluetooth: hci1: command 0x2016 tx timeout [ 413.438275][T10627] : Can't lookup blockdev [ 413.964648][T10632] udc dummy_udc.0: soft-connect without a gadget driver [ 414.291550][T10638] FAULT_INJECTION: forcing a failure. [ 414.291550][T10638] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 414.362892][T10638] CPU: 1 UID: 0 PID: 10638 Comm: syz.2.1064 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.362941][T10638] Tainted: [L]=SOFTLOCKUP [ 414.362953][T10638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 414.362969][T10638] Call Trace: [ 414.362980][T10638] [ 414.362991][T10638] dump_stack_lvl+0x100/0x190 [ 414.363047][T10638] should_fail_ex.cold+0x5/0xa [ 414.363090][T10638] ? prepare_alloc_pages+0x16d/0x5f0 [ 414.363133][T10638] should_fail_alloc_page+0xeb/0x140 [ 414.363173][T10638] prepare_alloc_pages+0x1f0/0x5f0 [ 414.363219][T10638] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 414.363274][T10638] ? lock_acquire+0x1b1/0x370 [ 414.363320][T10638] ? find_held_lock+0x2b/0x80 [ 414.363356][T10638] ? page_table_check_set+0x477/0x920 [ 414.363390][T10638] ? page_table_check_set+0x477/0x920 [ 414.363429][T10638] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 414.363476][T10638] ? page_table_check_set+0x486/0x920 [ 414.363513][T10638] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 414.363546][T10638] ? xas_move_index+0xae/0x110 [ 414.363599][T10638] ? find_held_lock+0x2b/0x80 [ 414.363638][T10638] ? find_held_lock+0x2b/0x80 [ 414.363674][T10638] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 414.363720][T10638] ? policy_nodemask+0xed/0x4f0 [ 414.363761][T10638] alloc_pages_mpol+0x1fb/0x540 [ 414.363798][T10638] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 414.363839][T10638] ? __lock_acquire+0x4a5/0x2630 [ 414.363890][T10638] folio_alloc_mpol_noprof+0x36/0x260 [ 414.363933][T10638] vma_alloc_folio_noprof+0xed/0x1d0 [ 414.363975][T10638] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 414.364027][T10638] do_anonymous_page+0xb46/0x2050 [ 414.364082][T10638] ? rcu_read_unlock+0x2d/0xb0 [ 414.364137][T10638] __handle_mm_fault+0x1d2c/0x2a00 [ 414.364192][T10638] ? reacquire_held_locks+0xce/0x1e0 [ 414.364240][T10638] ? __pfx___handle_mm_fault+0x10/0x10 [ 414.364289][T10638] ? lock_vma_under_rcu+0x17c/0x590 [ 414.364355][T10638] handle_mm_fault+0x37b/0xa30 [ 414.364408][T10638] do_user_addr_fault+0x5a3/0x12f0 [ 414.364455][T10638] exc_page_fault+0x6f/0xd0 [ 414.364497][T10638] asm_exc_page_fault+0x26/0x30 [ 414.364527][T10638] RIP: 0033:0x7f4be7a5e60b [ 414.364553][T10638] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 414.364582][T10638] RSP: 002b:00007f4be8a36fa0 EFLAGS: 00010206 [ 414.364606][T10638] RAX: 0000000000000000 RBX: 00007f4be7e15fa0 RCX: 0000000000000000 [ 414.364625][T10638] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 414.364643][T10638] RBP: 00007f4be7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 414.364662][T10638] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 414.364680][T10638] R13: 00007f4be7e16038 R14: 00007f4be7e15fa0 R15: 00007ffe36bf2548 [ 414.364723][T10638] [ 414.960457][T10638] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 415.191174][T10645] __vm_enough_memory: pid: 10645, comm: syz.1.1065, bytes: 4398046457856 not enough memory for the allocation [ 415.375621][ T9618] Bluetooth: hci1: command 0x2016 tx timeout [ 415.966598][T10652] kvm: vcpu 4: requested lapic timer restore with starting count register 0x390=4294967104 (137438947328 ns) > initial count (6624 ns). Using initial count to start timer. [ 416.720575][T10671] FAULT_INJECTION: forcing a failure. [ 416.720575][T10671] name failslab, interval 1, probability 0, space 0, times 0 [ 416.799559][T10671] CPU: 1 UID: 0 PID: 10671 Comm: syz.2.1071 Tainted: G L syzkaller #0 PREEMPT(full) [ 416.799619][T10671] Tainted: [L]=SOFTLOCKUP [ 416.799630][T10671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 416.799648][T10671] Call Trace: [ 416.799658][T10671] [ 416.799671][T10671] dump_stack_lvl+0x100/0x190 [ 416.799729][T10671] should_fail_ex.cold+0x5/0xa [ 416.799773][T10671] should_failslab+0xc2/0x120 [ 416.799810][T10671] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 416.799858][T10671] ? sk_prot_alloc+0x60/0x2a0 [ 416.800037][T10671] sk_prot_alloc+0x60/0x2a0 [ 416.800076][T10671] sk_alloc+0x36/0xe80 [ 416.800108][T10671] inet_create+0x3a0/0x1060 [ 416.800207][T10671] ? inet_create+0x94/0x1060 [ 416.800261][T10671] __sock_create+0x339/0x860 [ 416.800311][T10671] __sys_socket+0x14d/0x260 [ 416.800353][T10671] ? __pfx___sys_socket+0x10/0x10 [ 416.800394][T10671] ? ksys_write+0x1ac/0x250 [ 416.800440][T10671] __x64_sys_socket+0x72/0xb0 [ 416.800509][T10671] ? lockdep_hardirqs_on+0x78/0x100 [ 416.800554][T10671] do_syscall_64+0x115/0x840 [ 416.800605][T10671] ? clear_bhb_loop+0x40/0x90 [ 416.800642][T10671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.800674][T10671] RIP: 0033:0x7f4be7b9ce59 [ 416.800701][T10671] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.800730][T10671] RSP: 002b:00007f4be8a17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 416.800761][T10671] RAX: ffffffffffffffda RBX: 00007f4be7e16090 RCX: 00007f4be7b9ce59 [ 416.800781][T10671] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 416.800799][T10671] RBP: 00007f4be7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 416.800815][T10671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 416.800830][T10671] R13: 00007f4be7e16128 R14: 00007f4be7e16090 R15: 00007ffe36bf2548 [ 416.800871][T10671] [ 417.145341][ T0] NOHZ tick-stop error: local softirq work is pending, handler #240!!! [ 417.337169][T10675] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1070'. [ 418.390239][T10686] : Can't lookup blockdev [ 418.765253][T10693] udc dummy_udc.0: soft-connect without a gadget driver [ 419.662322][T10703] : Can't lookup blockdev [ 419.817366][T10709] udc dummy_udc.0: soft-connect without a gadget driver [ 419.955738][T10711] udc dummy_udc.0: soft-connect without a gadget driver [ 422.520775][T10746] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 422.865318][T10753] : Can't lookup blockdev [ 423.336754][ T29] audit: type=1107 audit(1780110004.096:5): pid=10761 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='v6/' [ 423.369618][ T29] audit: type=1107 audit(1780110004.106:6): pid=10761 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='v6/conf/wg2/max_addresses' [ 424.140946][T10771] __vm_enough_memory: pid: 10771, comm: syz.2.1093, bytes: 4398046457856 not enough memory for the allocation [ 426.702204][T10798] udc dummy_udc.0: soft-connect without a gadget driver [ 426.725653][T10796] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1099'. [ 428.288462][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 428.537349][T10823] FAULT_INJECTION: forcing a failure. [ 428.537349][T10823] name failslab, interval 1, probability 0, space 0, times 0 [ 428.589599][T10826] FAULT_INJECTION: forcing a failure. [ 428.589599][T10826] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 428.604964][T10818] __vm_enough_memory: pid: 10818, comm: syz.3.1104, bytes: 4398046457856 not enough memory for the allocation [ 428.620643][T10823] CPU: 0 UID: 0 PID: 10823 Comm: syz.0.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 428.620683][T10823] Tainted: [L]=SOFTLOCKUP [ 428.620690][T10823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 428.620700][T10823] Call Trace: [ 428.620707][T10823] [ 428.620714][T10823] dump_stack_lvl+0x100/0x190 [ 428.620750][T10823] should_fail_ex.cold+0x5/0xa [ 428.620773][T10823] ? sd_pr_read_keys+0xc6/0x300 [ 428.620882][T10823] should_failslab+0xc2/0x120 [ 428.620904][T10823] __kmalloc_noprof+0xe0/0x850 [ 428.620927][T10823] sd_pr_read_keys+0xc6/0x300 [ 428.620955][T10823] blkdev_common_ioctl+0x1bc8/0x2b80 [ 428.621042][T10823] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 428.621079][T10823] ? do_vfs_ioctl+0x226/0x13e0 [ 428.621097][T10823] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 428.621121][T10823] ? find_held_lock+0x2b/0x80 [ 428.621144][T10823] ? __fget_files+0x215/0x3d0 [ 428.621168][T10823] blkdev_ioctl+0x43b/0x6f0 [ 428.621196][T10823] ? __pfx_blkdev_ioctl+0x10/0x10 [ 428.621227][T10823] ? __pfx_blkdev_ioctl+0x10/0x10 [ 428.621255][T10823] __x64_sys_ioctl+0x18e/0x210 [ 428.621275][T10823] do_syscall_64+0x115/0x840 [ 428.621301][T10823] ? clear_bhb_loop+0x40/0x90 [ 428.621323][T10823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.621346][T10823] RIP: 0033:0x7f37e5f9ce59 [ 428.621362][T10823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.621380][T10823] RSP: 002b:00007f37e6e67028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 428.621398][T10823] RAX: ffffffffffffffda RBX: 00007f37e6215fa0 RCX: 00007f37e5f9ce59 [ 428.621410][T10823] RDX: 0000000000000000 RSI: 00000000c01070ce RDI: 0000000000000006 [ 428.621421][T10823] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 428.621432][T10823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.621443][T10823] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 428.621465][T10823] [ 428.735442][T10826] CPU: 1 UID: 0 PID: 10826 Comm: syz.1.1106 Tainted: G L syzkaller #0 PREEMPT(full) [ 428.735489][T10826] Tainted: [L]=SOFTLOCKUP [ 428.735499][T10826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 428.735514][T10826] Call Trace: [ 428.735525][T10826] [ 428.735536][T10826] dump_stack_lvl+0x100/0x190 [ 428.735586][T10826] should_fail_ex.cold+0x5/0xa [ 428.735617][T10826] ? prepare_alloc_pages+0x16d/0x5f0 [ 428.735655][T10826] should_fail_alloc_page+0xeb/0x140 [ 428.735689][T10826] prepare_alloc_pages+0x1f0/0x5f0 [ 428.735729][T10826] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 428.735779][T10826] ? lock_acquire+0x1b1/0x370 [ 428.735824][T10826] ? __lock_acquire+0x4a5/0x2630 [ 428.735867][T10826] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 428.735908][T10826] ? page_table_check_set+0x486/0x920 [ 428.735945][T10826] ? do_raw_spin_lock+0x128/0x260 [ 428.735982][T10826] ? mark_held_locks+0x40/0x70 [ 428.736021][T10826] ? find_held_lock+0x2b/0x80 [ 428.736052][T10826] ? find_held_lock+0x2b/0x80 [ 428.736090][T10826] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 428.736130][T10826] ? policy_nodemask+0xed/0x4f0 [ 428.736165][T10826] alloc_pages_mpol+0x1fb/0x540 [ 428.736199][T10826] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 428.736234][T10826] ? __lock_acquire+0x4a5/0x2630 [ 428.736278][T10826] folio_alloc_mpol_noprof+0x36/0x260 [ 428.736317][T10826] vma_alloc_folio_noprof+0xed/0x1d0 [ 428.736354][T10826] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 428.736401][T10826] do_anonymous_page+0xb46/0x2050 [ 428.736441][T10826] ? rcu_read_unlock+0x2d/0xb0 [ 428.736488][T10826] __handle_mm_fault+0x1d2c/0x2a00 [ 428.736534][T10826] ? reacquire_held_locks+0xce/0x1e0 [ 428.736576][T10826] ? __pfx___handle_mm_fault+0x10/0x10 [ 428.736621][T10826] ? lock_vma_under_rcu+0x17c/0x590 [ 428.736681][T10826] handle_mm_fault+0x37b/0xa30 [ 428.736726][T10826] do_user_addr_fault+0x5a3/0x12f0 [ 428.736768][T10826] exc_page_fault+0x6f/0xd0 [ 428.736807][T10826] asm_exc_page_fault+0x26/0x30 [ 428.736833][T10826] RIP: 0033:0x7fd16fe5e60b [ 428.736856][T10826] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 428.736881][T10826] RSP: 002b:00007fd170e86fa0 EFLAGS: 00010206 [ 428.736902][T10826] RAX: 0000000000000000 RBX: 00007fd170215fa0 RCX: 0000000000000000 [ 428.736919][T10826] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 428.736936][T10826] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 428.736952][T10826] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 428.736969][T10826] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 428.737006][T10826] [ 428.738141][T10826] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 429.529986][T10837] udc dummy_udc.0: soft-connect without a gadget driver [ 430.528622][T10849] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1111'. [ 431.157513][T10856] FAULT_INJECTION: forcing a failure. [ 431.157513][T10856] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 431.171078][T10856] CPU: 0 UID: 0 PID: 10856 Comm: syz.1.1113 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.171125][T10856] Tainted: [L]=SOFTLOCKUP [ 431.171134][T10856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 431.171151][T10856] Call Trace: [ 431.171162][T10856] [ 431.171172][T10856] dump_stack_lvl+0x100/0x190 [ 431.171225][T10856] should_fail_ex.cold+0x5/0xa [ 431.171256][T10856] ? prepare_alloc_pages+0x16d/0x5f0 [ 431.171297][T10856] should_fail_alloc_page+0xeb/0x140 [ 431.171336][T10856] prepare_alloc_pages+0x1f0/0x5f0 [ 431.171380][T10856] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 431.171436][T10856] ? lock_acquire+0x1b1/0x370 [ 431.171488][T10856] ? find_held_lock+0x2b/0x80 [ 431.171528][T10856] ? page_table_check_set+0x477/0x920 [ 431.171561][T10856] ? page_table_check_set+0x477/0x920 [ 431.171596][T10856] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 431.171651][T10856] ? page_table_check_set+0x486/0x920 [ 431.171690][T10856] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 431.171722][T10856] ? xas_move_index+0xae/0x110 [ 431.171772][T10856] ? find_held_lock+0x2b/0x80 [ 431.171805][T10856] ? find_held_lock+0x2b/0x80 [ 431.171839][T10856] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 431.171881][T10856] ? policy_nodemask+0xed/0x4f0 [ 431.171917][T10856] alloc_pages_mpol+0x1fb/0x540 [ 431.171965][T10856] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 431.172004][T10856] ? __lock_acquire+0x4a5/0x2630 [ 431.172053][T10856] folio_alloc_mpol_noprof+0x36/0x260 [ 431.172096][T10856] vma_alloc_folio_noprof+0xed/0x1d0 [ 431.172137][T10856] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 431.172191][T10856] do_anonymous_page+0xb46/0x2050 [ 431.172241][T10856] ? rcu_read_unlock+0x2d/0xb0 [ 431.172293][T10856] __handle_mm_fault+0x1d2c/0x2a00 [ 431.172345][T10856] ? reacquire_held_locks+0xce/0x1e0 [ 431.172391][T10856] ? __pfx___handle_mm_fault+0x10/0x10 [ 431.172441][T10856] ? lock_vma_under_rcu+0x17c/0x590 [ 431.172510][T10856] handle_mm_fault+0x37b/0xa30 [ 431.172564][T10856] do_user_addr_fault+0x5a3/0x12f0 [ 431.172613][T10856] exc_page_fault+0x6f/0xd0 [ 431.172655][T10856] asm_exc_page_fault+0x26/0x30 [ 431.172686][T10856] RIP: 0033:0x7fd16fe5e60b [ 431.172711][T10856] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 431.172742][T10856] RSP: 002b:00007fd170e86fa0 EFLAGS: 00010206 [ 431.172765][T10856] RAX: 0000000000000000 RBX: 00007fd170215fa0 RCX: 0000000000000000 [ 431.172784][T10856] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 431.172802][T10856] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 431.172819][T10856] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 431.172836][T10856] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 431.172878][T10856] [ 431.492985][T10856] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 432.870118][T10883] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 434.838805][T10907] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1123'. [ 434.973793][T10871] Process accounting resumed [ 438.141807][T10959] FAULT_INJECTION: forcing a failure. [ 438.141807][T10959] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 438.185580][T10959] CPU: 1 UID: 0 PID: 10959 Comm: syz.1.1137 Tainted: G L syzkaller #0 PREEMPT(full) [ 438.185628][T10959] Tainted: [L]=SOFTLOCKUP [ 438.185638][T10959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 438.185655][T10959] Call Trace: [ 438.185665][T10959] [ 438.185676][T10959] dump_stack_lvl+0x100/0x190 [ 438.185713][T10959] should_fail_ex.cold+0x5/0xa [ 438.185732][T10959] ? prepare_alloc_pages+0x16d/0x5f0 [ 438.185766][T10959] should_fail_alloc_page+0xeb/0x140 [ 438.185803][T10959] prepare_alloc_pages+0x1f0/0x5f0 [ 438.185845][T10959] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 438.185900][T10959] ? lock_acquire+0x1b1/0x370 [ 438.185947][T10959] ? find_held_lock+0x2b/0x80 [ 438.185983][T10959] ? page_table_check_set+0x477/0x920 [ 438.186013][T10959] ? page_table_check_set+0x477/0x920 [ 438.186050][T10959] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 438.186098][T10959] ? page_table_check_set+0x486/0x920 [ 438.186124][T10959] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 438.186150][T10959] ? xas_move_index+0xae/0x110 [ 438.186201][T10959] ? find_held_lock+0x2b/0x80 [ 438.186234][T10959] ? find_held_lock+0x2b/0x80 [ 438.186260][T10959] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 438.186288][T10959] ? policy_nodemask+0xed/0x4f0 [ 438.186311][T10959] alloc_pages_mpol+0x1fb/0x540 [ 438.186342][T10959] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 438.186366][T10959] ? __lock_acquire+0x4a5/0x2630 [ 438.186396][T10959] folio_alloc_mpol_noprof+0x36/0x260 [ 438.186422][T10959] vma_alloc_folio_noprof+0xed/0x1d0 [ 438.186447][T10959] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 438.186480][T10959] do_anonymous_page+0xb46/0x2050 [ 438.186511][T10959] ? rcu_read_unlock+0x2d/0xb0 [ 438.186544][T10959] __handle_mm_fault+0x1d2c/0x2a00 [ 438.186578][T10959] ? __pfx___handle_mm_fault+0x10/0x10 [ 438.186605][T10959] ? irqentry_exit+0x24d/0x970 [ 438.186630][T10959] ? lockdep_hardirqs_on+0x78/0x100 [ 438.186667][T10959] ? handle_mm_fault+0x103/0xa30 [ 438.186695][T10959] handle_mm_fault+0x37b/0xa30 [ 438.186726][T10959] do_user_addr_fault+0x5a3/0x12f0 [ 438.186754][T10959] exc_page_fault+0x6f/0xd0 [ 438.186779][T10959] asm_exc_page_fault+0x26/0x30 [ 438.186798][T10959] RIP: 0033:0x7fd16fe5e60b [ 438.186822][T10959] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 438.186848][T10959] RSP: 002b:00007fd170e86fa0 EFLAGS: 00010206 [ 438.186872][T10959] RAX: 0000000000000000 RBX: 00007fd170215fa0 RCX: 0000000000000000 [ 438.186890][T10959] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 438.186906][T10959] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 438.186921][T10959] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 438.186932][T10959] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 438.186956][T10959] [ 438.550171][T10960] __vm_enough_memory: pid: 10960, comm: syz.2.1135, bytes: 4398046457856 not enough memory for the allocation [ 438.695480][T10959] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 438.819264][T10971] udc dummy_udc.0: soft-connect without a gadget driver [ 439.542442][T10983] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1142'. [ 439.561727][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.569466][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.601713][T10983] IPv6: NLM_F_CREATE should be specified when creating new route [ 439.618877][T10983] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 439.627319][T10983] IPv6: NLM_F_CREATE should be set when creating new route [ 439.634617][T10983] IPv6: NLM_F_CREATE should be set when creating new route [ 439.904921][T10986] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1142'. [ 441.601160][T11019] udc dummy_udc.0: soft-connect without a gadget driver [ 441.955491][T11026] : Can't lookup blockdev [ 443.872815][T11045] futex_wake_op: syz.0.1153 tries to shift op by -2048; fix this program [ 443.934289][T11045] futex_wake_op: syz.0.1153 tries to shift op by -2048; fix this program [ 444.024440][T11045] 0x000000000001-0x000000020000 : "" [ 444.199004][T11045] ftl_cs: FTL header corrupt! [ 445.386192][T11066] netlink: 'syz.0.1157': attribute type 1 has an invalid length. [ 445.907927][T11072] : Can't lookup blockdev [ 448.183731][T11109] FAULT_INJECTION: forcing a failure. [ 448.183731][T11109] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 448.197479][T11109] CPU: 0 UID: 0 PID: 11109 Comm: syz.0.1167 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.197531][T11109] Tainted: [L]=SOFTLOCKUP [ 448.197543][T11109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 448.197561][T11109] Call Trace: [ 448.197572][T11109] [ 448.197583][T11109] dump_stack_lvl+0x100/0x190 [ 448.197637][T11109] should_fail_ex.cold+0x5/0xa [ 448.197675][T11109] _copy_from_user+0x2e/0xd0 [ 448.197834][T11109] move_addr_to_kernel+0x65/0x170 [ 448.197883][T11109] __sys_sendto+0x1c9/0x4b0 [ 448.197934][T11109] ? __pfx___sys_sendto+0x10/0x10 [ 448.197996][T11109] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 448.198036][T11109] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 448.198101][T11109] __x64_sys_sendto+0xe0/0x1c0 [ 448.198146][T11109] ? do_syscall_64+0x90/0x840 [ 448.198190][T11109] ? lockdep_hardirqs_on+0x78/0x100 [ 448.198234][T11109] do_syscall_64+0x115/0x840 [ 448.198277][T11109] ? clear_bhb_loop+0x40/0x90 [ 448.198315][T11109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.198347][T11109] RIP: 0033:0x7f37e5f5d68e [ 448.198375][T11109] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 448.198405][T11109] RSP: 002b:00007f37e6e65e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 448.198435][T11109] RAX: ffffffffffffffda RBX: 00007f37e6e676c0 RCX: 00007f37e5f5d68e [ 448.198456][T11109] RDX: 0000000000000020 RSI: 00007f37e6e66000 RDI: 0000000000000008 [ 448.198475][T11109] RBP: 0000000000000000 R08: 00007f37e6e65f04 R09: 000000000000000c [ 448.198493][T11109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 448.198512][T11109] R13: 00007f37e6e65f58 R14: 00007f37e6e66000 R15: 0000000000000000 [ 448.198553][T11109] [ 448.979242][T11129] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 449.014491][T11126] __vm_enough_memory: pid: 11126, comm: syz.2.1170, bytes: 4398046457856 not enough memory for the allocation [ 449.419712][T11137] udc dummy_udc.0: soft-connect without a gadget driver [ 450.803062][T11158] FAULT_INJECTION: forcing a failure. [ 450.803062][T11158] name failslab, interval 1, probability 0, space 0, times 0 [ 450.815958][T11158] CPU: 1 UID: 0 PID: 11158 Comm: syz.3.1178 Tainted: G L syzkaller #0 PREEMPT(full) [ 450.816007][T11158] Tainted: [L]=SOFTLOCKUP [ 450.816018][T11158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 450.816035][T11158] Call Trace: [ 450.816045][T11158] [ 450.816057][T11158] dump_stack_lvl+0x100/0x190 [ 450.816115][T11158] should_fail_ex.cold+0x5/0xa [ 450.816154][T11158] should_failslab+0xc2/0x120 [ 450.816189][T11158] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 450.816234][T11158] ? __alloc_skb+0x140/0x710 [ 450.816339][T11158] ? __alloc_skb+0x5b7/0x710 [ 450.816380][T11158] __alloc_skb+0x140/0x710 [ 450.816404][T11158] ? __alloc_skb+0x5b7/0x710 [ 450.816429][T11158] ? __pfx___alloc_skb+0x10/0x10 [ 450.816468][T11158] netlink_alloc_large_skb+0x69/0x150 [ 450.816549][T11158] netlink_sendmsg+0x680/0xda0 [ 450.816593][T11158] ? __pfx_netlink_sendmsg+0x10/0x10 [ 450.816634][T11158] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 450.816706][T11158] __sys_sendto+0x468/0x4b0 [ 450.816750][T11158] ? __pfx_netlink_sendmsg+0x10/0x10 [ 450.816788][T11158] ? __pfx___sys_sendto+0x10/0x10 [ 450.816841][T11158] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 450.816874][T11158] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 450.816934][T11158] __x64_sys_sendto+0xe0/0x1c0 [ 450.816983][T11158] ? do_syscall_64+0x90/0x840 [ 450.817026][T11158] ? lockdep_hardirqs_on+0x78/0x100 [ 450.817069][T11158] do_syscall_64+0x115/0x840 [ 450.817111][T11158] ? clear_bhb_loop+0x40/0x90 [ 450.817150][T11158] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.817188][T11158] RIP: 0033:0x7f7fb495d68e [ 450.817214][T11158] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 450.817244][T11158] RSP: 002b:00007f7fb2bf4e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 450.817275][T11158] RAX: ffffffffffffffda RBX: 00007f7fb2bf66c0 RCX: 00007f7fb495d68e [ 450.817296][T11158] RDX: 0000000000000020 RSI: 00007f7fb2bf5000 RDI: 0000000000000008 [ 450.817314][T11158] RBP: 0000000000000000 R08: 00007f7fb2bf4f04 R09: 000000000000000c [ 450.817332][T11158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 450.817349][T11158] R13: 00007f7fb2bf4f58 R14: 00007f7fb2bf5000 R15: 0000000000000000 [ 450.817396][T11158] [ 451.874756][T11172] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1179'. [ 451.943442][T11176] udc dummy_udc.0: soft-connect without a gadget driver [ 452.371213][T11181] udc dummy_udc.0: soft-connect without a gadget driver [ 452.762666][T11185] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1183'. [ 454.561717][T11217] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 455.070603][T11224] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 457.661156][ T9618] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 457.838569][T11270] udc dummy_udc.0: soft-connect without a gadget driver [ 458.654770][T11284] __vm_enough_memory: pid: 11284, comm: syz.1.1203, bytes: 4398046457856 not enough memory for the allocation [ 459.694803][ T8555] Bluetooth: hci0: command 0x2016 tx timeout [ 460.271807][T11308] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 460.294740][T11312] __vm_enough_memory: pid: 11312, comm: syz.0.1210, bytes: 4398046457856 not enough memory for the allocation [ 460.362842][T11314] udc dummy_udc.0: soft-connect without a gadget driver [ 461.303628][T11326] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1212'. [ 461.764285][ T9618] Bluetooth: hci0: command 0x2016 tx timeout [ 464.380771][T11364] udc dummy_udc.0: soft-connect without a gadget driver [ 464.645475][T11369] __vm_enough_memory: pid: 11369, comm: syz.2.1221, bytes: 4398046457856 not enough memory for the allocation [ 464.693281][T11373] : Can't lookup blockdev [ 465.424362][T11377] Process accounting paused [ 465.612602][T11390] __vm_enough_memory: pid: 11390, comm: syz.2.1226, bytes: 4398046457856 not enough memory for the allocation [ 465.645864][T11389] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1225'. [ 466.021298][T11398] __vm_enough_memory: pid: 11398, comm: syz.0.1228, bytes: 4398046457856 not enough memory for the allocation [ 467.915866][T11420] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 469.409532][T11443] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1237'. [ 470.394195][T11454] usb usb16: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 470.481455][T11461] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 470.852340][T11463] udc dummy_udc.0: soft-connect without a gadget driver [ 471.059747][T11467] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 471.569631][T11473] udc dummy_udc.0: soft-connect without a gadget driver [ 472.093152][T11454] kexec: Could not allocate control_code_buffer [ 473.033454][T11498] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 474.766490][ T8555] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 475.550511][T11547] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 475.849579][T11557] FAULT_INJECTION: forcing a failure. [ 475.849579][T11557] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 475.849641][T11557] CPU: 1 UID: 0 PID: 11557 Comm: syz.0.1264 Tainted: G L syzkaller #0 PREEMPT(full) [ 475.849689][T11557] Tainted: [L]=SOFTLOCKUP [ 475.849701][T11557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 475.849719][T11557] Call Trace: [ 475.849729][T11557] [ 475.849740][T11557] dump_stack_lvl+0x100/0x190 [ 475.849795][T11557] should_fail_ex.cold+0x5/0xa [ 475.849834][T11557] _copy_from_iter+0x1f4/0x1690 [ 475.849949][T11557] ? __asan_memset+0x23/0x50 [ 475.849997][T11557] ? __pfx__copy_from_iter+0x10/0x10 [ 475.850036][T11557] ? __pfx___alloc_skb+0x10/0x10 [ 475.850079][T11557] netlink_sendmsg+0x808/0xda0 [ 475.850126][T11557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.850167][T11557] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 475.850204][T11557] __sys_sendto+0x468/0x4b0 [ 475.850246][T11557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.850285][T11557] ? __pfx___sys_sendto+0x10/0x10 [ 475.850343][T11557] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 475.850377][T11557] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 475.850437][T11557] __x64_sys_sendto+0xe0/0x1c0 [ 475.850476][T11557] ? do_syscall_64+0x90/0x840 [ 475.850501][T11557] ? lockdep_hardirqs_on+0x78/0x100 [ 475.850527][T11557] do_syscall_64+0x115/0x840 [ 475.850551][T11557] ? clear_bhb_loop+0x40/0x90 [ 475.850574][T11557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.850593][T11557] RIP: 0033:0x7f37e5f5d68e [ 475.850609][T11557] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 475.850627][T11557] RSP: 002b:00007f37e6e65e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 475.850654][T11557] RAX: ffffffffffffffda RBX: 00007f37e6e676c0 RCX: 00007f37e5f5d68e [ 475.850669][T11557] RDX: 0000000000000020 RSI: 00007f37e6e66000 RDI: 0000000000000008 [ 475.850687][T11557] RBP: 0000000000000000 R08: 00007f37e6e65f04 R09: 000000000000000c [ 475.850705][T11557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 475.850721][T11557] R13: 00007f37e6e65f58 R14: 00007f37e6e66000 R15: 0000000000000000 [ 475.850744][T11557] [ 476.570355][T11568] FAULT_INJECTION: forcing a failure. [ 476.570355][T11568] name failslab, interval 1, probability 0, space 0, times 0 [ 476.570390][T11568] CPU: 0 UID: 0 PID: 11568 Comm: syz.1.1267 Tainted: G L syzkaller #0 PREEMPT(full) [ 476.570416][T11568] Tainted: [L]=SOFTLOCKUP [ 476.570422][T11568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 476.570433][T11568] Call Trace: [ 476.570439][T11568] [ 476.570450][T11568] dump_stack_lvl+0x100/0x190 [ 476.570485][T11568] should_fail_ex.cold+0x5/0xa [ 476.570508][T11568] ? alloc_pipe_info+0x1ec/0x590 [ 476.570531][T11568] should_failslab+0xc2/0x120 [ 476.570553][T11568] __kmalloc_noprof+0xe0/0x850 [ 476.570575][T11568] alloc_pipe_info+0x1ec/0x590 [ 476.570601][T11568] splice_direct_to_actor+0x78f/0xa30 [ 476.570626][T11568] ? __lock_acquire+0x4a5/0x2630 [ 476.570654][T11568] ? __pfx_direct_splice_actor+0x10/0x10 [ 476.570692][T11568] ? __pfx_aa_file_perm+0x10/0x10 [ 476.570773][T11568] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 476.570813][T11568] do_splice_direct+0x174/0x240 [ 476.570849][T11568] ? __pfx_do_splice_direct+0x10/0x10 [ 476.570878][T11568] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 476.570905][T11568] ? rw_verify_area+0xce/0x6d0 [ 476.570925][T11568] do_sendfile+0xadc/0xe20 [ 476.570949][T11568] ? __pfx_do_sendfile+0x10/0x10 [ 476.570970][T11568] ? __fget_files+0x21f/0x3d0 [ 476.570997][T11568] __x64_sys_sendfile64+0x1d8/0x220 [ 476.571022][T11568] ? ksys_write+0x1ac/0x250 [ 476.571043][T11568] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 476.571071][T11568] ? rcu_is_watching+0x12/0xc0 [ 476.571095][T11568] do_syscall_64+0x115/0x840 [ 476.571122][T11568] ? clear_bhb_loop+0x40/0x90 [ 476.571144][T11568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.571163][T11568] RIP: 0033:0x7fd16ff9ce59 [ 476.571182][T11568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.571208][T11568] RSP: 002b:00007fd170e88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 476.571236][T11568] RAX: ffffffffffffffda RBX: 00007fd170215fa0 RCX: 00007fd16ff9ce59 [ 476.571250][T11568] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 476.571261][T11568] RBP: 00007fd170e88090 R08: 0000000000000000 R09: 0000000000000000 [ 476.571272][T11568] R10: 0000400000000006 R11: 0000000000000246 R12: 0000000000000001 [ 476.571283][T11568] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 476.571306][T11568] [ 476.806995][ T9618] Bluetooth: hci1: command 0x2016 tx timeout [ 476.851265][T11569] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1265'. [ 478.653074][T11598] FAULT_INJECTION: forcing a failure. [ 478.653074][T11598] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 478.653167][T11598] CPU: 1 UID: 0 PID: 11598 Comm: syz.0.1274 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.653204][T11598] Tainted: [L]=SOFTLOCKUP [ 478.653213][T11598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 478.653227][T11598] Call Trace: [ 478.653234][T11598] [ 478.653241][T11598] dump_stack_lvl+0x100/0x190 [ 478.653278][T11598] should_fail_ex.cold+0x5/0xa [ 478.653299][T11598] ? prepare_alloc_pages+0x16d/0x5f0 [ 478.653330][T11598] should_fail_alloc_page+0xeb/0x140 [ 478.653362][T11598] prepare_alloc_pages+0x1f0/0x5f0 [ 478.653392][T11598] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 478.653428][T11598] ? lock_acquire+0x1b1/0x370 [ 478.653458][T11598] ? find_held_lock+0x2b/0x80 [ 478.653479][T11598] ? page_table_check_set+0x477/0x920 [ 478.653500][T11598] ? page_table_check_set+0x477/0x920 [ 478.653523][T11598] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 478.653562][T11598] ? page_table_check_set+0x486/0x920 [ 478.653585][T11598] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 478.653605][T11598] ? xas_move_index+0xae/0x110 [ 478.653637][T11598] ? find_held_lock+0x2b/0x80 [ 478.653658][T11598] ? find_held_lock+0x2b/0x80 [ 478.653681][T11598] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 478.653719][T11598] ? policy_nodemask+0xed/0x4f0 [ 478.653743][T11598] alloc_pages_mpol+0x1fb/0x540 [ 478.653765][T11598] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 478.653790][T11598] ? __lock_acquire+0x4a5/0x2630 [ 478.653821][T11598] folio_alloc_mpol_noprof+0x36/0x260 [ 478.653851][T11598] vma_alloc_folio_noprof+0xed/0x1d0 [ 478.653880][T11598] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 478.653912][T11598] do_anonymous_page+0xb46/0x2050 [ 478.653940][T11598] ? rcu_read_unlock+0x2d/0xb0 [ 478.653972][T11598] __handle_mm_fault+0x1d2c/0x2a00 [ 478.654004][T11598] ? reacquire_held_locks+0xce/0x1e0 [ 478.654034][T11598] ? __pfx___handle_mm_fault+0x10/0x10 [ 478.654065][T11598] ? lock_vma_under_rcu+0x17c/0x590 [ 478.654105][T11598] handle_mm_fault+0x37b/0xa30 [ 478.654136][T11598] do_user_addr_fault+0x5a3/0x12f0 [ 478.654165][T11598] exc_page_fault+0x6f/0xd0 [ 478.654193][T11598] asm_exc_page_fault+0x26/0x30 [ 478.654211][T11598] RIP: 0033:0x7f37e5e5e60b [ 478.654228][T11598] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 478.654245][T11598] RSP: 002b:00007f37e6e65fa0 EFLAGS: 00010206 [ 478.654260][T11598] RAX: 0000000000000000 RBX: 00007f37e6215fa0 RCX: 0000000000000000 [ 478.654271][T11598] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 478.654282][T11598] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 478.654293][T11598] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 478.654303][T11598] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 478.654326][T11598] [ 478.668701][T11598] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 478.875299][ T8555] Bluetooth: hci1: command 0x2016 tx timeout [ 478.973975][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 479.245776][T11604] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1273'. [ 480.256908][T11625] openvswitch: netlink: IP tunnel dst address not specified [ 482.251962][T11651] FAULT_INJECTION: forcing a failure. [ 482.251962][T11651] name failslab, interval 1, probability 0, space 0, times 0 [ 482.268398][T11651] CPU: 1 UID: 0 PID: 11651 Comm: syz.2.1285 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.268430][T11651] Tainted: [L]=SOFTLOCKUP [ 482.268437][T11651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 482.268448][T11651] Call Trace: [ 482.268454][T11651] [ 482.268463][T11651] dump_stack_lvl+0x100/0x190 [ 482.268498][T11651] should_fail_ex.cold+0x5/0xa [ 482.268523][T11651] should_failslab+0xc2/0x120 [ 482.268545][T11651] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 482.268573][T11651] ? skb_clone+0x190/0x400 [ 482.268597][T11651] skb_clone+0x190/0x400 [ 482.268616][T11651] netlink_deliver_tap+0xaed/0xcc0 [ 482.268644][T11651] netlink_unicast+0x62b/0x850 [ 482.268671][T11651] ? __pfx_netlink_unicast+0x10/0x10 [ 482.268708][T11651] netlink_sendmsg+0x8b0/0xda0 [ 482.268736][T11651] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.268763][T11651] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 482.268786][T11651] __sys_sendto+0x468/0x4b0 [ 482.268813][T11651] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.268838][T11651] ? __pfx___sys_sendto+0x10/0x10 [ 482.268873][T11651] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 482.268897][T11651] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 482.268934][T11651] __x64_sys_sendto+0xe0/0x1c0 [ 482.268962][T11651] ? do_syscall_64+0x90/0x840 [ 482.268987][T11651] ? lockdep_hardirqs_on+0x78/0x100 [ 482.269012][T11651] do_syscall_64+0x115/0x840 [ 482.269036][T11651] ? clear_bhb_loop+0x40/0x90 [ 482.269059][T11651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.269078][T11651] RIP: 0033:0x7f4be7b5d68e [ 482.269093][T11651] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 482.269111][T11651] RSP: 002b:00007f4be8a36e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 482.269130][T11651] RAX: ffffffffffffffda RBX: 00007f4be8a386c0 RCX: 00007f4be7b5d68e [ 482.269141][T11651] RDX: 0000000000000020 RSI: 00007f4be8a37000 RDI: 0000000000000008 [ 482.269152][T11651] RBP: 0000000000000000 R08: 00007f4be8a36f04 R09: 000000000000000c [ 482.269163][T11651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 482.269173][T11651] R13: 00007f4be8a36f58 R14: 00007f4be8a37000 R15: 0000000000000000 [ 482.269195][T11651] [ 483.645131][T11666] __vm_enough_memory: pid: 11666, comm: syz.0.1287, bytes: 4398046457856 not enough memory for the allocation [ 484.363301][T11681] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1291'. [ 484.622881][T11684] FAULT_INJECTION: forcing a failure. [ 484.622881][T11684] name failslab, interval 1, probability 0, space 0, times 0 [ 484.677406][T11684] CPU: 1 UID: 0 PID: 11684 Comm: syz.0.1292 Tainted: G L syzkaller #0 PREEMPT(full) [ 484.677450][T11684] Tainted: [L]=SOFTLOCKUP [ 484.677457][T11684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 484.677468][T11684] Call Trace: [ 484.677475][T11684] [ 484.677482][T11684] dump_stack_lvl+0x100/0x190 [ 484.677518][T11684] should_fail_ex.cold+0x5/0xa [ 484.677542][T11684] ? copy_splice_read+0x1a3/0xb90 [ 484.677567][T11684] should_failslab+0xc2/0x120 [ 484.677589][T11684] __kmalloc_noprof+0xe0/0x850 [ 484.677611][T11684] copy_splice_read+0x1a3/0xb90 [ 484.677639][T11684] ? __pfx_copy_splice_read+0x10/0x10 [ 484.677664][T11684] ? look_up_lock_class+0x55/0x120 [ 484.677696][T11684] ? lockdep_init_map_type+0x5c/0x250 [ 484.677728][T11684] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 484.677751][T11684] ? __pfx_copy_splice_read+0x10/0x10 [ 484.677774][T11684] do_splice_read+0x285/0x370 [ 484.677799][T11684] splice_direct_to_actor+0x2a1/0xa30 [ 484.677825][T11684] ? __pfx_direct_splice_actor+0x10/0x10 [ 484.677852][T11684] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 484.677888][T11684] do_splice_direct+0x174/0x240 [ 484.677925][T11684] ? __pfx_do_splice_direct+0x10/0x10 [ 484.677953][T11684] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 484.677980][T11684] ? rw_verify_area+0xce/0x6d0 [ 484.678001][T11684] do_sendfile+0xadc/0xe20 [ 484.678024][T11684] ? __pfx_do_sendfile+0x10/0x10 [ 484.678052][T11684] ? irqentry_exit+0x24d/0x970 [ 484.678079][T11684] ? irqentry_exit+0x24d/0x970 [ 484.678109][T11684] __x64_sys_sendfile64+0x1d8/0x220 [ 484.678136][T11684] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 484.678168][T11684] do_syscall_64+0x115/0x840 [ 484.678193][T11684] ? clear_bhb_loop+0x40/0x90 [ 484.678215][T11684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.678234][T11684] RIP: 0033:0x7f37e5f9ce59 [ 484.678251][T11684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.678269][T11684] RSP: 002b:00007f37e6e67028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 484.678287][T11684] RAX: ffffffffffffffda RBX: 00007f37e6215fa0 RCX: 00007f37e5f9ce59 [ 484.678299][T11684] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 484.678309][T11684] RBP: 00007f37e6e67090 R08: 0000000000000000 R09: 0000000000000000 [ 484.678320][T11684] R10: 0000400000000006 R11: 0000000000000246 R12: 0000000000000001 [ 484.678331][T11684] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 484.678352][T11684] [ 485.917474][T11699] smpboot: CPU 1 is now offline [ 486.728207][T11713] netlink: 'syz.3.1298': attribute type 19 has an invalid length. [ 486.805780][T11713] netlink: 226 bytes leftover after parsing attributes in process `syz.3.1298'. [ 488.503191][T11739] __vm_enough_memory: pid: 11739, comm: syz.3.1304, bytes: 4398046457856 not enough memory for the allocation [ 489.499856][ T9618] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 490.771631][T11784] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1312'. [ 491.528594][ T9618] Bluetooth: hci0: command 0x2016 tx timeout [ 491.822183][T11799] udc dummy_udc.0: soft-connect without a gadget driver [ 492.771204][T11817] : Can't lookup blockdev [ 493.598299][ T8555] Bluetooth: hci0: command 0x2016 tx timeout [ 495.044608][T11858] udc dummy_udc.0: soft-connect without a gadget driver [ 495.417129][T11853] Process accounting resumed [ 496.101677][T11872] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1330'. [ 496.248044][T11875] vhci_hcd vhci_hcd.0: default hub control req: 0000 v0000 i0000 l0 [ 497.257487][T11886] : Can't lookup blockdev [ 497.483432][T11887] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1333'. [ 498.707101][T11900] netlink: 'syz.1.1336': attribute type 64 has an invalid length. [ 498.734226][T11900] netlink: 74 bytes leftover after parsing attributes in process `syz.1.1336'. [ 500.683821][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.690333][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 500.962397][T11939] udc dummy_udc.0: soft-connect without a gadget driver [ 501.078164][T11941] FAULT_INJECTION: forcing a failure. [ 501.078164][T11941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 501.183204][T11941] CPU: 0 UID: 0 PID: 11941 Comm: syz.2.1345 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.183236][T11941] Tainted: [L]=SOFTLOCKUP [ 501.183243][T11941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 501.183254][T11941] Call Trace: [ 501.183262][T11941] [ 501.183269][T11941] dump_stack_lvl+0x100/0x190 [ 501.183305][T11941] should_fail_ex.cold+0x5/0xa [ 501.183336][T11941] _copy_from_user+0x2e/0xd0 [ 501.183362][T11941] move_addr_to_kernel+0x65/0x170 [ 501.183390][T11941] __sys_sendto+0x1c9/0x4b0 [ 501.183419][T11941] ? __pfx___sys_sendto+0x10/0x10 [ 501.183455][T11941] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 501.183476][T11941] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 501.183511][T11941] __x64_sys_sendto+0xe0/0x1c0 [ 501.183540][T11941] ? do_syscall_64+0x90/0x840 [ 501.183565][T11941] ? lockdep_hardirqs_on+0x78/0x100 [ 501.183594][T11941] do_syscall_64+0x115/0x840 [ 501.183618][T11941] ? clear_bhb_loop+0x40/0x90 [ 501.183640][T11941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.183658][T11941] RIP: 0033:0x7f4be7b5d68e [ 501.183674][T11941] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 501.183691][T11941] RSP: 002b:00007f4be8a36e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 501.183709][T11941] RAX: ffffffffffffffda RBX: 00007f4be8a386c0 RCX: 00007f4be7b5d68e [ 501.183721][T11941] RDX: 0000000000000020 RSI: 00007f4be8a37000 RDI: 0000000000000008 [ 501.183731][T11941] RBP: 0000000000000000 R08: 00007f4be8a36f04 R09: 000000000000000c [ 501.183742][T11941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 501.183753][T11941] R13: 00007f4be8a36f58 R14: 00007f4be8a37000 R15: 0000000000000000 [ 501.183775][T11941] [ 501.763381][T11951] __vm_enough_memory: pid: 11951, comm: syz.2.1348, bytes: 4398046457856 not enough memory for the allocation [ 504.399067][ T9618] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 504.487203][T11990] FAULT_INJECTION: forcing a failure. [ 504.487203][T11990] name failslab, interval 1, probability 0, space 0, times 0 [ 504.625645][T11990] CPU: 0 UID: 0 PID: 11990 Comm: syz.1.1356 Tainted: G L syzkaller #0 PREEMPT(full) [ 504.625677][T11990] Tainted: [L]=SOFTLOCKUP [ 504.625684][T11990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 504.625695][T11990] Call Trace: [ 504.625701][T11990] [ 504.625709][T11990] dump_stack_lvl+0x100/0x190 [ 504.625745][T11990] should_fail_ex.cold+0x5/0xa [ 504.625769][T11990] should_failslab+0xc2/0x120 [ 504.625791][T11990] __kmalloc_cache_noprof+0x7a/0x6f0 [ 504.625818][T11990] ? snd_seq_queue_alloc+0x56/0x540 [ 504.625941][T11990] snd_seq_queue_alloc+0x56/0x540 [ 504.625972][T11990] snd_seq_ioctl_create_queue+0xa9/0x370 [ 504.625996][T11990] call_seq_client_ctl+0xa3/0x130 [ 504.626023][T11990] snd_seq_kernel_client_ctl+0x77/0xd0 [ 504.626047][T11990] alloc_seq_queue+0xdb/0x180 [ 504.626085][T11990] ? __pfx_alloc_seq_queue+0x10/0x10 [ 504.626118][T11990] ? find_held_lock+0x2b/0x80 [ 504.626143][T11990] ? mark_held_locks+0x40/0x70 [ 504.626174][T11990] snd_seq_oss_open+0x2b2/0xa10 [ 504.626202][T11990] odev_open+0x6f/0x90 [ 504.626223][T11990] ? __pfx_odev_open+0x10/0x10 [ 504.626244][T11990] soundcore_open+0x2e3/0x5a0 [ 504.626310][T11990] ? __pfx_soundcore_open+0x10/0x10 [ 504.626339][T11990] chrdev_open+0x234/0x6a0 [ 504.626362][T11990] ? __pfx_apparmor_file_open+0x10/0x10 [ 504.626383][T11990] ? __pfx_chrdev_open+0x10/0x10 [ 504.626408][T11990] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 504.626448][T11990] do_dentry_open+0x6ab/0x14d0 [ 504.626471][T11990] ? __pfx_chrdev_open+0x10/0x10 [ 504.626499][T11990] vfs_open+0x82/0x3f0 [ 504.626528][T11990] path_openat+0x208c/0x31a0 [ 504.626560][T11990] ? __pfx_path_openat+0x10/0x10 [ 504.626592][T11990] do_file_open+0x20e/0x430 [ 504.626618][T11990] ? __pfx_do_file_open+0x10/0x10 [ 504.626657][T11990] ? alloc_fd+0x476/0x790 [ 504.626681][T11990] ? do_getname+0x191/0x390 [ 504.626710][T11990] do_sys_openat2+0x10d/0x1e0 [ 504.626737][T11990] ? __pfx_do_sys_openat2+0x10/0x10 [ 504.626774][T11990] __x64_sys_openat+0x12d/0x210 [ 504.626803][T11990] ? __pfx___x64_sys_openat+0x10/0x10 [ 504.626830][T11990] ? exit_to_user_mode_loop+0xf3/0x670 [ 504.626868][T11990] ? rcu_is_watching+0x12/0xc0 [ 504.626892][T11990] do_syscall_64+0x115/0x840 [ 504.626918][T11990] ? clear_bhb_loop+0x40/0x90 [ 504.626941][T11990] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.626959][T11990] RIP: 0033:0x7fd16ff9ce59 [ 504.626975][T11990] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.626993][T11990] RSP: 002b:00007fd170e88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 504.627011][T11990] RAX: ffffffffffffffda RBX: 00007fd170215fa0 RCX: 00007fd16ff9ce59 [ 504.627039][T11990] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 504.627051][T11990] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 504.627062][T11990] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 504.627072][T11990] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 504.627095][T11990] [ 505.550675][T12007] __vm_enough_memory: pid: 12007, comm: syz.1.1359, bytes: 4398046457856 not enough memory for the allocation [ 505.825628][T12011] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 506.418378][ T9618] Bluetooth: hci0: command 0x2016 tx timeout [ 507.331799][T12032] vivid-007: ================= START STATUS ================= [ 507.457955][T12032] vivid-007: Generate PTS: true [ 507.607861][T12032] vivid-007: Generate SCR: true [ 507.697193][T12032] tpg source WxH: 320x240 (Y'CbCr) [ 507.800284][T12032] tpg field: 1 [ 507.866989][T12032] tpg crop: (0,0)/320x240 [ 507.938175][T12032] tpg compose: (0,0)/320x240 [ 507.998770][T12032] tpg colorspace: 8 [ 508.058139][T12032] tpg transfer function: 0/0 [ 508.128007][T12032] tpg Y'CbCr encoding: 0/0 [ 508.189790][T12032] tpg quantization: 0/0 [ 508.248780][T12032] tpg RGB range: 0/2 [ 508.324386][T12032] vivid-007: ================== END STATUS ================== [ 508.485145][ T9618] Bluetooth: hci0: command 0x2016 tx timeout [ 509.957689][T12065] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 510.293966][T12067] __vm_enough_memory: pid: 12067, comm: syz.3.1372, bytes: 4398046457856 not enough memory for the allocation [ 510.606427][T12074] : Can't lookup blockdev [ 511.239794][ T8555] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 511.264378][T12086] udc dummy_udc.0: soft-connect without a gadget driver [ 512.332460][T12106] : Can't lookup blockdev [ 512.509625][T12110] netlink: 334 bytes leftover after parsing attributes in process `syz.3.1381'. [ 513.052660][T12116] __vm_enough_memory: pid: 12116, comm: syz.1.1383, bytes: 4398046457856 not enough memory for the allocation [ 513.200684][T12120] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 513.256424][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 515.325157][ T8555] Bluetooth: hci3: command 0x2016 tx timeout [ 516.329367][T12160] __vm_enough_memory: pid: 12160, comm: syz.1.1393, bytes: 4398046457856 not enough memory for the allocation [ 516.755410][T12171] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 518.737882][T12199] : Can't lookup blockdev [ 519.313501][T12206] __vm_enough_memory: pid: 12206, comm: syz.0.1403, bytes: 4398046457856 not enough memory for the allocation [ 519.595076][T12215] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 521.680068][T12249] sd 0:0:1:0: PR command failed: 1026 [ 521.713216][T12249] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 521.751790][T12249] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 521.842940][T12258] __vm_enough_memory: pid: 12258, comm: syz.2.1414, bytes: 4398046457856 not enough memory for the allocation [ 522.202573][T12264] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 523.416740][T12295] futex_wake_op: syz.1.1422 tries to shift op by -2048; fix this program [ 523.576224][T12299] __vm_enough_memory: pid: 12299, comm: syz.0.1424, bytes: 4398046457856 not enough memory for the allocation [ 523.917329][T12305] udc dummy_udc.0: soft-connect without a gadget driver [ 524.675467][T12314] synth uevent: /devices/virtual/tty/ttyv7: unknown uevent action string [ 524.753343][T12314] tty ttyv7: uevent: failed to send synthetic uevent: -22 [ 525.355705][T12330] Process accounting paused [ 525.614262][T12340] FAULT_INJECTION: forcing a failure. [ 525.614262][T12340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.689928][T12340] CPU: 0 UID: 0 PID: 12340 Comm: syz.3.1435 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.689961][T12340] Tainted: [L]=SOFTLOCKUP [ 525.689967][T12340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 525.689978][T12340] Call Trace: [ 525.689984][T12340] [ 525.689991][T12340] dump_stack_lvl+0x100/0x190 [ 525.690032][T12340] should_fail_ex.cold+0x5/0xa [ 525.690057][T12340] _copy_from_user+0x2e/0xd0 [ 525.690087][T12340] snd_rawmidi_kernel_write1+0x390/0x7c0 [ 525.690191][T12340] snd_rawmidi_write+0x2dc/0xc60 [ 525.690221][T12340] ? get_pid_task+0xfc/0x250 [ 525.690261][T12340] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 525.690290][T12340] ? apparmor_file_permission+0x13f/0x1c0 [ 525.690317][T12340] ? bpf_lsm_file_permission+0x9/0x10 [ 525.690355][T12340] ? security_file_permission+0x76/0x210 [ 525.690399][T12340] ? rw_verify_area+0xce/0x6d0 [ 525.690420][T12340] vfs_write+0x2aa/0x1070 [ 525.690442][T12340] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 525.690470][T12340] ? rcu_preempt_deferred_qs_irqrestore+0x4fd/0xb90 [ 525.690502][T12340] ? __pfx_vfs_write+0x10/0x10 [ 525.690521][T12340] ? rcu_is_watching+0x12/0xc0 [ 525.690545][T12340] ? __rcu_read_unlock+0x27f/0x5e0 [ 525.690575][T12340] ? __fget_files+0x21f/0x3d0 [ 525.690603][T12340] ksys_write+0x1f8/0x250 [ 525.690624][T12340] ? __pfx_ksys_write+0x10/0x10 [ 525.690647][T12340] ? rcu_is_watching+0x12/0xc0 [ 525.690671][T12340] do_syscall_64+0x115/0x840 [ 525.690704][T12340] ? clear_bhb_loop+0x40/0x90 [ 525.690727][T12340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.690746][T12340] RIP: 0033:0x7f7fb499ce59 [ 525.690762][T12340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 525.690780][T12340] RSP: 002b:00007f7fb2bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 525.690798][T12340] RAX: ffffffffffffffda RBX: 00007f7fb4c15fa0 RCX: 00007f7fb499ce59 [ 525.690810][T12340] RDX: 000000100000a3d9 RSI: 00002000000000c0 RDI: 0000000000000003 [ 525.690821][T12340] RBP: 00007f7fb2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 525.690832][T12340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.690843][T12340] R13: 00007f7fb4c16038 R14: 00007f7fb4c15fa0 R15: 00007ffe938d30e8 [ 525.690865][T12340] [ 526.355561][T12354] __vm_enough_memory: pid: 12354, comm: syz.1.1436, bytes: 4398046457856 not enough memory for the allocation [ 526.379045][T12353] : Can't lookup blockdev [ 526.779398][T12342] __vm_enough_memory: pid: 12342, comm: syz.3.1435, bytes: 4398046457856 not enough memory for the allocation [ 526.827569][T12359] FAULT_INJECTION: forcing a failure. [ 526.827569][T12359] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 526.887907][T12359] CPU: 0 UID: 0 PID: 12359 Comm: syz.1.1438 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.887939][T12359] Tainted: [L]=SOFTLOCKUP [ 526.887945][T12359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 526.887956][T12359] Call Trace: [ 526.887963][T12359] [ 526.887971][T12359] dump_stack_lvl+0x100/0x190 [ 526.888006][T12359] should_fail_ex.cold+0x5/0xa [ 526.888026][T12359] ? prepare_alloc_pages+0x16d/0x5f0 [ 526.888053][T12359] should_fail_alloc_page+0xeb/0x140 [ 526.888078][T12359] prepare_alloc_pages+0x1f0/0x5f0 [ 526.888104][T12359] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 526.888142][T12359] ? __lock_acquire+0x4a5/0x2630 [ 526.888180][T12359] ? page_table_check_set+0x477/0x920 [ 526.888204][T12359] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 526.888237][T12359] ? lock_acquire+0x1b1/0x370 [ 526.888265][T12359] ? find_held_lock+0x2b/0x80 [ 526.888295][T12359] ? ktime_get+0x9f/0x320 [ 526.888321][T12359] ? ktime_get+0x1a4/0x320 [ 526.888347][T12359] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 526.888375][T12359] ? policy_nodemask+0xed/0x4f0 [ 526.888399][T12359] alloc_pages_mpol+0x1fb/0x540 [ 526.888421][T12359] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 526.888443][T12359] ? __hrtimer_rearm_deferred+0x24d/0x740 [ 526.888471][T12359] folio_alloc_mpol_noprof+0x36/0x260 [ 526.888498][T12359] vma_alloc_folio_noprof+0xed/0x1d0 [ 526.888522][T12359] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 526.888554][T12359] do_anonymous_page+0xb46/0x2050 [ 526.888582][T12359] ? rcu_read_unlock+0x2d/0xb0 [ 526.888613][T12359] __handle_mm_fault+0x1d2c/0x2a00 [ 526.888646][T12359] ? reacquire_held_locks+0xce/0x1e0 [ 526.888674][T12359] ? __pfx___handle_mm_fault+0x10/0x10 [ 526.888705][T12359] ? lock_vma_under_rcu+0x17c/0x590 [ 526.888744][T12359] handle_mm_fault+0x37b/0xa30 [ 526.888774][T12359] do_user_addr_fault+0x5a3/0x12f0 [ 526.888803][T12359] exc_page_fault+0x6f/0xd0 [ 526.888830][T12359] asm_exc_page_fault+0x26/0x30 [ 526.888848][T12359] RIP: 0033:0x7fd16fe5e60b [ 526.888866][T12359] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 526.888883][T12359] RSP: 002b:00007fd170e86fa0 EFLAGS: 00010206 [ 526.888899][T12359] RAX: 0000000000000000 RBX: 00007fd170215fa0 RCX: 0000000000000000 [ 526.888910][T12359] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 526.888921][T12359] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 526.888932][T12359] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 526.888944][T12359] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 526.888967][T12359] [ 526.888982][T12359] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 527.748962][T12337] kexec: Could not allocate control_code_buffer [ 527.947548][ T9618] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 528.816072][T12395] __vm_enough_memory: pid: 12395, comm: syz.3.1446, bytes: 4398046457856 not enough memory for the allocation [ 528.843357][T12394] : Can't lookup blockdev [ 529.232190][T12406] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 529.612305][T12415] FAULT_INJECTION: forcing a failure. [ 529.612305][T12415] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 529.713707][T12415] CPU: 0 UID: 0 PID: 12415 Comm: syz.3.1450 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.713740][T12415] Tainted: [L]=SOFTLOCKUP [ 529.713746][T12415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 529.713757][T12415] Call Trace: [ 529.713764][T12415] [ 529.713771][T12415] dump_stack_lvl+0x100/0x190 [ 529.713811][T12415] should_fail_ex.cold+0x5/0xa [ 529.713834][T12415] _copy_from_user+0x2e/0xd0 [ 529.713862][T12415] snd_rawmidi_kernel_write1+0x390/0x7c0 [ 529.713900][T12415] snd_rawmidi_write+0x2dc/0xc60 [ 529.713934][T12415] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 529.713964][T12415] ? __pfx_default_wake_function+0x10/0x10 [ 529.714013][T12415] ? bpf_lsm_file_permission+0x9/0x10 [ 529.714031][T12415] ? security_file_permission+0x76/0x210 [ 529.714057][T12415] ? rw_verify_area+0xce/0x6d0 [ 529.714084][T12415] vfs_write+0x2aa/0x1070 [ 529.714107][T12415] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 529.714137][T12415] ? __pfx_vfs_write+0x10/0x10 [ 529.714156][T12415] ? find_held_lock+0x2b/0x80 [ 529.714178][T12415] ? __fget_files+0x215/0x3d0 [ 529.714199][T12415] ? __fget_files+0x215/0x3d0 [ 529.714224][T12415] ? __fget_files+0x21f/0x3d0 [ 529.714251][T12415] ksys_write+0x1f8/0x250 [ 529.714272][T12415] ? __pfx_ksys_write+0x10/0x10 [ 529.714292][T12415] ? trace_irq_enable.constprop.0+0x31/0x160 [ 529.714324][T12415] ? rcu_is_watching+0x12/0xc0 [ 529.714348][T12415] do_syscall_64+0x115/0x840 [ 529.714374][T12415] ? clear_bhb_loop+0x40/0x90 [ 529.714396][T12415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.714415][T12415] RIP: 0033:0x7f7fb499ce59 [ 529.714431][T12415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.714449][T12415] RSP: 002b:00007f7fb2bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 529.714468][T12415] RAX: ffffffffffffffda RBX: 00007f7fb4c15fa0 RCX: 00007f7fb499ce59 [ 529.714479][T12415] RDX: 000000100000a3d9 RSI: 00002000000000c0 RDI: 0000000000000003 [ 529.714490][T12415] RBP: 00007f7fb2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 529.714501][T12415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.714512][T12415] R13: 00007f7fb4c16038 R14: 00007f7fb4c15fa0 R15: 00007ffe938d30e8 [ 529.714534][T12415] [ 529.714993][T12418] __vm_enough_memory: pid: 12418, comm: syz.3.1450, bytes: 4398046457856 not enough memory for the allocation [ 530.035996][ T8555] Bluetooth: hci2: command 0x2016 tx timeout [ 530.045872][T12411] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1447'. [ 530.126828][T12417] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1451'. [ 530.222043][T12422] synth uevent: /devices/virtual/tty/ttyv7: unknown uevent action string [ 530.234223][T12422] tty ttyv7: uevent: failed to send synthetic uevent: -22 [ 530.808743][ T8555] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 531.541842][T12455] udc dummy_udc.0: soft-connect without a gadget driver [ 531.695151][T12457] __vm_enough_memory: pid: 12457, comm: syz.1.1459, bytes: 4398046457856 not enough memory for the allocation [ 532.117634][ T9618] Bluetooth: hci2: command 0x2016 tx timeout [ 532.834327][ T8548] Bluetooth: hci3: command 0x2016 tx timeout [ 533.193604][T12479] FAULT_INJECTION: forcing a failure. [ 533.193604][T12479] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.283872][T12479] CPU: 0 UID: 0 PID: 12479 Comm: syz.0.1466 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.283905][T12479] Tainted: [L]=SOFTLOCKUP [ 533.283912][T12479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 533.283923][T12479] Call Trace: [ 533.283929][T12479] [ 533.283937][T12479] dump_stack_lvl+0x100/0x190 [ 533.283971][T12479] should_fail_ex.cold+0x5/0xa [ 533.283995][T12479] _copy_from_user+0x2e/0xd0 [ 533.284021][T12479] move_addr_to_kernel+0x65/0x170 [ 533.284052][T12479] __sys_sendto+0x1c9/0x4b0 [ 533.284082][T12479] ? __pfx___sys_sendto+0x10/0x10 [ 533.284129][T12479] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 533.284152][T12479] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 533.284189][T12479] __x64_sys_sendto+0xe0/0x1c0 [ 533.284219][T12479] ? do_syscall_64+0x90/0x840 [ 533.284246][T12479] ? lockdep_hardirqs_on+0x78/0x100 [ 533.284273][T12479] do_syscall_64+0x115/0x840 [ 533.284300][T12479] ? clear_bhb_loop+0x40/0x90 [ 533.284323][T12479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.284345][T12479] RIP: 0033:0x7f37e5f5d68e [ 533.284362][T12479] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 533.284380][T12479] RSP: 002b:00007f37e6e65e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 533.284400][T12479] RAX: ffffffffffffffda RBX: 00007f37e6e676c0 RCX: 00007f37e5f5d68e [ 533.284412][T12479] RDX: 0000000000000020 RSI: 00007f37e6e66000 RDI: 0000000000000008 [ 533.284424][T12479] RBP: 0000000000000000 R08: 00007f37e6e65f04 R09: 000000000000000c [ 533.284435][T12479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 533.284446][T12479] R13: 00007f37e6e65f58 R14: 00007f37e6e66000 R15: 0000000000000000 [ 533.284470][T12479] [ 533.604589][T12482] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1465'. [ 534.133958][T12489] __vm_enough_memory: pid: 12489, comm: syz.3.1468, bytes: 4398046457856 not enough memory for the allocation [ 534.431999][T12494] __vm_enough_memory: pid: 12494, comm: syz.3.1469, bytes: 4398046457856 not enough memory for the allocation [ 534.908991][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 535.526068][T12508] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 535.845172][ T29] audit: type=1800 audit(1780110117.181:7): pid=12516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1475" name="discovery_nqn" dev="configfs" ino=44544 res=0 errno=0 [ 537.715932][T12538] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1480'. [ 538.109033][T12547] udc dummy_udc.0: soft-connect without a gadget driver [ 542.694945][T12604] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1493'. [ 543.583045][T12612] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1495'. [ 544.859653][T12627] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 545.002167][T12629] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1499'. [ 545.058958][T12629] IPv6: NLM_F_CREATE should be specified when creating new route [ 545.105048][T12629] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 545.112404][T12629] IPv6: NLM_F_CREATE should be set when creating new route [ 545.120789][T12629] IPv6: NLM_F_CREATE should be set when creating new route [ 545.258781][T12630] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1499'. [ 545.495295][T12638] FAULT_INJECTION: forcing a failure. [ 545.495295][T12638] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 545.562853][T12638] CPU: 0 UID: 0 PID: 12638 Comm: syz.2.1501 Tainted: G L syzkaller #0 PREEMPT(full) [ 545.562888][T12638] Tainted: [L]=SOFTLOCKUP [ 545.562895][T12638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 545.562905][T12638] Call Trace: [ 545.562912][T12638] [ 545.562919][T12638] dump_stack_lvl+0x100/0x190 [ 545.562955][T12638] should_fail_ex.cold+0x5/0xa [ 545.562975][T12638] ? prepare_alloc_pages+0x16d/0x5f0 [ 545.563001][T12638] should_fail_alloc_page+0xeb/0x140 [ 545.563024][T12638] prepare_alloc_pages+0x1f0/0x5f0 [ 545.563052][T12638] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 545.563087][T12638] ? lock_acquire+0x1b1/0x370 [ 545.563115][T12638] ? find_held_lock+0x2b/0x80 [ 545.563137][T12638] ? page_table_check_set+0x477/0x920 [ 545.563157][T12638] ? page_table_check_set+0x477/0x920 [ 545.563180][T12638] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 545.563210][T12638] ? page_table_check_set+0x486/0x920 [ 545.563234][T12638] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 545.563254][T12638] ? xas_move_index+0xae/0x110 [ 545.563285][T12638] ? find_held_lock+0x2b/0x80 [ 545.563306][T12638] ? find_held_lock+0x2b/0x80 [ 545.563328][T12638] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 545.563355][T12638] ? policy_nodemask+0xed/0x4f0 [ 545.563378][T12638] alloc_pages_mpol+0x1fb/0x540 [ 545.563401][T12638] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 545.563425][T12638] ? __lock_acquire+0x4a5/0x2630 [ 545.563454][T12638] folio_alloc_mpol_noprof+0x36/0x260 [ 545.563481][T12638] vma_alloc_folio_noprof+0xed/0x1d0 [ 545.563507][T12638] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 545.563539][T12638] do_anonymous_page+0xb46/0x2050 [ 545.563568][T12638] ? rcu_read_unlock+0x2d/0xb0 [ 545.563600][T12638] __handle_mm_fault+0x1d2c/0x2a00 [ 545.563640][T12638] ? reacquire_held_locks+0xce/0x1e0 [ 545.563669][T12638] ? __pfx___handle_mm_fault+0x10/0x10 [ 545.563699][T12638] ? lock_vma_under_rcu+0x17c/0x590 [ 545.563739][T12638] handle_mm_fault+0x37b/0xa30 [ 545.563770][T12638] do_user_addr_fault+0x5a3/0x12f0 [ 545.563799][T12638] exc_page_fault+0x6f/0xd0 [ 545.563826][T12638] asm_exc_page_fault+0x26/0x30 [ 545.563843][T12638] RIP: 0033:0x7f4be7a5e60b [ 545.563859][T12638] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 545.563877][T12638] RSP: 002b:00007f4be8a36fa0 EFLAGS: 00010206 [ 545.563892][T12638] RAX: 0000000000000000 RBX: 00007f4be7e15fa0 RCX: 0000000000000000 [ 545.563903][T12638] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 545.563913][T12638] RBP: 00007f4be7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 545.563924][T12638] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 545.563935][T12638] R13: 00007f4be7e16038 R14: 00007f4be7e15fa0 R15: 00007ffe36bf2548 [ 545.563958][T12638] [ 545.872037][T12638] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 546.459484][T12652] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1506'. [ 546.577288][ T8548] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 547.989522][T12673] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1508'. [ 548.594633][ T9618] Bluetooth: hci2: command 0x2016 tx timeout [ 550.612770][T12694] udc dummy_udc.0: soft-connect without a gadget driver [ 550.661000][ T9618] Bluetooth: hci2: command 0x2016 tx timeout [ 550.681466][T12697] FAULT_INJECTION: forcing a failure. [ 550.681466][T12697] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 550.749141][T12697] CPU: 0 UID: 0 PID: 12697 Comm: syz.1.1514 Tainted: G L syzkaller #0 PREEMPT(full) [ 550.749173][T12697] Tainted: [L]=SOFTLOCKUP [ 550.749180][T12697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 550.749190][T12697] Call Trace: [ 550.749197][T12697] [ 550.749204][T12697] dump_stack_lvl+0x100/0x190 [ 550.749241][T12697] should_fail_ex.cold+0x5/0xa [ 550.749261][T12697] ? prepare_alloc_pages+0x16d/0x5f0 [ 550.749288][T12697] should_fail_alloc_page+0xeb/0x140 [ 550.749312][T12697] prepare_alloc_pages+0x1f0/0x5f0 [ 550.749340][T12697] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 550.749375][T12697] ? lock_acquire+0x1b1/0x370 [ 550.749403][T12697] ? find_held_lock+0x2b/0x80 [ 550.749424][T12697] ? page_table_check_set+0x477/0x920 [ 550.749445][T12697] ? page_table_check_set+0x477/0x920 [ 550.749467][T12697] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 550.749497][T12697] ? page_table_check_set+0x486/0x920 [ 550.749521][T12697] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 550.749540][T12697] ? xas_move_index+0xae/0x110 [ 550.749571][T12697] ? find_held_lock+0x2b/0x80 [ 550.749592][T12697] ? find_held_lock+0x2b/0x80 [ 550.749613][T12697] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 550.749641][T12697] ? policy_nodemask+0xed/0x4f0 [ 550.749668][T12697] alloc_pages_mpol+0x1fb/0x540 [ 550.749691][T12697] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 550.749715][T12697] ? __lock_acquire+0x4a5/0x2630 [ 550.749746][T12697] folio_alloc_mpol_noprof+0x36/0x260 [ 550.749773][T12697] vma_alloc_folio_noprof+0xed/0x1d0 [ 550.749798][T12697] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 550.749830][T12697] do_anonymous_page+0xb46/0x2050 [ 550.749858][T12697] ? rcu_read_unlock+0x2d/0xb0 [ 550.749890][T12697] __handle_mm_fault+0x1d2c/0x2a00 [ 550.749931][T12697] ? reacquire_held_locks+0xce/0x1e0 [ 550.749960][T12697] ? __pfx___handle_mm_fault+0x10/0x10 [ 550.749991][T12697] ? lock_vma_under_rcu+0x17c/0x590 [ 550.750030][T12697] handle_mm_fault+0x37b/0xa30 [ 550.750063][T12697] do_user_addr_fault+0x5a3/0x12f0 [ 550.750092][T12697] exc_page_fault+0x6f/0xd0 [ 550.750119][T12697] asm_exc_page_fault+0x26/0x30 [ 550.750137][T12697] RIP: 0033:0x7fd16fe5e60b [ 550.750153][T12697] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 550.750171][T12697] RSP: 002b:00007fd170e86fa0 EFLAGS: 00010206 [ 550.750186][T12697] RAX: 0000000000000000 RBX: 00007fd170215fa0 RCX: 0000000000000000 [ 550.750197][T12697] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 550.750208][T12697] RBP: 00007fd170032d6f R08: 0000000000000000 R09: 0000000000000000 [ 550.750218][T12697] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 550.750229][T12697] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 550.750252][T12697] [ 551.373210][T12697] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 551.803882][T12713] udc dummy_udc.0: soft-connect without a gadget driver [ 551.876816][T12714] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1516'. [ 552.695457][T12727] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1518'. [ 554.029871][T12742] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 554.130350][T12745] udc dummy_udc.0: soft-connect without a gadget driver [ 556.928234][T12775] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1530'. [ 558.356075][T12796] udc dummy_udc.0: soft-connect without a gadget driver [ 558.416858][T12777] Process accounting resumed [ 558.425902][T12794] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1534'. [ 559.004626][T12805] netlink: 'syz.2.1537': attribute type 1 has an invalid length. [ 559.664304][T12817] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 560.564677][T12830] FAULT_INJECTION: forcing a failure. [ 560.564677][T12830] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 560.644303][T12830] CPU: 0 UID: 0 PID: 12830 Comm: syz.0.1543 Tainted: G L syzkaller #0 PREEMPT(full) [ 560.644335][T12830] Tainted: [L]=SOFTLOCKUP [ 560.644341][T12830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 560.644357][T12830] Call Trace: [ 560.644364][T12830] [ 560.644372][T12830] dump_stack_lvl+0x100/0x190 [ 560.644408][T12830] should_fail_ex.cold+0x5/0xa [ 560.644430][T12830] ? prepare_alloc_pages+0x16d/0x5f0 [ 560.644456][T12830] should_fail_alloc_page+0xeb/0x140 [ 560.644480][T12830] prepare_alloc_pages+0x1f0/0x5f0 [ 560.644506][T12830] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 560.644541][T12830] ? lock_acquire+0x1b1/0x370 [ 560.644570][T12830] ? find_held_lock+0x2b/0x80 [ 560.644592][T12830] ? page_table_check_set+0x477/0x920 [ 560.644612][T12830] ? page_table_check_set+0x477/0x920 [ 560.644634][T12830] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 560.644664][T12830] ? page_table_check_set+0x486/0x920 [ 560.644688][T12830] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 560.644708][T12830] ? xas_move_index+0xae/0x110 [ 560.644742][T12830] ? find_held_lock+0x2b/0x80 [ 560.644765][T12830] ? find_held_lock+0x2b/0x80 [ 560.644791][T12830] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 560.644818][T12830] ? policy_nodemask+0xed/0x4f0 [ 560.644842][T12830] alloc_pages_mpol+0x1fb/0x540 [ 560.644865][T12830] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 560.644890][T12830] ? __lock_acquire+0x4a5/0x2630 [ 560.644922][T12830] folio_alloc_mpol_noprof+0x36/0x260 [ 560.644973][T12830] vma_alloc_folio_noprof+0xed/0x1d0 [ 560.644998][T12830] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 560.645031][T12830] do_anonymous_page+0xb46/0x2050 [ 560.645060][T12830] ? rcu_read_unlock+0x2d/0xb0 [ 560.645093][T12830] __handle_mm_fault+0x1d2c/0x2a00 [ 560.645125][T12830] ? reacquire_held_locks+0xce/0x1e0 [ 560.645155][T12830] ? __pfx___handle_mm_fault+0x10/0x10 [ 560.645185][T12830] ? lock_vma_under_rcu+0x17c/0x590 [ 560.645225][T12830] handle_mm_fault+0x37b/0xa30 [ 560.645256][T12830] do_user_addr_fault+0x5a3/0x12f0 [ 560.645284][T12830] exc_page_fault+0x6f/0xd0 [ 560.645310][T12830] asm_exc_page_fault+0x26/0x30 [ 560.645328][T12830] RIP: 0033:0x7f37e5e5e60b [ 560.645344][T12830] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 560.645361][T12830] RSP: 002b:00007f37e6e65fa0 EFLAGS: 00010206 [ 560.645376][T12830] RAX: 0000000000000000 RBX: 00007f37e6215fa0 RCX: 0000000000000000 [ 560.645387][T12830] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 560.645398][T12830] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 560.645408][T12830] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 560.645418][T12830] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 560.645445][T12830] [ 561.080957][T12830] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 561.806766][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 561.813335][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.213704][T12846] udc dummy_udc.0: soft-connect without a gadget driver [ 562.497010][T12826] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1542'. [ 562.683758][T12853] FAULT_INJECTION: forcing a failure. [ 562.683758][T12853] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 562.792565][T12853] CPU: 0 UID: 0 PID: 12853 Comm: syz.2.1550 Tainted: G L syzkaller #0 PREEMPT(full) [ 562.792597][T12853] Tainted: [L]=SOFTLOCKUP [ 562.792604][T12853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 562.792615][T12853] Call Trace: [ 562.792622][T12853] [ 562.792629][T12853] dump_stack_lvl+0x100/0x190 [ 562.792665][T12853] should_fail_ex.cold+0x5/0xa [ 562.792688][T12853] _copy_from_user+0x2e/0xd0 [ 562.792716][T12853] move_addr_to_kernel+0x65/0x170 [ 562.792743][T12853] __sys_sendto+0x1c9/0x4b0 [ 562.792773][T12853] ? __pfx___sys_sendto+0x10/0x10 [ 562.792807][T12853] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 562.792829][T12853] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 562.792868][T12853] __x64_sys_sendto+0xe0/0x1c0 [ 562.792898][T12853] ? do_syscall_64+0x90/0x840 [ 562.792924][T12853] ? lockdep_hardirqs_on+0x78/0x100 [ 562.792950][T12853] do_syscall_64+0x115/0x840 [ 562.792974][T12853] ? clear_bhb_loop+0x40/0x90 [ 562.792996][T12853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.793015][T12853] RIP: 0033:0x7f4be7b5d68e [ 562.793031][T12853] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 562.793048][T12853] RSP: 002b:00007f4be8a36e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 562.793068][T12853] RAX: ffffffffffffffda RBX: 00007f4be8a386c0 RCX: 00007f4be7b5d68e [ 562.793079][T12853] RDX: 0000000000000020 RSI: 00007f4be8a37000 RDI: 0000000000000008 [ 562.793090][T12853] RBP: 0000000000000000 R08: 00007f4be8a36f04 R09: 000000000000000c [ 562.793101][T12853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 562.793111][T12853] R13: 00007f4be8a36f58 R14: 00007f4be8a37000 R15: 0000000000000000 [ 562.793133][T12853] [ 563.394233][T12863] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1551'. [ 563.754523][T12870] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 565.572654][T12892] futex_wake_op: syz.2.1559 tries to shift op by -2048; fix this program [ 565.623524][T12892] futex_wake_op: syz.2.1559 tries to shift op by -2048; fix this program [ 567.069910][T12925] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 568.166595][T12941] udc dummy_udc.0: soft-connect without a gadget driver [ 568.602848][T12951] FAULT_INJECTION: forcing a failure. [ 568.602848][T12951] name failslab, interval 1, probability 0, space 0, times 0 [ 568.659423][T12951] CPU: 0 UID: 0 PID: 12951 Comm: syz.3.1572 Tainted: G L syzkaller #0 PREEMPT(full) [ 568.659456][T12951] Tainted: [L]=SOFTLOCKUP [ 568.659462][T12951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 568.659473][T12951] Call Trace: [ 568.659480][T12951] [ 568.659487][T12951] dump_stack_lvl+0x100/0x190 [ 568.659523][T12951] should_fail_ex.cold+0x5/0xa [ 568.659547][T12951] should_failslab+0xc2/0x120 [ 568.659569][T12951] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 568.659601][T12951] ? __alloc_skb+0x140/0x710 [ 568.659618][T12951] ? __alloc_skb+0x5b7/0x710 [ 568.659637][T12951] __alloc_skb+0x140/0x710 [ 568.659652][T12951] ? __alloc_skb+0x5b7/0x710 [ 568.659668][T12951] ? __pfx___alloc_skb+0x10/0x10 [ 568.659691][T12951] netlink_alloc_large_skb+0x69/0x150 [ 568.659724][T12951] netlink_sendmsg+0x680/0xda0 [ 568.659752][T12951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 568.659779][T12951] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 568.659804][T12951] __sys_sendto+0x468/0x4b0 [ 568.659831][T12951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 568.659855][T12951] ? __pfx___sys_sendto+0x10/0x10 [ 568.659900][T12951] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 568.659922][T12951] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 568.659959][T12951] __x64_sys_sendto+0xe0/0x1c0 [ 568.659986][T12951] ? do_syscall_64+0x90/0x840 [ 568.660012][T12951] ? lockdep_hardirqs_on+0x78/0x100 [ 568.660038][T12951] do_syscall_64+0x115/0x840 [ 568.660062][T12951] ? clear_bhb_loop+0x40/0x90 [ 568.660084][T12951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.660104][T12951] RIP: 0033:0x7f7fb495d68e [ 568.660119][T12951] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 568.660136][T12951] RSP: 002b:00007f7fb2bf4e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 568.660154][T12951] RAX: ffffffffffffffda RBX: 00007f7fb2bf66c0 RCX: 00007f7fb495d68e [ 568.660166][T12951] RDX: 0000000000000020 RSI: 00007f7fb2bf5000 RDI: 0000000000000008 [ 568.660176][T12951] RBP: 0000000000000000 R08: 00007f7fb2bf4f04 R09: 000000000000000c [ 568.660187][T12951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 568.660197][T12951] R13: 00007f7fb2bf4f58 R14: 00007f7fb2bf5000 R15: 0000000000000000 [ 568.660220][T12951] [ 569.070584][T12956] __vm_enough_memory: pid: 12956, comm: syz.1.1573, bytes: 4398046457856 not enough memory for the allocation [ 569.324158][T12961] udc dummy_udc.0: soft-connect without a gadget driver [ 570.588992][T12980] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1578'. [ 571.640728][T12995] futex_wake_op: syz.1.1582 tries to shift op by -2048; fix this program [ 571.736175][T12998] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 572.059095][T13005] futex_wake_op: syz.0.1592 tries to shift op by -2048; fix this program [ 572.150623][T13009] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 572.307827][T13013] __vm_enough_memory: pid: 13013, comm: syz.2.1584, bytes: 4398046457856 not enough memory for the allocation [ 573.108172][T13033] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 573.730555][T13042] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1591'. [ 573.994988][T13046] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1593'. [ 574.494695][T13055] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 574.515534][T13054] __vm_enough_memory: pid: 13054, comm: syz.1.1602, bytes: 4398046457856 not enough memory for the allocation [ 574.946422][T13062] futex_wake_op: syz.3.1596 tries to shift op by -2048; fix this program [ 575.020803][T13062] futex_wake_op: syz.3.1596 tries to shift op by -2048; fix this program [ 575.461182][T13066] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1595'. [ 575.827111][T13076] __vm_enough_memory: pid: 13076, comm: syz.0.1598, bytes: 4398046457856 not enough memory for the allocation [ 576.608386][T13086] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 577.660380][T13099] udc dummy_udc.0: soft-connect without a gadget driver [ 578.129658][T13111] : Can't lookup blockdev [ 578.172055][T13107] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1605'. [ 579.082299][T13122] futex_wake_op: syz.0.1609 tries to shift op by -2048; fix this program [ 579.124703][T13122] futex_wake_op: syz.0.1609 tries to shift op by -2048; fix this program [ 579.182084][T13122] 0x000000000001-0x000000020000 : "" [ 579.226120][T13122] ftl_cs: FTL header corrupt! [ 579.718839][T13134] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 580.147457][T13142] udc dummy_udc.0: soft-connect without a gadget driver [ 580.833351][T13156] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1613'. [ 582.311827][T13171] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1618'. [ 583.086573][T13184] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 583.237449][T13190] udc dummy_udc.0: soft-connect without a gadget driver [ 583.807697][T13201] udc dummy_udc.0: soft-connect without a gadget driver [ 583.997077][T13203] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1624'. [ 584.944530][T13222] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 584.987270][T13221] udc dummy_udc.0: soft-connect without a gadget driver [ 585.981811][T13234] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1632'. [ 586.001953][T13239] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 587.065529][T13251] udc dummy_udc.0: soft-connect without a gadget driver [ 587.457785][T13264] : Can't lookup blockdev [ 588.434161][T13277] udc dummy_udc.0: soft-connect without a gadget driver [ 588.445328][T13254] Process accounting paused [ 588.481559][T13279] udc dummy_udc.0: soft-connect without a gadget driver [ 588.706943][T13285] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 589.206812][T13294] netlink: 218 bytes leftover after parsing attributes in process `syz.2.1644'. [ 590.848258][T13324] udc dummy_udc.0: soft-connect without a gadget driver [ 591.416370][T13334] __vm_enough_memory: pid: 13334, comm: syz.3.1655, bytes: 4398046457856 not enough memory for the allocation [ 593.085923][T13361] netlink: 218 bytes leftover after parsing attributes in process `syz.1.1658'. [ 594.340999][T13376] udc dummy_udc.0: soft-connect without a gadget driver [ 594.701543][T13379] futex_wake_op: syz.1.1664 tries to shift op by -2048; fix this program [ 594.737039][T13379] futex_wake_op: syz.1.1664 tries to shift op by -2048; fix this program [ 594.810443][T13379] 0x000000000001-0x000000020000 : "" [ 594.863870][T13379] ftl_cs: FTL header corrupt! [ 594.950122][T13385] udc dummy_udc.0: soft-connect without a gadget driver [ 595.320770][T13398] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 596.156811][ T8548] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 597.672363][T13441] __vm_enough_memory: pid: 13441, comm: syz.0.1674, bytes: 4398046457856 not enough memory for the allocation [ 597.761666][T13431] futex_wake_op: syz.1.1673 tries to shift op by -2048; fix this program [ 597.776769][T13435] random: crng reseeded on system resumption [ 597.823931][T13431] futex_wake_op: syz.1.1673 tries to shift op by -2048; fix this program [ 597.879401][T13433] 0x000000000001-0x000000020000 : "" [ 598.045124][T13433] ftl_cs: FTL header corrupt! [ 598.174160][ T9618] Bluetooth: hci3: command 0x2016 tx timeout [ 599.374332][T13462] udc dummy_udc.0: soft-connect without a gadget driver [ 599.753514][T13471] futex_wake_op: syz.2.1682 tries to shift op by -2048; fix this program [ 599.811988][T13471] futex_wake_op: syz.2.1682 tries to shift op by -2048; fix this program [ 599.860092][T13473] 0x000000000001-0x000000020000 : "" [ 599.932905][T13473] ftl_cs: FTL header corrupt! [ 600.243272][ T8548] Bluetooth: hci3: command 0x2016 tx timeout [ 600.353509][T13484] FAULT_INJECTION: forcing a failure. [ 600.353509][T13484] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 600.428124][T13484] CPU: 0 UID: 0 PID: 13484 Comm: syz.0.1685 Tainted: G L syzkaller #0 PREEMPT(full) [ 600.428156][T13484] Tainted: [L]=SOFTLOCKUP [ 600.428163][T13484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 600.428173][T13484] Call Trace: [ 600.428183][T13484] [ 600.428195][T13484] dump_stack_lvl+0x100/0x190 [ 600.428231][T13484] should_fail_ex.cold+0x5/0xa [ 600.428252][T13484] ? prepare_alloc_pages+0x16d/0x5f0 [ 600.428277][T13484] should_fail_alloc_page+0xeb/0x140 [ 600.428301][T13484] prepare_alloc_pages+0x1f0/0x5f0 [ 600.428328][T13484] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 600.428362][T13484] ? lock_acquire+0x1b1/0x370 [ 600.428391][T13484] ? find_held_lock+0x2b/0x80 [ 600.428413][T13484] ? page_table_check_set+0x477/0x920 [ 600.428433][T13484] ? page_table_check_set+0x477/0x920 [ 600.428456][T13484] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 600.428485][T13484] ? page_table_check_set+0x486/0x920 [ 600.428512][T13484] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 600.428532][T13484] ? xas_move_index+0xae/0x110 [ 600.428564][T13484] ? find_held_lock+0x2b/0x80 [ 600.428595][T13484] ? find_held_lock+0x2b/0x80 [ 600.428618][T13484] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 600.428650][T13484] ? policy_nodemask+0xed/0x4f0 [ 600.428676][T13484] alloc_pages_mpol+0x1fb/0x540 [ 600.428699][T13484] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 600.428722][T13484] ? __lock_acquire+0x4a5/0x2630 [ 600.428752][T13484] folio_alloc_mpol_noprof+0x36/0x260 [ 600.428778][T13484] vma_alloc_folio_noprof+0xed/0x1d0 [ 600.428803][T13484] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 600.428835][T13484] do_anonymous_page+0xb46/0x2050 [ 600.428864][T13484] ? rcu_read_unlock+0x2d/0xb0 [ 600.428896][T13484] __handle_mm_fault+0x1d2c/0x2a00 [ 600.428928][T13484] ? reacquire_held_locks+0xce/0x1e0 [ 600.428957][T13484] ? __pfx___handle_mm_fault+0x10/0x10 [ 600.428988][T13484] ? lock_vma_under_rcu+0x17c/0x590 [ 600.429027][T13484] handle_mm_fault+0x37b/0xa30 [ 600.429058][T13484] do_user_addr_fault+0x5a3/0x12f0 [ 600.429086][T13484] exc_page_fault+0x6f/0xd0 [ 600.429112][T13484] asm_exc_page_fault+0x26/0x30 [ 600.429130][T13484] RIP: 0033:0x7f37e5e5e60b [ 600.429145][T13484] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 600.429163][T13484] RSP: 002b:00007f37e6e65fa0 EFLAGS: 00010206 [ 600.429178][T13484] RAX: 0000000000000000 RBX: 00007f37e6215fa0 RCX: 0000000000000000 [ 600.429189][T13484] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 600.429199][T13484] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 600.429210][T13484] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 600.429220][T13484] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 600.429243][T13484] [ 600.429267][T13484] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 601.677318][T13498] futex_wake_op: syz.3.1688 tries to shift op by -2048; fix this program [ 601.801659][T13498] futex_wake_op: syz.3.1688 tries to shift op by -2048; fix this program [ 602.259071][T13512] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1689'. [ 602.582945][T13519] udc dummy_udc.0: soft-connect without a gadget driver [ 602.643064][T13518] futex_wake_op: syz.1.1691 tries to shift op by -2048; fix this program [ 602.804508][T13518] futex_wake_op: syz.1.1691 tries to shift op by -2048; fix this program [ 603.295415][T13535] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 604.361267][T13550] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 604.721591][T13559] udc dummy_udc.0: soft-connect without a gadget driver [ 605.335533][T13560] netlink: 218 bytes leftover after parsing attributes in process `syz.0.1700'. [ 606.150797][T13576] FAULT_INJECTION: forcing a failure. [ 606.150797][T13576] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 606.247840][T13576] CPU: 0 UID: 0 PID: 13576 Comm: syz.1.1705 Tainted: G L syzkaller #0 PREEMPT(full) [ 606.247888][T13576] Tainted: [L]=SOFTLOCKUP [ 606.247897][T13576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 606.247910][T13576] Call Trace: [ 606.247919][T13576] [ 606.247930][T13576] dump_stack_lvl+0x100/0x190 [ 606.247983][T13576] should_fail_ex.cold+0x5/0xa [ 606.248020][T13576] _copy_to_user+0x32/0xd0 [ 606.248056][T13576] simple_read_from_buffer+0xcb/0x170 [ 606.248096][T13576] proc_fail_nth_read+0x1af/0x230 [ 606.248141][T13576] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 606.248188][T13576] ? rw_verify_area+0xce/0x6d0 [ 606.248207][T13576] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 606.248236][T13576] vfs_read+0x1e4/0xb30 [ 606.248260][T13576] ? __pfx_vfs_read+0x10/0x10 [ 606.248281][T13576] ? __fget_files+0x215/0x3d0 [ 606.248307][T13576] ? __fget_files+0x21f/0x3d0 [ 606.248334][T13576] ksys_read+0x12a/0x250 [ 606.248355][T13576] ? __pfx_ksys_read+0x10/0x10 [ 606.248378][T13576] ? rcu_is_watching+0x12/0xc0 [ 606.248402][T13576] do_syscall_64+0x115/0x840 [ 606.248430][T13576] ? clear_bhb_loop+0x40/0x90 [ 606.248465][T13576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.248493][T13576] RIP: 0033:0x7fd16ff5d68e [ 606.248517][T13576] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 606.248549][T13576] RSP: 002b:00007fd170e87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 606.248568][T13576] RAX: ffffffffffffffda RBX: 00007fd170e886c0 RCX: 00007fd16ff5d68e [ 606.248580][T13576] RDX: 000000000000000f RSI: 00007fd170e880a0 RDI: 0000000000000003 [ 606.248591][T13576] RBP: 00007fd170e88090 R08: 0000000000000000 R09: 0000000000000000 [ 606.248601][T13576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 606.248612][T13576] R13: 00007fd170216038 R14: 00007fd170215fa0 R15: 00007ffe827f7138 [ 606.248635][T13576] [ 606.979422][T13596] udc dummy_udc.0: soft-connect without a gadget driver [ 607.298063][T13600] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 607.736060][T13614] netlink: 'syz.0.1715': attribute type 64 has an invalid length. [ 607.761611][T13614] netlink: 74 bytes leftover after parsing attributes in process `syz.0.1715'. [ 608.323749][T13624] udc dummy_udc.0: soft-connect without a gadget driver [ 608.399535][T13621] netlink: 218 bytes leftover after parsing attributes in process `syz.3.1714'. [ 609.200087][T13641] FAULT_INJECTION: forcing a failure. [ 609.200087][T13641] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 609.261444][T13641] CPU: 0 UID: 0 PID: 13641 Comm: syz.0.1721 Tainted: G L syzkaller #0 PREEMPT(full) [ 609.261495][T13641] Tainted: [L]=SOFTLOCKUP [ 609.261506][T13641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 609.261524][T13641] Call Trace: [ 609.261533][T13641] [ 609.261546][T13641] dump_stack_lvl+0x100/0x190 [ 609.261613][T13641] should_fail_ex.cold+0x5/0xa [ 609.261647][T13641] ? prepare_alloc_pages+0x16d/0x5f0 [ 609.261690][T13641] should_fail_alloc_page+0xeb/0x140 [ 609.261731][T13641] prepare_alloc_pages+0x1f0/0x5f0 [ 609.261777][T13641] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 609.261844][T13641] ? lock_acquire+0x1b1/0x370 [ 609.261892][T13641] ? find_held_lock+0x2b/0x80 [ 609.261929][T13641] ? page_table_check_set+0x477/0x920 [ 609.261963][T13641] ? page_table_check_set+0x477/0x920 [ 609.262002][T13641] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 609.262052][T13641] ? page_table_check_set+0x486/0x920 [ 609.262091][T13641] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 609.262124][T13641] ? xas_move_index+0xae/0x110 [ 609.262175][T13641] ? find_held_lock+0x2b/0x80 [ 609.262213][T13641] ? find_held_lock+0x2b/0x80 [ 609.262251][T13641] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 609.262299][T13641] ? policy_nodemask+0xed/0x4f0 [ 609.262339][T13641] alloc_pages_mpol+0x1fb/0x540 [ 609.262378][T13641] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 609.262420][T13641] ? __lock_acquire+0x4a5/0x2630 [ 609.262471][T13641] folio_alloc_mpol_noprof+0x36/0x260 [ 609.262517][T13641] vma_alloc_folio_noprof+0xed/0x1d0 [ 609.262555][T13641] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 609.262614][T13641] do_anonymous_page+0xb46/0x2050 [ 609.262663][T13641] ? rcu_read_unlock+0x2d/0xb0 [ 609.262721][T13641] __handle_mm_fault+0x1d2c/0x2a00 [ 609.262777][T13641] ? reacquire_held_locks+0xce/0x1e0 [ 609.262827][T13641] ? __pfx___handle_mm_fault+0x10/0x10 [ 609.262884][T13641] ? lock_vma_under_rcu+0x17c/0x590 [ 609.262954][T13641] handle_mm_fault+0x37b/0xa30 [ 609.263007][T13641] do_user_addr_fault+0x5a3/0x12f0 [ 609.263052][T13641] exc_page_fault+0x6f/0xd0 [ 609.263092][T13641] asm_exc_page_fault+0x26/0x30 [ 609.263121][T13641] RIP: 0033:0x7f37e5e5e60b [ 609.263145][T13641] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 609.263173][T13641] RSP: 002b:00007f37e6e65fa0 EFLAGS: 00010206 [ 609.263197][T13641] RAX: 0000000000000000 RBX: 00007f37e6215fa0 RCX: 0000000000000000 [ 609.263217][T13641] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000180 [ 609.263235][T13641] RBP: 00007f37e6032d6f R08: 0000000000000000 R09: 0000000000000000 [ 609.263252][T13641] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000000 [ 609.263269][T13641] R13: 00007f37e6216038 R14: 00007f37e6215fa0 R15: 00007ffe974eead8 [ 609.263308][T13641] [ 609.264581][T13641] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 610.093502][T13656] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 610.472581][T13662] udc dummy_udc.0: soft-connect without a gadget driver [ 610.846030][ T9618] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 610.855053][T13666] vivid-008: ================= START STATUS ================= [ 610.912191][T13666] vivid-008: ================== END STATUS ================== [ 611.785736][T13665] random: crng reseeded on system resumption [ 612.728326][T13686] udc dummy_udc.0: soft-connect without a gadget driver [ 612.896697][T13690] : Can't lookup blockdev [ 612.903983][ T9618] Bluetooth: hci2: command 0x2016 tx timeout [ 614.973567][ T8548] Bluetooth: hci2: command 0x2016 tx timeout [ 615.171940][T13742] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 615.633901][T13747] smpboot: CPU 1 is now offline [ 616.229424][T13755] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 616.410228][T13758] udc dummy_udc.0: soft-connect without a gadget driver [ 616.723893][T13766] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 616.753436][ T6678] ------------[ cut here ]------------ [ 616.754689][ T6678] [ 616.754696][ T6678] ====================================================== [ 616.754702][ T6678] WARNING: possible circular locking dependency detected [ 616.754713][ T6678] syzkaller #0 Tainted: G L [ 616.754723][ T6678] ------------------------------------------------------ [ 616.754728][ T6678] kworker/0:2H/6678 is trying to acquire lock: [ 616.754737][ T6678] ffffffff8e6f1560 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x61/0x80 [ 616.754785][ T6678] [ 616.754785][ T6678] but task is already holding lock: [ 616.754790][ T6678] ffff8880b843b420 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 616.754832][ T6678] [ 616.754832][ T6678] which lock already depends on the new lock. [ 616.754832][ T6678] [ 616.754838][ T6678] [ 616.754838][ T6678] the existing dependency chain (in reverse order) is: [ 616.754843][ T6678] [ 616.754843][ T6678] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 616.754907][ T6678] _raw_spin_lock_nested+0x31/0x40 [ 616.754950][ T6678] raw_spin_rq_lock_nested+0x2c/0x140 [ 616.754972][ T6678] _task_rq_lock+0xcf/0x510 [ 616.754993][ T6678] cgroup_move_task+0x81/0x320 [ 616.755023][ T6678] css_set_move_task+0x285/0x600 [ 616.755050][ T6678] cgroup_post_fork+0x202/0x9b0 [ 616.755074][ T6678] copy_process+0x5b9a/0x7ed0 [ 616.755096][ T6678] kernel_clone+0x176/0x9e0 [ 616.755117][ T6678] user_mode_thread+0xcc/0x110 [ 616.755147][ T6678] rest_init+0x21/0x260 [ 616.755163][ T6678] start_kernel+0x484/0x490 [ 616.755257][ T6678] x86_64_start_reservations+0x24/0x30 [ 616.755293][ T6678] x86_64_start_kernel+0x12b/0x130 [ 616.755309][ T6678] common_startup_64+0x13e/0x148 [ 616.755344][ T6678] [ 616.755344][ T6678] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 616.755366][ T6678] _raw_spin_lock_irqsave+0x3a/0x60 [ 616.755396][ T6678] try_to_wake_up+0xb5/0x1900 [ 616.755416][ T6678] __wake_up_common+0x135/0x1f0 [ 616.755443][ T6678] __wake_up+0x31/0x60 [ 616.755472][ T6678] tty_port_default_wakeup+0x52/0x70 [ 616.755547][ T6678] serial8250_tx_chars+0x68f/0x860 [ 616.755600][ T6678] serial8250_handle_irq_locked+0x5e6/0x7e0 [ 616.755625][ T6678] serial8250_handle_irq.part.0+0xb4/0x530 [ 616.755650][ T6678] serial8250_default_handle_irq+0xc2/0x290 [ 616.755676][ T6678] serial8250_interrupt+0xf8/0x1c0 [ 616.755719][ T6678] __handle_irq_event_percpu+0x235/0x8c0 [ 616.755741][ T6678] handle_irq_event+0xab/0x1e0 [ 616.755761][ T6678] handle_edge_irq+0x35e/0x960 [ 616.755779][ T6678] __common_interrupt+0xd8/0x2f0 [ 616.755810][ T6678] common_interrupt+0xb9/0xe0 [ 616.755827][ T6678] asm_common_interrupt+0x26/0x40 [ 616.755845][ T6678] finish_task_switch.isra.0+0x2d3/0x1010 [ 616.755866][ T6678] __schedule+0x129d/0x67a0 [ 616.755887][ T6678] preempt_schedule_irq+0x50/0x90 [ 616.755913][ T6678] irqentry_exit+0x205/0x970 [ 616.755936][ T6678] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 616.755955][ T6678] write_comp_data+0x7/0x90 [ 616.755976][ T6678] __pkru_allows_pkey+0xa7/0xb0 [ 616.755993][ T6678] do_user_addr_fault+0x9f7/0x12f0 [ 616.756012][ T6678] exc_page_fault+0x6f/0xd0 [ 616.756034][ T6678] asm_exc_page_fault+0x26/0x30 [ 616.756050][ T6678] [ 616.756050][ T6678] -> #2 (&tty->write_wait){-.-.}-{3:3}: [ 616.756073][ T6678] _raw_spin_lock_irqsave+0x3a/0x60 [ 616.756094][ T6678] __wake_up+0x1c/0x60 [ 616.756117][ T6678] tty_port_default_wakeup+0x52/0x70 [ 616.756140][ T6678] serial8250_tx_chars+0x68f/0x860 [ 616.756164][ T6678] serial8250_handle_irq_locked+0x5e6/0x7e0 [ 616.756189][ T6678] serial8250_handle_irq.part.0+0xb4/0x530 [ 616.756214][ T6678] serial8250_default_handle_irq+0xc2/0x290 [ 616.756239][ T6678] serial8250_interrupt+0xf8/0x1c0 [ 616.756266][ T6678] __handle_irq_event_percpu+0x235/0x8c0 [ 616.756287][ T6678] handle_irq_event+0xab/0x1e0 [ 616.756307][ T6678] handle_edge_irq+0x35e/0x960 [ 616.756325][ T6678] __common_interrupt+0xd8/0x2f0 [ 616.756350][ T6678] common_interrupt+0xb9/0xe0 [ 616.756367][ T6678] asm_common_interrupt+0x26/0x40 [ 616.756383][ T6678] _raw_spin_unlock_irqrestore+0x31/0x80 [ 616.756413][ T6678] uart_write+0x29d/0xb20 [ 616.756435][ T6678] n_tty_write+0x431/0x11c0 [ 616.756460][ T6678] file_tty_write.isra.0+0x4d2/0x890 [ 616.756482][ T6678] redirected_tty_write+0xd4/0x120 [ 616.756504][ T6678] vfs_write+0x6ac/0x1070 [ 616.756522][ T6678] ksys_write+0x12a/0x250 [ 616.756540][ T6678] do_syscall_64+0x115/0x840 [ 616.756564][ T6678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.756581][ T6678] [ 616.756581][ T6678] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 616.756603][ T6678] _raw_spin_lock_irqsave+0x3a/0x60 [ 616.756624][ T6678] serial8250_console_write+0x17e/0x1900 [ 616.756651][ T6678] console_flush_one_record+0x790/0xe50 [ 616.756671][ T6678] console_unlock+0x103/0x260 [ 616.756690][ T6678] vprintk_emit+0x407/0x6b0 [ 616.756710][ T6678] _printk+0xcf/0x110 [ 616.756725][ T6678] register_console.cold+0xc0/0x248 [ 616.756742][ T6678] univ8250_console_init+0x6f/0x80 [ 616.756801][ T6678] console_init+0x3f7/0x5e0 [ 616.756847][ T6678] start_kernel+0x30a/0x490 [ 616.756873][ T6678] x86_64_start_reservations+0x24/0x30 [ 616.756892][ T6678] x86_64_start_kernel+0x12b/0x130 [ 616.756908][ T6678] common_startup_64+0x13e/0x148 [ 616.756929][ T6678] [ 616.756929][ T6678] -> #0 (console_owner){-.-.}-{0:0}: [ 616.756951][ T6678] __lock_acquire+0x14b8/0x2630 [ 616.756977][ T6678] lock_acquire+0x1b1/0x370 [ 616.757003][ T6678] console_lock_spinning_enable+0x72/0x80 [ 616.757023][ T6678] console_flush_one_record+0x739/0xe50 [ 616.757043][ T6678] console_unlock+0x103/0x260 [ 616.757062][ T6678] vprintk_emit+0x407/0x6b0 [ 616.757081][ T6678] _printk+0xcf/0x110 [ 616.757096][ T6678] __report_bug.cold+0x15/0x137 [ 616.757123][ T6678] report_bug+0xb2/0x220 [ 616.757177][ T6678] handle_bug+0x16a/0x2a0 [ 616.757191][ T6678] exc_invalid_op+0x17/0x50 [ 616.757206][ T6678] asm_exc_invalid_op+0x1a/0x20 [ 616.757221][ T6678] update_rq_clock+0x40a/0xd20 [ 616.757243][ T6678] __schedule+0x1e84/0x67a0 [ 616.757264][ T6678] schedule+0xdd/0x390 [ 616.757284][ T6678] worker_thread+0x53b/0xe50 [ 616.757299][ T6678] kthread+0x370/0x450 [ 616.757324][ T6678] ret_from_fork+0x72b/0xd50 [ 616.757341][ T6678] ret_from_fork_asm+0x1a/0x30 [ 616.757363][ T6678] [ 616.757363][ T6678] other info that might help us debug this: [ 616.757363][ T6678] [ 616.757368][ T6678] Chain exists of: [ 616.757368][ T6678] console_owner --> &p->pi_lock --> &rq->__lock [ 616.757368][ T6678] [ 616.757399][ T6678] Possible unsafe locking scenario: [ 616.757399][ T6678] [ 616.757404][ T6678] CPU0 CPU1 [ 616.757408][ T6678] ---- ---- [ 616.757413][ T6678] lock(&rq->__lock); [ 616.757424][ T6678] lock(&p->pi_lock); [ 616.757436][ T6678] lock(&rq->__lock); [ 616.757447][ T6678] lock(console_owner); [ 616.757458][ T6678] [ 616.757458][ T6678] *** DEADLOCK *** [ 616.757458][ T6678] [ 616.757462][ T6678] 3 locks held by kworker/0:2H/6678: [ 616.757472][ T6678] #0: ffff8880b843b420 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 616.757518][ T6678] #1: ffffffff8e7d19a0 (console_lock){+.+.}-{0:0}, at: _printk+0xcf/0x110 [ 616.757556][ T6678] #2: ffffffff8e7d1a18 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfd/0xe50 [ 616.757600][ T6678] [ 616.757600][ T6678] stack backtrace: [ 616.757611][ T6678] CPU: 0 UID: 0 PID: 6678 Comm: kworker/0:2H Tainted: G L syzkaller #0 PREEMPT(full) [ 616.757636][ T6678] Tainted: [L]=SOFTLOCKUP [ 616.757642][ T6678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 616.757660][ T6678] Workqueue: 0x0 (events_highpri) [ 616.757681][ T6678] Call Trace: [ 616.757688][ T6678] [ 616.757695][ T6678] dump_stack_lvl+0x100/0x190 [ 616.757725][ T6678] print_circular_bug.cold+0x178/0x1c7 [ 616.757755][ T6678] check_noncircular+0x146/0x160 [ 616.757783][ T6678] __lock_acquire+0x14b8/0x2630 [ 616.757814][ T6678] lock_acquire+0x1b1/0x370 [ 616.757841][ T6678] ? console_lock_spinning_enable+0x61/0x80 [ 616.757863][ T6678] ? console_lock_spinning_enable+0x4a/0x80 [ 616.757886][ T6678] console_lock_spinning_enable+0x72/0x80 [ 616.757910][ T6678] ? console_lock_spinning_enable+0x61/0x80 [ 616.757930][ T6678] console_flush_one_record+0x739/0xe50 [ 616.757954][ T6678] ? __pfx_console_flush_one_record+0x10/0x10 [ 616.757979][ T6678] ? is_printk_cpu_sync_owner+0x32/0x40 [ 616.758004][ T6678] console_unlock+0x103/0x260 [ 616.758025][ T6678] ? __pfx_console_unlock+0x10/0x10 [ 616.758047][ T6678] ? do_raw_spin_unlock+0x145/0x1e0 [ 616.758067][ T6678] ? _printk+0xcf/0x110 [ 616.758084][ T6678] vprintk_emit+0x407/0x6b0 [ 616.758106][ T6678] ? __pfx_vprintk_emit+0x10/0x10 [ 616.758130][ T6678] _printk+0xcf/0x110 [ 616.758146][ T6678] ? __pfx__printk+0x10/0x10 [ 616.758165][ T6678] ? trace_ignore_this_task+0xc3/0x100 [ 616.758188][ T6678] ? find_held_lock+0x2b/0x80 [ 616.758209][ T6678] ? try_to_wake_up+0x5ec/0x1900 [ 616.758230][ T6678] ? __report_bug.cold+0x5/0x137 [ 616.758257][ T6678] ? __report_bug+0x377/0x3d0 [ 616.758281][ T6678] __report_bug.cold+0x15/0x137 [ 616.758308][ T6678] ? update_rq_clock+0x40a/0xd20 [ 616.758331][ T6678] ? __pfx___report_bug+0x10/0x10 [ 616.758357][ T6678] ? update_cfs_rq_load_avg+0x51/0x550 [ 616.758382][ T6678] ? update_rq_clock+0x40a/0xd20 [ 616.758416][ T6678] report_bug+0xb2/0x220 [ 616.758438][ T6678] ? update_rq_clock+0x40a/0xd20 [ 616.758461][ T6678] handle_bug+0x16a/0x2a0 [ 616.758476][ T6678] exc_invalid_op+0x17/0x50 [ 616.758492][ T6678] asm_exc_invalid_op+0x1a/0x20 [ 616.758509][ T6678] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 616.758533][ T6678] Code: ab 88 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 80 0b 00 00 48 b8 00 00 00 00 00 [ 616.758552][ T6678] RSP: 0018:ffffc9000ec67bd0 EFLAGS: 00010046 [ 616.758565][ T6678] RAX: 0000000000000000 RBX: ffff8880b853b3c0 RCX: 0000000000000001 [ 616.758577][ T6678] RDX: 0000000000000046 RSI: ffffffff8def47f1 RDI: ffffffff8c1c4380 [ 616.758588][ T6678] RBP: ffffc9000ec67d80 R08: 0000000000000001 R09: 0000000000000001 [ 616.758599][ T6678] R10: ffff88802fcebe80 R11: 00000000000000b4 R12: ffffffff90d765c4 [ 616.758610][ T6678] R13: ffff8880b853c260 R14: ffff888033eb8000 R15: ffff8880b853b3c0 [ 616.758626][ T6678] ? pick_task_fair+0x85/0x350 [ 616.758648][ T6678] __schedule+0x1e84/0x67a0 [ 616.758676][ T6678] ? __pfx___schedule+0x10/0x10 [ 616.758698][ T6678] ? find_held_lock+0x2b/0x80 [ 616.758720][ T6678] ? schedule+0x2bf/0x390 [ 616.758743][ T6678] schedule+0xdd/0x390 [ 616.758764][ T6678] ? worker_thread+0x4c0/0xe50 [ 616.758780][ T6678] worker_thread+0x53b/0xe50 [ 616.758798][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 616.758815][ T6678] ? kthread+0x13a/0x450 [ 616.758840][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 616.758856][ T6678] kthread+0x370/0x450 [ 616.758882][ T6678] ? __pfx_kthread+0x10/0x10 [ 616.758912][ T6678] ret_from_fork+0x72b/0xd50 [ 616.758930][ T6678] ? __pfx_ret_from_fork+0x10/0x10 [ 616.758948][ T6678] ? __switch_to+0x800/0x1100 [ 616.758972][ T6678] ? __switch_to_asm+0x39/0x70 [ 616.758994][ T6678] ? __pfx_kthread+0x10/0x10 [ 616.759021][ T6678] ret_from_fork_asm+0x1a/0x30 [ 616.759047][ T6678] [ 617.885908][ T6678] debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) [ 617.885944][ T6678] WARNING: kernel/sched/sched.h:1612 at update_rq_clock+0x40a/0xd20, CPU#0: kworker/0:2H/6678 [ 617.904041][ T6678] Modules linked in: [ 617.907941][ T6678] CPU: 0 UID: 0 PID: 6678 Comm: kworker/0:2H Tainted: G L syzkaller #0 PREEMPT(full) [ 617.918966][ T6678] Tainted: [L]=SOFTLOCKUP [ 617.923289][ T6678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 617.933347][ T6678] Workqueue: 0x0 (events_highpri) [ 617.938477][ T6678] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 617.944029][ T6678] Code: ab 88 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 80 0b 00 00 48 b8 00 00 00 00 00 [ 617.963644][ T6678] RSP: 0018:ffffc9000ec67bd0 EFLAGS: 00010046 [ 617.969725][ T6678] RAX: 0000000000000000 RBX: ffff8880b853b3c0 RCX: 0000000000000001 [ 617.977786][ T6678] RDX: 0000000000000046 RSI: ffffffff8def47f1 RDI: ffffffff8c1c4380 [ 617.985867][ T6678] RBP: ffffc9000ec67d80 R08: 0000000000000001 R09: 0000000000000001 [ 617.993850][ T6678] R10: ffff88802fcebe80 R11: 00000000000000b4 R12: ffffffff90d765c4 [ 618.001815][ T6678] R13: ffff8880b853c260 R14: ffff888033eb8000 R15: ffff8880b853b3c0 [ 618.009801][ T6678] FS: 0000000000000000(0000) GS:ffff88812438b000(0000) knlGS:0000000000000000 [ 618.018727][ T6678] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 618.025329][ T6678] CR2: 00007fc2f15c7c00 CR3: 000000008a8ec000 CR4: 00000000003526f0 [ 618.033309][ T6678] Call Trace: [ 618.036583][ T6678] [ 618.039507][ T6678] ? pick_task_fair+0x85/0x350 [ 618.044305][ T6678] __schedule+0x1e84/0x67a0 [ 618.048819][ T6678] ? __pfx___schedule+0x10/0x10 [ 618.053672][ T6678] ? find_held_lock+0x2b/0x80 [ 618.058352][ T6678] ? schedule+0x2bf/0x390 [ 618.062690][ T6678] schedule+0xdd/0x390 [ 618.066759][ T6678] ? worker_thread+0x4c0/0xe50 [ 618.071604][ T6678] worker_thread+0x53b/0xe50 [ 618.076209][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 618.081326][ T6678] ? kthread+0x13a/0x450 [ 618.085578][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 618.090684][ T6678] kthread+0x370/0x450 [ 618.094757][ T6678] ? __pfx_kthread+0x10/0x10 [ 618.099353][ T6678] ret_from_fork+0x72b/0xd50 [ 618.103955][ T6678] ? __pfx_ret_from_fork+0x10/0x10 [ 618.109062][ T6678] ? __switch_to+0x800/0x1100 [ 618.113741][ T6678] ? __switch_to_asm+0x39/0x70 [ 618.118506][ T6678] ? __pfx_kthread+0x10/0x10 [ 618.123147][ T6678] ret_from_fork_asm+0x1a/0x30 [ 618.127925][ T6678] [ 618.130981][ T6678] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 618.138263][ T6678] CPU: 0 UID: 0 PID: 6678 Comm: kworker/0:2H Tainted: G L syzkaller #0 PREEMPT(full) [ 618.149287][ T6678] Tainted: [L]=SOFTLOCKUP [ 618.153602][ T6678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 618.163674][ T6678] Workqueue: 0x0 (events_highpri) [ 618.168811][ T6678] Call Trace: [ 618.172097][ T6678] [ 618.175041][ T6678] dump_stack_lvl+0x100/0x190 [ 618.179774][ T6678] vpanic+0x552/0x970 [ 618.183760][ T6678] ? __pfx_vpanic+0x10/0x10 [ 618.188278][ T6678] ? lock_release+0x245/0x310 [ 618.192970][ T6678] panic+0xd1/0xe0 [ 618.196688][ T6678] ? __pfx_panic+0x10/0x10 [ 618.201100][ T6678] ? check_panic_on_warn+0x1f/0x90 [ 618.206494][ T6678] check_panic_on_warn.cold+0x19/0x34 [ 618.211862][ T6678] ? update_rq_clock+0x40a/0xd20 [ 618.216821][ T6678] __warn.cold+0x191/0x328 [ 618.221245][ T6678] __report_bug+0x296/0x3d0 [ 618.225777][ T6678] ? update_rq_clock+0x40a/0xd20 [ 618.230735][ T6678] ? __pfx___report_bug+0x10/0x10 [ 618.235798][ T6678] ? update_cfs_rq_load_avg+0x51/0x550 [ 618.241280][ T6678] ? update_rq_clock+0x40a/0xd20 [ 618.246227][ T6678] report_bug+0xb2/0x220 [ 618.250476][ T6678] ? update_rq_clock+0x40a/0xd20 [ 618.255415][ T6678] handle_bug+0x16a/0x2a0 [ 618.259773][ T6678] exc_invalid_op+0x17/0x50 [ 618.264372][ T6678] asm_exc_invalid_op+0x1a/0x20 [ 618.269219][ T6678] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 618.274771][ T6678] Code: ab 88 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 80 0b 00 00 48 b8 00 00 00 00 00 [ 618.294374][ T6678] RSP: 0018:ffffc9000ec67bd0 EFLAGS: 00010046 [ 618.300543][ T6678] RAX: 0000000000000000 RBX: ffff8880b853b3c0 RCX: 0000000000000001 [ 618.308516][ T6678] RDX: 0000000000000046 RSI: ffffffff8def47f1 RDI: ffffffff8c1c4380 [ 618.316480][ T6678] RBP: ffffc9000ec67d80 R08: 0000000000000001 R09: 0000000000000001 [ 618.324448][ T6678] R10: ffff88802fcebe80 R11: 00000000000000b4 R12: ffffffff90d765c4 [ 618.332499][ T6678] R13: ffff8880b853c260 R14: ffff888033eb8000 R15: ffff8880b853b3c0 [ 618.340469][ T6678] ? pick_task_fair+0x85/0x350 [ 618.345255][ T6678] __schedule+0x1e84/0x67a0 [ 618.349791][ T6678] ? __pfx___schedule+0x10/0x10 [ 618.354658][ T6678] ? find_held_lock+0x2b/0x80 [ 618.359440][ T6678] ? schedule+0x2bf/0x390 [ 618.363770][ T6678] schedule+0xdd/0x390 [ 618.367839][ T6678] ? worker_thread+0x4c0/0xe50 [ 618.372613][ T6678] worker_thread+0x53b/0xe50 [ 618.377212][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 618.382317][ T6678] ? kthread+0x13a/0x450 [ 618.386561][ T6678] ? __pfx_worker_thread+0x10/0x10 [ 618.391678][ T6678] kthread+0x370/0x450 [ 618.395754][ T6678] ? __pfx_kthread+0x10/0x10 [ 618.400349][ T6678] ret_from_fork+0x72b/0xd50 [ 618.404934][ T6678] ? __pfx_ret_from_fork+0x10/0x10 [ 618.410040][ T6678] ? __switch_to+0x800/0x1100 [ 618.414718][ T6678] ? __switch_to_asm+0x39/0x70 [ 618.419497][ T6678] ? __pfx_kthread+0x10/0x10 [ 618.424116][ T6678] ret_from_fork_asm+0x1a/0x30 [ 618.428883][ T6678] [ 618.432126][ T6678] Kernel Offset: disabled [ 618.436442][ T6678] Rebooting in 86400 seconds..