last executing test programs: 3.387648308s ago: executing program 0 (id=1): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ppoll(0x0, 0x0, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000180)={[0xffffffffffffff68]}, 0x8) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8400, 0x0) r3 = openat(r2, &(0x7f0000000400)='test\x00', 0x42, 0x1ff) write$binfmt_register(r3, &(0x7f00000000c0)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x0, 0x3a, '/dev/comedi2\x00', 0x3a, '', 0x3a, './file0'}, 0x34) r4 = socket(0x1d, 0x2, 0x6) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000080)={0x1d, r6, 0x3, {0x0, 0x0, 0x3}, 0xfe}, 0x18) write$binfmt_elf64(r1, &(0x7f0000000a40)=ANY=[@ANYBLOB="7f454c46030007e1080000000000000003003e00f9fdffffd8010000000000004000000000000000d902000000000000330d000008003800010079001f00090051e57464"], 0x78) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) close(r1) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x40007c, @dev={0xfe, 0x80, '\x00', 0x1f}, 0xc7}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r7, 0x8b2c, &(0x7f0000000040)) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f0000000180)='./my_configfs/target/usb_gadget\x00') 2.928048629s ago: executing program 0 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='add syz0 ', 0x9) 2.706356894s ago: executing program 0 (id=6): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000006c0)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x1) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_REG_LIST(r5, 0xc008aeb0, 0x0) 1.751246477s ago: executing program 1 (id=2): symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') chmod(&(0x7f0000000000)='./file0\x00', 0x28c) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchown(r0, r2, r3) setxattr$security_capability(&(0x7f0000000200)='./file0\x00', &(0x7f00000003c0), 0x0, 0x0, 0x3) 1.397310826s ago: executing program 3 (id=4): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SCAN_REQ(r4, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000000)={0x14, 0x0, 0x1, 0x2070bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x161b060f1436d4f2}, 0x4000820) getgid() 1.389942566s ago: executing program 1 (id=7): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f00000004c0), 0x202, 0x0) ioctl$SOUND_MIXER_READ_CAPS(r1, 0x80044dfc, &(0x7f0000000680)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x1c, r3, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x0, 0x6, @remote}, @FOU_ATTR_PEER_V6={0x0, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2a}}}]}, 0x61}}, 0x20044814) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x90) r4 = openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(0x0, r6) bpf$MAP_CREATE(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) syz_open_dev$loop(0x0, 0x7, 0x10c062) r8 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) write(r8, &(0x7f00000002c0)='snd_aloop.0', 0xb) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01008f925e2d04000000037400453fdbb67ed8ff93061100060069703667720330000000000000000000080007000000000008000400640101010c000500ffffffff"], 0x40}, 0x1, 0xffffffff00000003}, 0x0) 1.316997518s ago: executing program 2 (id=3): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000280)={0x0, 0xfffffffffffffffe}) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800000, 0x0, 0xb7, 0x0, &(0x7f00000003c0)) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0xd58c, 0x80, 0x2, 0x1e2}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1}) r7 = eventfd2(0x1, 0x80001) io_uring_register$IORING_REGISTER_EVENTFD(r3, 0x4, &(0x7f0000000080)=r7, 0x1) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=@delqdisc={0x58, 0x25, 0x200, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2}, {0xc, 0xc}, {0x4, 0x6}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x0, 0x6, 0x1, 0xd865}, {0xdd, 0x2, 0xf, 0x8000, 0x1, 0x3}, 0x7ff, 0xff800000, 0x3a2}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000001}, 0x94) mkdirat(0xffffffffffffff9c, 0x0, 0x1ea) mount(&(0x7f0000000000)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x4002, 0x0) write(0xffffffffffffffff, 0x0, 0x0) set_mempolicy(0x4003, &(0x7f0000000200)=0x7, 0x3) mlockall(0x2) r8 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r8, 0xb) shmat(r8, &(0x7f0000ffd000/0x1000)=nil, 0x7000) 1.025287635s ago: executing program 0 (id=8): socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfbdfe000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x84) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x22020400) r5 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x181041, 0x0) r6 = syz_io_uring_setup(0x3158, &(0x7f0000000040)={0x0, 0x986, 0x42, 0x0, 0x17e}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r6, 0xc, 0x2000000, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000001c0)={0xc}) 197.947185ms ago: executing program 3 (id=9): r0 = open(&(0x7f0000000080)='./file1\x00', 0x146142, 0x90) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x1}], 0x1, 0x7800, 0xfffffffe, 0x3) read$FUSE(r0, 0x0, 0xeffd) 0s ago: executing program 3 (id=10): syz_pidfd_open(0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000000)={{0x1, 0x3, 0x4, 0x3, 0x4}, 0x8, 0x7}) syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140), 0x1, 0x8a, &(0x7f0000000180)="$eJzszqENAkEUBNDhDKhrAEEH1wOlECQ4FISEimiFEugAgcUcYsGsxCy5vJf8n0zGzO11XaZPxksyVg7H026zLz9MUpdknmSRZNWX/FiXbvbp78/z9nut9wIAAL/rMtR5aDYGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4A+9AwAA///rYCNS") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. [ 76.821247][ T5762] cgroup: Unknown subsys name 'net' [ 76.954488][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.565323][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.938357][ T5784] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.939080][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.949969][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.959077][ T5783] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.966194][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.969200][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.978794][ T5784] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.985007][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.989674][ T5784] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.003123][ T5788] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.003246][ T5784] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.017234][ T5788] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.018846][ T5788] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.027321][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.038364][ T5788] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.043517][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.053194][ T5784] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 81.060767][ T5784] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 81.062684][ T5788] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.069243][ T5784] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.077917][ T5788] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 81.084299][ T5784] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 81.096637][ T5783] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.099054][ T5782] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.579856][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 81.627297][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 81.677831][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 81.805324][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 81.818293][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.825933][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.835948][ T5773] bridge_slave_0: entered allmulticast mode [ 81.844123][ T5773] bridge_slave_0: entered promiscuous mode [ 81.883198][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.890454][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.897910][ T5774] bridge_slave_0: entered allmulticast mode [ 81.905135][ T5774] bridge_slave_0: entered promiscuous mode [ 81.913737][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.921055][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.928595][ T5773] bridge_slave_1: entered allmulticast mode [ 81.935945][ T5773] bridge_slave_1: entered promiscuous mode [ 81.959375][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.966782][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.973988][ T5774] bridge_slave_1: entered allmulticast mode [ 81.981205][ T5774] bridge_slave_1: entered promiscuous mode [ 82.050322][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.063970][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.091075][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.140536][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.149838][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.159714][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.167091][ T5776] bridge_slave_0: entered allmulticast mode [ 82.174046][ T5776] bridge_slave_0: entered promiscuous mode [ 82.187162][ T5774] team0: Port device team_slave_0 added [ 82.223142][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.230430][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.237865][ T5776] bridge_slave_1: entered allmulticast mode [ 82.245263][ T5776] bridge_slave_1: entered promiscuous mode [ 82.253777][ T5774] team0: Port device team_slave_1 added [ 82.285616][ T5773] team0: Port device team_slave_0 added [ 82.324981][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.332346][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.340260][ T5775] bridge_slave_0: entered allmulticast mode [ 82.347832][ T5775] bridge_slave_0: entered promiscuous mode [ 82.357813][ T5773] team0: Port device team_slave_1 added [ 82.366061][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.377639][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.384619][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.410682][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.424265][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.431770][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.439200][ T5775] bridge_slave_1: entered allmulticast mode [ 82.446186][ T5775] bridge_slave_1: entered promiscuous mode [ 82.465385][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.484973][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.492110][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.518388][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.551016][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.558176][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.584273][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.602489][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.609611][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.635570][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.677392][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.690146][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.722027][ T5776] team0: Port device team_slave_0 added [ 82.730987][ T5776] team0: Port device team_slave_1 added [ 82.819789][ T5775] team0: Port device team_slave_0 added [ 82.833321][ T5774] hsr_slave_0: entered promiscuous mode [ 82.839890][ T5774] hsr_slave_1: entered promiscuous mode [ 82.854278][ T5773] hsr_slave_0: entered promiscuous mode [ 82.860760][ T5773] hsr_slave_1: entered promiscuous mode [ 82.869976][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.877901][ T5773] Cannot create hsr debugfs directory [ 82.884071][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.891779][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.917801][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.930308][ T5775] team0: Port device team_slave_1 added [ 82.950857][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.958162][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.984141][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.055931][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.063083][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.091756][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.139745][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.149666][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.176169][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.178683][ T5782] Bluetooth: hci0: command tx timeout [ 83.189448][ T52] Bluetooth: hci1: command tx timeout [ 83.192483][ T5782] Bluetooth: hci3: command tx timeout [ 83.198487][ T5783] Bluetooth: hci2: command tx timeout [ 83.251499][ T5776] hsr_slave_0: entered promiscuous mode [ 83.258929][ T5776] hsr_slave_1: entered promiscuous mode [ 83.265288][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.273466][ T5776] Cannot create hsr debugfs directory [ 83.365178][ T5775] hsr_slave_0: entered promiscuous mode [ 83.371667][ T5775] hsr_slave_1: entered promiscuous mode [ 83.378510][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.386075][ T5775] Cannot create hsr debugfs directory [ 83.694202][ T5773] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.718474][ T5773] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.735297][ T5773] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.759158][ T5773] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.819512][ T5774] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.837788][ T5774] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.853425][ T5774] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.864673][ T5774] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.968322][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.981556][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.992441][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.019235][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.062477][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.130665][ T5775] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.148952][ T5775] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.161536][ T5775] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.175691][ T5775] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.204492][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.222090][ T2944] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.229579][ T2944] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.284663][ T2944] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.291880][ T2944] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.388214][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.410975][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.454182][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.481433][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.515761][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.522976][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.533124][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.540779][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.582269][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.589632][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.610695][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.643380][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.650623][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.794939][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.859549][ T2944] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.866760][ T2944] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.899306][ T2944] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.906538][ T2944] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.045533][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.209813][ T5773] veth0_vlan: entered promiscuous mode [ 85.233770][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.259262][ T5773] veth1_vlan: entered promiscuous mode [ 85.268703][ T5783] Bluetooth: hci1: command tx timeout [ 85.274147][ T5783] Bluetooth: hci3: command tx timeout [ 85.277776][ T52] Bluetooth: hci0: command tx timeout [ 85.280198][ T5783] Bluetooth: hci2: command tx timeout [ 85.410380][ T5773] veth0_macvtap: entered promiscuous mode [ 85.429257][ T5773] veth1_macvtap: entered promiscuous mode [ 85.465817][ T5776] veth0_vlan: entered promiscuous mode [ 85.489440][ T5776] veth1_vlan: entered promiscuous mode [ 85.505317][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.530893][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.556002][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.570841][ T5773] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.580473][ T5773] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.589349][ T5773] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.598693][ T5773] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.619520][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.694290][ T5776] veth0_macvtap: entered promiscuous mode [ 85.724314][ T5776] veth1_macvtap: entered promiscuous mode [ 85.809916][ T2981] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.829220][ T5775] veth0_vlan: entered promiscuous mode [ 85.835484][ T2981] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.844715][ T5774] veth0_vlan: entered promiscuous mode [ 85.868100][ T5774] veth1_vlan: entered promiscuous mode [ 85.912473][ T5775] veth1_vlan: entered promiscuous mode [ 85.919121][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.927870][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.939898][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.958874][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.971215][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.982963][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.994582][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.006072][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.041706][ T5776] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.054039][ T5776] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.063987][ T5776] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.073030][ T5776] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.118160][ T5774] veth0_macvtap: entered promiscuous mode [ 86.153077][ T5774] veth1_macvtap: entered promiscuous mode [ 86.193782][ T5775] veth0_macvtap: entered promiscuous mode [ 86.259443][ T5775] veth1_macvtap: entered promiscuous mode [ 86.275357][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.292212][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.304716][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.317821][ T5835] jffs2: notice: (5835) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 86.326975][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.352353][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.389090][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.401736][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.411710][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.422371][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.434092][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.448959][ T5835] warning: `syz.0.1' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 86.462171][ T5837] process 'syz.0.1' launched './file0' with NULL argv: empty string added [ 86.472410][ T5837] Invalid argument reading file caps for ./file0 [ 86.481996][ T5774] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.493212][ T5774] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.503019][ T5774] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.512750][ T5774] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.547580][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.568349][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.580475][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.591323][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.603502][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.614414][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.632878][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.645533][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.656850][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.688686][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.714496][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.724821][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.735679][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.748516][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.783777][ T5775] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.798869][ T5775] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.805716][ T5839] kAFS: Invalid Command on /proc/fs/afs/cells file [ 86.812237][ T5775] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.823362][ T5775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.909629][ T5842] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 86.947604][ T2987] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.972825][ T2987] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.360047][ T5783] Bluetooth: hci0: command tx timeout [ 87.365589][ T5782] Bluetooth: hci3: command tx timeout [ 87.372524][ T52] Bluetooth: hci1: command tx timeout [ 87.378295][ T52] Bluetooth: hci2: command tx timeout [ 87.390668][ T2987] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.422033][ T2987] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.653747][ T2987] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.694307][ T2987] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.850443][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.858631][ T2987] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.858780][ T2987] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.914584][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.953635][ T2944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.979752][ T2944] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.416764][ T5086] Bluetooth: hci2: command tx timeout [ 89.422239][ T5086] Bluetooth: hci0: command tx timeout [ 89.429282][ T52] Bluetooth: hci3: command tx timeout [ 89.434699][ T5783] Bluetooth: hci1: command tx timeout [ 90.756840][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 91.166471][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 91.537798][ T5852] ================================================================== [ 91.545894][ T5852] BUG: KASAN: slab-use-after-free in release_card_device+0x196/0x1a0 [ 91.554001][ T5852] Read of size 1 at addr ffff88802c5ac8f1 by task syz.1.7/5852 [ 91.561579][ T5852] [ 91.563953][ T5852] CPU: 1 PID: 5852 Comm: syz.1.7 Not tainted syzkaller #0 [ 91.571098][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.581193][ T5852] Call Trace: [ 91.584504][ T5852] [ 91.587469][ T5852] dump_stack_lvl+0x18c/0x250 [ 91.592187][ T5852] ? __lock_acquire+0x7d80/0x7d80 [ 91.597337][ T5852] ? show_regs_print_info+0x20/0x20 [ 91.602583][ T5852] ? load_image+0x420/0x420 [ 91.607130][ T5852] ? __virt_addr_valid+0x10c/0x380 [ 91.612322][ T5852] ? __virt_addr_valid+0x10c/0x380 [ 91.617486][ T5852] ? __virt_addr_valid+0x10c/0x380 [ 91.622667][ T5852] print_report+0xa8/0x210 [ 91.627141][ T5852] ? release_card_device+0x196/0x1a0 [ 91.632485][ T5852] kasan_report+0x117/0x150 [ 91.637028][ T5852] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 91.643047][ T5852] ? release_card_device+0x196/0x1a0 [ 91.648379][ T5852] release_card_device+0x196/0x1a0 [ 91.653527][ T5852] ? snd_power_wait+0x90/0x90 [ 91.658252][ T5852] device_release+0xbc/0x1e0 [ 91.662880][ T5852] kobject_put+0x21b/0x450 [ 91.667330][ T5852] snd_card_file_remove+0x331/0x380 [ 91.672560][ T5852] snd_pcm_oss_release+0x201/0x240 [ 91.677797][ T5852] ? snd_disconnect_mmap+0x10/0x10 [ 91.682944][ T5852] __fput+0x221/0x940 [ 91.686972][ T5852] task_work_run+0x1d4/0x260 [ 91.691603][ T5852] ? task_work_cancel+0x220/0x220 [ 91.696662][ T5852] ? exit_to_user_mode_loop+0x3b/0x110 [ 91.702165][ T5852] exit_to_user_mode_loop+0xe6/0x110 [ 91.707483][ T5852] exit_to_user_mode_prepare+0xee/0x180 [ 91.713057][ T5852] syscall_exit_to_user_mode+0x1a/0x50 [ 91.718548][ T5852] do_syscall_64+0x61/0xb0 [ 91.722991][ T5852] ? clear_bhb_loop+0x40/0x90 [ 91.727692][ T5852] ? clear_bhb_loop+0x40/0x90 [ 91.732399][ T5852] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.738336][ T5852] RIP: 0033:0x7f66a459e0d9 [ 91.742794][ T5852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.762433][ T5852] RSP: 002b:00007ffd04fbed98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 91.770875][ T5852] RAX: 0000000000000000 RBX: 00007f66a4827da0 RCX: 00007f66a459e0d9 [ 91.778867][ T5852] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 91.786867][ T5852] RBP: 00007f66a4827da0 R08: 0000000000000006 R09: 0000000000000000 [ 91.794892][ T5852] R10: 00007f66a4827cb0 R11: 0000000000000246 R12: 0000000000015da3 [ 91.802893][ T5852] R13: 00007f66a482609c R14: 0000000000015d71 R15: 00007f66a4826090 [ 91.810890][ T5852] [ 91.813929][ T5852] [ 91.816275][ T5852] Allocated by task 1: [ 91.820369][ T5852] kasan_set_track+0x4e/0x70 [ 91.824983][ T5852] __kasan_kmalloc+0x8f/0xa0 [ 91.829598][ T5852] __kmalloc_node_track_caller+0xb4/0x230 [ 91.835349][ T5852] __devres_alloc_node+0x4c/0x120 [ 91.840394][ T5852] snd_devm_card_new+0x78/0x150 [ 91.845271][ T5852] loopback_probe+0x151/0x1a30 [ 91.850061][ T5852] platform_probe+0x13b/0x1c0 [ 91.854779][ T5852] really_probe+0x247/0xae0 [ 91.859304][ T5852] __driver_probe_device+0x1f5/0x390 [ 91.864628][ T5852] driver_probe_device+0x4f/0x420 [ 91.869672][ T5852] __device_attach_driver+0x2ca/0x510 [ 91.875059][ T5852] bus_for_each_drv+0x252/0x2e0 [ 91.879935][ T5852] __device_attach+0x2c1/0x420 [ 91.884727][ T5852] bus_probe_device+0x180/0x260 [ 91.889602][ T5852] device_add+0x87c/0xc40 [ 91.893950][ T5852] platform_device_add+0x4c3/0x830 [ 91.899090][ T5852] platform_device_register_full+0x472/0x560 [ 91.905096][ T5852] alsa_card_loopback_init+0x156/0x2b0 [ 91.910575][ T5852] do_one_initcall+0x242/0x790 [ 91.915371][ T5852] do_initcall_level+0x13d/0x1f0 [ 91.920322][ T5852] do_initcalls+0x69/0xd0 [ 91.924668][ T5852] kernel_init_freeable+0x3d9/0x560 [ 91.929878][ T5852] kernel_init+0x1d/0x1c0 [ 91.934241][ T5852] ret_from_fork+0x48/0x80 [ 91.938688][ T5852] ret_from_fork_asm+0x11/0x20 [ 91.943477][ T5852] [ 91.945822][ T5852] Freed by task 5855: [ 91.949833][ T5852] kasan_set_track+0x4e/0x70 [ 91.954442][ T5852] kasan_save_free_info+0x28/0x40 [ 91.959494][ T5852] ____kasan_slab_free+0x126/0x1f0 [ 91.964627][ T5852] slab_free_freelist_hook+0x130/0x1a0 [ 91.970108][ T5852] __kmem_cache_free+0xba/0x1f0 [ 91.974979][ T5852] devres_release_all+0x1ad/0x230 [ 91.980016][ T5852] device_release_driver_internal+0x4c0/0x6f0 [ 91.986124][ T5852] unbind_store+0x1a1/0x1d0 [ 91.990660][ T5852] kernfs_fop_write_iter+0x3a4/0x520 [ 91.995971][ T5852] vfs_write+0x474/0x9a0 [ 92.000241][ T5852] ksys_write+0x151/0x260 [ 92.004600][ T5852] do_syscall_64+0x55/0xb0 [ 92.009037][ T5852] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.014948][ T5852] [ 92.017285][ T5852] The buggy address belongs to the object at ffff88802c5ac000 [ 92.017285][ T5852] which belongs to the cache kmalloc-8k of size 8192 [ 92.031355][ T5852] The buggy address is located 2289 bytes inside of [ 92.031355][ T5852] freed 8192-byte region [ffff88802c5ac000, ffff88802c5ae000) [ 92.045338][ T5852] [ 92.047672][ T5852] The buggy address belongs to the physical page: [ 92.054104][ T5852] page:ffffea0000b16a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c5a8 [ 92.064272][ T5852] head:ffffea0000b16a00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 92.073243][ T5852] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 92.081251][ T5852] page_type: 0xffffffff() [ 92.085608][ T5852] raw: 00fff00000000840 ffff888017c42280 dead000000000122 0000000000000000 [ 92.094209][ T5852] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 92.102813][ T5852] page dumped because: kasan: bad access detected [ 92.109255][ T5852] page_owner tracks the page as allocated [ 92.114990][ T5852] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 23522145705, free_ts 0 [ 92.134712][ T5852] post_alloc_hook+0x1c1/0x200 [ 92.139515][ T5852] get_page_from_freelist+0x2181/0x22a0 [ 92.145085][ T5852] __alloc_pages+0x1f0/0x460 [ 92.149723][ T5852] alloc_page_interleave+0x24/0x1e0 [ 92.154956][ T5852] alloc_slab_page+0x5d/0x180 [ 92.159653][ T5852] new_slab+0x87/0x2d0 [ 92.163752][ T5852] ___slab_alloc+0xc5c/0x12f0 [ 92.168445][ T5852] __kmem_cache_alloc_node+0x11f/0x250 [ 92.173928][ T5852] kmalloc_trace+0x2a/0xe0 [ 92.178559][ T5852] snd_mixer_oss_notify_handler+0x14a/0xff0 [ 92.184497][ T5852] snd_card_register+0x56b/0x6f0 [ 92.189459][ T5852] snd_dummy_probe+0x11b5/0x18e0 [ 92.194446][ T5852] platform_probe+0x13b/0x1c0 [ 92.199158][ T5852] really_probe+0x247/0xae0 [ 92.203682][ T5852] __driver_probe_device+0x1f5/0x390 [ 92.209006][ T5852] driver_probe_device+0x4f/0x420 [ 92.214043][ T5852] page_owner free stack trace missing [ 92.219434][ T5852] [ 92.221776][ T5852] Memory state around the buggy address: [ 92.227421][ T5852] ffff88802c5ac780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.235497][ T5852] ffff88802c5ac800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.243580][ T5852] >ffff88802c5ac880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.251658][ T5852] ^ [ 92.259392][ T5852] ffff88802c5ac900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.267466][ T5852] ffff88802c5ac980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.275531][ T5852] ================================================================== [ 92.443040][ T57] cfg80211: failed to load regulatory.db [ 92.498096][ T5852] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 92.505347][ T5852] CPU: 0 PID: 5852 Comm: syz.1.7 Not tainted syzkaller #0 [ 92.512492][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.522577][ T5852] Call Trace: [ 92.525888][ T5852] [ 92.528870][ T5852] dump_stack_lvl+0x18c/0x250 [ 92.533616][ T5852] ? show_regs_print_info+0x20/0x20 [ 92.538857][ T5852] ? load_image+0x420/0x420 [ 92.543398][ T5852] panic+0x2ca/0x720 [ 92.547343][ T5852] ? bpf_jit_dump+0xd0/0xd0 [ 92.551890][ T5852] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 92.557914][ T5852] ? _raw_spin_unlock+0x40/0x40 [ 92.562801][ T5852] ? print_memory_metadata+0x314/0x400 [ 92.568304][ T5852] ? release_card_device+0x196/0x1a0 [ 92.573634][ T5852] check_panic_on_warn+0x84/0xa0 [ 92.578622][ T5852] ? release_card_device+0x196/0x1a0 [ 92.583946][ T5852] end_report+0x6f/0x130 [ 92.588211][ T5852] kasan_report+0x128/0x150 [ 92.592734][ T5852] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 92.598731][ T5852] ? release_card_device+0x196/0x1a0 [ 92.604082][ T5852] release_card_device+0x196/0x1a0 [ 92.609250][ T5852] ? snd_power_wait+0x90/0x90 [ 92.613947][ T5852] device_release+0xbc/0x1e0 [ 92.618602][ T5852] kobject_put+0x21b/0x450 [ 92.623056][ T5852] snd_card_file_remove+0x331/0x380 [ 92.628295][ T5852] snd_pcm_oss_release+0x201/0x240 [ 92.633436][ T5852] ? snd_disconnect_mmap+0x10/0x10 [ 92.638570][ T5852] __fput+0x221/0x940 [ 92.642582][ T5852] task_work_run+0x1d4/0x260 [ 92.647197][ T5852] ? task_work_cancel+0x220/0x220 [ 92.652260][ T5852] ? exit_to_user_mode_loop+0x3b/0x110 [ 92.657745][ T5852] exit_to_user_mode_loop+0xe6/0x110 [ 92.663057][ T5852] exit_to_user_mode_prepare+0xee/0x180 [ 92.668628][ T5852] syscall_exit_to_user_mode+0x1a/0x50 [ 92.674131][ T5852] do_syscall_64+0x61/0xb0 [ 92.678569][ T5852] ? clear_bhb_loop+0x40/0x90 [ 92.683292][ T5852] ? clear_bhb_loop+0x40/0x90 [ 92.687988][ T5852] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.693899][ T5852] RIP: 0033:0x7f66a459e0d9 [ 92.698336][ T5852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.717959][ T5852] RSP: 002b:00007ffd04fbed98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 92.726392][ T5852] RAX: 0000000000000000 RBX: 00007f66a4827da0 RCX: 00007f66a459e0d9 [ 92.734389][ T5852] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 92.742393][ T5852] RBP: 00007f66a4827da0 R08: 0000000000000006 R09: 0000000000000000 [ 92.750391][ T5852] R10: 00007f66a4827cb0 R11: 0000000000000246 R12: 0000000000015da3 [ 92.758381][ T5852] R13: 00007f66a482609c R14: 0000000000015d71 R15: 00007f66a4826090 [ 92.766389][ T5852] [ 92.769564][ T5852] Kernel Offset: disabled [ 92.773901][ T5852] Rebooting in 86400 seconds..