last executing test programs: 39.018437215s ago: executing program 0 (id=63): io_uring_setup$auto(0xb06, &(0x7f0000000080)={0x7fffffff, 0xd, 0x1020, 0x206, 0x10007, 0x8, 0xffffffffffffffff, [], {0x27, 0x6, 0x21bb9432, 0x4, 0xffffffff, 0x7f, 0x40101, 0x6, 0x2}, {0x100, 0x10000008, 0x7, 0x1, 0x1, 0x3f, 0x76c4, 0x80008, 0x2}}) (fail_nth: 4) 38.035391179s ago: executing program 0 (id=65): close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_vhci_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket(0x11, 0xa, 0x9) socket(0xa, 0x2, 0x3a) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptyz9\x00', 0x600882, 0x0) mmap$auto(0x0, 0x4020005, 0xdf, 0xeb1, 0x401, 0x8000) bpf$auto_BPF_LINK_GET_FD_BY_ID(0x1e, 0x0, 0x6) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0x10, 0x2, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x2d, 0x2, 0x0) ioctl$auto(0x3, 0x89e3, 0x91) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cmdline\x00', 0x8800, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x787806, 0x0) socket(0x10, 0x2, 0x4) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x14, 0x0, 0x1, 0x70bd25, 0x25dfdbf7, {0x1, 0x0, 0x3f00}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x1000, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) 36.626132729s ago: executing program 0 (id=68): mremap$auto(0x0, 0xbfffffffffffffff, 0x7ffffffffffffffd, 0x0, 0x7fffffffb000) openat$auto_nsim_psample_enable_fops_psample(0xffffffffffffff9c, 0x0, 0x169a02, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/block/ram6/queue/max_hw_sectors_kb\x00', 0x80000, 0x0) read$auto(r0, 0x0, 0x20) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x2, 0x2, 0x0) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) connect$auto(0x3, &(0x7f00000018c0)=@l2tp={0x2, 0x0, @multicast1}, 0x55) sendmmsg$auto(0x3, 0x0, 0x3, 0x0) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_usbfs_devices_fops_usb(0xffffffffffffff9c, 0x0, 0x28400, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r2) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x805, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004044}, 0x8000) unshare$auto(0x20000) r4 = pidfd_open$auto(0x1, 0x0) setns(r4, 0x20000) socket(0x18, 0x2, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20240, 0x0) r5 = socket(0xa, 0x5, 0x0) ioctl$auto(r5, 0x8941, 0x8) sendmsg$auto_NL80211_CMD_GET_INTERFACE(r5, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x40880}, 0x1) 34.559486027s ago: executing program 0 (id=71): r0 = openat$auto_percpu_stats_fops_(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) sendmmsg$auto(r0, 0x0, 0x3, 0x20000000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dmmidi2\x00', 0x1, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0x2, 0x2, 0x0) r1 = socket(0xa, 0x3, 0x3a) r2 = socket(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_fd=r1, r3, 0x4, 0x5fc, r2, @relative_fd, 0xc2a}, 0xf) bpf$auto(0x2, &(0x7f00000000c0)=@raw_tracepoint={0x5, 0xffffffffffffffff, 0x0, 0x3}, 0x91) r4 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, 0x0, 0x20a00, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) r5 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000180), 0x40900, 0x0) ioctl$auto_UBI_IOCATT(r5, 0x40186f40, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x802, 0x0) syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) statmount$auto(0x0, 0x0, 0x800, 0x0) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_UBI_IOCDET(r5, 0x40046f41, 0x0) r6 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), r4) sendmsg$auto_L2TP_CMD_NOOP(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x66871c73e4a73b9}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0xfffffff9}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x8001}]}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x840) clone$auto(0x100000008, 0x9, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4000006) clone$auto(0x1, 0x1, 0x0, 0x0, 0x80000000001) sendmsg$auto_NFC_CMD_ACTIVATE_TARGET(0xffffffffffffffff, 0x0, 0x20000000) syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000240), r4) 30.481981202s ago: executing program 0 (id=77): close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_vhci_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket(0x11, 0xa, 0x9) socket(0xa, 0x2, 0x3a) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptyz9\x00', 0x600882, 0x0) mmap$auto(0x0, 0x4020005, 0xdf, 0xeb1, 0x401, 0x8000) bpf$auto_BPF_LINK_GET_FD_BY_ID(0x1e, 0x0, 0x6) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0x10, 0x2, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x2d, 0x2, 0x0) ioctl$auto(0x3, 0x89e3, 0x91) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cmdline\x00', 0x8800, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0x4) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x14, 0x0, 0x1, 0x70bd25, 0x25dfdbf7, {0x1, 0x0, 0x3f00}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x1000, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) 28.924543152s ago: executing program 0 (id=79): r0 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/swradio12\x00', 0x0, 0x0) poll$auto(&(0x7f0000000480)={r0, 0xffff, 0x29}, 0x3, 0x7) get_mempolicy$auto(0x0, 0x0, 0x3, 0x1ff, 0x3) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x4005, 0xb, 0x40eb2, 0x401, 0x300000000000) move_pages$auto(0x0, 0x40000000000001, 0x0, 0x0, 0x0, 0x8000000000000000) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv6/icmp/ratemask\x00', 0xa0202, 0x0) sendfile$auto(r1, r1, 0x0, 0x8) socket(0xa, 0x2, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/fs/ext4/sda1/reserved_clusters\x00', 0x222080, 0x0) openat$auto_fops_init_pkru_pkeys(0xffffffffffffff9c, &(0x7f0000000140), 0x42600, 0x0) r3 = getsockopt$auto(r1, 0x4, 0x9733, &(0x7f00000001c0)='/sys/kernel/debug/x86/init_pkru\x00', &(0x7f0000000200)=0x9) sendfile$auto(r3, r2, 0x0, 0xfffffffffffffffe) r4 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/block/sda/hctx0/busy\x00', 0x169100, 0x0) pread64$auto(r4, 0x0, 0x1000f42d, 0x100) write$auto(0x1, 0x0, 0x80000000) write$auto(0x1, 0x0, 0x7ffbfffc) munmap$auto(0x1775387, 0x5) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_hwsim_simulate_radar_(0xffffffffffffff9c, 0x0, 0x8346, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x40342, 0x22) mount$auto(&(0x7f00000000c0)='veth1_vlan\x00', &(0x7f00000009c0)='./file0\x00', 0x0, 0x19b7f249, 0x0) sendmmsg$auto(0x3, 0x0, 0x3, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv6/neigh/netdevsim3/locktime\x00', 0xd7a185e90694ec51, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/ptp/ptp0/n_vclocks\x00', 0x8502, 0x0) fsconfig$auto_XFS_DAX_NEVER(0xffffffffffffffff, 0x80, &(0x7f0000000100)='\x00', 0x0, 0x2) write$auto(0xffffffffffffffff, &(0x7f0000000040)=',\x00^\xa2\x02\x00\x05\x00\x00\x00\xd8l\x00\x00\x00\x00\x00\x00\xb2s\x83\xbd\xc5_%\xc1\xa3\xd0\x95Hq\xf4zG\x01[{\x17\x05I\xe0\xb1d)\x06z8L\xe6&[\xa9X6\x7f\xec\x94\xdal\xa1\xbb\x86\x9c\xc2\xef\x02\r9%\x06\xc5\'b%m_\x96A\"\xdd\xe40\xa7\xc3\x9ah\xf3B\xc2\xec\xf8\r\f[\xe5\x9dK\xe1\x99\x86\xfc\xac\x9f\x8a', 0x1000) 18.674441725s ago: executing program 3 (id=92): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = open(&(0x7f0000000000)='./file0\x00', 0x1052c2, 0xe1d2b27bdc14aabc) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/audio1\x00', 0x11d001, 0x0) ioctl$auto_SNDCTL_DSP_NONBLOCK(r1, 0x500e, 0x0) fcntl$auto(r0, 0x3, 0x1) prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x40) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) 18.226504045s ago: executing program 3 (id=94): r0 = openat$auto_percpu_stats_fops_(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) sendmmsg$auto(r0, 0x0, 0x3, 0x20000000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dmmidi2\x00', 0x1, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0x2, 0x2, 0x0) r1 = socket(0xa, 0x3, 0x3a) r2 = socket(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_fd=r1, r3, 0x4, 0x5fc, r2, @relative_fd, 0xc2a}, 0xf) bpf$auto(0x2, &(0x7f00000000c0)=@raw_tracepoint={0x5, 0xffffffffffffffff, 0x0, 0x3}, 0x91) r4 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, 0x0, 0x20a00, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) r5 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000180), 0x40900, 0x0) ioctl$auto_UBI_IOCATT(r5, 0x40186f40, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x802, 0x0) syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) statmount$auto(0x0, 0x0, 0x800, 0x0) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_UBI_IOCDET(r5, 0x40046f41, 0x0) r6 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), r4) sendmsg$auto_L2TP_CMD_NOOP(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x66871c73e4a73b9}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0xfffffff9}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x8001}]}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x840) clone$auto(0x100000008, 0x9, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4000006) clone$auto(0x1, 0x1, 0x0, 0x0, 0x80000000001) sendmsg$auto_NFC_CMD_ACTIVATE_TARGET(0xffffffffffffffff, 0x0, 0x20000000) syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000240), r4) 15.183179196s ago: executing program 1 (id=98): close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/devices/virtual/block/nbd7/power/autosuspend_delay_ms\x00', 0x22902, 0x0) pwrite64$auto(0xc8, &(0x7f0000000080)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdde\x1cJ\x99\x00\x06\x11\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8dg\x81K*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,,\x93\xba\x88\x93\xc6#\xe5\xaae\x9d\xb6\x1a\x7f\xc0%\xb0\rfOJ+\x02\x9b#\x1c\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd0\xbdn\x1d\x00\xeb]B\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xaf\n1\x80\x1a\xbc_\xef\x8b\t\xcc\xa6\xf2\xc1\"\xact\xee\xc9', 0xfdef, 0x3) (async) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x189401, 0x0) (async) r1 = socketcall$auto(0xa, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) (async, rerun: 32) ioctl$auto(0x3, 0xae60, 0x10000000000402) (rerun: 32) ioctl$auto(0x3, 0xae41, r1) (async, rerun: 32) ioctl$auto_KVM_GET_MSRS(r0, 0x4400ae8f, &(0x7f00000000c0)={0xdd}) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000700), r3) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_CHANNEL(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000780)={0x1c, r4, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x20000000) (async) sendmsg$auto_NL80211_CMD_NEW_STATION(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x58, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@NL80211_ATTR_USE_MFP={0x8}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0xfff}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x4e23}, @NL80211_ATTR_REKEY_DATA={0x2c, 0x7a, 0x0, 0x1, [@typed={0x14, 0x147, 0x0, 0x0, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}}, @typed={0x14, 0x116, 0x0, 0x0, @ipv6=@mcast1}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x804) (async) ioctl$auto_KVM_CREATE_VM(r0, 0xae80, 0x0) 14.767654402s ago: executing program 3 (id=99): close_range$auto(0x0, 0xffffffffffffffff, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/cpu.weight.nice\x00', 0xa001, 0x0) write$auto(r0, &(0x7f0000000100)='0\x81=\"\xad/\x8d\b\x00\x18\xa4\xb0\xb4\xd9\x82=~\x17\xfb&L\xeb=j\a\xf1y\xb3\"\xeb\a\xdd\xf4\xf4Ry\xee\xd7\x1e\x1c\x86\x0f\xcf\x7f\xbf\xab\x12{\xc2\xc2*\xc1M+6/v8\xea\xe9\x85s4\xfe\xe5\t\x7fc\xfb7^\xb86J_\x1d1s!\x01\xff\xff\xff\xff\xff\xff\xff\x1dF\xe6\xf6\x17\x10+\xc0\xb0\xafc\x99\xd4\x150Y~\x1e\xe2\xd6x4fW\x13\xc4U`\x9e-X\xd7\xe2H^\fLS`\xfc\xbb\r\f\x00\xeaN\xa5\xd2\x82;\x7f\xa0.\x9a\xfb\x8d\xf3l\xf2\xd3\x95\xc1M5\xcb\xa6I\x067\xe36\xea\xe9\xe3\xf44oT_`8\xb3\xef\x04 \x05K\xf9\x87pl\xac\x86\nE\xc7e\xc5Q\x89\xcd@\x1c\x92\x00\x87\x976\x9f>\xa2\xcfm\xec\r\x11\x7f\x00\x00\x00\xb1\xde@\x02\xce\x03\xb7\xb1\xfb\x9fr\v\xb2\xe3\xc7\b\x85K /zm\x7f\x8fg,p\a\xc8\x7f\xa5\x87\x02\x87\xbbR=A\x00\x1f\x8a\xa7/Q\"J\xbb\xb0m\xf2SP\x84\x84S\xf0\xba\x9a\xf6\xb6`WI\xba\xba*8\x9f\xea\xe8K/\x98\xbc7~>\x12\x9buB\xcb\xe4\x8aKf\xba\x8c\x19m\xe6I\x02\xde\x80\x9d\x87}\xf4\xbd9\xaa\xd6\xdb1]\xde\xa0r\x14\xca56^\x94\xd2\xd8\xe6}9\x91\xb6\xf7\xa1=\x96\x11\xf1\\\xa91\x0e\xd1\xe4z\xc1;Pw!\x8b\xf5{\xc7Xd\xf1\xf2}\x96EVf\xc9\xa8\xcd\xe4\xc9\x8d\x1d7\xd5\x94\\\xb5\r\xd2\xaa\xe6H\xfe)\xb3a\x04\x1eRMl\xa3F\xa8W0\x90\xc9Ky#\x03\xf5~\xd2Z\xe9(\x99\b\x00M\xde\x01]\r\xd09k\xc2\x84\xc1\xabN\x96\x8a6\x98@\xd3\xab\xa8m\xdf\x8d\x1d\b\x82\xfcP\x87\x93\x80\x97Q\x86\x8a\x9c\xf8L\x0f\xa8@VE2\x9d\x1e`#\xd8\xd7M\xd4k1\xe6\x13Y\\\x83E\xd0e\x0eM\xa9Q\xac\x0e\x1d]\a\x19H\x81\xd2\xccF\xc6\xd4\xe2R$\xfa\xd6}\xbdsN\x18\xdf\xf5\xffP\xf5\f\xccL\xef\x83\xb3$\xd4\xf4\xb5\xe6\xd0 \xb9\xa7\x8e6\t\x83q\xef\b\xd2\xdbIS6\xbf\xa2\xac\xbc\x88\x9c\xfb\x16\xdc-8i\x03\xd9\xac\xda[\xb8\xee\r!8\\a\x9e@\\\x81/cz\x8c{r\xb6*\x80\x1b\x81NH\xc8.\xc2z\x8eJN#\xde<\x92b\xc4\x8a\x03\x06\xc8\xb2\xd2\xa8\xeeO\x83\v\xc9\xa2C\x03\x9d\xbf6\x86\xb1\xe5\x1a%\xfdT\x8c\xe7z`%5(\x03\xb5a\xc3!s\x16', 0x3) r1 = socket(0x2, 0x2, 0x1) openat$auto_show_traces_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/available_tracers\x00', 0x210042, 0x0) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_4={0x1f, r1, 0x10000}, 0x10) 14.002141713s ago: executing program 3 (id=100): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = open(&(0x7f0000000000)='./file0\x00', 0x1052c2, 0xe1d2b27bdc14aabc) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/audio1\x00', 0x11d001, 0x0) ioctl$auto_SNDCTL_DSP_NONBLOCK(r1, 0x500e, 0x0) fcntl$auto(r0, 0x3, 0x1) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/run_estimation\x00', 0x88042, 0x0) write$auto_proc_sys_file_operations_proc_sysctl(r2, 0x0, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000040)=0x5) r3 = prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5) r4 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) syz_clone3(&(0x7f00000003c0)={0x2200, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) epoll_pwait2$auto(r4, 0x0, 0xffffffff, 0x0, 0x0, 0x8) setsockopt$auto_SO_RCVLOWAT(r3, 0x80000001, 0x12, &(0x7f0000000000)='+\x00', 0x800) r5 = openat$auto_memtype_fops_memtype(0xffffffffffffff9c, &(0x7f0000000080), 0x404202, 0x0) mmap$auto(0x6, 0x46, 0xdf, 0x8000000000eb1, r5, 0xdffffffffffffff7) r6 = ioctl$auto_TUNSETVNETBE2(r0, 0x400454de, &(0x7f0000000100)=0x7) fcntl$auto_F_GETSIG(r6, 0xb, 0x0) r7 = openat$auto_drm_debugfs_entry_fops_drm_debugfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/dri/vkms/internal_clients\x00', 0xa8201, 0x0) lseek$auto(r7, 0x9, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x5, 0xffffffffffff0005, 0x5) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x2, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x40) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) mount$auto(0x0, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000001c0)='\xa8t\x1c\x10\x81\xfdnfsd\x00}\xb0J\xd1v\x91\x9fp=\xc0\xca\xf2\xa0\b\x8a\xffa\xcb\xc2\x89D\xca#zZ\xac\xd6\xfazc\xc0\xa5\a,i\xb4\x02\xa6R\x13\xce~\x1a\xd59\xbf\x05\x00\x00\x00\x00\x00\x00\x00\x9c\x13\r\x91\x00\xbe\xe8\x01=\xbfwE\xe1\xbc\x00\xd7\xbe\a\xe1$\xc16.\x19\x8di\x02\xb2_\x9c\xd7&\xfd\xff\xde\xd8\xc9\xadD\x94|\x89\xc9Ot\xf3gq\x96\xd1\xe9\x98*\xad\xa5+\xa8\x1c\x88\xa1\x0e[\x99\xb6LKZ\x9e\r\xd0r\xe2Ct\xc1\x99\x1b/\xc5P.aUdq\x97\x94\xb9\xa8qU\xae*g\x86\xc9\xa4\xe7\n\vh-v\"o.\xbf6\x13\tFK\x8e\xc6&&\x13\x81\x00\x8c7PS\x9c\xa3\xfb\x1d\xa9\x98\xd47\n\xa7\xd1\x10\xb3i\xd2\xa8\x18f\xb3K\x9b\x9b\x8c\xe8\x84\xa3,5-\xd6\xae\xbd\x1d\xf2o\x99\x02\x1a:w9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\bl\x042\x935\x9e\xeeH\x87\xda\x10\x8f^1\x89L`\xf4[\x06\xf6\xc7\xd0#\xdb\xb1\\\xc3\xb1\xb8\xe8\xde2\xbb\xf8I\x9c\x17KI\x8c\f\x1d\xaa\xa0\xdb\xc7\x9e\x81\x90CTe\xfa\x8dq&\x17\x908\xc9T\xffm\x890\x1d\x91\xf8|t\xfd\x18\xd5\xb0\xcbH\xa7\xb6T\n\x11%\xba\x16o\r\xf6\xd0\x00\xc1\x1a\x1f\xaa8\xfbo)rtYK\"c\xe2c\xbeM\x9bT\x05\xf3\xccC\x8c\x00\xdf\x8c\x1b+\xca\x80\x00\x00\x00\xc3aB\xa0\xd7\xf8C\xde\xcc\xeaoNs\f\x86\x06<\x17\xcd\xd7\xf7\xc3\xba\xd0\xb9\x0e\xd0v\xeb\xe5$_\xd7\x9f\x8e\xac \x9a\xa3\xfd\x83(\xcc\xcd!%Kv\x13\xe9rR\xbc\xc1\x89\xd3vpA\x8a\xa6\xdc<\xaa\xdcsdCA\x19\xe3\xdf&\xea\x00f /X\xc6\x9b\xaa\x86\xa6\x8a\x80\xc0w\xb2S\xba\x9f\xef\xa5\xea\xff\x86\xb6l_M\x8b\xffj\xbc\x19\xa0\x81aBq\x85\x9b\xc4\x92\xc3\x87', 0x84, 0xe83) ioctl$auto(0x3, 0x40085400, 0x5) bpf$auto_BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=@bpf_attr_7={@start_id=0x7, 0x2, 0x10000, r2}, 0xac) mmap$auto(0x0, 0x4020009, 0x80000000df, 0xeb1, 0xffffffffffffffff, 0x8000) prctl$auto_PR_SET_MM_START_CODE(0x800, 0x1, 0x0, 0x1, 0xfff) setrlimit$auto(0x9, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000000000007ffe) io_setup$auto(0x7ffe, 0x0) 6.140633668s ago: executing program 3 (id=110): mmap$auto(0x0, 0x202000d, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) r0 = fsopen$auto(0x0, 0x1) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), r0) sendmsg$auto_NL80211_CMD_DEL_KEY(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',=\x00\x00', @ANYRES16=r1, @ANYBLOB="20002bbd7000ffdbdf250c00000008003700080000000600960001000000080061001f960000"], 0x2c}, 0x1, 0x0, 0x0, 0x30}, 0x2400c050) fsconfig$auto(r0, 0x3, &(0x7f0000000000)='Q**\x00', &(0x7f0000000040), 0x0) unshare$auto(0x40000080) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0xffffffffffffffff, 0x7) open(&(0x7f0000000140)='./file0\x00', 0x105b00, 0x4) socket(0xa, 0x801, 0x106) listen$auto(0x3, 0x83) setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x0) sysfs$auto(0x2, 0x5, 0x0) lseek$auto(0xffffffffffffffff, 0x8a05, 0x1) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) timerfd_create$auto(0x9, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) pwrite64$auto(0xc8, &(0x7f0000000480)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00\x00\x00\xfd\xfd\xd3\xd3\x1d\x00^\x0fo\x97\xfc\x89\v\xea\xc2\x95\xafQ;C>\x15L\x90\xad\xa4\x1648W\t\x00\x00\x001\x00\x00\x04@X\xb9_\xdd\xee\xc4\xd06,|\xfe.\xa6\x00\x00\x00\x00\x00\x00\x00\x1ch*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,,\x93\xba\x88\x93\xc6#\xe4\xaae\x9d\xb6\x1a\x7f\xc0%\xb0\rfOJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd0J}]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\b\x00\x00\x00wU&%`_[\xde\x7f\xde8\xf7\xc1\x94\xf2\xc1\"\xact\xee\xc9\x00\x00\x00\x00\x00\x00\x00\x00\xee\xa9\x0eX\x01\xa3g\xba\x9cc\x90\xe3\xae\xa9\xde\x84v\n\xcdN\xb6\xa4\xe0\xb7e\x97 ?\xb5\xa1E=t\x96\xbd\xfd\xc5\xebn\xb7\n\xc2\xbc\xa2\xa8\x04#\x84\xa7R}\xed\x8f\x03\x01\x10wLT\vay\x12\xb63\x9e\a\x8e\xbd\x18y<\xb3\v\x14\x82\x97&\xfcm\x86\x10o\xdc\xf3x\xfd\x06\x87t\xb9$\x94,f\x9b0\xcd\xd3\r\xb1e\'\x19\xc1\xe7>*\xad\xa5+\xa8\x1c\x88\xa1\x0e[\x99\xb6LKZ\x9e\r\xd0r\xe2Ct\xc1\x99\x1b/\xc5P.aUdq\x97\x94\xb9\xa8qU\xae*g\x86\xc9\xa4\xe7\n\vh-v\"o.\xbf6\x13\tFK\x8e\xc6&&\x13\x81\x00\x8c7PS\x9c\xa3\xfb\x1d\xa9\x98\xd47\n\xa7\xd1\x10\xb3i\xd2\xa8\x18f\xb3K\x9b\x9b\x8c\xe8\x84\xa3,5-\xd6\xae\xbd\x1d\xf2o\x99\x02\x1a:w9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\bl\x042\x935\x9e\xeeH\x87\xda\x10\x8f^1\x89L`\xf4[\x06\xf6\xc7\xd0#\xdb\xb1\\\xc3\xb1\xb8\xe8\xde2\xbb\xf8I\x9c\x17KI\x8c\f\x1d\xaa\xa0\xdb\xc7\x9e\x81\x90CTe\xfa\x8dq&\x17\x908\xc9T\xffm\x890\x1d\x91\xf8|t\xfd\x18\xd5\xb0\xcbH\xa7\xb6T\n\x11%\xba\x16o\r\xf6\xd0\x00\xc1\x1a\x1f\xaa8\xfbo)rtYK\"c\xe2c\xbeM\x9bT\x05\xf3\xccC\x8c\x00\xdf\x8c\x1b+\xca\x80\x00\x00\x00\xc3aB\xa0\xd7\xf8C\xde\xcc\xeaoNs\f\x86\x06<\x17\xcd\xd7\xf7\xc3\xba\xd0\xb9\x0e\xd0v\xeb\xe5$_\xd7\x9f\x8e\xac \x9a\xa3\xfd\x83(\xcc\xcd!%Kv\x13\xe9rR\xbc\xc1\x89\xd3vpA\x8a\xa6\xdc<\xaa\xdcsdCA\x19\xe3\xdf&\xea\x00f /X\xc6\x9b\xaa\x86\xa6\x8a\x80\xc0w\xb2S\xba\x9f\xef\xa5\xea\xff\x86\xb6l_M\x8b\xffj\xbc\x19\xa0\x81aBq\x85\x9b\xc4\x92\xc3\x87', 0x84, 0xe83) ioctl$auto(0x3, 0x40085400, 0x5) bpf$auto_BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=@bpf_attr_7={@start_id=0x7, 0x2, 0x10000, r2}, 0xac) mmap$auto(0x0, 0x4020009, 0x80000000df, 0xeb1, 0xffffffffffffffff, 0x8000) prctl$auto_PR_SET_MM_START_CODE(0x800, 0x1, 0x0, 0x1, 0xfff) setrlimit$auto(0x9, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000000000007ffe) io_setup$auto(0x7ffe, 0x0) 6.057476023s ago: executing program 2 (id=111): mmap$auto(0x0, 0x7, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000380)="7a47301037954c081c9a0bb84bb7b04ef84993eab91abe1686f43e43d786e964e8f04455bd620de9f3fb6d65e6c078c1a672c549dbc7876cb528ba081a81d884bfc00dd4eef57cedc0cc4156ff6a5b0aa8ba9511fe2b07c6e7f4732fe36ba218aa5b0ff402f2e6adb8ea60886c1e52c60d7d87e4c0551386501763ad098eb2b9602f83b2a643399f10dfdb0f4018b401be4db675d0acf8d348c26acf338cbe20fcb76439ca602a3c022f4463a8820f1c6f865d24e058af98f0c48bf552c3f6cc28c09d9054347db3c28701c67fa1e57d81b881638b518dd8e24969b7fd10406fcf6eb9bb66bf56ed7568510c72b380fa6efbca845bde90f7672708000000000000003513") mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_kmsg_fops_printk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) lseek$auto(0x3, 0x7fffffffffffffff, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) r1 = openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, 0x0, 0x1c1041, 0x0) write$auto_fuse_dev_operations_fuse_i(r1, &(0x7f0000000440)="110000000300"/17, 0x11) timer_create$auto(0x2, 0x0, 0x0) mmap$auto(0x0, 0x20009, 0xfff, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0x5, 0x0) openat$auto_force_wakeup_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/bluetooth/hci2/force_wakeup\x00', 0x8742, 0x0) r2 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0) clone$auto(0x20003b11, 0x8, 0x0, 0x0, 0x7) write$auto(r2, 0x0, 0xe) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) socket(0x10, 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xc, 0x0, 0x4) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x123002, 0x0) write$auto(r3, &(0x7f0000000080)='/dev/audio\x00', 0x80000000) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) execve$auto(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) execve$auto(&(0x7f0000000040)='./file0\x00', &(0x7f00000004c0)=&(0x7f0000000340)='#\xdc\xfe\xd8E\xc8\x8bu4\xd9n\xcb\xca\xc7zw \x96\x9ejh\xad\x9eEc\xae\x1e\x89\x92\x9a\xbbP[B\xae\x9cf)\x15\xac\x90)l\x06\xf0\t\x12\x05zz\xa6\xb3\xce=\x00\x00\x00\x00\x00/\xc4T\x1f\xe5P\xff\xb4\xb7s0\x02\xc5\x81\x93\xc6\xc8\xb6Sp\x1a{8\xfc\xe0,X\xc7BU\xd0\x97\x7f1\x16\x99\x04\xabu/a(\x02\x7f\xbb\xbd\x906\xa8\xce\xee\xcd\xd7\t\x00\xfb\x83\xc8\x8aO\xe9\xbe=\xf7\xf4\x84,\x06\xd3j\x99b\xe6\xf6Y3A\xbb\xa4\xb2\f\x1b\xc3\x8a,g\xc6\xe8[\xdf\x88\x01\x9f7\xb5\x19m\xd8L\x84j\x8c\xec\xdf\x1a\xbd\xc5\x94\xb9\xb7\xd5\xa4\xc0\f-6\xfe\xa8\xed/u\x81_G\xfeR\xbb\x12\x16\xb8*\xa9\xc9\xe81\x9d\x06\xbbC\x17\xbb\xe6|\x97\xabB4J\xed+-\xf8u0/n\xcf\x8b\x95\x9d\xab\xa8\xc47\xa6\x0e\xdeOq\\\xc3\'{\b\xd3m\x94\xc2\xdd{\xeaO\x0e\xe4\xe0\xb9N:\xd60\x17,\x06\xc7B#Y0\x99\xeb\x874\xab?\xc8\x82\xe5\x8f\xb7\x91\xc2\xbe\xb2\x02\xfe\xd3k\xd5\xdcZ\xdcP\x8e+\xd8\xc7C\xcb\x15\x13c\xbf\xe8\xbd\"\x8f3\"\x14\xf8(\xda\x19\xcd\xec\x03.\xd9^\xc3A\xda\r[\x1a\xda\\#/\xd4\xaf\xd0\xe8\xa2\xdd\xc5{\xfa\xe0\x90\x8f\x99lQ\xec\x84h^\x11+\x93\b\xe0c\xe6\xd22\xf9\xa5', 0x0) ioctl$auto_SNDCTL_DSP_SYNC(r3, 0x5001, 0x0) sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xffffffb8, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4044810}, 0x4000804) lstat$auto(0x0, &(0x7f0000000180)={0x11, 0x2, 0x0, 0x1000, 0x0, 0x0, 0x0, 0xfa98, 0xfffffffffffffffb, 0x7fffffffffffffff, 0x4, 0x100000007ffffffe, 0x7fffffffffff7ffb, 0x5f3, 0x7, 0x4, 0x6}) 5.481552638s ago: executing program 1 (id=112): openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000240)='/dev/radio18\x00', 0x8aa49, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000640)={0x0, 0x1, 0x3800, 0x2, 0x7, 0x400a, 0xffffffffffffffff, [], {0x7, 0xaaf, 0x8c48, 0x29b, 0x3, 0x7b, 0x0, 0x5, 0xfffffffffffffffa}, {0x100, 0x20001, 0x52, 0x85, 0x2, 0x1a7b8702, 0x2072c2, 0xc, 0xc80c}}) io_uring_register$auto(0x2, 0x20, &(0x7f0000000240), 0x1) 4.927266611s ago: executing program 2 (id=113): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x800008000) msync$auto(0x2, 0x8, 0x3) r0 = socket(0xa, 0x3, 0x3a) getsockopt$auto(r0, 0x29, 0x11, 0x0, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/pci_bus/0000:00/cpulistaffinity\x00', 0xc0200, 0x0) setresuid$auto(0x8, 0x8, 0x0) r1 = setfsuid$auto(0xee00) setreuid$auto(r1, 0x0) syz_genetlink_get_family_id$auto_net_shaper(&(0x7f0000000540), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'netdevsim0\x00'}) sendmsg$auto_NET_SHAPER_CMD_DELETE(0xffffffffffffffff, 0x0, 0xc050) fsconfig$auto(0xffffffffffffffff, 0x2, 0x0, &(0x7f0000000580), 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000280), r3) sendmsg$auto_NL80211_CMD_SET_HW_TIMESTAMP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r4, @ANYBLOB="200029bd7000fbdbdf009900000008009e000500000008001f0145090000d6c66a299281a9a31cec2addbc8c75dad7e4793f1a718c655a1307cc2503e632300e5ec4439b33530bcc2e2269abbcd274796f18b073df985e27db796dd19f84af43436513ef78e87b66"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000001840), 0xffffffffffffffff) clone3$auto(0x0, 0xfffffffffffffff8) sendmsg$auto_NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400d0}, 0x4000000) mmap$auto(0xc, 0x4000020009, 0x5, 0x14, 0xffffffffffffffff, 0x0) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) fsconfig$auto(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) socket(0x2, 0x5, 0x0) listen$auto(0x3, 0x83) 4.217757143s ago: executing program 1 (id=114): r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/security/tomoyo/profile\x00', 0x40802, 0x0) read$auto(r0, &(0x7f00000002c0)='N\xd5\f\xb9GC\x00\x00\x00\x00\x00\x00\x00\x00\xa3`\xb1\xf2\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xedKW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7 %\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1\x1f\xf7\xff\x7f\a\xd0\x83{_>/\xff', 0x280) write$auto(r0, &(0x7f0000000040)='-\x00\x00\x00\xfe\xff\xff\xff', 0x8587) 2.583405346s ago: executing program 1 (id=115): openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0xc0000, 0x0) r0 = openat$auto_proc_projid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/projid_map\x00', 0x181000, 0x0) mkdir$auto(&(0x7f00000001c0)='./cgroup/../file0\x00', 0x2) r1 = openat$auto_urandom_fops_random(0xffffffffffffff9c, &(0x7f0000000840), 0xc0000, 0x0) ioctl$auto_RNDADDTOENTCNT2(r1, 0x40045201, &(0x7f0000000880)=0x80000001) socket(0x2, 0x801, 0x100) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @empty}, 0x51) mmap$auto(0xa, 0x20009, 0x4000000000df, 0xffffffffffffc27d, r0, 0x8000) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x8100, 0x0) r2 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x80, 0x0) socket(0x15, 0x5, 0x0) write$auto(0xffffffffffffffff, &(0x7f0000000280)='9\x00d1L\xf0\x15\xba\xa17=(\x18\xdd\xff\xec\v\xb5^\xa1/[vv\x19\x00\x7f0\xa30\xc7\x9d\x1f]\xf8\xe04\xe7s\x9a\xd3H\xd3F\x819+\x90S\x10\xb2\b\xf8)\xe4IU\t\xb8\r\x9a\x8e\'Q\xfb\xb5I\x0f\x96;\xc7\\2V\x01g\xf8\xce\xbb\x9d\xa2c2\x00\x7f\xa1:\ax\xbc\x17\xde\x0e<\x00\x00\x00\x00\x00\x00\x00\x06\xc8\xf4\xdf\xcc\x9b\xd7D\xd7ARq', 0x40) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x0, 0x8002, 0x2) sysfs$auto(0x2, 0x44, 0x0) prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x9000, 0x8002, 0x2) getsockopt$auto(0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffffc, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/netdevsim/del_device\x00', 0x501, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000040)="3290b800009c550d22350f737ca2dd0af0d849aec832ec49c034169af8fa9231c143b1a8dd292977588a83400445ddc508f3aef64488936413adba3a9cc99bdfd8e7000000", 0x45) getsockopt$auto_SO_BSDCOMPAT(r2, 0x78, 0xe, &(0x7f00000000c0)='/sys/bus/netdevsim/del_device\x00', &(0x7f0000000100)=0xff) r4 = openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cec10\x00', 0x40, 0x0) syz_clone3(&(0x7f00000004c0)={0x2000000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket(0x2d, 0x2, 0x0) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0) semtimedop$auto(0x0, &(0x7f0000000000)={0x807, 0x6, 0x36ec}, 0x1, 0x0) recvfrom$auto(r4, &(0x7f0000000040)="8e6f00e6d2cd95290a26f1611374476afdbbeec479f5caa8881028931ff174ecb907503b2d017f857a65337f9d9be31c05c9425e925ad2d026ee85bfcaa167e3d36078be674a6fbc117d2d9ff05398fbb5687c1efd303068ae4fa25ac20f1fcc41338e7c6846019da13656f216c773b88f540e4561796c1ce89c0afd481affde154d0919008976ab", 0x1, 0x0, &(0x7f0000000100)=@can, &(0x7f0000000140)=0x5) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/virtual/block/ram1/queue/atomic_write_unit_max_bytes\x00', 0x123000, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f00000000c0)=""/48, 0x30) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/conf/veth1_to_team/ignore_routes_with_linkdown\x00', 0x80801, 0x0) 2.287754143s ago: executing program 2 (id=116): mmap$auto(0x0, 0x402200d, 0xdf, 0xeb1, 0x401, 0x8000) sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010329bd700002dcdf25050000000c00010000000100000000000c00010005"], 0x2c}, 0x1, 0x0, 0x0, 0x20008810}, 0x81) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) r0 = socket(0x2, 0x3, 0x100) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sysfs$auto(0x2, 0x27, 0x6) r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vbi7\x00', 0x40040, 0x0) ioctl$auto(r1, 0xc0445624, r1) r2 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$auto_NL802154_CMD_SET_MAX_ASSOCIATIONS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r2, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_IFNAME={0x14, 0x4, 'macvlan1\x00'}, @NL802154_ATTR_MAX_ASSOCIATIONS={0x8, 0x27, 0xfffff800}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) openat$auto_nsim_dev_take_snapshot_fops_dev(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim0/take_snapshot\x00', 0x224080, 0x0) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a00010000000000000000000600070001000000"], 0x68}, 0x1, 0x0, 0x0, 0x4044080}, 0x40090) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004) pread64$auto(0xffffffffffffffff, &(0x7f0000000480)='\x00', 0x8312, 0x2f49) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x0, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x9}, 0x7}, 0x3, 0x0) close_range$auto(0xffffffffffffffff, r0, 0x2) 1.682856621s ago: executing program 2 (id=117): r0 = fanotify_init$auto(0x8, 0x2000000000002) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) signalfd4$auto(0xffffffffffffffff, 0x0, 0x8, 0x800) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/pm_async\x00', 0x48040, 0x0) socket(0x10, 0x3, 0x6) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty1\x00', 0x40, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/mountinfo\x00', 0x28c40, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x101001, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyr0\x00', 0x6a500, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = pipe2$auto(0x0, 0x0) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), r1) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x400008, 0x3, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0x2, 0x0) r4 = fsopen$auto(0x0, 0x1) fsconfig$auto(r4, 0x8, 0x0, 0x0, 0x0) fsmount$auto(0x4, 0x0, 0x200003) r5 = ioctl$auto_NS_GET_TGID_IN_PIDNS(r0, 0x8004b709, &(0x7f0000000100)=0x11) sendmsg$auto_NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002a1a7000ffdbdf25440000000400370104004a0106009500060000000400b800040016010c005a8008005000", @ANYRES32=r5, @ANYBLOB="060014019e02000005008a001e000000"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4004000) close_range$auto(0x2, 0x8, 0x0) openat$auto_suspend_stats_fops_(0xffffffffffffff9c, &(0x7f0000000280), 0x400000, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ptyd8\x00', 0x480, 0x0) r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0) r7 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/fs/cifs/dfscache\x00', 0x101000, 0x0) pread64$auto(r7, 0x0, 0x8, 0x75e8) ioctl$auto_TIOCSETD2(r6, 0x5423, 0x0) ioctl$auto(0x3, 0x540b, 0x10000000000402) 348.348272ms ago: executing program 3 (id=118): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = open(&(0x7f0000000000)='./file0\x00', 0x1052c2, 0xe1d2b27bdc14aabc) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/audio1\x00', 0x11d001, 0x0) ioctl$auto_SNDCTL_DSP_NONBLOCK(r1, 0x500e, 0x0) fcntl$auto(r0, 0x3, 0x1) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/run_estimation\x00', 0x88042, 0x0) write$auto_proc_sys_file_operations_proc_sysctl(r2, 0x0, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000040)=0x5) r3 = prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5) r4 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) syz_clone3(&(0x7f00000003c0)={0x2200, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) epoll_pwait2$auto(r4, 0x0, 0xffffffff, 0x0, 0x0, 0x8) setsockopt$auto_SO_RCVLOWAT(r3, 0x80000001, 0x12, &(0x7f0000000000)='+\x00', 0x800) r5 = openat$auto_memtype_fops_memtype(0xffffffffffffff9c, &(0x7f0000000080), 0x404202, 0x0) mmap$auto(0x6, 0x46, 0xdf, 0x8000000000eb1, r5, 0xdffffffffffffff7) r6 = ioctl$auto_TUNSETVNETBE2(r0, 0x400454de, &(0x7f0000000100)=0x7) fcntl$auto_F_GETSIG(r6, 0xb, 0x0) r7 = openat$auto_drm_debugfs_entry_fops_drm_debugfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/dri/vkms/internal_clients\x00', 0xa8201, 0x0) lseek$auto(r7, 0x9, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x5, 0xffffffffffff0005, 0x5) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x2, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x40) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) mount$auto(0x0, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000001c0)='\xa8t\x1c\x10\x81\xfdnfsd\x00}\xb0J\xd1v\x91\x9fp=\xc0\xca\xf2\xa0\b\x8a\xffa\xcb\xc2\x89D\xca#zZ\xac\xd6\xfazc\xc0\xa5\a,i\xb4\x02\xa6R\x13\xce~\x1a\xd59\xbf\x05\x00\x00\x00\x00\x00\x00\x00\x9c\x13\r\x91\x00\xbe\xe8\x01=\xbfwE\xe1\xbc\x00\xd7\xbe\a\xe1$\xc16.\x19\x8di\x02\xb2_\x9c\xd7&\xfd\xff\xde\xd8\xc9\xadD\x94|\x89\xc9Ot\xf3gq\x96\xd1\xe9\x98*\xad\xa5+\xa8\x1c\x88\xa1\x0e[\x99\xb6LKZ\x9e\r\xd0r\xe2Ct\xc1\x99\x1b/\xc5P.aUdq\x97\x94\xb9\xa8qU\xae*g\x86\xc9\xa4\xe7\n\vh-v\"o.\xbf6\x13\tFK\x8e\xc6&&\x13\x81\x00\x8c7PS\x9c\xa3\xfb\x1d\xa9\x98\xd47\n\xa7\xd1\x10\xb3i\xd2\xa8\x18f\xb3K\x9b\x9b\x8c\xe8\x84\xa3,5-\xd6\xae\xbd\x1d\xf2o\x99\x02\x1a:w9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\bl\x042\x935\x9e\xeeH\x87\xda\x10\x8f^1\x89L`\xf4[\x06\xf6\xc7\xd0#\xdb\xb1\\\xc3\xb1\xb8\xe8\xde2\xbb\xf8I\x9c\x17KI\x8c\f\x1d\xaa\xa0\xdb\xc7\x9e\x81\x90CTe\xfa\x8dq&\x17\x908\xc9T\xffm\x890\x1d\x91\xf8|t\xfd\x18\xd5\xb0\xcbH\xa7\xb6T\n\x11%\xba\x16o\r\xf6\xd0\x00\xc1\x1a\x1f\xaa8\xfbo)rtYK\"c\xe2c\xbeM\x9bT\x05\xf3\xccC\x8c\x00\xdf\x8c\x1b+\xca\x80\x00\x00\x00\xc3aB\xa0\xd7\xf8C\xde\xcc\xeaoNs\f\x86\x06<\x17\xcd\xd7\xf7\xc3\xba\xd0\xb9\x0e\xd0v\xeb\xe5$_\xd7\x9f\x8e\xac \x9a\xa3\xfd\x83(\xcc\xcd!%Kv\x13\xe9rR\xbc\xc1\x89\xd3vpA\x8a\xa6\xdc<\xaa\xdcsdCA\x19\xe3\xdf&\xea\x00f /X\xc6\x9b\xaa\x86\xa6\x8a\x80\xc0w\xb2S\xba\x9f\xef\xa5\xea\xff\x86\xb6l_M\x8b\xffj\xbc\x19\xa0\x81aBq\x85\x9b\xc4\x92\xc3\x87', 0x84, 0xe83) ioctl$auto(0x3, 0x40085400, 0x5) bpf$auto_BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=@bpf_attr_7={@start_id=0x7, 0x2, 0x10000, r2}, 0xac) mmap$auto(0x0, 0x4020009, 0x80000000df, 0xeb1, 0xffffffffffffffff, 0x8000) prctl$auto_PR_SET_MM_START_CODE(0x800, 0x1, 0x0, 0x1, 0xfff) setrlimit$auto(0x9, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000000000007ffe) io_setup$auto(0x7ffe, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.193' (ED25519) to the list of known hosts. [ 85.344567][ T5622] cgroup: Unknown subsys name 'net' [ 85.484015][ T5622] cgroup: Unknown subsys name 'cpuset' [ 85.493139][ T5622] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 87.446597][ T5622] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 89.707587][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.719080][ T5635] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.729900][ T5635] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.741892][ T5635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.750562][ T5635] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.825504][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 89.835301][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 89.843571][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 89.852065][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 89.859910][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 89.956908][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 89.970146][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 89.979712][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 89.988253][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 90.001763][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.032600][ T5635] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 90.044077][ T5635] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 90.052585][ T5635] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 90.061498][ T5635] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.071318][ T5635] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 91.563268][ T5633] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.571001][ T5633] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.579331][ T5633] bridge_slave_0: entered allmulticast mode [ 91.586906][ T5633] bridge_slave_0: entered promiscuous mode [ 91.628927][ T5633] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.636196][ T5633] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.643922][ T5633] bridge_slave_1: entered allmulticast mode [ 91.654450][ T5633] bridge_slave_1: entered promiscuous mode [ 91.741612][ T5646] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.749085][ T5646] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.756404][ T5646] bridge_slave_0: entered allmulticast mode [ 91.764077][ T5646] bridge_slave_0: entered promiscuous mode [ 91.774930][ T5633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.804361][ T5646] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.812440][ T5646] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.819768][ T5646] bridge_slave_1: entered allmulticast mode [ 91.827232][ T5646] bridge_slave_1: entered promiscuous mode [ 91.837015][ T5633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.849068][ T50] Bluetooth: hci0: command tx timeout [ 91.919198][ T50] Bluetooth: hci1: command tx timeout [ 91.963053][ T5646] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.975189][ T5633] team0: Port device team_slave_0 added [ 91.981471][ T5637] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.989713][ T5637] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.996928][ T5637] bridge_slave_0: entered allmulticast mode [ 92.004603][ T5637] bridge_slave_0: entered promiscuous mode [ 92.021061][ T1224] cfg80211: failed to load regulatory.db [ 92.032968][ T5646] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.044780][ T5633] team0: Port device team_slave_1 added [ 92.062204][ T5637] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.069947][ T5637] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.077152][ T5637] bridge_slave_1: entered allmulticast mode [ 92.079410][ T50] Bluetooth: hci2: command tx timeout [ 92.089695][ T5637] bridge_slave_1: entered promiscuous mode [ 92.158921][ T50] Bluetooth: hci3: command tx timeout [ 92.190844][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.197934][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.224406][ T5633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.245430][ T5637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.254827][ T5642] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.262497][ T5642] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.269954][ T5642] bridge_slave_0: entered allmulticast mode [ 92.277708][ T5642] bridge_slave_0: entered promiscuous mode [ 92.288271][ T5646] team0: Port device team_slave_0 added [ 92.294697][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.301892][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.328517][ T5633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.341966][ T5637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.351523][ T5642] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.359413][ T5642] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.366645][ T5642] bridge_slave_1: entered allmulticast mode [ 92.374276][ T5642] bridge_slave_1: entered promiscuous mode [ 92.383207][ T5646] team0: Port device team_slave_1 added [ 92.477517][ T5646] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.485968][ T5646] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.512090][ T5646] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.525767][ T5637] team0: Port device team_slave_0 added [ 92.534806][ T5642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.556303][ T5646] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.563353][ T5646] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.589680][ T5646] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.604100][ T5637] team0: Port device team_slave_1 added [ 92.612484][ T5642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.672285][ T5633] hsr_slave_0: entered promiscuous mode [ 92.679094][ T5633] hsr_slave_1: entered promiscuous mode [ 92.723628][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.730900][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.756951][ T5637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.772606][ T5642] team0: Port device team_slave_0 added [ 92.803049][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.810328][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.836602][ T5637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.850293][ T5642] team0: Port device team_slave_1 added [ 92.870789][ T5646] hsr_slave_0: entered promiscuous mode [ 92.877314][ T5646] hsr_slave_1: entered promiscuous mode [ 92.883764][ T5646] debugfs: 'hsr0' already exists in 'hsr' [ 92.889656][ T5646] Cannot create hsr debugfs directory [ 92.988143][ T5642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.995598][ T5642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.022325][ T5642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.068268][ T5642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.075599][ T5642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.102507][ T5642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.154185][ T5637] hsr_slave_0: entered promiscuous mode [ 93.160826][ T5637] hsr_slave_1: entered promiscuous mode [ 93.167477][ T5637] debugfs: 'hsr0' already exists in 'hsr' [ 93.173599][ T5637] Cannot create hsr debugfs directory [ 93.313034][ T5642] hsr_slave_0: entered promiscuous mode [ 93.320901][ T5642] hsr_slave_1: entered promiscuous mode [ 93.327105][ T5642] debugfs: 'hsr0' already exists in 'hsr' [ 93.333421][ T5642] Cannot create hsr debugfs directory [ 93.660863][ T5633] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.674357][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.697487][ T5633] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.708768][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.717077][ T5633] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.729539][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.737498][ T5633] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.751134][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.851915][ T5646] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 93.867517][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.884806][ T5646] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 93.899021][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.907128][ T5646] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 93.917866][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.918854][ T50] Bluetooth: hci0: command tx timeout [ 93.935494][ T5646] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.946048][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.999034][ T50] Bluetooth: hci1: command tx timeout [ 94.060200][ T5642] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 94.073197][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.083858][ T5642] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 94.097348][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.105622][ T5642] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 94.116687][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.133334][ T5642] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 94.144014][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.159356][ T50] Bluetooth: hci2: command tx timeout [ 94.227799][ T5633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.239738][ T50] Bluetooth: hci3: command tx timeout [ 94.300627][ T5637] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 94.313245][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.332307][ T5637] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 94.342896][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.354789][ T5633] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.369099][ T5637] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 94.379434][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.387844][ T5637] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 94.397604][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.421899][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.429588][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.464143][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.471384][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.526188][ T5646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.609726][ T5646] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.650871][ T1171] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.658038][ T1171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.706977][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.714263][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.773021][ T5642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.863481][ T5642] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.897226][ T5637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.920894][ T3281] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.928117][ T3281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.971975][ T3281] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.979234][ T3281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.014397][ T5637] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.061208][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.069103][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.115283][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.122540][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.785731][ T5633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.969781][ T5633] veth0_vlan: entered promiscuous mode [ 95.998977][ T50] Bluetooth: hci0: command tx timeout [ 96.034425][ T5633] veth1_vlan: entered promiscuous mode [ 96.079937][ T50] Bluetooth: hci1: command tx timeout [ 96.120531][ T5633] veth0_macvtap: entered promiscuous mode [ 96.145760][ T5633] veth1_macvtap: entered promiscuous mode [ 96.215262][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.239245][ T50] Bluetooth: hci2: command tx timeout [ 96.295519][ T5646] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.317088][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.329265][ T50] Bluetooth: hci3: command tx timeout [ 96.362819][ T5642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.394329][ T1171] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.407064][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.433635][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.446188][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.541361][ T5637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.623122][ T5646] veth0_vlan: entered promiscuous mode [ 96.662488][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.683903][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.728096][ T5646] veth1_vlan: entered promiscuous mode [ 96.747861][ T5642] veth0_vlan: entered promiscuous mode [ 96.773826][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.784454][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.806088][ T5642] veth1_vlan: entered promiscuous mode [ 96.877631][ T5637] veth0_vlan: entered promiscuous mode [ 96.886712][ T5646] veth0_macvtap: entered promiscuous mode [ 96.906964][ T5646] veth1_macvtap: entered promiscuous mode [ 96.931786][ T5633] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 96.955118][ T5637] veth1_vlan: entered promiscuous mode [ 96.974876][ T5642] veth0_macvtap: entered promiscuous mode [ 96.987976][ T5646] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.014559][ T5642] veth1_macvtap: entered promiscuous mode [ 97.037842][ T5646] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.093014][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.105267][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.123918][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.133431][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.153461][ T5642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.201204][ T5642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.225657][ T5637] veth0_macvtap: entered promiscuous mode [ 97.234725][ T3312] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.277931][ T5637] veth1_macvtap: entered promiscuous mode [ 97.304865][ T3312] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.315022][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.351671][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.367752][ T5782] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 97.447091][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.455350][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.470820][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.524223][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.613084][ T3372] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.628167][ T3372] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.645304][ T1171] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.695983][ T1171] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.721125][ T1171] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.774225][ T1171] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.801189][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.832249][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.078859][ T50] Bluetooth: hci0: command tx timeout [ 98.111798][ T3312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.130958][ T3312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.159252][ T50] Bluetooth: hci1: command tx timeout [ 98.264169][ T1171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.299327][ T1171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.319926][ T50] Bluetooth: hci2: command tx timeout [ 98.399159][ T50] Bluetooth: hci3: command tx timeout [ 98.410309][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.456687][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.935975][ T5798] ubi0: attaching mtd0 [ 98.987384][ T5798] ubi0: scanning is finished [ 98.999653][ T5798] ubi0: empty MTD device detected [ 99.315638][ T5792] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.655861][ T5798] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 99.678019][ T5798] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 99.703302][ T5798] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 99.718891][ T5798] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 99.814401][ T5798] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 99.899069][ T5798] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 99.917966][ T5798] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3343160950 [ 100.017396][ T5798] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 100.119695][ T5810] ubi0: background thread "ubi_bgt0d" started, PID 5810 [ 100.153162][ T5792] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.393379][ T5792] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.578094][ T5792] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.748861][ T5833] ubi: mtd0 is already attached to ubi0 [ 102.851554][ T5836] ubi0: detaching mtd0 [ 102.899591][ T5836] ubi0: mtd0 is detached [ 103.260462][ T5818] kexec: Could not allocate control_code_buffer [ 105.676202][ T5859] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 116.039797][ T5961] smpboot: CPU 1 is now offline [ 119.373043][ T5998] FAULT_INJECTION: forcing a failure. [ 119.373043][ T5998] name fail_futex, interval 1, probability 0, space 0, times 1 [ 119.446861][ T5998] CPU: 0 UID: 0 PID: 5998 Comm: syz.3.54 Not tainted syzkaller #0 PREEMPT(full) [ 119.446901][ T5998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.446924][ T5998] Call Trace: [ 119.446933][ T5998] [ 119.446941][ T5998] dump_stack_lvl+0x100/0x190 [ 119.446976][ T5998] should_fail_ex.cold+0x5/0xa [ 119.447006][ T5998] get_futex_key+0x295/0x1510 [ 119.447034][ T5998] ? __pfx_get_futex_key+0x10/0x10 [ 119.447060][ T5998] ? kasan_save_track+0x14/0x30 [ 119.447083][ T5998] ? __kasan_kmalloc+0xaa/0xb0 [ 119.447110][ T5998] futex_lock_pi+0x1d2/0x7a0 [ 119.447145][ T5998] ? __pfx_futex_lock_pi+0x10/0x10 [ 119.447189][ T5998] ? __pfx_try_to_wake_up+0x10/0x10 [ 119.447229][ T5998] ? futex_private_hash_put+0x107/0x1c0 [ 119.447257][ T5998] ? __pfx_futex_wake_mark+0x10/0x10 [ 119.447295][ T5998] ? __get_user_nocheck_8+0x20/0x20 [ 119.447326][ T5998] ? do_vfs_ioctl+0x226/0x13e0 [ 119.447353][ T5998] do_futex+0x18a/0x350 [ 119.447380][ T5998] ? __pfx_do_futex+0x10/0x10 [ 119.447407][ T5998] ? find_held_lock+0x2b/0x80 [ 119.447443][ T5998] __x64_sys_futex+0x34f/0x4d0 [ 119.447473][ T5998] ? __pfx___x64_sys_futex+0x10/0x10 [ 119.447505][ T5998] ? rcu_is_watching+0x12/0xc0 [ 119.447541][ T5998] do_syscall_64+0x10b/0xf80 [ 119.447576][ T5998] ? clear_bhb_loop+0x40/0x90 [ 119.447604][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.447628][ T5998] RIP: 0033:0x7f05a2b9ce59 [ 119.447652][ T5998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.447678][ T5998] RSP: 002b:00007f05a3aca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 119.447703][ T5998] RAX: ffffffffffffffda RBX: 00007f05a2e16090 RCX: 00007f05a2b9ce59 [ 119.447719][ T5998] RDX: 0000000000000008 RSI: 0000000000000006 RDI: 0000000000000000 [ 119.447732][ T5998] RBP: 00007f05a2c32d6f R08: 0000000000000000 R09: 000000008000fff5 [ 119.447747][ T5998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.447761][ T5998] R13: 00007f05a2e16128 R14: 00007f05a2e16090 R15: 00007fffa6d0cdd8 [ 119.447790][ T5998] [ 120.409293][ T50] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 122.653779][ T6030] ubi0: attaching mtd0 [ 122.700083][ T6030] ubi0: scanning is finished [ 123.170821][ T6030] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 123.265151][ T6030] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 123.401097][ T6030] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 123.540533][ T6030] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 123.671244][ T6030] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 123.792282][ T6030] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 123.948190][ T6030] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3343160950 [ 124.128503][ T6030] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 124.293590][ T6037] ubi0: detaching mtd0 [ 124.300819][ T6043] ubi0: background thread "ubi_bgt0d" started, PID 6043 [ 124.447621][ T6037] ubi0: mtd0 is detached [ 125.765720][ T6059] FAULT_INJECTION: forcing a failure. [ 125.765720][ T6059] name failslab, interval 1, probability 0, space 0, times 0 [ 126.098640][ T6059] CPU: 0 UID: 0 PID: 6059 Comm: syz.2.67 Tainted: G L syzkaller #0 PREEMPT(full) [ 126.098678][ T6059] Tainted: [L]=SOFTLOCKUP [ 126.098685][ T6059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 126.098699][ T6059] Call Trace: [ 126.098706][ T6059] [ 126.098714][ T6059] dump_stack_lvl+0x100/0x190 [ 126.098744][ T6059] should_fail_ex.cold+0x5/0xa [ 126.098774][ T6059] should_failslab+0xc2/0x120 [ 126.098802][ T6059] __kmalloc_cache_noprof+0x7a/0x6f0 [ 126.098836][ T6059] ? refill_pi_state_cache+0x91/0x260 [ 126.098890][ T6059] refill_pi_state_cache+0x91/0x260 [ 126.098937][ T6059] futex_lock_pi+0x16d/0x7a0 [ 126.098970][ T6059] ? __pfx_futex_lock_pi+0x10/0x10 [ 126.099002][ T6059] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 126.099059][ T6059] ? __pfx_futex_wake_mark+0x10/0x10 [ 126.099096][ T6059] ? __get_user_nocheck_8+0x20/0x20 [ 126.099125][ T6059] ? do_vfs_ioctl+0x226/0x13e0 [ 126.099157][ T6059] do_futex+0x18a/0x350 [ 126.099203][ T6059] ? __pfx_do_futex+0x10/0x10 [ 126.099231][ T6059] ? find_held_lock+0x2b/0x80 [ 126.099267][ T6059] __x64_sys_futex+0x34f/0x4d0 [ 126.099297][ T6059] ? __pfx___x64_sys_futex+0x10/0x10 [ 126.099330][ T6059] ? rcu_is_watching+0x12/0xc0 [ 126.099377][ T6059] do_syscall_64+0x10b/0xf80 [ 126.099411][ T6059] ? clear_bhb_loop+0x40/0x90 [ 126.099438][ T6059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.099462][ T6059] RIP: 0033:0x7ff25219ce59 [ 126.099480][ T6059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.099502][ T6059] RSP: 002b:00007ff253021028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 126.099523][ T6059] RAX: ffffffffffffffda RBX: 00007ff252416090 RCX: 00007ff25219ce59 [ 126.099538][ T6059] RDX: 0000000000000008 RSI: 0000000000000006 RDI: 0000000000000000 [ 126.099551][ T6059] RBP: 00007ff252232d6f R08: 0000000000000000 R09: 000000008000fff5 [ 126.099565][ T6059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.099578][ T6059] R13: 00007ff252416128 R14: 00007ff252416090 R15: 00007ffef9065c78 [ 126.099607][ T6059] [ 126.847322][ T6054] kexec: Could not allocate control_code_buffer [ 127.285212][ T6064] syz.0.68 (6064) used greatest stack depth: 19720 bytes left [ 128.188241][ T6081] ubi0: attaching mtd0 [ 128.334287][ T6081] ubi0: scanning is finished [ 128.999803][ T6081] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 129.176206][ T6081] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 129.390237][ T6081] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 129.589966][ T6081] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 129.802598][ T6081] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 130.011266][ T6081] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 130.260474][ T6081] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3343160950 [ 130.506945][ T6081] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 130.752502][ T6088] ubi0: background thread "ubi_bgt0d" started, PID 6088 [ 130.760596][ T6085] ubi0: detaching mtd0 [ 130.944433][ T6085] ubi0: mtd0 is detached [ 131.110961][ T6098] ubi0: attaching mtd0 [ 131.219736][ T6107] FAULT_INJECTION: forcing a failure. [ 131.219736][ T6107] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 131.260294][ T6098] ubi0: scanning is finished [ 131.408176][ T6107] CPU: 0 UID: 0 PID: 6107 Comm: syz.1.76 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.408211][ T6107] Tainted: [L]=SOFTLOCKUP [ 131.408219][ T6107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 131.408232][ T6107] Call Trace: [ 131.408239][ T6107] [ 131.408247][ T6107] dump_stack_lvl+0x100/0x190 [ 131.408276][ T6107] should_fail_ex.cold+0x5/0xa [ 131.408304][ T6107] _copy_to_user+0x32/0xd0 [ 131.408328][ T6107] simple_read_from_buffer+0xcb/0x170 [ 131.408360][ T6107] proc_fail_nth_read+0x1af/0x230 [ 131.408396][ T6107] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 131.408434][ T6107] ? rw_verify_area+0xce/0x6d0 [ 131.408456][ T6107] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 131.408492][ T6107] vfs_read+0x1e4/0xb30 [ 131.408539][ T6107] ? __pfx_vfs_read+0x10/0x10 [ 131.408563][ T6107] ? __fget_files+0x215/0x3d0 [ 131.408596][ T6107] ? __fget_files+0x21f/0x3d0 [ 131.408635][ T6107] ksys_read+0x12a/0x250 [ 131.408659][ T6107] ? __pfx_ksys_read+0x10/0x10 [ 131.408686][ T6107] ? rcu_is_watching+0x12/0xc0 [ 131.408717][ T6107] do_syscall_64+0x10b/0xf80 [ 131.408761][ T6107] ? clear_bhb_loop+0x40/0x90 [ 131.408788][ T6107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.408810][ T6107] RIP: 0033:0x7fbedc15d68e [ 131.408828][ T6107] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 131.408848][ T6107] RSP: 002b:00007fbedd0fdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 131.408868][ T6107] RAX: ffffffffffffffda RBX: 00007fbedd0fe6c0 RCX: 00007fbedc15d68e [ 131.408882][ T6107] RDX: 000000000000000f RSI: 00007fbedd0fe0a0 RDI: 0000000000000004 [ 131.408895][ T6107] RBP: 00007fbedd0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 131.408907][ T6107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.408920][ T6107] R13: 00007fbedc416038 R14: 00007fbedc415fa0 R15: 00007ffffd0d77d8 [ 131.408947][ T6107] [ 132.829480][ T6098] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 132.965884][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.976407][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.985619][ T6098] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 133.121061][ T6098] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 133.255633][ T6098] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 133.411908][ T6098] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 133.557143][ T6098] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 133.699164][ T6098] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3343160950 [ 133.868640][ T6098] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 134.026152][ T6114] ubi0: background thread "ubi_bgt0d" started, PID 6114 [ 135.889107][ T6143] FAULT_INJECTION: forcing a failure. [ 135.889107][ T6143] name failslab, interval 1, probability 0, space 0, times 0 [ 136.348049][ T6143] CPU: 0 UID: 0 PID: 6143 Comm: syz.1.81 Tainted: G L syzkaller #0 PREEMPT(full) [ 136.348085][ T6143] Tainted: [L]=SOFTLOCKUP [ 136.348093][ T6143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 136.348120][ T6143] Call Trace: [ 136.348127][ T6143] [ 136.348136][ T6143] dump_stack_lvl+0x100/0x190 [ 136.348168][ T6143] should_fail_ex.cold+0x5/0xa [ 136.348195][ T6143] ? tomoyo_realpath_from_path+0xb6/0x690 [ 136.348226][ T6143] should_failslab+0xc2/0x120 [ 136.348264][ T6143] __kmalloc_noprof+0xe0/0x850 [ 136.348283][ T6143] ? kfree+0x1dd/0x6c0 [ 136.348319][ T6143] tomoyo_realpath_from_path+0xb6/0x690 [ 136.348359][ T6143] tomoyo_path_number_perm+0x23c/0x580 [ 136.348382][ T6143] ? tomoyo_path_number_perm+0x22e/0x580 [ 136.348408][ T6143] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 136.348461][ T6143] ? find_held_lock+0x2b/0x80 [ 136.348491][ T6143] ? __fget_files+0x215/0x3d0 [ 136.348517][ T6143] ? hook_file_ioctl_common+0x149/0x410 [ 136.348542][ T6143] ? __fget_files+0x215/0x3d0 [ 136.348573][ T6143] ? __fget_files+0x21f/0x3d0 [ 136.348604][ T6143] security_file_ioctl+0xd3/0x230 [ 136.348630][ T6143] __x64_sys_ioctl+0xb7/0x210 [ 136.348656][ T6143] do_syscall_64+0x10b/0xf80 [ 136.348690][ T6143] ? clear_bhb_loop+0x40/0x90 [ 136.348718][ T6143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.348741][ T6143] RIP: 0033:0x7fbedc19ce59 [ 136.348759][ T6143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.348787][ T6143] RSP: 002b:00007fbedd0dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 136.348809][ T6143] RAX: ffffffffffffffda RBX: 00007fbedc416090 RCX: 00007fbedc19ce59 [ 136.348828][ T6143] RDX: 0000200000000040 RSI: 0000000000005412 RDI: 0000000000000004 [ 136.348843][ T6143] RBP: 00007fbedd0dd090 R08: 0000000000000000 R09: 0000000000000000 [ 136.348856][ T6143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.348870][ T6143] R13: 00007fbedc416128 R14: 00007fbedc416090 R15: 00007ffffd0d77d8 [ 136.348899][ T6143] [ 140.232905][ T6143] ERROR: Out of memory at tomoyo_realpath_from_path. [ 142.446525][ T6191] sg_write: data in/out 262108/45 bytes for SCSI command 0x61-- guessing data in; [ 142.446525][ T6191] program syz.1.86 not setting count and/or reply_len properly [ 144.143206][ T6215] ubi: mtd0 is already attached to ubi0 [ 144.294269][ T6215] ubi0: detaching mtd0 [ 144.429500][ T6215] ubi0: mtd0 is detached [ 144.544826][ T6224] ubi0: attaching mtd0 [ 144.662582][ T6224] ubi0: scanning is finished [ 145.237216][ T6224] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 145.409899][ T6224] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 145.610514][ T6224] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 145.814722][ T6224] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 146.029639][ T6224] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 146.214605][ T6224] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 146.382768][ T6224] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3343160950 [ 146.532399][ T6233] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 146.609827][ T6224] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 146.818177][ T6234] ubi0: background thread "ubi_bgt0d" started, PID 6234 [ 146.825717][ T6229] ubi0: detaching mtd0 [ 147.062960][ T6229] ubi0: mtd0 is detached [ 149.320293][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 149.333441][ T5635] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 149.343033][ T5635] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 149.358469][ T5635] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 149.367583][ T5635] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 150.133509][ T6275] FAULT_INJECTION: forcing a failure. [ 150.133509][ T6275] name fail_futex, interval 1, probability 0, space 0, times 0 [ 150.305554][ T6275] CPU: 0 UID: 0 PID: 6275 Comm: syz.2.104 Tainted: G L syzkaller #0 PREEMPT(full) [ 150.305593][ T6275] Tainted: [L]=SOFTLOCKUP [ 150.305601][ T6275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 150.305615][ T6275] Call Trace: [ 150.305623][ T6275] [ 150.305631][ T6275] dump_stack_lvl+0x100/0x190 [ 150.305662][ T6275] should_fail_ex.cold+0x5/0xa [ 150.305693][ T6275] get_futex_key+0x1d2/0x1510 [ 150.305720][ T6275] ? __pfx_get_futex_key+0x10/0x10 [ 150.305746][ T6275] ? kasan_save_track+0x14/0x30 [ 150.305770][ T6275] ? __kasan_kmalloc+0xaa/0xb0 [ 150.305797][ T6275] futex_lock_pi+0x1d2/0x7a0 [ 150.305832][ T6275] ? __pfx_futex_lock_pi+0x10/0x10 [ 150.305876][ T6275] ? __pfx_try_to_wake_up+0x10/0x10 [ 150.305915][ T6275] ? futex_private_hash_put+0x107/0x1c0 [ 150.305944][ T6275] ? __pfx_futex_wake_mark+0x10/0x10 [ 150.305984][ T6275] ? __get_user_nocheck_8+0x20/0x20 [ 150.306017][ T6275] ? do_vfs_ioctl+0x226/0x13e0 [ 150.306044][ T6275] do_futex+0x18a/0x350 [ 150.306071][ T6275] ? __pfx_do_futex+0x10/0x10 [ 150.306099][ T6275] ? find_held_lock+0x2b/0x80 [ 150.306141][ T6275] __x64_sys_futex+0x34f/0x4d0 [ 150.306171][ T6275] ? __pfx___x64_sys_futex+0x10/0x10 [ 150.306204][ T6275] ? rcu_is_watching+0x12/0xc0 [ 150.306243][ T6275] do_syscall_64+0x10b/0xf80 [ 150.306278][ T6275] ? clear_bhb_loop+0x40/0x90 [ 150.306309][ T6275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.306333][ T6275] RIP: 0033:0x7ff25219ce59 [ 150.306354][ T6275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.306377][ T6275] RSP: 002b:00007ff253021028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 150.306401][ T6275] RAX: ffffffffffffffda RBX: 00007ff252416090 RCX: 00007ff25219ce59 [ 150.306418][ T6275] RDX: 0000000000000008 RSI: 0000000000000006 RDI: 0000000000000000 [ 150.306437][ T6275] RBP: 00007ff252232d6f R08: 0000000000000000 R09: 000000008000fff5 [ 150.306451][ T6275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 150.306465][ T6275] R13: 00007ff252416128 R14: 00007ff252416090 R15: 00007ffef9065c78 [ 150.306494][ T6275] [ 151.460546][ T5635] Bluetooth: hci4: command tx timeout [ 152.350512][ T6288] ubi0: attaching mtd0 [ 152.555001][ T6288] ubi0: scanning is finished [ 153.220673][ T6263] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.263908][ T6263] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.312822][ T6263] bridge_slave_0: entered allmulticast mode [ 153.351674][ T6263] bridge_slave_0: entered promiscuous mode [ 153.411482][ T6263] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.448546][ T6263] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.507074][ T6263] bridge_slave_1: entered allmulticast mode [ 153.518728][ T5635] Bluetooth: hci4: command tx timeout [ 153.562794][ T6263] bridge_slave_1: entered promiscuous mode [ 153.584448][ T6288] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 153.790297][ T6263] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 153.878502][ T6288] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 153.908895][ T6263] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.161544][ T6263] team0: Port device team_slave_0 added [ 154.226659][ T6263] team0: Port device team_slave_1 added [ 154.243906][ T6288] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 154.530149][ T6288] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 154.713467][ T6263] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 154.760021][ T6263] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 154.826347][ T6288] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 154.900598][ T6263] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 154.991746][ T6263] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.017041][ T6288] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 155.033439][ T6263] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 155.150199][ T6263] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.239231][ T6288] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3343160950 [ 155.501868][ T6288] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 155.598449][ T5635] Bluetooth: hci4: command tx timeout [ 155.623327][ T6263] hsr_slave_0: entered promiscuous mode [ 155.655852][ T6263] hsr_slave_1: entered promiscuous mode [ 155.682828][ T6263] debugfs: 'hsr0' already exists in 'hsr' [ 155.707950][ T6263] Cannot create hsr debugfs directory [ 155.755787][ T6307] ubi0: background thread "ubi_bgt0d" started, PID 6307 [ 156.692248][ T6320] process 'syz.2.111' launched './file0' with NULL argv: empty string added [ 156.947657][ T6263] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 157.034867][ T6263] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 157.082583][ T6263] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 157.159775][ T6263] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 157.248769][ T6263] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 157.354377][ T6263] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 157.405928][ T6263] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 157.553505][ T6263] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 157.678399][ T5635] Bluetooth: hci4: command tx timeout [ 159.509704][ T6263] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.606313][ T6263] 8021q: adding VLAN 0 to HW filter on device team0 [ 159.667957][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.675269][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.774301][ T3281] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.781571][ T3281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.245980][ T6263] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 162.305871][ T6122] ------------[ cut here ]------------ [ 162.311455][ T6122] ODEBUG: free active (active state 0) object: ffff88807cf0d438 object type: timer_list hint: hci_devcd_timeout+0x0/0x2e0 [ 162.324533][ T6122] WARNING: lib/debugobjects.c:629 at debug_print_object+0x18e/0x2a0, CPU#0: syz.0.79/6122 [ 162.334540][ T6122] Modules linked in: [ 162.338527][ T6122] CPU: 0 UID: 0 PID: 6122 Comm: syz.0.79 Tainted: G L syzkaller #0 PREEMPT(full) [ 162.349328][ T6122] Tainted: [L]=SOFTLOCKUP [ 162.353657][ T6122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.363800][ T6122] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 162.369820][ T6122] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d 52 a9 e2 0b 41 56 48 8b 14 dd c0 39 1c 8c 4c 89 e6 <67> 48 0f b9 3a 58 83 05 ac 25 d8 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 162.389691][ T6122] RSP: 0018:ffffc900035ef6f8 EFLAGS: 00010246 [ 162.396977][ T6122] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 162.407328][ T6122] RDX: ffffffff8c1c3900 RSI: ffffffff8c1c3520 RDI: ffffffff90e29360 [ 162.415606][ T6122] RBP: 0000000000000001 R08: ffff88807cf0d438 R09: ffffffff8bb2b700 [ 162.423894][ T6122] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c1c3520 [ 162.432033][ T6122] R13: ffffffff8bb2b740 R14: ffffffff8a92bd10 R15: ffffc900035ef7f8 [ 162.440068][ T6122] FS: 0000000000000000(0000) GS:ffff888124377000(0000) knlGS:0000000000000000 [ 162.449075][ T6122] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.455672][ T6122] CR2: 000055558b930a38 CR3: 000000007cacc000 CR4: 00000000003526f0 [ 162.463710][ T6122] Call Trace: [ 162.466996][ T6122] [ 162.469961][ T6122] ? __pfx_hci_devcd_timeout+0x10/0x10 [ 162.475468][ T6122] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 162.481449][ T6122] debug_check_no_obj_freed+0x4da/0x630 [ 162.487043][ T6122] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 162.493212][ T6122] ? __page_table_check_zero+0x333/0x410 [ 162.500160][ T6122] ? __page_table_check_zero+0x333/0x410 [ 162.505837][ T6122] ? __page_table_check_zero+0x338/0x410 [ 162.512322][ T6122] __free_frozen_pages+0x3f5/0x1040 [ 162.517560][ T6122] hci_release_dev+0x4ef/0x630 [ 162.522413][ T6122] ? __pfx_hci_release_dev+0x10/0x10 [ 162.527727][ T6122] ? device_release+0x97/0x270 [ 162.532545][ T6122] ? rcu_is_watching+0x12/0xc0 [ 162.537328][ T6122] ? device_release+0x97/0x270 [ 162.542161][ T6122] bt_host_release+0x6a/0xb0 [ 162.546792][ T6122] ? __pfx_bt_host_release+0x10/0x10 [ 162.552151][ T6122] device_release+0xd2/0x270 [ 162.556800][ T6122] kobject_put+0x1f7/0x640 [ 162.561543][ T6122] put_device+0x1f/0x30 [ 162.565825][ T6122] vhci_release+0x185/0x230 [ 162.570424][ T6122] ? __pfx_vhci_release+0x10/0x10 [ 162.575480][ T6122] __fput+0x3ff/0xb50 [ 162.579578][ T6122] task_work_run+0x150/0x240 [ 162.584282][ T6122] ? __pfx_task_work_run+0x10/0x10 [ 162.589490][ T6122] do_exit+0x8d2/0x2a60 [ 162.593679][ T6122] ? __pfx___might_resched+0x10/0x10 [ 162.599034][ T6122] ? rcu_is_watching+0x12/0xc0 [ 162.605040][ T6122] ? __pfx_do_exit+0x10/0x10 [ 162.610507][ T6122] ? do_raw_spin_lock+0x128/0x260 [ 162.615574][ T6122] ? find_held_lock+0x2b/0x80 [ 162.620357][ T6122] ? get_signal+0x7e0/0x21e0 [ 162.624977][ T6122] do_group_exit+0xd5/0x2a0 [ 162.629547][ T6122] get_signal+0x1ec7/0x21e0 [ 162.634077][ T6122] ? lockdep_hardirqs_on+0x78/0x100 [ 162.639637][ T6122] ? __pfx_get_signal+0x10/0x10 [ 162.644508][ T6122] ? kernel_move_pages+0xcfd/0x13f0 [ 162.649776][ T6122] ? do_futex+0x192/0x350 [ 162.654128][ T6122] arch_do_signal_or_restart+0x91/0x7a0 [ 162.659791][ T6122] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 162.665985][ T6122] ? rcu_is_watching+0x12/0xc0 [ 162.670883][ T6122] exit_to_user_mode_loop+0x8b/0x4f0 [ 162.676189][ T6122] ? rcu_is_watching+0x12/0xc0 [ 162.681127][ T6122] do_syscall_64+0x6f2/0xf80 [ 162.685771][ T6122] ? clear_bhb_loop+0x40/0x90 [ 162.690533][ T6122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.696445][ T6122] RIP: 0033:0x7fcea099ce59 [ 162.700903][ T6122] Code: Unable to access opcode bytes at 0x7fcea099ce2f. [ 162.709305][ T6122] RSP: 002b:00007fcea1783028 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 162.717756][ T6122] RAX: fffffffffffffff2 RBX: 00007fcea0c15fa0 RCX: 00007fcea099ce59 [ 162.726926][ T6122] RDX: 0000000000000000 RSI: 0040000000000001 RDI: 0000000000000000 [ 162.734986][ T6122] RBP: 00007fcea0a32d6f R08: 0000000000000000 R09: 8000000000000000 [ 162.743012][ T6122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 162.751025][ T6122] R13: 00007fcea0c16038 R14: 00007fcea0c15fa0 R15: 00007ffc11467f38 [ 162.759068][ T6122] [ 162.762099][ T6122] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 162.769388][ T6122] CPU: 0 UID: 0 PID: 6122 Comm: syz.0.79 Tainted: G L syzkaller #0 PREEMPT(full) [ 162.780078][ T6122] Tainted: [L]=SOFTLOCKUP [ 162.784403][ T6122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.794530][ T6122] Call Trace: [ 162.797840][ T6122] [ 162.800789][ T6122] dump_stack_lvl+0x100/0x190 [ 162.805508][ T6122] vpanic+0x552/0x970 [ 162.809537][ T6122] ? __pfx_vpanic+0x10/0x10 [ 162.814070][ T6122] panic+0xd1/0xe0 [ 162.817811][ T6122] ? __pfx_panic+0x10/0x10 [ 162.822251][ T6122] ? check_panic_on_warn+0x1f/0x90 [ 162.827385][ T6122] check_panic_on_warn.cold+0x19/0x34 [ 162.832800][ T6122] ? debug_print_object+0x18e/0x2a0 [ 162.838030][ T6122] __warn.cold+0x191/0x328 [ 162.842486][ T6122] __report_bug+0x296/0x3d0 [ 162.847009][ T6122] ? debug_print_object+0x18e/0x2a0 [ 162.852252][ T6122] ? __pfx___report_bug+0x10/0x10 [ 162.857319][ T6122] ? __lock_acquire+0x4a5/0x2630 [ 162.862271][ T6122] ? unwind_next_frame+0x3c8/0x2090 [ 162.867498][ T6122] report_bug_entry+0xe1/0x290 [ 162.872284][ T6122] ? debug_print_object+0x19b/0x2a0 [ 162.877506][ T6122] handle_bug+0x1cd/0x2a0 [ 162.881849][ T6122] exc_invalid_op+0x17/0x50 [ 162.886379][ T6122] asm_exc_invalid_op+0x1a/0x20 [ 162.891328][ T6122] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 162.897163][ T6122] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d 52 a9 e2 0b 41 56 48 8b 14 dd c0 39 1c 8c 4c 89 e6 <67> 48 0f b9 3a 58 83 05 ac 25 d8 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 162.916801][ T6122] RSP: 0018:ffffc900035ef6f8 EFLAGS: 00010246 [ 162.922885][ T6122] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 162.931067][ T6122] RDX: ffffffff8c1c3900 RSI: ffffffff8c1c3520 RDI: ffffffff90e29360 [ 162.939058][ T6122] RBP: 0000000000000001 R08: ffff88807cf0d438 R09: ffffffff8bb2b700 [ 162.947039][ T6122] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c1c3520 [ 162.955023][ T6122] R13: ffffffff8bb2b740 R14: ffffffff8a92bd10 R15: ffffc900035ef7f8 [ 162.963013][ T6122] ? __pfx_hci_devcd_timeout+0x10/0x10 [ 162.968522][ T6122] ? __pfx_hci_devcd_timeout+0x10/0x10 [ 162.974004][ T6122] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 162.979840][ T6122] debug_check_no_obj_freed+0x4da/0x630 [ 162.985425][ T6122] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 162.991519][ T6122] ? __page_table_check_zero+0x333/0x410 [ 162.997168][ T6122] ? __page_table_check_zero+0x333/0x410 [ 163.002820][ T6122] ? __page_table_check_zero+0x338/0x410 [ 163.008483][ T6122] __free_frozen_pages+0x3f5/0x1040 [ 163.013722][ T6122] hci_release_dev+0x4ef/0x630 [ 163.018510][ T6122] ? __pfx_hci_release_dev+0x10/0x10 [ 163.023825][ T6122] ? device_release+0x97/0x270 [ 163.028634][ T6122] ? rcu_is_watching+0x12/0xc0 [ 163.033437][ T6122] ? device_release+0x97/0x270 [ 163.038244][ T6122] bt_host_release+0x6a/0xb0 [ 163.042865][ T6122] ? __pfx_bt_host_release+0x10/0x10 [ 163.048193][ T6122] device_release+0xd2/0x270 [ 163.052842][ T6122] kobject_put+0x1f7/0x640 [ 163.057280][ T6122] put_device+0x1f/0x30 [ 163.061471][ T6122] vhci_release+0x185/0x230 [ 163.066002][ T6122] ? __pfx_vhci_release+0x10/0x10 [ 163.071078][ T6122] __fput+0x3ff/0xb50 [ 163.075130][ T6122] task_work_run+0x150/0x240 [ 163.079827][ T6122] ? __pfx_task_work_run+0x10/0x10 [ 163.084972][ T6122] do_exit+0x8d2/0x2a60 [ 163.089204][ T6122] ? __pfx___might_resched+0x10/0x10 [ 163.094516][ T6122] ? rcu_is_watching+0x12/0xc0 [ 163.099311][ T6122] ? __pfx_do_exit+0x10/0x10 [ 163.103932][ T6122] ? do_raw_spin_lock+0x128/0x260 [ 163.108976][ T6122] ? find_held_lock+0x2b/0x80 [ 163.113683][ T6122] ? get_signal+0x7e0/0x21e0 [ 163.118305][ T6122] do_group_exit+0xd5/0x2a0 [ 163.122832][ T6122] get_signal+0x1ec7/0x21e0 [ 163.127377][ T6122] ? lockdep_hardirqs_on+0x78/0x100 [ 163.132626][ T6122] ? __pfx_get_signal+0x10/0x10 [ 163.137589][ T6122] ? kernel_move_pages+0xcfd/0x13f0 [ 163.142818][ T6122] ? do_futex+0x192/0x350 [ 163.147170][ T6122] arch_do_signal_or_restart+0x91/0x7a0 [ 163.152749][ T6122] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 163.158948][ T6122] ? rcu_is_watching+0x12/0xc0 [ 163.163737][ T6122] exit_to_user_mode_loop+0x8b/0x4f0 [ 163.169036][ T6122] ? rcu_is_watching+0x12/0xc0 [ 163.173820][ T6122] do_syscall_64+0x6f2/0xf80 [ 163.178447][ T6122] ? clear_bhb_loop+0x40/0x90 [ 163.183160][ T6122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.189074][ T6122] RIP: 0033:0x7fcea099ce59 [ 163.193522][ T6122] Code: Unable to access opcode bytes at 0x7fcea099ce2f. [ 163.200554][ T6122] RSP: 002b:00007fcea1783028 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 163.209197][ T6122] RAX: fffffffffffffff2 RBX: 00007fcea0c15fa0 RCX: 00007fcea099ce59 [ 163.217183][ T6122] RDX: 0000000000000000 RSI: 0040000000000001 RDI: 0000000000000000 [ 163.225164][ T6122] RBP: 00007fcea0a32d6f R08: 0000000000000000 R09: 8000000000000000 [ 163.233178][ T6122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.241185][ T6122] R13: 00007fcea0c16038 R14: 00007fcea0c15fa0 R15: 00007ffc11467f38 [ 163.249184][ T6122] [ 163.252275][ T6122] Kernel Offset: disabled [ 163.256629][ T6122] Rebooting in 86400 seconds..