last executing test programs: 27.857833744s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000005c0)='-2 -3 -4 +4.2\n\x00', 0xe) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./export\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./export/sub\x00', 0x1ff) mount$tmpfs(0x0, &(0x7f0000000140)='./export/sub\x00', &(0x7f0000000180), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='nfsd 127.0.0.1 2147483647 myclient\n\x00', 0x23) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='myclient ./export 2147483647 25632 0 0 0\n\x00', 0x29) write(r2, &(0x7f00000002c0)='myclient ./export/sub 2147483647 25632 0 0 1\n\x00', 0x2d) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='tcp 2049\n\x00', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='8\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/export\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='nolock,clientaddr=127.0.0.1,addr=127.0.0.1\x00']) stat(&(0x7f0000000500)='./mnt/sub\x00', &(0x7f0000000540)) 21.500756559s ago: executing program 4 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000500)=""/10, 0xa) read(0xffffffffffffffff, &(0x7f0000000500)=""/10, 0xa) read(0xffffffffffffffff, &(0x7f0000000500)=""/10, 0xa) read(0xffffffffffffffff, &(0x7f0000000500)=""/10, 0xa) 19.706493445s ago: executing program 4 (id=60): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0c010310000000000040000000"], 0xf) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04050400c90016"], 0x7) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="040e0401550c00"], 0x7) syz_emit_vhci(0x0, 0x7) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_emit_vhci(&(0x7f0000000a00)=ANY=[@ANYBLOB="040e04016d0c00"], 0x7) nanosleep(&(0x7f0000000b00)={0x0, 0x2faf080}, 0x0) write(0xffffffffffffffff, &(0x7f0000000c00)="29000000010001", 0x7) nanosleep(&(0x7f0000000f00)={0x0, 0x2faf080}, 0x0) syz_emit_vhci(&(0x7f0000001000)=ANY=[@ANYBLOB="040e0401082000"], 0x7) 19.455346632s ago: executing program 32 (id=60): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0c010310000000000040000000"], 0xf) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04050400c90016"], 0x7) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="040e0401550c00"], 0x7) syz_emit_vhci(0x0, 0x7) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="040e04011a0c00"], 0x7) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_emit_vhci(&(0x7f0000000a00)=ANY=[@ANYBLOB="040e04016d0c00"], 0x7) nanosleep(&(0x7f0000000b00)={0x0, 0x2faf080}, 0x0) write(0xffffffffffffffff, &(0x7f0000000c00)="29000000010001", 0x7) nanosleep(&(0x7f0000000f00)={0x0, 0x2faf080}, 0x0) syz_emit_vhci(&(0x7f0000001000)=ANY=[@ANYBLOB="040e0401082000"], 0x7) 8.125043557s ago: executing program 3 (id=124): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000150)='16777216\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r1, &(0x7f0000000250)='/dev/zram0,65536\x00', 0x11) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000500), 0x1, 0x2) ioctl$MEMERASE64(r2, 0x40104d14, &(0x7f0000000600)={0x0, 0x1000000}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000400)="ffffffff0100"/24) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000c00)='./dev\x00', &(0x7f0000000c10)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000800)="ffffffff01000000002d3101000000000300040000000000766f6c3000"/152) 6.137209965s ago: executing program 3 (id=134): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000150)='16777216\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r1, &(0x7f0000000250)='/dev/zram0,65536\x00', 0x11) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000500), 0x1, 0x2) ioctl$MEMERASE64(r2, 0x40104d14, &(0x7f0000000600)={0x0, 0x1000000}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000400)="ffffffff0100"/24) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000c00)='./dev\x00', &(0x7f0000000c10)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000800)="ffffffff01000000002d3101000000000300040000000000766f6c3000"/152) 5.865718058s ago: executing program 0 (id=137): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) 5.154066946s ago: executing program 0 (id=139): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_to_team\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x3a}, 0x78, r3}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x40000000000000) sendfile(r0, 0xffffffffffffffff, 0x0, 0x80000001) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) syz_kvm_add_vcpu$x86(0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, 0x0) 4.059834882s ago: executing program 0 (id=141): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1414, 0x0, @dev={0xfe, 0x80, '\x00', 0x15}, 0x3}}}, 0x30) 3.600128377s ago: executing program 0 (id=143): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000150)='16777216\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r1, &(0x7f0000000250)='/dev/zram0,65536\x00', 0x11) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000500), 0x1, 0x2) ioctl$MEMERASE64(r2, 0x40104d14, &(0x7f0000000600)={0x0, 0x1000000}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000400)="ffffffff0100"/24) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000800)="ffffffff01000000002d3101000000000300040000000000766f6c3000"/152) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt\x00', 0x1ff) 3.287242036s ago: executing program 1 (id=144): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dummy.img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='md0\x00', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='7:0\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='raid1\x00', 0x6) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r5, &(0x7f0000000340)='1\x00', 0x2) write(0xffffffffffffffff, &(0x7f00000003c0)='0\x00', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='active\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000004c0)='+8\x00', 0x3) 2.963144561s ago: executing program 1 (id=145): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='acti', 0x4) 2.817974066s ago: executing program 1 (id=146): mount(&(0x7f0000000040)=@filename='configfs\x00', 0x0, &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='loop\x00', 0x4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/subsystems/testnqn\x00') r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write(r1, &(0x7f0000000340)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000380)={0x0, 0x2faf080}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f00000003c0)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/class/nvme/nvme0/reset_controller\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='1\x00', 0x1) 2.561220889s ago: executing program 2 (id=147): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) 2.232807609s ago: executing program 2 (id=148): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000150)='16777216\x00', 0x9) 2.227941098s ago: executing program 3 (id=149): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) 2.062563278s ago: executing program 5 (id=62): r0 = syz_io_uring_setup(0x10, &(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0, 0x0) socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./proc\x00', &(0x7f0000000900)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/afs/cells\x00', 0x1, 0x0) syz_io_uring_submit(r1, r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000001100)='add mycell 127.0.', 0x11}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 2.02300941s ago: executing program 2 (id=150): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_to_team\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x3a}, 0x78, r3}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x40000000000000) sendfile(r0, 0xffffffffffffffff, 0x0, 0x80000001) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) syz_kvm_add_vcpu$x86(0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, 0x0) 1.850869341s ago: executing program 3 (id=151): r0 = syz_io_uring_setup(0x10, &(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) r4 = socket$rxrpc(0x21, 0x2, 0x2) bind(r4, &(0x7f0000000100)=@generic={0x21, "34000200100002001b5b00"}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./proc\x00', &(0x7f0000000900)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/afs/cells\x00', 0x1, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000180)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r5, 0xffffffffffffffff, &(0x7f0000001000)=[{0x0}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r4, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000510)=""/1024, 0x400}], 0x1, &(0x7f0000000400)=""/24, 0x18}}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r4, 0x0, &(0x7f0000000320)={0x0, 0x0, &(0x7f0000000520)=[{&(0x7f0000000530)=""/1024, 0x400}], 0x1, &(0x7f0000000420)=""/24, 0x18}}) 1.739200851s ago: executing program 5 (id=152): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1414, 0x0, @dev={0xfe, 0x80, '\x00', 0x15}, 0x3}}}, 0x30) 1.560913418s ago: executing program 0 (id=153): r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c00)={'dummy0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000d00)={@local, 0x40, r1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000b00)={'dummy0\x00', 0x1043}) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000e00)='dummy0\x00', 0x7) bind$inet6(r3, &(0x7f0000000600)={0xa, 0x4e25, 0x0, @empty}, 0x1c) listen(r3, 0xa) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000300)={0x3, 0x40, 0x0, {{0xa, 0x0, 0x0, @empty}, {0xa, 0x4e25, 0x0, @local, 0x2}, 0xffffffffffffffff, 0x3e8}}, 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000400)={0x4, 0x8, 0x0, {0xffffffffffffffff, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r4, &(0x7f0000000500)={0x6, 0x118, 0x0, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}}}, 0x120) r5 = accept4$inet6(r3, 0x0, 0x0, 0x0) sendto$inet6(r5, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r5) 1.253107735s ago: executing program 1 (id=154): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dummy.img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='md0\x00', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='7:0\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='raid1\x00', 0x6) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r5, &(0x7f0000000340)='1\x00', 0x2) write(0xffffffffffffffff, &(0x7f00000003c0)='0\x00', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='active\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000004c0)='+8\x00', 0x3) 1.167655286s ago: executing program 5 (id=155): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='acti', 0x4) 1.051889831s ago: executing program 3 (id=156): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/functions/uac2.0/c_sync\x00', 0x2, 0x0) write(r0, &(0x7f0000000740)='8\n', 0x2) 1.003439387s ago: executing program 2 (id=157): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) read(r0, &(0x7f0000000500)=""/10, 0xa) 862.332071ms ago: executing program 5 (id=158): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x10, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x11, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x12, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x13, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x14, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x15, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x16, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x17, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x18, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x19, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1a, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1b, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1c, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1d, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1e, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1f, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x20, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x21, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x22, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x23, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x27, 0x1, 0x0, 0x0, {0xc}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xb, 0x2, 0x0, 0x0, @str='client\x00'}]}]}, 0x24}}, 0x0) 861.014322ms ago: executing program 1 (id=159): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000001900)='./config/target/usb_gadget/naa.1234567890/tpgt_1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000001a00)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') 599.165376ms ago: executing program 2 (id=160): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000150)='16777216\x00', 0x9) 494.804466ms ago: executing program 3 (id=161): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000150)='16777216\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r1, &(0x7f0000000250)='/dev/zram0,65536\x00', 0x11) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000500), 0x1, 0x2) ioctl$MEMERASE64(r2, 0x40104d14, &(0x7f0000000600)={0x0, 0x1000000}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000c00)='./dev\x00', &(0x7f0000000c10)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000800)="ffffffff01000000002d3101000000000300040000000000766f6c3000"/152) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt\x00', 0x1ff) 357.688201ms ago: executing program 2 (id=162): r0 = syz_io_uring_setup(0x10, &(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0, 0x0) socket$rxrpc(0x21, 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./proc\x00', &(0x7f0000000900)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/afs/cells\x00', 0x1, 0x0) syz_io_uring_submit(r1, r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000001100)='add mycell 127.0.', 0x11}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 353.32963ms ago: executing program 5 (id=163): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) pwrite64(r0, 0x0, 0x0, 0x1000) pwrite64(r0, &(0x7f0000001004)="01000000", 0x4, 0x1004) pwrite64(r0, &(0x7f0000001008)="01000000", 0x4, 0x1008) pwrite64(r0, &(0x7f000000100c)='\b\x00\x00\x00', 0x4, 0x1060) pwrite64(r0, &(0x7f0000001010)="1000000000000000", 0x8, 0x1080) pwrite64(r0, &(0x7f0000001018)='\n\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1088) pwrite64(r0, &(0x7f0000001020)='\b\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1090) pwrite64(r0, &(0x7f0000001028)="284f2ba9", 0x4, 0x10d8) pwrite64(r0, &(0x7f000000102c)='bitm', 0x4, 0x2000) pwrite64(r0, &(0x7f0000001030)="04000000", 0x4, 0x2004) pwrite64(r0, &(0x7f0000001034)="00020000", 0x4, 0x2034) pwrite64(r0, &(0x7f0000001038)="01000000", 0x4, 0x2038) pwrite64(r0, &(0x7f000000103c)='\x00\x00\x00\x00', 0x4, 0x203c) fsync(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='md0\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram0/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000a00)='writemostly\x00', 0xc) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/bitmap/backlog\x00', 0x2, 0x0) write(r3, &(0x7f0000000e00)='1024\x00', 0x5) 327.523151ms ago: executing program 1 (id=164): mount(&(0x7f0000000040)=@filename='configfs\x00', 0x0, &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='loop\x00', 0x4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/subsystems/testnqn\x00') r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write(r1, &(0x7f0000000340)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000380)={0x0, 0x2faf080}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f00000003c0)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/class/nvme/nvme0/reset_controller\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='1\x00', 0x1) 0s ago: executing program 0 (id=165): r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1414, 0x0, @dev={0xfe, 0x80, '\x00', 0x15}, 0x3}}}, 0x30) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.64' (ED25519) to the list of known hosts. [ 83.918245][ T5573] cgroup: Unknown subsys name 'net' [ 84.172051][ T5573] cgroup: Unknown subsys name 'cpuset' [ 84.224194][ T5573] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.087342][ T5573] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.777228][ T5589] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.778841][ T4902] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.795008][ T5589] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.817729][ T5589] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.819398][ T5589] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.823844][ T4902] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.824278][ T4902] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.828720][ T5589] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.871540][ T59] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.876320][ T59] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 89.010160][ T5588] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 89.027508][ T5593] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 89.038160][ T5588] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 89.061397][ T5593] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 89.066856][ T5597] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 89.078967][ T5597] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 89.097840][ T5593] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 89.099795][ T5597] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 89.115509][ T5597] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 89.123259][ T5597] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 89.134361][ T5597] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 89.157530][ T5593] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 89.173134][ T5593] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 89.186028][ T5593] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 89.196382][ T5593] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 91.034664][ T5588] Bluetooth: hci1: command tx timeout [ 91.041705][ T5588] Bluetooth: hci0: command tx timeout [ 91.193718][ T59] Bluetooth: hci2: command tx timeout [ 91.273791][ T59] Bluetooth: hci3: command tx timeout [ 91.275698][ T59] Bluetooth: hci4: command tx timeout [ 91.449953][ T5584] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.451063][ T5584] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.451493][ T5584] bridge_slave_0: entered allmulticast mode [ 91.466135][ T5584] bridge_slave_0: entered promiscuous mode [ 91.518654][ T5584] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.519007][ T5584] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.519419][ T5584] bridge_slave_1: entered allmulticast mode [ 91.530721][ T5584] bridge_slave_1: entered promiscuous mode [ 91.708859][ T5584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.711056][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.711594][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.721162][ T5595] bridge_slave_0: entered allmulticast mode [ 91.727804][ T5595] bridge_slave_0: entered promiscuous mode [ 91.772692][ T5586] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.773183][ T5586] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.773599][ T5586] bridge_slave_0: entered allmulticast mode [ 91.781601][ T5586] bridge_slave_0: entered promiscuous mode [ 91.805080][ T5584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.806902][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.807210][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.808552][ T5595] bridge_slave_1: entered allmulticast mode [ 91.817193][ T5595] bridge_slave_1: entered promiscuous mode [ 91.908054][ T5586] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.908418][ T5586] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.908831][ T5586] bridge_slave_1: entered allmulticast mode [ 91.929340][ T5586] bridge_slave_1: entered promiscuous mode [ 92.022381][ T1588] cfg80211: failed to load regulatory.db [ 92.066789][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.069836][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.070351][ T5590] bridge_slave_0: entered allmulticast mode [ 92.076227][ T5590] bridge_slave_0: entered promiscuous mode [ 92.112332][ T5584] team0: Port device team_slave_0 added [ 92.120963][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.122620][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.122718][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.122871][ T5594] bridge_slave_0: entered allmulticast mode [ 92.154115][ T5594] bridge_slave_0: entered promiscuous mode [ 92.159177][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.159467][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.171073][ T5590] bridge_slave_1: entered allmulticast mode [ 92.179229][ T5590] bridge_slave_1: entered promiscuous mode [ 92.188816][ T5586] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.208273][ T5584] team0: Port device team_slave_1 added [ 92.216369][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.216979][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.217261][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.219196][ T5594] bridge_slave_1: entered allmulticast mode [ 92.228222][ T5594] bridge_slave_1: entered promiscuous mode [ 92.263828][ T5586] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.398386][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.426758][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.426860][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.426932][ T5584] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.446719][ T5595] team0: Port device team_slave_0 added [ 92.467565][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.488652][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.499075][ T5586] team0: Port device team_slave_0 added [ 92.503361][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.503402][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.503487][ T5584] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.522511][ T5595] team0: Port device team_slave_1 added [ 92.539680][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.574980][ T5586] team0: Port device team_slave_1 added [ 92.675973][ T5590] team0: Port device team_slave_0 added [ 92.695936][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.696008][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.696079][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.717689][ T5594] team0: Port device team_slave_0 added [ 92.727488][ T5590] team0: Port device team_slave_1 added [ 92.760247][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.760326][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.760386][ T5586] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.767187][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.767220][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.767285][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.785607][ T5594] team0: Port device team_slave_1 added [ 92.869735][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.869891][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.870004][ T5586] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.949663][ T5584] hsr_slave_0: entered promiscuous mode [ 92.955774][ T5584] hsr_slave_1: entered promiscuous mode [ 93.113826][ T59] Bluetooth: hci1: command tx timeout [ 93.114398][ T5588] Bluetooth: hci0: command tx timeout [ 93.273841][ T5588] Bluetooth: hci2: command tx timeout [ 93.353966][ T59] Bluetooth: hci3: command tx timeout [ 93.354437][ T5588] Bluetooth: hci4: command tx timeout [ 93.403445][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.404466][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.404538][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.434758][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.434791][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.434860][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.450748][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.450783][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.450848][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.574091][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.574171][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.574233][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.672299][ T5595] hsr_slave_0: entered promiscuous mode [ 93.676810][ T5595] hsr_slave_1: entered promiscuous mode [ 93.679057][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 93.679298][ T5595] Cannot create hsr debugfs directory [ 93.714096][ T5586] hsr_slave_0: entered promiscuous mode [ 93.717721][ T5586] hsr_slave_1: entered promiscuous mode [ 93.727565][ T5586] debugfs: 'hsr0' already exists in 'hsr' [ 93.727630][ T5586] Cannot create hsr debugfs directory [ 93.856989][ T5590] hsr_slave_0: entered promiscuous mode [ 93.861725][ T5590] hsr_slave_1: entered promiscuous mode [ 93.865691][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 93.865767][ T5590] Cannot create hsr debugfs directory [ 93.907486][ T5594] hsr_slave_0: entered promiscuous mode [ 93.910846][ T5594] hsr_slave_1: entered promiscuous mode [ 93.912938][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 93.913000][ T5594] Cannot create hsr debugfs directory [ 94.789101][ T5584] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.846771][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.859112][ T5584] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.884661][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.892992][ T5584] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.927063][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.951628][ T5584] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.986808][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.132599][ T5586] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 95.166667][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.177680][ T5586] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 95.193941][ T5588] Bluetooth: hci0: command tx timeout [ 95.193951][ T59] Bluetooth: hci1: command tx timeout [ 95.210277][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.218339][ T5586] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 95.257476][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.284153][ T5586] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 95.307385][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.354623][ T5588] Bluetooth: hci2: command tx timeout [ 95.434947][ T5588] Bluetooth: hci3: command tx timeout [ 95.434959][ T59] Bluetooth: hci4: command tx timeout [ 95.460607][ T5590] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 95.489537][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.503414][ T5590] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 95.528769][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.549593][ T5590] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 95.588591][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.638631][ T5590] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 95.678803][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.817339][ T5594] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 95.857165][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.874238][ T5594] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 95.898360][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.909647][ T5594] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 95.938067][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.978792][ T5594] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 96.010721][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.058373][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.209564][ T5595] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.237507][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.251417][ T5595] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.277118][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.288216][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.292674][ T5595] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.328358][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.341632][ T5595] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.369412][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.405871][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.413520][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.443216][ T5586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.470735][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.482587][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.589693][ T5586] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.658766][ T162] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.659185][ T162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.685583][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.712977][ T162] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.727108][ T162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.809669][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.888934][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.909185][ T1344] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.909881][ T1344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.003457][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.006535][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.081133][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.122760][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.141818][ T1344] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.149985][ T1344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.218431][ T1344] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.232127][ T1344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.273903][ T5588] Bluetooth: hci0: command tx timeout [ 97.283766][ T5588] Bluetooth: hci1: command tx timeout [ 97.328178][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.405041][ T162] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.413195][ T162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.434523][ T5588] Bluetooth: hci2: command tx timeout [ 97.515423][ T5588] Bluetooth: hci3: command tx timeout [ 97.515493][ T59] Bluetooth: hci4: command tx timeout [ 97.551238][ T162] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.554215][ T162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.834548][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.433314][ T5584] veth0_vlan: entered promiscuous mode [ 98.466904][ T5586] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.501689][ T5584] veth1_vlan: entered promiscuous mode [ 98.749653][ T5584] veth0_macvtap: entered promiscuous mode [ 98.780426][ T5586] veth0_vlan: entered promiscuous mode [ 98.817405][ T5584] veth1_macvtap: entered promiscuous mode [ 98.880398][ T5586] veth1_vlan: entered promiscuous mode [ 98.931808][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.951717][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.014793][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.029189][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.257669][ T5586] veth0_macvtap: entered promiscuous mode [ 99.349216][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.368722][ T5586] veth1_macvtap: entered promiscuous mode [ 99.563833][ T5590] veth0_vlan: entered promiscuous mode [ 99.627915][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.661174][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.691932][ T5590] veth1_vlan: entered promiscuous mode [ 99.741543][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.762867][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.080809][ T5595] veth0_vlan: entered promiscuous mode [ 100.152543][ T162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.165762][ T162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.343259][ T5594] veth0_vlan: entered promiscuous mode [ 100.353295][ T5590] veth0_macvtap: entered promiscuous mode [ 100.366182][ T5595] veth1_vlan: entered promiscuous mode [ 100.394626][ T5590] veth1_macvtap: entered promiscuous mode [ 100.411218][ T162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.411287][ T162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.492551][ T5594] veth1_vlan: entered promiscuous mode [ 100.667141][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.817327][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.818911][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.851564][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.925032][ T5595] veth0_macvtap: entered promiscuous mode [ 100.969476][ T5595] veth1_macvtap: entered promiscuous mode [ 101.072284][ T5594] veth0_macvtap: entered promiscuous mode [ 101.207441][ T5594] veth1_macvtap: entered promiscuous mode [ 101.462604][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.540953][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.667879][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.742901][ T5785] loop0: detected capacity change from 0 to 32768 [ 101.864247][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.277586][ T166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.277805][ T166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.429579][ T5790] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.757024][ T5795] FAULT_INJECTION: forcing a failure. [ 102.757024][ T5795] name failslab, interval 1, probability 0, space 0, times 1 [ 102.757126][ T5795] CPU: 0 UID: 0 PID: 5795 Comm: syz.0.11 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.757220][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.757274][ T5795] Call Trace: [ 102.757284][ T5795] [ 102.757320][ T5795] dump_stack_lvl+0xe8/0x150 [ 102.757458][ T5795] should_fail_ex+0x46b/0x600 [ 102.757566][ T5795] should_failslab+0xa8/0x100 [ 102.757658][ T5795] __kmalloc_noprof+0xfb/0x790 [ 102.757746][ T5795] ? tomoyo_encode+0x2ad/0x570 [ 102.757822][ T5795] ? tomoyo_encode+0x2ad/0x570 [ 102.757912][ T5795] tomoyo_encode+0x2ad/0x570 [ 102.758001][ T5795] tomoyo_realpath_from_path+0x5fa/0x640 [ 102.758048][ T5795] ? tomoyo_path_number_perm+0x219/0x5f0 [ 102.758072][ T5795] tomoyo_path_number_perm+0x246/0x5f0 [ 102.758103][ T5795] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 102.758162][ T5795] ? __lock_acquire+0x6df/0x2e40 [ 102.758250][ T5795] ? __asan_memset+0x22/0x50 [ 102.758328][ T5795] ? _copy_from_user+0x4c/0xb0 [ 102.758414][ T5795] ? hook_file_ioctl+0x1f5/0x610 [ 102.758576][ T5795] ? __fget_files+0x2a/0x420 [ 102.758624][ T5795] ? __fget_files+0x2a/0x420 [ 102.758675][ T5795] ? __fget_files+0x3a8/0x420 [ 102.758741][ T5795] ? __fget_files+0x2a/0x420 [ 102.758819][ T5795] security_file_ioctl+0xc3/0x2a0 [ 102.758896][ T5795] __se_sys_ioctl+0x47/0x170 [ 102.758977][ T5795] do_syscall_64+0x166/0x520 [ 102.759037][ T5795] ? trace_irq_disable+0x3b/0x140 [ 102.759115][ T5795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.759182][ T5795] ? clear_bhb_loop+0x70/0xc0 [ 102.759253][ T5795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.759318][ T5795] RIP: 0033:0x7fa26e63e159 [ 102.759377][ T5795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.759433][ T5795] RSP: 002b:00007fa26c896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.759502][ T5795] RAX: ffffffffffffffda RBX: 00007fa26e8c5fa0 RCX: 00007fa26e63e159 [ 102.759558][ T5795] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 102.759594][ T5795] RBP: 00007fa26e6d5024 R08: 0000000000000000 R09: 0000000000000000 [ 102.759636][ T5795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.759671][ T5795] R13: 00007fa26e8c6038 R14: 00007fa26e8c5fa0 R15: 00007ffdabd54328 [ 102.759759][ T5795] [ 102.774128][ T5795] ERROR: Out of memory at tomoyo_realpath_from_path. [ 103.230983][ T166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.231058][ T166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.809817][ T3373] nvmet: connect request for invalid subsystem testnqn! [ 103.834986][ T5798] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 103.918153][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.918222][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.262289][ T5808] loop0: detected capacity change from 0 to 32768 [ 104.320264][ T5808] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 104.506560][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.506625][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.659962][ T5719] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 104.671959][ T162] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.672874][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.672939][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.982825][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.990977][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.007486][ T5719] usb 1-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 105.092268][ T5719] usb 1-1: config index 0 descriptor too short (expected 59, got 54) [ 105.100497][ T5719] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.100554][ T5719] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.176207][ T5719] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.184358][ T5719] usb 1-1: Product: syz [ 105.184378][ T5719] usb 1-1: Manufacturer: syz [ 105.184394][ T5719] usb 1-1: SerialNumber: syz [ 105.186015][ T154] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.389513][ T166] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.402094][ T3373] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.446376][ T5719] ljca 1-1:1.0: bulk endpoints not found [ 105.478428][ T57] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.594932][ T5816] md: could not open device unknown-block(7,0). [ 105.637379][ T162] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.921109][ T1588] usb 1-1: USB disconnect, device number 2 [ 106.008204][ T154] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.009705][ T154] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.099708][ T57] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.181539][ T57] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.297861][ T5816] md/raid1:md0: active with 1 out of 1 mirrors [ 106.388876][ T57] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.398822][ T3373] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.462837][ T154] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.719669][ T154] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.719912][ T154] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.720124][ T154] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.720370][ T154] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.720523][ T154] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.721124][ T154] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.787027][ T154] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.931586][ T5824] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 107.047782][ T5824] md: could not open device unknown-block(7,0). [ 108.199796][ T5857] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 108.473595][ T12] nvmet: connect request for invalid subsystem testnqn! [ 108.488953][ T5854] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 108.637928][ T5868] CIFS: Attempting to mount //127.0.0.1/share [ 108.910356][ T5857] md: could not open device unknown-block(7,0). [ 109.486202][ T5868] CIFS: VFS: cifs_mount failed w/return code = -112 [ 109.565142][ T5868] syz.1.27 (5868) used greatest stack depth: 19208 bytes left [ 109.986432][ T998] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 110.039395][ T5836] svc: failed to register lockdv1 RPC service (errno 512). [ 110.072126][ T5836] lockd_up: makesock failed, error=-512 [ 110.156924][ T5893] FAULT_INJECTION: forcing a failure. [ 110.156924][ T5893] name failslab, interval 1, probability 0, space 0, times 0 [ 110.172800][ T5893] CPU: 1 UID: 0 PID: 5893 Comm: syz.3.32 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 110.172827][ T5893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.172839][ T5893] Call Trace: [ 110.172847][ T5893] [ 110.172855][ T5893] dump_stack_lvl+0xe8/0x150 [ 110.172904][ T5893] should_fail_ex+0x46b/0x600 [ 110.172933][ T5893] should_failslab+0xa8/0x100 [ 110.172966][ T5893] ? new_userfaultfd+0x88/0x3d0 [ 110.172988][ T5893] kmem_cache_alloc_noprof+0x9e/0x690 [ 110.173016][ T5893] ? new_userfaultfd+0x88/0x3d0 [ 110.173042][ T5893] new_userfaultfd+0x88/0x3d0 [ 110.173066][ T5893] __x64_sys_userfaultfd+0x81/0xa0 [ 110.173085][ T5893] do_syscall_64+0x166/0x520 [ 110.173110][ T5893] ? trace_irq_disable+0x3b/0x140 [ 110.173135][ T5893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.173156][ T5893] ? clear_bhb_loop+0x70/0xc0 [ 110.173181][ T5893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.173202][ T5893] RIP: 0033:0x7f1169b6e159 [ 110.173220][ T5893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.173238][ T5893] RSP: 002b:00007f1167dc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 110.173261][ T5893] RAX: ffffffffffffffda RBX: 00007f1169df5fa0 RCX: 00007f1169b6e159 [ 110.173277][ T5893] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000801 [ 110.173291][ T5893] RBP: 00007f1169c05024 R08: 0000000000000000 R09: 0000000000000000 [ 110.173305][ T5893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.173318][ T5893] R13: 00007f1169df6038 R14: 00007f1169df5fa0 R15: 00007fff727efc48 [ 110.173350][ T5893] [ 110.405946][ T998] usb 3-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 110.415812][ T998] usb 3-1: config index 0 descriptor too short (expected 59, got 54) [ 110.415894][ T998] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 110.416000][ T998] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.557190][ T998] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.557276][ T998] usb 3-1: Product: syz [ 110.557292][ T998] usb 3-1: Manufacturer: syz [ 110.557306][ T998] usb 3-1: SerialNumber: syz [ 110.924997][ T998] ljca 3-1:1.0: bulk endpoints not found [ 111.289873][ T5909] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 111.311240][ T1588] usb 3-1: USB disconnect, device number 2 [ 111.422001][ T5909] md: could not open device unknown-block(7,0). [ 112.183855][ T5927] FAULT_INJECTION: forcing a failure. [ 112.183855][ T5927] name fail_futex, interval 1, probability 0, space 0, times 1 [ 112.184631][ T5927] CPU: 0 UID: 0 PID: 5927 Comm: syz.2.45 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 112.184660][ T5927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.184673][ T5927] Call Trace: [ 112.184682][ T5927] [ 112.184691][ T5927] dump_stack_lvl+0xe8/0x150 [ 112.184742][ T5927] should_fail_ex+0x46b/0x600 [ 112.184771][ T5927] get_futex_key+0x1b4/0x1580 [ 112.184817][ T5927] ? __pfx_get_futex_key+0x10/0x10 [ 112.184845][ T5927] ? kasan_quarantine_put+0xbb/0x1f0 [ 112.184888][ T5927] futex_wake+0x119/0x600 [ 112.184920][ T5927] ? __pfx_futex_wake+0x10/0x10 [ 112.184956][ T5927] ? sock_do_ioctl+0x1bd/0x320 [ 112.184983][ T5927] do_futex+0x458/0x4e0 [ 112.185025][ T5927] ? __pfx_do_futex+0x10/0x10 [ 112.185060][ T5927] ? smack_file_ioctl+0x265/0x370 [ 112.185104][ T5927] __se_sys_futex+0x3a8/0x450 [ 112.185145][ T5927] ? __fget_files+0x2a/0x420 [ 112.185168][ T5927] ? __pfx___se_sys_futex+0x10/0x10 [ 112.185222][ T5927] ? __fget_files+0x2a/0x420 [ 112.185256][ T5927] ? __x64_sys_futex+0x21/0xf0 [ 112.185297][ T5927] do_syscall_64+0x166/0x520 [ 112.185323][ T5927] ? trace_irq_disable+0x3b/0x140 [ 112.185350][ T5927] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.185373][ T5927] ? clear_bhb_loop+0x70/0xc0 [ 112.185400][ T5927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.185423][ T5927] RIP: 0033:0x7f0d6489e159 [ 112.185443][ T5927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.185462][ T5927] RSP: 002b:00007f0d62af60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 112.185487][ T5927] RAX: ffffffffffffffda RBX: 00007f0d64b25fa8 RCX: 00007f0d6489e159 [ 112.185505][ T5927] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f0d64b25fac [ 112.185519][ T5927] RBP: 00007f0d64b25fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 112.185536][ T5927] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 112.185570][ T5927] R13: 00007f0d64b26038 R14: 00007ffd66a65780 R15: 00007ffd66a65868 [ 112.185606][ T5927] [ 112.419825][ T5836] svc: failed to register nfsdv3 RPC service (errno 512). [ 112.420423][ T5836] svc: failed to register nfsaclv3 RPC service (errno 512). [ 112.420468][ T5836] failed to unregister tcp with rpcbind [ 112.563014][ T5934] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 112.671145][ T12] nvmet: connect request for invalid subsystem testnqn! [ 112.681155][ T5924] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 112.685542][ T5836] svc: failed to register nfsdv3 RPC service (errno 97). [ 112.685614][ T5836] svc: failed to register nfsaclv3 RPC service (errno 97). [ 112.685641][ T5836] failed to unregister tcp with rpcbind [ 113.714195][ T5847] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 113.906824][ T5847] usb 3-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice= 0.00 [ 113.924317][ T5847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.925601][ T5847] usb 3-1: Product: syz [ 113.925642][ T5847] usb 3-1: Manufacturer: syz [ 113.925686][ T5847] usb 3-1: SerialNumber: syz [ 113.950270][ T1588] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 114.014839][ T5847] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 114.016566][ T5847] gspca_stv06xx: st6422 sensor detected [ 114.149227][ T5966] NFSD: Failed to start, no listeners configured. [ 114.156179][ T1588] usb 4-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 114.158162][ T1588] usb 4-1: config index 0 descriptor too short (expected 59, got 54) [ 114.158192][ T1588] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.158225][ T1588] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 114.206904][ T1588] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.214636][ T1588] usb 4-1: Product: syz [ 114.214654][ T1588] usb 4-1: Manufacturer: syz [ 114.214669][ T1588] usb 4-1: SerialNumber: syz [ 114.233250][ T5961] FAULT_INJECTION: forcing a failure. [ 114.233250][ T5961] name failslab, interval 1, probability 0, space 0, times 0 [ 114.249681][ T5961] CPU: 0 UID: 0 PID: 5961 Comm: syz.1.57 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.249708][ T5961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.249721][ T5961] Call Trace: [ 114.249729][ T5961] [ 114.249738][ T5961] dump_stack_lvl+0xe8/0x150 [ 114.249775][ T5961] should_fail_ex+0x46b/0x600 [ 114.249805][ T5961] should_failslab+0xa8/0x100 [ 114.249838][ T5961] __kmalloc_cache_noprof+0xa1/0x680 [ 114.249867][ T5961] ? ipv6_add_addr+0x55e/0x11b0 [ 114.249888][ T5961] ? ipv6_add_addr+0x55e/0x11b0 [ 114.249916][ T5961] ipv6_add_addr+0x55e/0x11b0 [ 114.249944][ T5961] ? __pfx_ipv6_add_addr+0x10/0x10 [ 114.249968][ T5961] ? ipv6_find_idev+0x10a/0x1c0 [ 114.250005][ T5961] inet6_addr_add+0x43c/0xba0 [ 114.250047][ T5961] ? mutex_lock_nested+0x168/0x1d0 [ 114.250084][ T5961] addrconf_add_ifaddr+0x27c/0x3e0 [ 114.250120][ T5961] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 114.250147][ T5961] ? kasan_quarantine_put+0xbb/0x1f0 [ 114.250185][ T5961] inet6_ioctl+0x14e/0x2e0 [ 114.250210][ T5961] ? __pfx_inet6_ioctl+0x10/0x10 [ 114.250232][ T5961] ? tomoyo_path_number_perm+0x219/0x5f0 [ 114.250259][ T5961] ? do_vfs_ioctl+0x1184/0x1550 [ 114.250291][ T5961] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 114.250326][ T5961] sock_do_ioctl+0x101/0x320 [ 114.250352][ T5961] ? __pfx_sock_do_ioctl+0x10/0x10 [ 114.250371][ T5961] ? hook_file_ioctl+0x1f5/0x610 [ 114.250405][ T5961] ? __asan_memset+0x22/0x50 [ 114.250431][ T5961] ? smack_file_ioctl+0x265/0x370 [ 114.250472][ T5961] sock_ioctl+0x57d/0x7f0 [ 114.250510][ T5961] ? __pfx_sock_ioctl+0x10/0x10 [ 114.250544][ T5961] ? __fget_files+0x2a/0x420 [ 114.250564][ T5961] ? __fget_files+0x3a8/0x420 [ 114.250584][ T5961] ? __fget_files+0x2a/0x420 [ 114.250609][ T5961] ? bpf_lsm_file_ioctl+0x9/0x20 [ 114.250639][ T5961] ? __pfx_sock_ioctl+0x10/0x10 [ 114.250673][ T5961] __se_sys_ioctl+0xff/0x170 [ 114.250705][ T5961] do_syscall_64+0x166/0x520 [ 114.250730][ T5961] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.250753][ T5961] ? clear_bhb_loop+0x70/0xc0 [ 114.250780][ T5961] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.250803][ T5961] RIP: 0033:0x7faac80be159 [ 114.250823][ T5961] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.250841][ T5961] RSP: 002b:00007faac6316028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.250865][ T5961] RAX: ffffffffffffffda RBX: 00007faac8345fa0 RCX: 00007faac80be159 [ 114.250881][ T5961] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 114.250896][ T5961] RBP: 00007faac8155024 R08: 0000000000000000 R09: 0000000000000000 [ 114.250910][ T5961] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.250923][ T5961] R13: 00007faac8346038 R14: 00007faac8345fa0 R15: 00007ffd6cd892e8 [ 114.250958][ T5961] [ 114.665262][ T1588] ljca 4-1:1.0: bulk endpoints not found [ 115.084683][ T5719] usb 4-1: USB disconnect, device number 2 [ 115.331186][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 115.361948][ T59] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 115.367845][ T59] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 115.370059][ T59] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 115.371700][ T59] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 115.962133][ T5982] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 116.045486][ T5982] md: could not open device unknown-block(7,0). [ 116.258667][ T3373] nvmet: connect request for invalid subsystem testnqn! [ 116.269772][ T5987] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 117.443962][ T5588] Bluetooth: hci4: command tx timeout [ 117.472895][ T5847] STV06xx 3-1:1.0: probe with driver STV06xx failed with error -71 [ 117.503894][ T6012] FAULT_INJECTION: forcing a failure. [ 117.503894][ T6012] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 117.503986][ T6012] CPU: 1 UID: 0 PID: 6012 Comm: syz.0.71 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 117.504074][ T6012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 117.504114][ T6012] Call Trace: [ 117.504135][ T6012] [ 117.504165][ T6012] dump_stack_lvl+0xe8/0x150 [ 117.504291][ T6012] should_fail_ex+0x46b/0x600 [ 117.504378][ T6012] _copy_from_user+0x2d/0xb0 [ 117.504452][ T6012] addrconf_add_ifaddr+0x108/0x3e0 [ 117.504545][ T6012] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 117.504615][ T6012] ? kasan_quarantine_put+0xbb/0x1f0 [ 117.504715][ T6012] inet6_ioctl+0x14e/0x2e0 [ 117.504815][ T6012] ? __pfx_inet6_ioctl+0x10/0x10 [ 117.504887][ T6012] ? tomoyo_path_number_perm+0x219/0x5f0 [ 117.504961][ T6012] ? do_vfs_ioctl+0x1184/0x1550 [ 117.505042][ T6012] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 117.505122][ T6012] sock_do_ioctl+0x101/0x320 [ 117.505188][ T6012] ? __pfx_sock_do_ioctl+0x10/0x10 [ 117.505221][ T6012] ? hook_file_ioctl+0x1f5/0x610 [ 117.505306][ T6012] ? __asan_memset+0x22/0x50 [ 117.505378][ T6012] ? smack_file_ioctl+0x265/0x370 [ 117.505489][ T6012] sock_ioctl+0x57d/0x7f0 [ 117.505538][ T6012] ? __pfx_sock_ioctl+0x10/0x10 [ 117.505635][ T6012] ? __fget_files+0x2a/0x420 [ 117.505694][ T6012] ? __fget_files+0x3a8/0x420 [ 117.505749][ T6012] ? __fget_files+0x2a/0x420 [ 117.505802][ T6012] ? bpf_lsm_file_ioctl+0x9/0x20 [ 117.505864][ T6012] ? __pfx_sock_ioctl+0x10/0x10 [ 117.505954][ T6012] __se_sys_ioctl+0xff/0x170 [ 117.506023][ T6012] do_syscall_64+0x166/0x520 [ 117.506087][ T6012] ? trace_irq_disable+0x3b/0x140 [ 117.506161][ T6012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.506224][ T6012] ? clear_bhb_loop+0x70/0xc0 [ 117.506295][ T6012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.506356][ T6012] RIP: 0033:0x7fa26e63e159 [ 117.506417][ T6012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.506467][ T6012] RSP: 002b:00007fa26c896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 117.506540][ T6012] RAX: ffffffffffffffda RBX: 00007fa26e8c5fa0 RCX: 00007fa26e63e159 [ 117.506587][ T6012] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 117.506621][ T6012] RBP: 00007fa26e6d5024 R08: 0000000000000000 R09: 0000000000000000 [ 117.506662][ T6012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.506695][ T6012] R13: 00007fa26e8c6038 R14: 00007fa26e8c5fa0 R15: 00007ffdabd54328 [ 117.506783][ T6012] [ 117.793149][ T5847] usb 3-1: USB disconnect, device number 3 [ 117.949968][ T6015] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 117.994545][ T6017] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 118.333813][ T5847] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 118.495341][ T5847] usb 1-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 118.506023][ T5847] usb 1-1: config index 0 descriptor too short (expected 59, got 54) [ 118.506054][ T5847] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.506106][ T5847] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 118.552571][ T5847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.557949][ T5847] usb 1-1: Product: syz [ 118.557969][ T5847] usb 1-1: Manufacturer: syz [ 118.557985][ T5847] usb 1-1: SerialNumber: syz [ 118.675695][ T5847] ljca 1-1:1.0: bulk endpoints not found [ 118.877331][ T6040] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 118.964905][ T6040] md: could not open device unknown-block(7,0). [ 119.027852][ T2343] nvmet: connect request for invalid subsystem testnqn! [ 119.042753][ T6043] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 119.064079][ T5719] usb 1-1: USB disconnect, device number 3 [ 119.213541][ T5972] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.225343][ T5972] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.225602][ T5972] bridge_slave_0: entered allmulticast mode [ 119.324420][ T5972] bridge_slave_0: entered promiscuous mode [ 119.341865][ T5972] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.361540][ T5972] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.361746][ T5972] bridge_slave_1: entered allmulticast mode [ 119.397344][ T5972] bridge_slave_1: entered promiscuous mode [ 119.515520][ T5588] Bluetooth: hci4: command tx timeout [ 119.590735][ T6060] FAULT_INJECTION: forcing a failure. [ 119.590735][ T6060] name failslab, interval 1, probability 0, space 0, times 0 [ 119.591349][ T6060] CPU: 1 UID: 0 PID: 6060 Comm: syz.3.84 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.591379][ T6060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.591393][ T6060] Call Trace: [ 119.591403][ T6060] [ 119.591414][ T6060] dump_stack_lvl+0xe8/0x150 [ 119.591456][ T6060] should_fail_ex+0x46b/0x600 [ 119.591507][ T6060] should_failslab+0xa8/0x100 [ 119.591635][ T6060] __kmalloc_cache_noprof+0xa1/0x680 [ 119.591727][ T6060] ? ipv6_add_addr+0x55e/0x11b0 [ 119.591782][ T6060] ? ipv6_add_addr+0x55e/0x11b0 [ 119.591864][ T6060] ipv6_add_addr+0x55e/0x11b0 [ 119.591936][ T6060] ? __pfx_ipv6_add_addr+0x10/0x10 [ 119.592007][ T6060] ? ipv6_find_idev+0x10a/0x1c0 [ 119.592110][ T6060] inet6_addr_add+0x43c/0xba0 [ 119.592180][ T6060] ? mutex_lock_nested+0x168/0x1d0 [ 119.592278][ T6060] addrconf_add_ifaddr+0x27c/0x3e0 [ 119.592370][ T6060] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 119.592441][ T6060] ? kasan_quarantine_put+0xbb/0x1f0 [ 119.592554][ T6060] inet6_ioctl+0x14e/0x2e0 [ 119.592623][ T6060] ? __pfx_inet6_ioctl+0x10/0x10 [ 119.592679][ T6060] ? tomoyo_path_number_perm+0x219/0x5f0 [ 119.592751][ T6060] ? do_vfs_ioctl+0x1184/0x1550 [ 119.592834][ T6060] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 119.592922][ T6060] sock_do_ioctl+0x101/0x320 [ 119.592975][ T6060] ? __pfx_sock_do_ioctl+0x10/0x10 [ 119.592996][ T6060] ? hook_file_ioctl+0x1f5/0x610 [ 119.593101][ T6060] ? __asan_memset+0x22/0x50 [ 119.593180][ T6060] ? smack_file_ioctl+0x265/0x370 [ 119.593301][ T6060] sock_ioctl+0x57d/0x7f0 [ 119.593391][ T6060] ? __pfx_sock_ioctl+0x10/0x10 [ 119.593471][ T6060] ? __fget_files+0x2a/0x420 [ 119.593525][ T6060] ? __fget_files+0x3a8/0x420 [ 119.593577][ T6060] ? __fget_files+0x2a/0x420 [ 119.593623][ T6060] ? bpf_lsm_file_ioctl+0x9/0x20 [ 119.593647][ T6060] ? __pfx_sock_ioctl+0x10/0x10 [ 119.593683][ T6060] __se_sys_ioctl+0xff/0x170 [ 119.593715][ T6060] do_syscall_64+0x166/0x520 [ 119.593740][ T6060] ? trace_irq_disable+0x3b/0x140 [ 119.593768][ T6060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.593791][ T6060] ? clear_bhb_loop+0x70/0xc0 [ 119.593820][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.593850][ T6060] RIP: 0033:0x7f1169b6e159 [ 119.593871][ T6060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.593890][ T6060] RSP: 002b:00007f1167dc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 119.593913][ T6060] RAX: ffffffffffffffda RBX: 00007f1169df5fa0 RCX: 00007f1169b6e159 [ 119.593929][ T6060] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 119.593943][ T6060] RBP: 00007f1169c05024 R08: 0000000000000000 R09: 0000000000000000 [ 119.593955][ T6060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.593966][ T6060] R13: 00007f1169df6038 R14: 00007f1169df5fa0 R15: 00007fff727efc48 [ 119.593998][ T6060] [ 119.957071][ T5823] md_update_sb: can't update sb for read-only array md0 [ 120.029693][ T5972] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.071740][ T5972] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.315782][ T5972] team0: Port device team_slave_0 added [ 120.339759][ T5972] team0: Port device team_slave_1 added [ 120.352958][ T6071] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 120.428790][ T6071] md: could not open device unknown-block(7,0). [ 120.430657][ T5823] md_update_sb: can't update sb for read-only array md0 [ 120.517258][ T5823] md_update_sb: can't update sb for read-only array md0 [ 120.551983][ T6079] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 120.583185][ T6079] md: could not open device unknown-block(7,0). [ 120.650314][ T5823] md_update_sb: can't update sb for read-only array md0 [ 120.682215][ T5972] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 120.682288][ T5972] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.682318][ T5972] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 120.737181][ T5823] md_update_sb: can't update sb for read-only array md0 [ 120.752375][ T5972] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 120.752446][ T5972] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.752476][ T5972] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.032292][ T5972] hsr_slave_0: entered promiscuous mode [ 121.086809][ T5972] hsr_slave_1: entered promiscuous mode [ 121.093324][ T5972] debugfs: 'hsr0' already exists in 'hsr' [ 121.093350][ T5972] Cannot create hsr debugfs directory [ 121.139347][ T6091] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 121.186525][ T6091] md: could not open device unknown-block(7,0). [ 121.227246][ T6094] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 121.382877][ T48] nvmet: connect request for invalid subsystem testnqn! [ 121.393746][ T6096] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 121.423855][ T5679] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 121.462358][ T6094] md: could not open device unknown-block(7,0). [ 121.601945][ T5588] Bluetooth: hci4: command tx timeout [ 121.641842][ T5679] usb 3-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 121.652196][ T5679] usb 3-1: config index 0 descriptor too short (expected 59, got 54) [ 121.652384][ T5679] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 121.652539][ T5679] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 121.690639][ T5679] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.692612][ T5679] usb 3-1: Product: syz [ 121.692629][ T5679] usb 3-1: Manufacturer: syz [ 121.692643][ T5679] usb 3-1: SerialNumber: syz [ 122.033498][ T5679] ljca 3-1:1.0: bulk endpoints not found [ 122.305759][ T6112] FAULT_INJECTION: forcing a failure. [ 122.305759][ T6112] name failslab, interval 1, probability 0, space 0, times 0 [ 122.309548][ T6112] CPU: 0 UID: 0 PID: 6112 Comm: syz.0.99 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 122.309586][ T6112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 122.309598][ T6112] Call Trace: [ 122.309606][ T6112] [ 122.309615][ T6112] dump_stack_lvl+0xe8/0x150 [ 122.309669][ T6112] should_fail_ex+0x46b/0x600 [ 122.309698][ T6112] should_failslab+0xa8/0x100 [ 122.309734][ T6112] __kmalloc_noprof+0xfb/0x790 [ 122.309761][ T6112] ? fib6_info_alloc+0x30/0xf0 [ 122.309785][ T6112] ? fib6_info_alloc+0x30/0xf0 [ 122.309817][ T6112] fib6_info_alloc+0x30/0xf0 [ 122.309844][ T6112] ip6_route_info_create+0x149/0x890 [ 122.309878][ T6112] ip6_route_add+0x49/0x1d0 [ 122.309917][ T6112] addrconf_add_mroute+0x2d1/0x370 [ 122.309947][ T6112] ? addrconf_add_mroute+0xdc/0x370 [ 122.309973][ T6112] ? __pfx_addrconf_add_mroute+0x10/0x10 [ 122.310021][ T6112] ? ipv6_find_idev+0x10a/0x1c0 [ 122.310057][ T6112] inet6_addr_add+0x2b8/0xba0 [ 122.310082][ T6112] ? mutex_lock_nested+0x168/0x1d0 [ 122.310117][ T6112] addrconf_add_ifaddr+0x27c/0x3e0 [ 122.310150][ T6112] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 122.310175][ T6112] ? kasan_quarantine_put+0xbb/0x1f0 [ 122.310211][ T6112] inet6_ioctl+0x14e/0x2e0 [ 122.310234][ T6112] ? __pfx_inet6_ioctl+0x10/0x10 [ 122.310254][ T6112] ? tomoyo_path_number_perm+0x219/0x5f0 [ 122.310280][ T6112] ? do_vfs_ioctl+0x1184/0x1550 [ 122.310309][ T6112] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 122.310343][ T6112] sock_do_ioctl+0x101/0x320 [ 122.310367][ T6112] ? __pfx_sock_do_ioctl+0x10/0x10 [ 122.310385][ T6112] ? hook_file_ioctl+0x1f5/0x610 [ 122.310417][ T6112] ? __asan_memset+0x22/0x50 [ 122.310441][ T6112] ? smack_file_ioctl+0x265/0x370 [ 122.310480][ T6112] sock_ioctl+0x57d/0x7f0 [ 122.310514][ T6112] ? __pfx_sock_ioctl+0x10/0x10 [ 122.310546][ T6112] ? __fget_files+0x2a/0x420 [ 122.310565][ T6112] ? __fget_files+0x3a8/0x420 [ 122.310583][ T6112] ? __fget_files+0x2a/0x420 [ 122.310607][ T6112] ? bpf_lsm_file_ioctl+0x9/0x20 [ 122.310629][ T6112] ? __pfx_sock_ioctl+0x10/0x10 [ 122.310660][ T6112] __se_sys_ioctl+0xff/0x170 [ 122.310689][ T6112] do_syscall_64+0x166/0x520 [ 122.310712][ T6112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.310735][ T6112] ? clear_bhb_loop+0x70/0xc0 [ 122.310760][ T6112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.310780][ T6112] RIP: 0033:0x7fa26e63e159 [ 122.310800][ T6112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.310817][ T6112] RSP: 002b:00007fa26c896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 122.310840][ T6112] RAX: ffffffffffffffda RBX: 00007fa26e8c5fa0 RCX: 00007fa26e63e159 [ 122.310866][ T6112] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 122.310879][ T6112] RBP: 00007fa26e6d5024 R08: 0000000000000000 R09: 0000000000000000 [ 122.310897][ T6112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 122.310909][ T6112] R13: 00007fa26e8c6038 R14: 00007fa26e8c5fa0 R15: 00007ffdabd54328 [ 122.310940][ T6112] [ 122.431821][ T5679] usb 3-1: USB disconnect, device number 4 [ 122.971519][ T5972] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 123.127294][ T6130] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 123.186302][ T5972] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 123.217042][ T5972] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 123.237501][ T6130] md: could not open device unknown-block(7,0). [ 123.382465][ T5972] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 123.402016][ T5972] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 123.508259][ T5972] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 123.519028][ T5972] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 123.546402][ T6141] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 123.613607][ T5972] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 123.673963][ T5588] Bluetooth: hci4: command tx timeout [ 123.749295][ T6141] md: could not open device unknown-block(7,0). [ 124.240482][ T154] nvmet: connect request for invalid subsystem testnqn! [ 124.271369][ T6157] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 124.309893][ T5972] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.357638][ T6165] FAULT_INJECTION: forcing a failure. [ 124.357638][ T6165] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 124.357720][ T6165] CPU: 1 UID: 0 PID: 6165 Comm: syz.1.113 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 124.357786][ T6165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.357834][ T6165] Call Trace: [ 124.357860][ T6165] [ 124.357887][ T6165] dump_stack_lvl+0xe8/0x150 [ 124.357991][ T6165] should_fail_ex+0x46b/0x600 [ 124.358067][ T6165] _copy_from_user+0x2d/0xb0 [ 124.358135][ T6165] addrconf_add_ifaddr+0x108/0x3e0 [ 124.358224][ T6165] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 124.358296][ T6165] ? kasan_quarantine_put+0xbb/0x1f0 [ 124.358384][ T6165] inet6_ioctl+0x14e/0x2e0 [ 124.358442][ T6165] ? __pfx_inet6_ioctl+0x10/0x10 [ 124.358491][ T6165] ? tomoyo_path_number_perm+0x219/0x5f0 [ 124.358557][ T6165] ? do_vfs_ioctl+0x1184/0x1550 [ 124.358627][ T6165] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 124.358712][ T6165] sock_do_ioctl+0x101/0x320 [ 124.358772][ T6165] ? __pfx_sock_do_ioctl+0x10/0x10 [ 124.358818][ T6165] ? hook_file_ioctl+0x1f5/0x610 [ 124.358896][ T6165] ? __asan_memset+0x22/0x50 [ 124.358960][ T6165] ? smack_file_ioctl+0x265/0x370 [ 124.359064][ T6165] sock_ioctl+0x57d/0x7f0 [ 124.359151][ T6165] ? __pfx_sock_ioctl+0x10/0x10 [ 124.359219][ T6165] ? __fget_files+0x2a/0x420 [ 124.359237][ T6165] ? __fget_files+0x3a8/0x420 [ 124.359264][ T6165] ? __fget_files+0x2a/0x420 [ 124.359332][ T6165] ? bpf_lsm_file_ioctl+0x9/0x20 [ 124.359395][ T6165] ? __pfx_sock_ioctl+0x10/0x10 [ 124.359477][ T6165] __se_sys_ioctl+0xff/0x170 [ 124.359544][ T6165] do_syscall_64+0x166/0x520 [ 124.359602][ T6165] ? trace_irq_disable+0x3b/0x140 [ 124.359661][ T6165] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.359720][ T6165] ? clear_bhb_loop+0x70/0xc0 [ 124.359792][ T6165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.359848][ T6165] RIP: 0033:0x7faac80be159 [ 124.359896][ T6165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.359937][ T6165] RSP: 002b:00007faac6316028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.359994][ T6165] RAX: ffffffffffffffda RBX: 00007faac8345fa0 RCX: 00007faac80be159 [ 124.360031][ T6165] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 124.360062][ T6165] RBP: 00007faac8155024 R08: 0000000000000000 R09: 0000000000000000 [ 124.360098][ T6165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.360134][ T6165] R13: 00007faac8346038 R14: 00007faac8345fa0 R15: 00007ffd6cd892e8 [ 124.360214][ T6165] [ 124.669898][ T5972] 8021q: adding VLAN 0 to HW filter on device team0 [ 124.698482][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.705911][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 124.750979][ T2343] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.758310][ T2343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.088286][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.088877][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.106469][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.148781][ T6171] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 125.178410][ T6171] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 125.178465][ T6171] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 125.229911][ T6171] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 125.262843][ T6171] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 125.354891][ T998] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 125.450707][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.513009][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.548713][ T998] usb 2-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 125.573984][ T998] usb 2-1: config index 0 descriptor too short (expected 59, got 54) [ 125.574063][ T998] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.574197][ T998] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 125.653005][ T998] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.653095][ T998] usb 2-1: Product: syz [ 125.653115][ T998] usb 2-1: Manufacturer: syz [ 125.653470][ T998] usb 2-1: SerialNumber: syz [ 125.728816][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.782867][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.879311][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.939074][ T6171] dummy0 speed is unknown, defaulting to 1000 [ 125.953048][ T6190] siw: device registration error -23 [ 125.954092][ T998] ljca 2-1:1.0: bulk endpoints not found [ 126.365533][ T5847] usb 2-1: USB disconnect, device number 2 [ 126.417340][ T6205] zram0: detected capacity change from 0 to 32768 [ 126.814587][ T6219] FAULT_INJECTION: forcing a failure. [ 126.814587][ T6219] name failslab, interval 1, probability 0, space 0, times 0 [ 126.814989][ T6219] CPU: 0 UID: 0 PID: 6219 Comm: syz.0.126 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 126.815017][ T6219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.815030][ T6219] Call Trace: [ 126.815040][ T6219] [ 126.815050][ T6219] dump_stack_lvl+0xe8/0x150 [ 126.815090][ T6219] should_fail_ex+0x46b/0x600 [ 126.815121][ T6219] should_failslab+0xa8/0x100 [ 126.815157][ T6219] __kmalloc_noprof+0xfb/0x790 [ 126.815185][ T6219] ? fib6_info_alloc+0x30/0xf0 [ 126.815210][ T6219] ? fib6_info_alloc+0x30/0xf0 [ 126.815244][ T6219] fib6_info_alloc+0x30/0xf0 [ 126.815271][ T6219] ip6_route_info_create+0x149/0x890 [ 126.815411][ T6219] ip6_route_add+0x49/0x1d0 [ 126.815449][ T6219] addrconf_add_mroute+0x2d1/0x370 [ 126.815481][ T6219] ? addrconf_add_mroute+0xdc/0x370 [ 126.815517][ T6219] ? __pfx_addrconf_add_mroute+0x10/0x10 [ 126.815655][ T6219] ? ipv6_find_idev+0x10a/0x1c0 [ 126.815759][ T6219] inet6_addr_add+0x2b8/0xba0 [ 126.815826][ T6219] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 126.815893][ T6219] ? mutex_lock_nested+0x152/0x1d0 [ 126.815978][ T6219] ? addrconf_add_ifaddr+0x14d/0x3e0 [ 126.816055][ T6219] addrconf_add_ifaddr+0x27c/0x3e0 [ 126.816139][ T6219] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 126.816207][ T6219] ? kasan_quarantine_put+0xbb/0x1f0 [ 126.816300][ T6219] inet6_ioctl+0x14e/0x2e0 [ 126.816326][ T6219] ? __pfx_inet6_ioctl+0x10/0x10 [ 126.816348][ T6219] ? tomoyo_path_number_perm+0x219/0x5f0 [ 126.816377][ T6219] ? do_vfs_ioctl+0x1184/0x1550 [ 126.816464][ T6219] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 126.816564][ T6219] sock_do_ioctl+0x101/0x320 [ 126.816638][ T6219] ? __pfx_sock_do_ioctl+0x10/0x10 [ 126.816692][ T6219] ? hook_file_ioctl+0x1f5/0x610 [ 126.816782][ T6219] ? __asan_memset+0x22/0x50 [ 126.816837][ T6219] ? smack_file_ioctl+0x265/0x370 [ 126.816929][ T6219] sock_ioctl+0x57d/0x7f0 [ 126.817056][ T6219] ? __pfx_sock_ioctl+0x10/0x10 [ 126.817118][ T6219] ? __fget_files+0x2a/0x420 [ 126.817185][ T6219] ? __fget_files+0x3a8/0x420 [ 126.817240][ T6219] ? __fget_files+0x2a/0x420 [ 126.817306][ T6219] ? bpf_lsm_file_ioctl+0x9/0x20 [ 126.817372][ T6219] ? __pfx_sock_ioctl+0x10/0x10 [ 126.817408][ T6219] __se_sys_ioctl+0xff/0x170 [ 126.817442][ T6219] do_syscall_64+0x166/0x520 [ 126.817467][ T6219] ? trace_irq_disable+0x3b/0x140 [ 126.817546][ T6219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.817612][ T6219] ? clear_bhb_loop+0x70/0xc0 [ 126.817680][ T6219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.817738][ T6219] RIP: 0033:0x7fa26e63e159 [ 126.817792][ T6219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.817844][ T6219] RSP: 002b:00007fa26c896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 126.817907][ T6219] RAX: ffffffffffffffda RBX: 00007fa26e8c5fa0 RCX: 00007fa26e63e159 [ 126.817951][ T6219] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 126.817987][ T6219] RBP: 00007fa26e6d5024 R08: 0000000000000000 R09: 0000000000000000 [ 126.818032][ T6219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.818059][ T6219] R13: 00007fa26e8c6038 R14: 00007fa26e8c5fa0 R15: 00007ffdabd54328 [ 126.818152][ T6219] [ 127.350200][ T5972] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.475409][ T6227] md: could not open device unknown-block(7,0). [ 127.596283][ T6207] ftl_cs: FTL header not found. [ 127.868272][ T1344] nvmet: connect request for invalid subsystem testnqn! [ 127.868451][ T6233] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 128.043646][ T6250] netlink: 'syz.1.132': attribute type 1 has an invalid length. [ 128.055785][ T6250] netlink: 'syz.1.132': attribute type 1 has an invalid length. [ 128.213113][ T6207] block2mtd: mtd1: [/dev/zram0] erase_size = 64KiB [65536] [ 128.236866][ T6223] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 128.496612][ T5972] veth0_vlan: entered promiscuous mode [ 128.555972][ T5972] veth1_vlan: entered promiscuous mode [ 128.591161][ T6257] zram: Cannot change disksize for initialized device [ 128.608133][ T6257] block2mtd: error: cannot open device /dev/zram0 [ 128.779809][ T6264] ubi0: attaching mtd1 [ 128.827020][ T6259] siw: device registration error -23 [ 129.072401][ T5972] veth0_macvtap: entered promiscuous mode [ 129.118066][ T5972] veth1_macvtap: entered promiscuous mode [ 129.184062][ T998] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 129.257979][ T5972] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.328948][ T5972] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.374664][ T998] usb 2-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 2.00 [ 129.390151][ T998] usb 2-1: config index 0 descriptor too short (expected 59, got 54) [ 129.390227][ T998] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 129.390304][ T998] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 129.390329][ T998] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 129.429537][ T6264] ubi0: scanning is finished [ 129.434378][ T6264] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 129.459095][ T998] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.459172][ T998] usb 2-1: Product: syz [ 129.459201][ T998] usb 2-1: Manufacturer: syz [ 129.459245][ T998] usb 2-1: SerialNumber: syz [ 129.560958][ T6273] FAULT_INJECTION: forcing a failure. [ 129.560958][ T6273] name failslab, interval 1, probability 0, space 0, times 0 [ 129.572682][ T6273] CPU: 1 UID: 0 PID: 6273 Comm: syz.0.139 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.572710][ T6273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.572723][ T6273] Call Trace: [ 129.572732][ T6273] [ 129.572741][ T6273] dump_stack_lvl+0xe8/0x150 [ 129.572779][ T6273] should_fail_ex+0x46b/0x600 [ 129.572808][ T6273] should_failslab+0xa8/0x100 [ 129.572841][ T6273] __kmalloc_noprof+0xfb/0x790 [ 129.572868][ T6273] ? fib6_info_alloc+0x30/0xf0 [ 129.572893][ T6273] ? fib6_info_alloc+0x30/0xf0 [ 129.572924][ T6273] fib6_info_alloc+0x30/0xf0 [ 129.572951][ T6273] ip6_route_info_create+0x149/0x890 [ 129.572986][ T6273] ip6_route_add+0x49/0x1d0 [ 129.573017][ T6273] addrconf_add_mroute+0x2d1/0x370 [ 129.573046][ T6273] ? addrconf_add_mroute+0xdc/0x370 [ 129.573073][ T6273] ? __pfx_addrconf_add_mroute+0x10/0x10 [ 129.573120][ T6273] ? ipv6_find_idev+0x10a/0x1c0 [ 129.573156][ T6273] inet6_addr_add+0x2b8/0xba0 [ 129.573180][ T6273] ? mutex_lock_nested+0x168/0x1d0 [ 129.573214][ T6273] addrconf_add_ifaddr+0x27c/0x3e0 [ 129.573247][ T6273] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 129.573271][ T6273] ? kasan_quarantine_put+0xbb/0x1f0 [ 129.573306][ T6273] inet6_ioctl+0x14e/0x2e0 [ 129.573329][ T6273] ? __pfx_inet6_ioctl+0x10/0x10 [ 129.573374][ T6273] ? tomoyo_path_number_perm+0x219/0x5f0 [ 129.573402][ T6273] ? do_vfs_ioctl+0x1184/0x1550 [ 129.573433][ T6273] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 129.573470][ T6273] sock_do_ioctl+0x101/0x320 [ 129.573495][ T6273] ? __pfx_sock_do_ioctl+0x10/0x10 [ 129.573514][ T6273] ? hook_file_ioctl+0x1f5/0x610 [ 129.573548][ T6273] ? __asan_memset+0x22/0x50 [ 129.573573][ T6273] ? smack_file_ioctl+0x265/0x370 [ 129.573620][ T6273] sock_ioctl+0x57d/0x7f0 [ 129.573656][ T6273] ? __pfx_sock_ioctl+0x10/0x10 [ 129.573691][ T6273] ? __fget_files+0x2a/0x420 [ 129.573711][ T6273] ? __fget_files+0x3a8/0x420 [ 129.573731][ T6273] ? __fget_files+0x2a/0x420 [ 129.573755][ T6273] ? bpf_lsm_file_ioctl+0x9/0x20 [ 129.573778][ T6273] ? __pfx_sock_ioctl+0x10/0x10 [ 129.573812][ T6273] __se_sys_ioctl+0xff/0x170 [ 129.573843][ T6273] do_syscall_64+0x166/0x520 [ 129.573867][ T6273] ? trace_irq_disable+0x3b/0x140 [ 129.573894][ T6273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.573917][ T6273] ? clear_bhb_loop+0x70/0xc0 [ 129.573944][ T6273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.573967][ T6273] RIP: 0033:0x7fa26e63e159 [ 129.573987][ T6273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.574005][ T6273] RSP: 002b:00007fa26c896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 129.574030][ T6273] RAX: ffffffffffffffda RBX: 00007fa26e8c5fa0 RCX: 00007fa26e63e159 [ 129.574047][ T6273] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 129.574061][ T6273] RBP: 00007fa26e6d5024 R08: 0000000000000000 R09: 0000000000000000 [ 129.574071][ T6273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.574081][ T6273] R13: 00007fa26e8c6038 R14: 00007fa26e8c5fa0 R15: 00007ffdabd54328 [ 129.574110][ T6273] [ 129.953835][ T154] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.954147][ T154] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.287137][ T998] ljca 2-1:1.0: probe with driver ljca failed with error -90 [ 130.589438][ T5722] usb 2-1: USB disconnect, device number 3 [ 130.617594][ T162] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.629862][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.128699][ T6287] zram: Cannot change disksize for initialized device [ 131.170829][ T6287] block2mtd: error: cannot open device /dev/zram0 [ 131.189669][ T6285] netlink: 'syz.2.142': attribute type 1 has an invalid length. [ 131.199772][ T6285] netlink: 'syz.2.142': attribute type 1 has an invalid length. [ 131.281039][ T162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.281127][ T162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.460545][ T6264] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 131.525833][ T6292] ubi0: attaching mtd1 [ 131.633472][ T6292] ubi0: scanning is finished [ 131.646544][ T6292] ubi0: empty MTD device detected [ 131.796575][ T162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.796933][ T162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.081568][ T154] nvmet: connect request for invalid subsystem testnqn! [ 132.102766][ T6299] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 132.311609][ T6306] zram: Cannot change disksize for initialized device [ 132.342989][ T6292] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 132.477210][ T37] audit: type=1800 audit(1788459921.618:2): pid=6308 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.149" name="enable" dev="configfs" ino=10544 res=0 errno=0 [ 132.756926][ T6314] FAULT_INJECTION: forcing a failure. [ 132.756926][ T6314] name failslab, interval 1, probability 0, space 0, times 0 [ 132.769700][ T6314] CPU: 0 UID: 0 PID: 6314 Comm: syz.2.150 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 132.769732][ T6314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 132.769746][ T6314] Call Trace: [ 132.769755][ T6314] [ 132.769765][ T6314] dump_stack_lvl+0xe8/0x150 [ 132.769817][ T6314] should_fail_ex+0x46b/0x600 [ 132.769846][ T6314] should_failslab+0xa8/0x100 [ 132.769880][ T6314] __kmalloc_noprof+0xfb/0x790 [ 132.769925][ T6314] ? fib6_info_alloc+0x30/0xf0 [ 132.769963][ T6314] ? fib6_info_alloc+0x30/0xf0 [ 132.769994][ T6314] fib6_info_alloc+0x30/0xf0 [ 132.770039][ T6314] ip6_route_info_create+0x149/0x890 [ 132.770095][ T6314] addrconf_f6i_alloc+0x38b/0x630 [ 132.770128][ T6314] ? addrconf_f6i_alloc+0xfd/0x630 [ 132.770177][ T6314] ? __pfx_addrconf_f6i_alloc+0x10/0x10 [ 132.770225][ T6314] ? __kasan_kmalloc+0x93/0xb0 [ 132.770257][ T6314] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 132.770287][ T6314] ? ipv6_add_addr+0x55e/0x11b0 [ 132.770308][ T6314] ? ipv6_add_addr+0x55e/0x11b0 [ 132.770338][ T6314] ipv6_add_addr+0x59c/0x11b0 [ 132.770368][ T6314] ? __pfx_ipv6_add_addr+0x10/0x10 [ 132.770404][ T6314] ? ipv6_find_idev+0x10a/0x1c0 [ 132.770439][ T6314] inet6_addr_add+0x43c/0xba0 [ 132.770460][ T6314] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 132.770484][ T6314] ? mutex_lock_nested+0x152/0x1d0 [ 132.770530][ T6314] ? addrconf_add_ifaddr+0x14d/0x3e0 [ 132.770558][ T6314] addrconf_add_ifaddr+0x27c/0x3e0 [ 132.770590][ T6314] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 132.770619][ T6314] ? kasan_quarantine_put+0xbb/0x1f0 [ 132.770657][ T6314] inet6_ioctl+0x14e/0x2e0 [ 132.770680][ T6314] ? __pfx_inet6_ioctl+0x10/0x10 [ 132.770701][ T6314] ? tomoyo_path_number_perm+0x219/0x5f0 [ 132.770728][ T6314] ? do_vfs_ioctl+0x1184/0x1550 [ 132.770760][ T6314] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 132.770795][ T6314] sock_do_ioctl+0x101/0x320 [ 132.770824][ T6314] ? __pfx_sock_do_ioctl+0x10/0x10 [ 132.770843][ T6314] ? hook_file_ioctl+0x1f5/0x610 [ 132.770879][ T6314] ? __asan_memset+0x22/0x50 [ 132.770904][ T6314] ? smack_file_ioctl+0x265/0x370 [ 132.770945][ T6314] sock_ioctl+0x57d/0x7f0 [ 132.770982][ T6314] ? __pfx_sock_ioctl+0x10/0x10 [ 132.771016][ T6314] ? __fget_files+0x2a/0x420 [ 132.771037][ T6314] ? __fget_files+0x3a8/0x420 [ 132.771057][ T6314] ? __fget_files+0x2a/0x420 [ 132.771082][ T6314] ? bpf_lsm_file_ioctl+0x9/0x20 [ 132.771111][ T6314] ? __pfx_sock_ioctl+0x10/0x10 [ 132.771145][ T6314] __se_sys_ioctl+0xff/0x170 [ 132.771175][ T6314] do_syscall_64+0x166/0x520 [ 132.771199][ T6314] ? trace_irq_disable+0x3b/0x140 [ 132.771227][ T6314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.771251][ T6314] ? clear_bhb_loop+0x70/0xc0 [ 132.771277][ T6314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.771299][ T6314] RIP: 0033:0x7f0d6489e159 [ 132.771320][ T6314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.771339][ T6314] RSP: 002b:00007f0d62af6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.771364][ T6314] RAX: ffffffffffffffda RBX: 00007f0d64b25fa0 RCX: 00007f0d6489e159 [ 132.771381][ T6314] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000004 [ 132.771395][ T6314] RBP: 00007f0d64935024 R08: 0000000000000000 R09: 0000000000000000 [ 132.771409][ T6314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.771423][ T6314] R13: 00007f0d64b26038 R14: 00007f0d64b25fa0 R15: 00007ffd66a65868 [ 132.771457][ T6314] [ 133.047623][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.047871][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.343064][ T6324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 133.408955][ T6324] md: could not open device unknown-block(7,0). [ 133.806544][ T6336] netlink: 'syz.5.158': attribute type 1 has an invalid length. [ 133.823414][ T37] audit: type=1800 audit(1788459922.978:3): pid=6332 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.156" name="c_sync" dev="configfs" ino=10603 res=0 errno=0 [ 133.842186][ T37] audit: type=1800 audit(1788459922.998:4): pid=6341 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.159" name="enable" dev="configfs" ino=10605 res=0 errno=0 [ 133.899727][ T6340] netlink: 'syz.5.158': attribute type 1 has an invalid length. [ 134.257010][ T6345] zram: Cannot change disksize for initialized device [ 134.281260][ T6345] block2mtd: error: cannot open device /dev/zram0 [ 134.468008][ T2343] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI [ 134.479996][ T2343] KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] [ 134.488452][ T2343] CPU: 0 UID: 0 PID: 2343 Comm: kworker/u8:11 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 134.498560][ T2343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.508650][ T2343] Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work [ 134.514123][ T13] nvmet: connect request for invalid subsystem testnqn! [ 134.519609][ T6349] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 134.530136][ T2343] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 134.536084][ T2343] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 134.555733][ T2343] RSP: 0018:ffffc90008c9f8c8 EFLAGS: 00010206 [ 134.561843][ T2343] RAX: dffffc0000000000 RBX: ffffffff8b57cf93 RCX: 8000000000000001 [ 134.569848][ T2343] RDX: 0000000000000000 RSI: ffffffff8b57cf93 RDI: 0000000000000024 [ 134.577888][ T2343] RBP: ffffc90008c9fa38 R08: 0000000000000001 R09: 0000000000000000 [ 134.585976][ T2343] R10: dffffc0000000000 R11: ffffed10062ecacf R12: 0000000000000120 [ 134.593983][ T2343] R13: 0000000000000000 R14: 0000000000000120 R15: 0000000000000001 [ 134.602005][ T2343] FS: 0000000000000000(0000) GS:ffff888125bd5000(0000) knlGS:0000000000000000 [ 134.610970][ T2343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.617578][ T2343] CR2: 00007f26bbdf757c CR3: 0000000050f26000 CR4: 00000000003526f0 [ 134.625593][ T2343] Call Trace: [ 134.628908][ T2343] [ 134.631867][ T2343] __kasan_check_byte+0x12/0x40 [ 134.636787][ T2343] lock_acquire+0x7d/0x350 [ 134.641239][ T2343] ? __pfx___flush_work+0x10/0x10 [ 134.646313][ T2343] ? rcu_is_watching+0x16/0xb0 [ 134.651138][ T2343] rt_spin_lock+0x83/0x400 [ 134.655626][ T2343] ? blk_mq_quiesce_queue+0x2f/0x190 [ 134.660950][ T2343] ? __pfx_rt_spin_lock+0x10/0x10 [ 134.666014][ T2343] ? enable_work+0x17f/0x230 [ 134.670650][ T2343] ? lockdep_hardirqs_on+0x7b/0x110 [ 134.675875][ T2343] ? enable_work+0x1fd/0x230 [ 134.680524][ T2343] blk_mq_quiesce_queue+0x2f/0x190 [ 134.685691][ T2343] nvme_loop_reset_ctrl_work+0x1cf/0x810 [ 134.691394][ T2343] ? process_scheduled_works+0x97a/0x1630 [ 134.697226][ T2343] process_scheduled_works+0xc3d/0x1630 [ 134.702824][ T2343] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.708834][ T2343] ? assign_work+0x3cf/0x5d0 [ 134.713458][ T2343] worker_thread+0xa47/0xfb0 [ 134.718114][ T2343] ? __kthread_parkme+0x71/0x1f0 [ 134.723091][ T2343] kthread+0x38b/0x470 [ 134.727204][ T2343] ? __pfx_worker_thread+0x10/0x10 [ 134.732343][ T2343] ? __pfx_kthread+0x10/0x10 [ 134.736960][ T2343] ret_from_fork+0x514/0xb70 [ 134.741674][ T2343] ? __pfx_ret_from_fork+0x10/0x10 [ 134.746814][ T2343] ? __switch_to+0xc89/0x1420 [ 134.751532][ T2343] ? __pfx_kthread+0x10/0x10 [ 134.756151][ T2343] ret_from_fork_asm+0x1a/0x30 [ 134.760955][ T2343] [ 134.764084][ T2343] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 134.768072][ T2343] ---[ end trace 0000000000000000 ]--- [ 134.903276][ T2343] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 134.903359][ T23 ** replaying previous printk message ** [ 134.903359][ T2343] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 134.903379][ T2343] RSP: 0018:ffffc90008c9f8c8 EFLAGS: 00010206 [ 134.903491][ T2343] RAX: dffffc0000000000 RBX: ffffffff8b57cf93 RCX: 8000000000000001 [ 134.903545][ T2343] RDX: 0000000000000000 RSI: ffffffff8b57cf93 RDI: 0000000000000024 [ 134.909305][ T2343] RBP: ffffc90008c9fa38 R08: 0000000000000001 R09: 0000000000000000 [ 134.909323][ T2343] R10: dffffc0000000000 R11: ffffed10062ecacf R12: 0000000000000120 [ 134.909358][ T2343] R13: 0000000000000000 R14: 0000000000000120 R15: 0000000000000001 [ 134.909396][ T2343] FS: 0000000000000000(0000) GS:ffff888125bd5000(0000) knlGS:0000000000000000 [ 134.909448][ T2343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.910746][ T2343] CR2: 0000200000000500 CR3: 000000003c97a000 CR4: 00000000003526f0 [ 134.910804][ T2343] Kernel panic - not syncing: Fatal exception [ 135.010487][ T2343] Kernel Offset: disabled [ 135.014827][ T2343] Rebooting in 86400 seconds..