last executing test programs: 1.654436851s ago: executing program 0 (id=1): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r1, 0x5303}], 0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 1.428522784s ago: executing program 1 (id=6): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="01000000ef01"], 0x38}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 1.168561345s ago: executing program 1 (id=7): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') mkdir(&(0x7f00000000c0)='./file0\x00', 0x143) preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) 1.059687601s ago: executing program 1 (id=8): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r0, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f00000007c0)={0x1, {&(0x7f0000000080)=""/158, 0x9e, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000000a00)={0x1, {&(0x7f0000000ac0)=""/23, 0x17, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000200)=""/56, 0x38, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) 959.530545ms ago: executing program 3 (id=4): syz_mount_image$hfs(&(0x7f0000000180), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="71756965742c636f6465706167653d69736f383835392d31352c706172743d3078303030303030300000000000000000662c00a20000000700000000ede9debf530c3cc4d04b548919aca0c2937d4da1fc31dc42fc2e3e", @ANYRES64, @ANYRESOCT, @ANYRES16, @ANYRES16], 0x11, 0x2d2, &(0x7f0000000bc0)="$eJzs3U1rE1scx/HfmaRteht6pw+XC3fZa0E3UutG3KRIXoS4ELWJUAwVbQV1YxVXIrp371vwLQhuFN+Arlz5AiIII+fMZJJJJzMxNDMNfj9gmMycM+d/Mg/n/AfsCMAf60rzy9uL3+w/I1VUkV5cljxJNakq6R/9W3uwf7h32Gm3MvbTDRxbyyisaY4V2t1vp9WtKaoR8e23quqD6zAdQRDsfJV0UHYgKJW7+lN40kJ0dbrttcIjy/Z0wnpHJxzHrDFddfVQy2XHAQAoVzT+e9E4X4/m754nbUbD/qkc/yfVLTuAqQsytw6M/y7LCow9vn+7Tf18z6VwdrvXyxLHaXlu6Pu8wjMrMcE0eVmli8VbvL3XaZ/fvdtpeXqmRmSg2Lr7bIWnbk9OtBspuWmGMfpu0meUS64Pc7YP2yPiX5uwxYmZD+aTuW58vVErnv9VA2MPkztS/tCRCuPfGr1H10vfllJ022g0Gl6iyIpr5L+ohUhOL2vpGYl6Z9SKkg8I/Lw4Xa3VoVph7y7k1FoLa+0sJmpt976NqLWeaMv2Jj6bR7c3beaVuWo29F3v1ByY/3s2vk1lXpn9q8ZshkOB+8XD/synN1d1+/SPjRxHulZProl/xYVRof/IvqdhyJOMbS91S5e0fPDo8Z1Kp9O+bxdupizcq8dr5p5LqWVKWPDUX6Oj/qYFhQ8ij9XqDUpFhnruRHdo7x+5he1VVkgHT82ZUMZC82OxJ1IZCwXdo1Cq/kHPLfq+kIBQNDfvCvO/gXxly0327IefMU/PnZBFewzsHDvOgGqJ+qtu6a/fyuCWRmdw4+Zc/5+VzsSrfgY5LfpRnLMhyJr6Waapz7rB838AAAAAAAAAAAAAAAAAAIBZU8R/Jyi7jwAAAAAAAAAAAAAAAAAAAAAAzLr4/b/qvf9X473/d/gvf1fCN7ycyPt/X++L9/8C0/crAAD//zZmik0=") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe82) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x80d800, 0x0, 0x0, 0x0, &(0x7f0000000240)) 889.958031ms ago: executing program 1 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4138ae84, &(0x7f00000000c0)=@x86={0x0, 0x7, 0x5, 0x0, 0x1, 0x2, 0x4, 0x45, 0x5, 0x4, 0x7, 0xe, 0x0, 0x9, 0xf, 0x7, 0x7, 0x0, 0x1, '\x00', 0x4, 0xfffffffffffffff0}) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000001000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1b, 0x0, 0xfee00d00}]}) 746.261745ms ago: executing program 2 (id=3): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0x8, 0x3cf607, 0x1ed59c}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000001200)={0x48, 0x8, r2, 0x0, 0xffff, 0x2, &(0x7f0000000200)='|0', 0x5}) 500.432422ms ago: executing program 3 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20044890}, 0x20000000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 444.237156ms ago: executing program 2 (id=11): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000280)={0xc, r1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x6, r1, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x9}) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x1) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000300)={0x28, 0x4, r1, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xb}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000ff2f00000000000001"]) 337.286081ms ago: executing program 1 (id=12): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x82) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x1}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0xfdef) 282.315504ms ago: executing program 2 (id=13): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ptrace(0x4207, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x64}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 44.39538ms ago: executing program 3 (id=14): fspick(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/graphics/fbcon/rotate\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000040)={0x0, 0x0, 0x8, 0x4, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000000000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413fcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff4175b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a2b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6d07002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f63520cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) 0s ago: executing program 1 (id=15): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0x39) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000180)={0xfffffff8, 0x6, 0xffffff70, 0x2, 0x4d, "0d418107050088b791e15b34f96ff88c6b00", 0xfff, 0x140223}) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000000c0)=0x7) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 48.824212][ T5438] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.833789][ T5438] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts. syzkaller login: [ 66.523780][ T5763] cgroup: Unknown subsys name 'net' [ 66.652560][ T5763] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.007088][ T5763] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 69.396480][ T5777] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 69.405062][ T5777] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 69.412765][ T5777] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 69.421825][ T5777] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 69.435200][ T5777] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 69.442563][ T5777] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 69.476571][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 69.484651][ T5777] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 69.497023][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 69.504893][ T5782] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 69.513676][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 69.536847][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 69.557232][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 69.567528][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 69.579098][ T5785] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 69.586633][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 69.616777][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 69.632866][ T5777] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 69.637399][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 69.640940][ T5777] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 69.654744][ T5785] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 69.663404][ T5785] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 69.671922][ T5777] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 69.679723][ T5777] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 69.857808][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 70.013623][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 70.034667][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.042417][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.049798][ T5775] bridge_slave_0: entered allmulticast mode [ 70.057048][ T5775] bridge_slave_0: entered promiscuous mode [ 70.079595][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.088078][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.095182][ T5775] bridge_slave_1: entered allmulticast mode [ 70.102179][ T5775] bridge_slave_1: entered promiscuous mode [ 70.133261][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.192905][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.241851][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 70.258540][ T5775] team0: Port device team_slave_0 added [ 70.299503][ T5775] team0: Port device team_slave_1 added [ 70.320993][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.329365][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.339316][ T5778] bridge_slave_0: entered allmulticast mode [ 70.348238][ T5778] bridge_slave_0: entered promiscuous mode [ 70.386929][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.394031][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.401260][ T5778] bridge_slave_1: entered allmulticast mode [ 70.407958][ T5778] bridge_slave_1: entered promiscuous mode [ 70.422882][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.429947][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.457838][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.474623][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.482227][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.508579][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.538542][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 70.567946][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.575138][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.582353][ T5779] bridge_slave_0: entered allmulticast mode [ 70.589666][ T5779] bridge_slave_0: entered promiscuous mode [ 70.599489][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.612162][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.641070][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.648337][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.655466][ T5779] bridge_slave_1: entered allmulticast mode [ 70.664689][ T5779] bridge_slave_1: entered promiscuous mode [ 70.723788][ T5778] team0: Port device team_slave_0 added [ 70.747111][ T5775] hsr_slave_0: entered promiscuous mode [ 70.753375][ T5775] hsr_slave_1: entered promiscuous mode [ 70.771115][ T5778] team0: Port device team_slave_1 added [ 70.793668][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.806581][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.871365][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.878450][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.904498][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.915625][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.925430][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.932646][ T5784] bridge_slave_0: entered allmulticast mode [ 70.940405][ T5784] bridge_slave_0: entered promiscuous mode [ 70.961138][ T5779] team0: Port device team_slave_0 added [ 70.973375][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.983800][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.012312][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.033042][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.042112][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.049378][ T5784] bridge_slave_1: entered allmulticast mode [ 71.056058][ T5784] bridge_slave_1: entered promiscuous mode [ 71.064253][ T5779] team0: Port device team_slave_1 added [ 71.132985][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.152867][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.159950][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.188960][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.208099][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.230166][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.237248][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.263194][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.293613][ T5778] hsr_slave_0: entered promiscuous mode [ 71.300678][ T5778] hsr_slave_1: entered promiscuous mode [ 71.306908][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 71.314629][ T5778] Cannot create hsr debugfs directory [ 71.390879][ T5784] team0: Port device team_slave_0 added [ 71.400729][ T5784] team0: Port device team_slave_1 added [ 71.440248][ T5779] hsr_slave_0: entered promiscuous mode [ 71.446841][ T5779] hsr_slave_1: entered promiscuous mode [ 71.453163][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 71.461244][ T5779] Cannot create hsr debugfs directory [ 71.485493][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.493090][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.522340][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.526575][ T5777] Bluetooth: hci0: command tx timeout [ 71.528822][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.538366][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.553885][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.561060][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.587159][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.656607][ T5777] Bluetooth: hci2: command tx timeout [ 71.681932][ T5784] hsr_slave_0: entered promiscuous mode [ 71.688417][ T5784] hsr_slave_1: entered promiscuous mode [ 71.694398][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 71.702320][ T5784] Cannot create hsr debugfs directory [ 71.736317][ T5777] Bluetooth: hci1: command tx timeout [ 71.736358][ T5088] Bluetooth: hci3: command tx timeout [ 71.826055][ T5775] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 71.853698][ T5775] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 71.864704][ T5775] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 71.894660][ T5775] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.024943][ T5778] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.034629][ T5778] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.046069][ T5778] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.056563][ T5778] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.153351][ T5779] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 72.163700][ T5779] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 72.188302][ T5779] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 72.198663][ T5779] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 72.290225][ T5784] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.301292][ T5784] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.314302][ T5784] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.324011][ T5784] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.363751][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.386880][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.420120][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.449438][ T2927] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.457057][ T2927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.474236][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.491254][ T2927] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.498403][ T2927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.511680][ T2927] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.518778][ T2927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.551885][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.559053][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.618155][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.681121][ T5775] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.703650][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.721014][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.744910][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.788468][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.795649][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.809762][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.816935][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.871648][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.878851][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.912483][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.919685][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.142732][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.230372][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.277665][ T5775] veth0_vlan: entered promiscuous mode [ 73.311729][ T5775] veth1_vlan: entered promiscuous mode [ 73.373710][ T5778] veth0_vlan: entered promiscuous mode [ 73.410494][ T5778] veth1_vlan: entered promiscuous mode [ 73.419675][ T5775] veth0_macvtap: entered promiscuous mode [ 73.433885][ T5775] veth1_macvtap: entered promiscuous mode [ 73.466058][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.499090][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.510879][ T5778] veth0_macvtap: entered promiscuous mode [ 73.529379][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.540177][ T5775] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.549697][ T5775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.559113][ T5775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.568189][ T5775] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.577133][ T5088] Bluetooth: hci0: command tx timeout [ 73.589639][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.603278][ T5778] veth1_macvtap: entered promiscuous mode [ 73.670370][ T5779] veth0_vlan: entered promiscuous mode [ 73.715475][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.726746][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.736941][ T5088] Bluetooth: hci2: command tx timeout [ 73.744373][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.769753][ T5779] veth1_vlan: entered promiscuous mode [ 73.801444][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.812855][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.822967][ T5088] Bluetooth: hci1: command tx timeout [ 73.826345][ T5088] Bluetooth: hci3: command tx timeout [ 73.832381][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.851291][ T1137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.861103][ T1137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.905843][ T5778] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.915555][ T5778] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.925014][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.934130][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.951910][ T5784] veth0_vlan: entered promiscuous mode [ 73.972725][ T4872] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.984053][ T5784] veth1_vlan: entered promiscuous mode [ 73.991337][ T4872] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.040277][ T5779] veth0_macvtap: entered promiscuous mode [ 74.065498][ T5779] veth1_macvtap: entered promiscuous mode [ 74.177580][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.180803][ T5834] syz.1.2[5834]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 74.185430][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.201529][ T5784] veth0_macvtap: entered promiscuous mode [ 74.230104][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.242904][ T5834] loop1: detected capacity change from 0 to 128 [ 74.246829][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.276179][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.301895][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.328458][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.344010][ T5784] veth1_macvtap: entered promiscuous mode [ 74.374827][ T1137] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.390584][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.401325][ T1137] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.413112][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.425500][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.436391][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.455257][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.494055][ T5779] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.503736][ T5779] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.516362][ T5779] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.525256][ T5779] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.544899][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.566166][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.580726][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.593011][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.607423][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.624075][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.650806][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.685613][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.720123][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.731120][ T5837] loop1: detected capacity change from 0 to 512 [ 74.736016][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.766426][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.786773][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.811771][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.837922][ T5837] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.857846][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.873338][ T5837] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 74.932811][ T5784] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.976208][ T5784] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.984977][ T5784] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.994227][ T5784] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.024045][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.171373][ T1137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.191593][ T1137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.290133][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.304862][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.397053][ T4872] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.405494][ T4872] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.517712][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.523506][ T5851] loop3: detected capacity change from 0 to 64 [ 75.542552][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.617621][ T5853] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 75.657727][ T5088] Bluetooth: hci0: command tx timeout [ 75.767852][ T28] audit: type=1800 audit(1790323838.410:2): pid=5851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4" name="file1" dev="loop3" ino=21 res=0 errno=0 [ 75.797871][ T5851] syz.3.4: attempt to access beyond end of device [ 75.797871][ T5851] loop3: rw=34817, sector=57, nr_sectors = 8 limit=64 [ 75.827472][ T5088] Bluetooth: hci2: command tx timeout [ 75.908608][ T5088] Bluetooth: hci3: command tx timeout [ 75.908618][ T5777] Bluetooth: hci1: command tx timeout [ 76.167059][ T5864] syz.1.12 uses obsolete (PF_INET,SOCK_PACKET) [ 76.705820][ T5872] ================================================================== [ 76.705834][ T5872] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x2114/0x25d0 [ 76.705872][ T5872] Write of size 4 at addr ffffc90003df9ff0 by task syz.3.14/5872 [ 76.705890][ T5872] [ 76.705906][ T5872] CPU: 0 PID: 5872 Comm: syz.3.14 Not tainted syzkaller #0 [ 76.705925][ T5872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.705946][ T5872] Call Trace: [ 76.705955][ T5872] [ 76.705963][ T5872] dump_stack_lvl+0x18c/0x250 [ 76.705989][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.706010][ T5872] ? show_regs_print_info+0x20/0x20 [ 76.706034][ T5872] ? load_image+0x420/0x420 [ 76.706059][ T5872] print_report+0xa8/0x210 [ 76.706082][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.706102][ T5872] kasan_report+0x117/0x150 [ 76.706124][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.706145][ T5872] sys_imageblit+0x2114/0x25d0 [ 76.706170][ T5872] ? sys_copyarea+0x2530/0x2530 [ 76.706191][ T5872] ? try_to_wake_up+0x6c3/0x10e0 [ 76.706214][ T5872] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 76.706241][ T5872] cw_putcs+0x15f3/0x18a0 [ 76.706271][ T5872] ? cw_clear+0x250/0x250 [ 76.706289][ T5872] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 76.706315][ T5872] ? fb_get_color_depth+0x162/0x280 [ 76.706340][ T5872] fbcon_putcs+0x35c/0x520 [ 76.706368][ T5872] ? cw_clear+0x250/0x250 [ 76.706386][ T5872] do_update_region+0x4e9/0x640 [ 76.706409][ T5872] ? __asan_memcpy+0x40/0x70 [ 76.706439][ T5872] ? hide_cursor+0x320/0x320 [ 76.706465][ T5872] redraw_screen+0xa30/0x1000 [ 76.706488][ T5872] ? _raw_spin_unlock+0x40/0x40 [ 76.706512][ T5872] ? clear_buffer_attributes+0x320/0x320 [ 76.706537][ T5872] ? tty_do_resize+0xe1/0x120 [ 76.706562][ T5872] vc_do_resize+0x1256/0x17f0 [ 76.706597][ T5872] ? vc_resize+0x50/0x50 [ 76.706625][ T5872] fbcon_do_set_font+0xb5c/0x1ae0 [ 76.706660][ T5872] ? fbcon_blank+0xb40/0xb40 [ 76.706685][ T5872] con_font_op+0xc3c/0xf60 [ 76.706712][ T5872] ? reset_palette+0xdd0/0xdd0 [ 76.706740][ T5872] ? __might_fault+0xaa/0x120 [ 76.706760][ T5872] ? __lock_acquire+0x7d80/0x7d80 [ 76.706790][ T5872] ? apparmor_capable+0x137/0x1a0 [ 76.706811][ T5872] ? __might_fault+0xaa/0x120 [ 76.706831][ T5872] ? __might_fault+0xc6/0x120 [ 76.706850][ T5872] ? __might_fault+0xaa/0x120 [ 76.706872][ T5872] vt_ioctl+0x1a21/0x1f20 [ 76.706892][ T5872] ? __vt_event_wait+0x260/0x260 [ 76.706915][ T5872] ? __fget_files+0x28/0x460 [ 76.706942][ T5872] ? tty_jobctrl_ioctl+0x378/0xba0 [ 76.706967][ T5872] tty_ioctl+0x91e/0xdc0 [ 76.706991][ T5872] ? tty_get_icount+0xb0/0xb0 [ 76.707014][ T5872] __se_sys_ioctl+0xfd/0x170 [ 76.707040][ T5872] do_syscall_64+0x55/0xb0 [ 76.707063][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.707088][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.707113][ T5872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 76.707138][ T5872] RIP: 0033:0x7fb48db9e159 [ 76.707161][ T5872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.707178][ T5872] RSP: 002b:00007fb48ea05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.707201][ T5872] RAX: ffffffffffffffda RBX: 00007fb48de26090 RCX: 00007fb48db9e159 [ 76.707216][ T5872] RDX: 0000200000000040 RSI: 0000000000004b72 RDI: 0000000000000003 [ 76.707230][ T5872] RBP: 00007fb48dc3506b R08: 0000000000000000 R09: 0000000000000000 [ 76.707243][ T5872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.707256][ T5872] R13: 00007fb48de26128 R14: 00007fb48de26090 R15: 00007ffc5e303978 [ 76.707277][ T5872] [ 76.707283][ T5872] [ 76.707287][ T5872] The buggy address belongs to a 0-page vmalloc region starting at 0xffffc90003dfa000 allocated at drm_gem_shmem_vmap+0x3c4/0x650 [ 76.707324][ T5872] Memory state around the buggy address: [ 76.707334][ T5872] ffffc90003df9e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.707346][ T5872] ffffc90003df9f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.707358][ T5872] >ffffc90003df9f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.707368][ T5872] ^ [ 76.707378][ T5872] ffffc90003dfa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.707390][ T5872] ffffc90003dfa080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.707398][ T5872] ================================================================== [ 76.708354][ T5872] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.708366][ T5872] CPU: 0 PID: 5872 Comm: syz.3.14 Not tainted syzkaller #0 [ 76.708386][ T5872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.708397][ T5872] Call Trace: [ 76.708404][ T5872] [ 76.708411][ T5872] dump_stack_lvl+0x18c/0x250 [ 76.708440][ T5872] ? show_regs_print_info+0x20/0x20 [ 76.708464][ T5872] ? load_image+0x420/0x420 [ 76.708489][ T5872] panic+0x2ca/0x720 [ 76.708511][ T5872] ? bpf_jit_dump+0xd0/0xd0 [ 76.708530][ T5872] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 76.708552][ T5872] ? _raw_spin_unlock+0x40/0x40 [ 76.708572][ T5872] ? print_memory_metadata+0x314/0x400 [ 76.708596][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.708614][ T5872] check_panic_on_warn+0x84/0xa0 [ 76.708637][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.708655][ T5872] end_report+0x6f/0x130 [ 76.708677][ T5872] kasan_report+0x128/0x150 [ 76.708700][ T5872] ? sys_imageblit+0x2114/0x25d0 [ 76.708721][ T5872] sys_imageblit+0x2114/0x25d0 [ 76.708746][ T5872] ? sys_copyarea+0x2530/0x2530 [ 76.708770][ T5872] ? try_to_wake_up+0x6c3/0x10e0 [ 76.708799][ T5872] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 76.708826][ T5872] cw_putcs+0x15f3/0x18a0 [ 76.708858][ T5872] ? cw_clear+0x250/0x250 [ 76.708876][ T5872] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 76.708902][ T5872] ? fb_get_color_depth+0x162/0x280 [ 76.708925][ T5872] fbcon_putcs+0x35c/0x520 [ 76.708950][ T5872] ? cw_clear+0x250/0x250 [ 76.708967][ T5872] do_update_region+0x4e9/0x640 [ 76.708988][ T5872] ? __asan_memcpy+0x40/0x70 [ 76.709017][ T5872] ? hide_cursor+0x320/0x320 [ 76.709043][ T5872] redraw_screen+0xa30/0x1000 [ 76.709065][ T5872] ? _raw_spin_unlock+0x40/0x40 [ 76.709088][ T5872] ? clear_buffer_attributes+0x320/0x320 [ 76.709114][ T5872] ? tty_do_resize+0xe1/0x120 [ 76.709138][ T5872] vc_do_resize+0x1256/0x17f0 [ 76.709172][ T5872] ? vc_resize+0x50/0x50 [ 76.709200][ T5872] fbcon_do_set_font+0xb5c/0x1ae0 [ 76.709235][ T5872] ? fbcon_blank+0xb40/0xb40 [ 76.709259][ T5872] con_font_op+0xc3c/0xf60 [ 76.709285][ T5872] ? reset_palette+0xdd0/0xdd0 [ 76.709312][ T5872] ? __might_fault+0xaa/0x120 [ 76.709331][ T5872] ? __lock_acquire+0x7d80/0x7d80 [ 76.709353][ T5872] ? apparmor_capable+0x137/0x1a0 [ 76.709372][ T5872] ? __might_fault+0xaa/0x120 [ 76.709391][ T5872] ? __might_fault+0xc6/0x120 [ 76.709409][ T5872] ? __might_fault+0xaa/0x120 [ 76.709430][ T5872] vt_ioctl+0x1a21/0x1f20 [ 76.709450][ T5872] ? __vt_event_wait+0x260/0x260 [ 76.709472][ T5872] ? __fget_files+0x28/0x460 [ 76.709499][ T5872] ? tty_jobctrl_ioctl+0x378/0xba0 [ 76.709523][ T5872] tty_ioctl+0x91e/0xdc0 [ 76.709546][ T5872] ? tty_get_icount+0xb0/0xb0 [ 76.709569][ T5872] __se_sys_ioctl+0xfd/0x170 [ 76.709593][ T5872] do_syscall_64+0x55/0xb0 [ 76.709616][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.709639][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.709664][ T5872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 76.709688][ T5872] RIP: 0033:0x7fb48db9e159 [ 76.709704][ T5872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.709720][ T5872] RSP: 002b:00007fb48ea05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.709740][ T5872] RAX: ffffffffffffffda RBX: 00007fb48de26090 RCX: 00007fb48db9e159 [ 76.709755][ T5872] RDX: 0000200000000040 RSI: 0000000000004b72 RDI: 0000000000000003 [ 76.709767][ T5872] RBP: 00007fb48dc3506b R08: 0000000000000000 R09: 0000000000000000 [ 76.709786][ T5872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.709797][ T5872] R13: 00007fb48de26128 R14: 00007fb48de26090 R15: 00007ffc5e303978 [ 76.709818][ T5872] [ 76.710072][ T5872] Kernel Offset: disabled