last executing test programs: 1m16.846057589s ago: executing program 0 (id=429): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setns(0xc9, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/hci\x00') pread64(r0, &(0x7f0000000380)=""/71, 0x47, 0x2) 1m16.790696059s ago: executing program 0 (id=431): r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x24, &(0x7f0000000000)=0xa, 0x4) 1m16.690915676s ago: executing program 0 (id=433): socket$inet_sctp(0x2, 0x5, 0x84) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/dlm/cl1\x00', 0x1ff) mkdirat(0xffffffffffffffff, 0x0, 0x16f) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/dlm/cl1/spaces/ls1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/dlm/cl1/spaces/ls1/nodes/2\x00', 0x1ff) 1m16.559753309s ago: executing program 0 (id=437): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 1m16.290082367s ago: executing program 0 (id=442): r0 = socket$inet(0x2, 0x3, 0x33) capset(&(0x7f0000000140)={0x20080522}, &(0x7f0000000180)={0x0, 0x7, 0x9}) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, 0x0, &(0x7f0000000040)) 1m15.69894761s ago: executing program 0 (id=454): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl(r0, 0x40186f40, &(0x7f0000000700)="ffffffff01") 1m15.506552373s ago: executing program 32 (id=454): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl(r0, 0x40186f40, &(0x7f0000000700)="ffffffff01") 1m12.869875436s ago: executing program 4 (id=473): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x30, 0x3f, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x2fc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x5, 0x23, 0x0, 0x0, @str='\x00'}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 1m12.725117751s ago: executing program 4 (id=474): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xbf) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) socket$alg(0x26, 0x5, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x38130d1, 0x0) sched_getaffinity(r0, 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x5, 0x41}, 0x50) openat(0xffffffffffffff9c, 0x0, 0x2, 0x20) 1m12.254443154s ago: executing program 3 (id=477): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r1, 0x0, 0x200048cc) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) 1m12.154330101s ago: executing program 3 (id=480): r0 = socket$inet(0x2, 0x1, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x1, 0x0) 1m12.098396791s ago: executing program 3 (id=482): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000000f1401"], 0x24}}, 0x84) 1m12.097933831s ago: executing program 3 (id=484): r0 = syz_io_uring_setup(0x6de4, &(0x7f0000000180)={0x0, 0x113a, 0x2, 0x2}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000300)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0x36, 0x0, 0x0, 0x1000, 0x81, 0x0, 0x0, 0x8a}}}, 0x0) io_uring_enter(r0, 0x0, 0xe38e, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f00000024c0)={0x2, 0x0, 0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000240)=""/191, 0xbf}], &(0x7f0000002480)=[0x0, 0x2]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) 1m11.857966513s ago: executing program 4 (id=487): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl(r0, 0x8941, &(0x7f0000000100)) 1m11.530397121s ago: executing program 4 (id=488): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@delqdisc={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x10}, {0xffff, 0xffff}}}, 0x24}}, 0x0) 1m11.337645135s ago: executing program 4 (id=491): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0xd27, 0x4) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto(r0, &(0x7f0000000380)="50fbdf12a30d7a48b2c5c849f3426077a9f0ca1775183db3bf52a6b2cdb77ef9af2a603a3e78adff59fbb22bae1b2443011fd801251bcef8f165533aac58c7556dd51edc5a6865d4e29f0bbd0ed602050000000000002944de604d849a", 0x5d, 0x4008044, 0x0, 0x0) write$binfmt_misc(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x0, 0x0, 0x0) 1m11.24933034s ago: executing program 3 (id=495): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) socket$unix(0x1, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c00", @ANYRES8=r0], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 1m11.200875968s ago: executing program 3 (id=496): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380c988cafb", 0xf}, {&(0x7f0000000100)="208aae0838a467b58f9fcbf9425134", 0xf}], 0x2) 1m10.426237144s ago: executing program 4 (id=506): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'ipvlan1\x00', &(0x7f0000000300)=@ethtool_rxfh_indir={0x38, 0x1, [0x1]}}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x112, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r6, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)={0x54, r6, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x800003e}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0xfffffffffffffdfa}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) tkill(r2, 0x3d) write$sndseq(0xffffffffffffffff, &(0x7f0000000040)=[{0x40, 0x0, 0x0, 0xfd, @tick, {0x4}, {0xf}, @addr={0x1b}}], 0x1c) read$midi(0xffffffffffffffff, &(0x7f00000001c0)=""/70, 0xffffffd8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dffff000000000000a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0xca, 0xac5) 55.830329493s ago: executing program 33 (id=496): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380c988cafb", 0xf}, {&(0x7f0000000100)="208aae0838a467b58f9fcbf9425134", 0xf}], 0x2) 55.414641336s ago: executing program 34 (id=506): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'ipvlan1\x00', &(0x7f0000000300)=@ethtool_rxfh_indir={0x38, 0x1, [0x1]}}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x112, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r6, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)={0x54, r6, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x800003e}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0xfffffffffffffdfa}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) tkill(r2, 0x3d) write$sndseq(0xffffffffffffffff, &(0x7f0000000040)=[{0x40, 0x0, 0x0, 0xfd, @tick, {0x4}, {0xf}, @addr={0x1b}}], 0x1c) read$midi(0xffffffffffffffff, &(0x7f00000001c0)=""/70, 0xffffffd8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dffff000000000000a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0xca, 0xac5) 4.113284509s ago: executing program 6 (id=910): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fdffffff000000000400000085000000360000001801000020646c2500000000002020207b1af8ff00000000bfa100000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001964d408861a92e03f53010203010902"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/protocols\x00') r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x5}, 0x2) read(r4, &(0x7f00000001c0)=""/93, 0x5d) 2.561711031s ago: executing program 5 (id=926): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x540, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x3a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000001000)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000f80)="27030200dc0f14000e0007000024c1020000ff3207c2fb7fe0406e52534b4f6b3d00000000000000892f3c35d5a8", 0x2e}], 0x1}, 0x0) 2.529284346s ago: executing program 2 (id=928): socket$inet6(0xa, 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='3', 0x1) 2.408539258s ago: executing program 2 (id=929): syz_emit_ethernet(0x24, &(0x7f0000000200)={@local, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x16, 0x0, 0x0, 0x0, 0x6c, 0x0, @remote, @local}, '\x00\x00'}}}}, 0x0) 2.288922528s ago: executing program 5 (id=930): r0 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) socket$kcm(0x2b, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) 2.287584359s ago: executing program 2 (id=941): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.175090728s ago: executing program 5 (id=931): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x11) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) 2.169636409s ago: executing program 2 (id=944): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() syz_emit_ethernet(0x46, 0x0, 0x0) ioctl(r1, 0xff, &(0x7f0000000300)="e5bf327a556719bad375f5a1ee40a8c20adc9118731691121fa11b78521c205b75f9905f548958314f0f9054a0ab851688a98b7eb6dfe8b2d490e47da7c1fe0ac9084c52aa203b3673ee2ecb0a0118b4d593393d218ead95bf6585bc340c0904286d302622fa235b85626c9ff397db264d5821e989398b9a") syz_emit_ethernet(0xa6, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000000702c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r6 = socket$kcm(0x10, 0x2, 0x4) close(r6) socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d", 0xf}], 0x2}, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) 1.71339984s ago: executing program 5 (id=936): syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() syz_emit_ethernet(0x46, 0x0, 0x0) ioctl(r0, 0xff, &(0x7f0000000300)="e5bf327a556719bad375f5a1ee40a8c20adc9118731691121fa11b78521c205b75f9905f548958314f0f9054a0ab851688a98b7eb6dfe8b2d490e47da7c1fe0ac9084c52aa203b3673ee2ecb0a0118b4d593393d218ead95bf6585bc340c0904286d302622fa235b85626c9ff397db264d5821e989398b9a") syz_emit_ethernet(0xa6, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000000702c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = socket$kcm(0x10, 0x2, 0x4) close(r4) sendmsg$inet(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d", 0xf}], 0x2}, 0x0) 1.25137816s ago: executing program 2 (id=939): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x36, &(0x7f00000005c0)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c2000002087800000000e00003000e0090780002000f0000000500000002000000090a1fd5d35388a91f6ad8c4321441b992be0c39b0a3890f7752dd35c579027c77b91fe607a3b9b7e429a48d847126c128b0571d8a5de3410fa5fc787067e256f137a086043046c2d41451d6f869f8e4b95c15fd980c9a5d74ff26f6eca4bb9895e47ef6e1de76d09f1b13e719eef54176120759636d46052be225a9c55c9f5a8916486e5e84f501a34b07cfbbde318323cc1b428fdb22fbf023a6bbb6851eaaa3bf8d2df2343b2d4c49da43e1b1b2a4ce86ba21d097593467e253216b506f7136807095a8598046d0b548b99fb859fc786b991f6ebb704412651230568b5d46b9e8c183bac03a7616"], 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r3, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe0000000000000008000f00fd000000", 0x24) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpriority(0x2, 0x0) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) 1.160394657s ago: executing program 7 (id=942): socket$inet6(0xa, 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='3', 0x1) 1.069819752s ago: executing program 6 (id=945): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x1c, 0x3b, 0x1, 0x70bd27, 0x25dfdbfd, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48c1}, 0x20040010) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000000)=0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x1, @ANYBLOB='@\x00'], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r5, &(0x7f00000007c0)='nf', 0x2, 0x20000000, &(0x7f0000000880)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000090a010400000000000000000a0000020900020073797a310000000008000a40fffffffc0900010073797a310000000008000540000000242c00128014000180090001006c6173740000000004000280140001800c000100636f756e74657200040002800800034000000130140000001100010000000000000000000100000abba5b8ae6196808a33411a998d9366b7ef9d021a675a987821a4637511f3f2f695c2929202e1469788c4748769ddc60fdfd5a940f71c824b32f34c7c9afa14446c26912de0edfed4036aa551c1273b3e0fd0be7471260c5fe6e007b97cc1f8679862455e958aa08038af477007a510aa7b11ebef3ba501c8c96681299462775a376c753a04"], 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x200400d0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000001100), &(0x7f0000001180)=0x8) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x2}]}, 0x1c}}, 0x4000880) bind$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x1}, 0x14) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000640)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r4, 0x0) write(r4, &(0x7f0000000000)="01", 0x1) bind$nfc_llcp(r0, &(0x7f0000000880)={0x27, r3, 0x0, 0x6, 0x0, 0x2, "d92984bd1ca44c226af5160e961711a077609475b78411e879918d20000000f2170e65e3f50327080e000000000000001900", 0x3c}, 0x60) close(0x4) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xffb0, 0x0, 0x0, 0x0, 0xfffffff9}, {{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x600}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff13}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x9, 0x20}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x4, 0x0, 0x7}, {0x18, 0x2, 0x2, 0x0, r8}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.048201956s ago: executing program 7 (id=946): 992.702126ms ago: executing program 7 (id=947): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 990.761586ms ago: executing program 1 (id=958): socket$inet6(0xa, 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='3', 0x1) 828.088425ms ago: executing program 5 (id=948): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x8d0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}, 0x1c) 827.754475ms ago: executing program 1 (id=949): sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x194, 0x0, 0x18, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x15c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x4}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x14008800}, 0x4000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x20, 0x1, {{0x0, 0x0, 0x2}}}]}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, &(0x7f0000000400)=ANY=[], 0x3a) 826.081165ms ago: executing program 7 (id=960): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 750.356428ms ago: executing program 6 (id=950): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x9, [@struct={0x0, 0x2, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x3}, {0x0, 0x2}]}, @fwd={0x7}, @restrict={0x0, 0x0, 0x0, 0x4}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x30, 0x61, 0x2e]}}, 0x0, 0x5d}, 0x28) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r6 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="230900000000000000000100000005000700000000000800090000000000060002000100000008000a000000000008001700", @ANYRES32=r6], 0x3c}}, 0x0) close(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r7, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'veth1_vlan\x00', @multicast}) write$UHID_INPUT(r1, &(0x7f0000001040)={0xe, {"a2e3ad21ed0d52f90b9b6e0987f70e06d038e7ff7fc6e5539b3248298b089b0708346d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d1780700523c921b1b9b31070d075d0936cd3b78130daa61f94b61404d64aec1b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c088215ec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6f44ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d208001349b41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2a15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee53259289d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c1980778efa5ea567b7b7430acc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a0700d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8440daaa69bf5c8f4350aeae9ca1207e76061b28f27da19acc7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211c7847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7beddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e781171e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b906ce2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf3f2aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7ae288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289d8523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c78e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e7c7b2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df06720ba2b26bbfcc807c8aabb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db38b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1040}}, 0x1006) 646.125217ms ago: executing program 7 (id=951): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/dlm\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster/comms/1\x00', 0x1ff) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=ANY=[@ANYBLOB="4000000010000104000000000300000000000000", @ANYRES32=0x0, @ANYBLOB="5cc20000000000001800128008000100677470000c00028008000200", @ANYRES32=r2, @ANYBLOB="829bcff05ca83e360bcca6a2a4d4d4a9e3f2279e1758c8f0ed15d4b250ef6b37115df96e9da024add3121e3a666fb9eef7097be987118bd11ced87539aacc31a6a4716e5b3f88e2a406ecb2116e7a10440d4e801f83effe540ddd86000f48600"/106, @ANYRES32=0x0, @ANYBLOB], 0x40}}, 0x0) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000300), &(0x7f00000008c0)=0x6e, 0x0) bind$unix(r3, &(0x7f0000000480)=@abs={0x1, 0x0, 0x4e22}, 0x6e) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster/comms/2\x00', 0x1fd) timer_create(0x0, &(0x7f00000007c0)={0x0, 0x33, 0x2, @thr={&(0x7f0000000740)="467de29de66f28a89f043bc670a65f", &(0x7f0000000780)="c31a56a6d768f5b7f9258e80b4dfbe526ee33663fc1d9d89e2e9df7fdb72c3131fea2474dcd8e07b8db72bcb03c9063d07526c74"}}, &(0x7f0000000800)=0x0) timer_settime(r4, 0x1, &(0x7f0000000840), &(0x7f0000000880)) r5 = openat$tun(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) write$tun(r5, &(0x7f00000009c0)={@void, @val={0x2, 0x3, 0x6, 0x0, 0x9, 0x7}, @ipv6=@tipc_packet={0x8, 0x6, "8d72d0", 0x200, 0x6, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, {[@hopopts={0x0, 0x21, '\x00', [@calipso={0x7, 0x40, {0x3, 0xe, 0x2, 0x981, [0x4, 0x9, 0xb28, 0x8, 0x8, 0x2, 0x5]}}, @hao={0xc9, 0x10, @private2={0xfc, 0x2, '\x00', 0x1}}, @generic={0x33, 0x98, "15630ba6813003746524f74ea3f5b481c33a813da4ffcc7b1c6b95d48dc1022712bb6919771d4aa4f3965e70fa13dc5a3a80eefa585cb09f03f22832ce4f57c7a51e7a8644ac037357358f141e0384898c29606e218bf13cb8b1bfa8d03a41e4cd5dfe30c25bf597d63220876a11d24b757fe1480f9c949821e1de7e1c8f3e4dbc61e31108da495614f0457722a8d89bf732a544cd738dfd"}, @pad1, @calipso={0x7, 0x10, {0x1, 0x2, 0x2, 0xffc0, [0x8000]}}, @enc_lim={0x4, 0x1, 0x6}, @padn]}, @srh={0x33, 0xa, 0x4, 0x5, 0x3, 0x8, 0x50bb, [@mcast2, @empty, @ipv4={'\x00', '\xff\xff', @empty}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}], @name_distributor={{0x98, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x40, 0x0, 0x0, 0x2, 0x9, 0x4, 0x4e24, 0x4e21, 0x3, 0x4}, [{0xff, 0xf, 0x0, 0x5, 0x6, 0x7ff, 0x2, 0x5}, {0x2, 0xffffffff, 0x4, 0x1, 0x5, 0x5, 0x8, 0x5}, {0x5, 0x200000, 0x8, 0x7fff, 0x80000001, 0x10000, 0x4}, {0x1af2, 0x0, 0xdf12, 0x1ff, 0xf9e0, 0x4, 0x8, 0xbb}]}}}}, 0x232) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/dlm/cluster/comms/1/local\x00', 0x1, 0x0) write(r6, &(0x7f0000000200)='1\x00', 0x2) 630.290809ms ago: executing program 5 (id=952): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() syz_emit_ethernet(0x46, 0x0, 0x0) ioctl(r1, 0xff, &(0x7f0000000300)="e5bf327a556719bad375f5a1ee40a8c20adc9118731691121fa11b78521c205b75f9905f548958314f0f9054a0ab851688a98b7eb6dfe8b2d490e47da7c1fe0ac9084c52aa203b3673ee2ecb0a0118b4d593393d218ead95bf6585bc340c0904286d302622fa235b85626c9ff397db264d5821e989398b9a") syz_emit_ethernet(0xa6, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000000702c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r6 = socket$kcm(0x10, 0x2, 0x4) close(r6) socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d", 0xf}], 0x2}, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) 514.763609ms ago: executing program 6 (id=953): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x3e) clock_gettime(0x0, 0x0) ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, 0x0) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x15000000) unshare(0xa040080) 135.913196ms ago: executing program 1 (id=954): add_key(0x0, 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a18", 0x7a, 0x0) r0 = socket(0x1e, 0x4, 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, 0x0, 0x0, &(0x7f0000000140)="7b49c882bd69b7c3779033332b1fa6d18726146c926e210f5eb92216aac59655e56250d9d7464ed7eb561d0c57f56ae60956ba7f962934aa9128b84f45e3822f2acc72d15bd7edd47570012303c6442b62e304fea00f59739bbd57f6355030892e0891314d100e8c6936d319e2200ed4f32d4056b58c2380fb0239cbb38a7f84ee304ed42933e0bf87c395141fac700717f7942fc82502733119a7999ca6d8", 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r2, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) 104.048472ms ago: executing program 7 (id=956): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x5ba8aec43a755617, 0x70bd26, 0x25dfdbeb, {0x0, 0x0, 0x0, 0x0, 0x600, 0x2b11}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_HELLO_TIME={0x8, 0x2, 0x83}, @IFLA_BR_MAX_AGE={0x8, 0x3, 0x6}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000844}, 0x4c040) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x0, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(aes)\x00'}, 0x58) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000140)='add 1', 0x5) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000ec0)=[{{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r5, 0x89f0, &(0x7f0000000180)={'bond0\x00', @ifru_names='netdevsim0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) syz_open_dev$sndctrl(0x0, 0x7cda, 0x40) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x18, 0x40, 0x107, 0x0, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x48800}, 0x0) ioctl$PPPIOCSMAXCID(r6, 0x40047451, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b0b, 0x0) r8 = dup(r2) syz_ublk_setup_queues(r8, r1, &(0x7f0000000880)={0x0, 0xfffffffe, 0x800, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c84, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2ced, 0x2, 0x1, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x20ec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) ioctl$KDMKTONE(r8, 0x4b30, 0x63fa1c05) syz_open_dev$tty1(0xc, 0x4, 0x4) 102.435622ms ago: executing program 2 (id=957): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x6484c2, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 73.346037ms ago: executing program 6 (id=959): 69.068357ms ago: executing program 1 (id=961): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='3', 0x1) 18.380086ms ago: executing program 6 (id=962): syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() syz_emit_ethernet(0x46, 0x0, 0x0) ioctl(r0, 0xff, &(0x7f0000000300)="e5bf327a556719bad375f5a1ee40a8c20adc9118731691121fa11b78521c205b75f9905f548958314f0f9054a0ab851688a98b7eb6dfe8b2d490e47da7c1fe0ac9084c52aa203b3673ee2ecb0a0118b4d593393d218ead95bf6585bc340c0904286d302622fa235b85626c9ff397db264d5821e989398b9a") syz_emit_ethernet(0xa6, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000000702c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = socket$kcm(0x10, 0x2, 0x4) socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d", 0xf}], 0x2}, 0x0) 17.969326ms ago: executing program 1 (id=963): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) io_uring_setup(0xf08, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) openat$audio(0xffffffffffffff9c, &(0x7f0000000100), 0xa0000, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f0000000400)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x7}) 0s ago: executing program 1 (id=964): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x11}, 0xa) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) kernel console output (not intermixed with test programs): 5026] syz.0.127: attempt to access beyond end of device [ 51.707166][ T5026] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 51.712867][ T5026] XFS (nbd0): SB validate failed with error -5. [ 51.741494][ T5039] md: could not open device unknown-block(1,0). [ 51.779009][ T5044] FAULT_INJECTION: forcing a failure. [ 51.779009][ T5044] name fail_futex, interval 1, probability 0, space 0, times 1 [ 51.781352][ T5044] CPU: 0 PID: 5044 Comm: syz.4.134 Not tainted syzkaller #0 [ 51.782645][ T5044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 51.784362][ T5044] Call trace: [ 51.784937][ T5044] dump_backtrace+0x1c4/0x1f0 [ 51.785732][ T5044] show_stack+0x2c/0x3c [ 51.786499][ T5044] __dump_stack+0x30/0x40 [ 51.787300][ T5044] dump_stack_lvl+0xf4/0x15c [ 51.788132][ T5044] dump_stack+0x1c/0x5c [ 51.788882][ T5044] should_fail_ex+0x3cc/0x524 [ 51.789731][ T5044] should_fail+0x14/0x24 [ 51.790546][ T5044] get_futex_key+0x904/0xfb0 [ 51.791458][ T5044] futex_wake+0x10c/0x458 [ 51.792277][ T5044] do_futex+0x2c4/0x340 [ 51.793033][ T5044] __arm64_sys_futex+0x390/0x414 [ 51.793954][ T5044] invoke_syscall+0x98/0x290 [ 51.794783][ T5044] el0_svc_common+0x13c/0x258 [ 51.795629][ T5044] do_el0_svc+0x5c/0x134 [ 51.796386][ T5044] el0_svc+0x58/0x128 [ 51.797098][ T5044] el0t_64_sync_handler+0x84/0xf0 [ 51.797977][ T5044] el0t_64_sync+0x18c/0x190 [ 51.861267][ T5052] netlink: 'syz.3.137': attribute type 1 has an invalid length. [ 51.862695][ T5052] netlink: 224 bytes leftover after parsing attributes in process `syz.3.137'. [ 51.887765][ T5050] netlink: 'syz.4.136': attribute type 8 has an invalid length. [ 51.889116][ T5050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.136'. [ 51.932266][ T5050] device bond0 entered promiscuous mode [ 51.933332][ T5050] device bond_slave_0 entered promiscuous mode [ 51.934576][ T5050] device bond_slave_1 entered promiscuous mode [ 51.967998][ T5050] device gretap0 entered promiscuous mode [ 52.008775][ T5050] device erspan0 entered promiscuous mode [ 52.025501][ T27] audit: type=1326 audit(52.010:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5059 comm="syz.0.140" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x0 [ 52.048243][ T5050] device hsr1 entered promiscuous mode [ 52.049888][ T5053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.135'. [ 52.052549][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 52.807302][ T5087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.809216][ T5087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.896673][ T5098] binder: 5097:5098 tried to acquire reference to desc 0, got 1 instead [ 52.905087][ T5098] binder: 5097:5098 got new transaction with bad transaction stack, transaction 16 has target 5097:0 [ 52.907142][ T5098] binder: 5097:5098 transaction call to 5097:0 failed 24/29201/-71, size 0-0 line 3122 [ 52.938493][ T4374] binder: release 5097:5098 transaction 16 out, still active [ 52.939889][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 52.940870][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 52.941903][ T4374] binder: send failed reply for transaction 23 to 5097:5098 [ 52.943278][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 52.944306][ T4374] binder: undelivered TRANSACTION_ERROR: 29189 [ 52.945393][ T4374] binder: send failed reply for transaction 16, target dead [ 53.196649][ T5110] gadgetfs: bound to dummy_udc driver [ 53.274844][ T5114] overlayfs: missing 'lowerdir' [ 53.351191][ T5120] netlink: 16 bytes leftover after parsing attributes in process `syz.4.163'. [ 53.434591][ T5127] FAULT_INJECTION: forcing a failure. [ 53.434591][ T5127] name failslab, interval 1, probability 0, space 0, times 0 [ 53.439568][ T5128] netlink: 40 bytes leftover after parsing attributes in process `syz.1.166'. [ 53.440132][ T5127] CPU: 0 PID: 5127 Comm: syz.4.167 Not tainted syzkaller #0 [ 53.442583][ T5127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 53.444520][ T5127] Call trace: [ 53.445149][ T5127] dump_backtrace+0x1c4/0x1f0 [ 53.446044][ T5127] show_stack+0x2c/0x3c [ 53.446802][ T5127] __dump_stack+0x30/0x40 [ 53.447593][ T5127] dump_stack_lvl+0xf4/0x15c [ 53.448452][ T5127] dump_stack+0x1c/0x5c [ 53.449276][ T5127] should_fail_ex+0x3cc/0x524 [ 53.450149][ T5127] __should_failslab+0xc0/0x11c [ 53.451063][ T5127] should_failslab+0x10/0x28 [ 53.451922][ T5127] __kmem_cache_alloc_node+0x7c/0x318 [ 53.452912][ T5127] __kmalloc_node_track_caller+0xb8/0x174 [ 53.453984][ T5127] kstrdup+0x68/0xb0 [ 53.454702][ T5127] snd_timer_instance_new+0x6c/0x1e0 [ 53.455672][ T5127] snd_seq_timer_open+0x1e4/0x504 [ 53.456595][ T5127] queue_use+0x174/0x20c [ 53.457459][ T5127] snd_seq_queue_alloc+0x220/0x4cc [ 53.458476][ T5127] snd_seq_ioctl_create_queue+0x84/0x37c [ 53.459510][ T5127] snd_seq_ioctl+0x2e8/0x570 [ 53.460345][ T5127] __arm64_sys_ioctl+0x14c/0x1c8 [ 53.461217][ T5127] invoke_syscall+0x98/0x290 [ 53.462036][ T5127] el0_svc_common+0x13c/0x258 [ 53.462868][ T5127] do_el0_svc+0x5c/0x134 [ 53.463617][ T5127] el0_svc+0x58/0x128 [ 53.464316][ T5127] el0t_64_sync_handler+0x84/0xf0 [ 53.465186][ T5127] el0t_64_sync+0x18c/0x190 [ 53.487806][ T4339] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 53.490038][ C1] gadgetfs: connected [ 53.491336][ T5109] gadgetfs: suspended from state 3 [ 53.492479][ T5109] gadgetfs: disconnected [ 53.965018][ T5167] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 54.080243][ T5167] netlink: 'syz.1.180': attribute type 1 has an invalid length. [ 54.096124][ T5167] 8021q: adding VLAN 0 to HW filter on device bond1 [ 54.271914][ T27] audit: type=1326 audit(54.260:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5197 comm="syz.0.194" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x7ffc0000 [ 54.276262][ T27] audit: type=1326 audit(54.260:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5197 comm="syz.0.194" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x7ffc0000 [ 54.284172][ T27] audit: type=1326 audit(54.270:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5197 comm="syz.0.194" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=181 compat=0 ip=0xffffacd79368 code=0x7ffc0000 [ 54.289006][ T27] audit: type=1326 audit(54.270:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5197 comm="syz.0.194" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x7ffc0000 [ 54.293215][ T27] audit: type=1326 audit(54.270:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5197 comm="syz.0.194" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x7ffc0000 [ 54.776721][ T5245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.778436][ T5245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.801047][ T4329] Bluetooth: hci2: command 0x0409 tx timeout [ 54.861935][ T5255] FAULT_INJECTION: forcing a failure. [ 54.861935][ T5255] name failslab, interval 1, probability 0, space 0, times 0 [ 54.864536][ T5255] CPU: 0 PID: 5255 Comm: syz.0.216 Not tainted syzkaller #0 [ 54.865864][ T5255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 54.867658][ T5255] Call trace: [ 54.868243][ T5255] dump_backtrace+0x1c4/0x1f0 [ 54.869085][ T5255] show_stack+0x2c/0x3c [ 54.869822][ T5255] __dump_stack+0x30/0x40 [ 54.870603][ T5255] dump_stack_lvl+0xf4/0x15c [ 54.871419][ T5255] dump_stack+0x1c/0x5c [ 54.872162][ T5255] should_fail_ex+0x3cc/0x524 [ 54.873021][ T5255] __should_failslab+0xc0/0x11c [ 54.873928][ T5255] should_failslab+0x10/0x28 [ 54.874791][ T5255] __kmem_cache_alloc_node+0x7c/0x318 [ 54.875761][ T5255] kmalloc_trace+0x48/0x94 [ 54.876576][ T5255] pkcs8_key_preparse+0x104/0x358 [ 54.877485][ T5255] asymmetric_key_preparse+0xcc/0x17c [ 54.878462][ T5255] key_create_or_update+0x394/0x868 [ 54.879421][ T5255] __arm64_sys_add_key+0x40c/0x520 [ 54.880365][ T5255] invoke_syscall+0x98/0x290 [ 54.881217][ T5255] el0_svc_common+0x13c/0x258 [ 54.882109][ T5255] do_el0_svc+0x5c/0x134 [ 54.882898][ T5255] el0_svc+0x58/0x128 [ 54.883634][ T5255] el0t_64_sync_handler+0x84/0xf0 [ 54.884559][ T5255] el0t_64_sync+0x18c/0x190 [ 54.981361][ T5259] netlink: 762 bytes leftover after parsing attributes in process `syz.3.218'. [ 54.984282][ T5245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.993930][ T5245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.055556][ T5270] FAULT_INJECTION: forcing a failure. [ 55.055556][ T5270] name failslab, interval 1, probability 0, space 0, times 0 [ 55.059722][ T5270] CPU: 1 PID: 5270 Comm: syz.3.224 Not tainted syzkaller #0 [ 55.060992][ T5270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 55.062862][ T5270] Call trace: [ 55.063470][ T5270] dump_backtrace+0x1c4/0x1f0 [ 55.064336][ T5270] show_stack+0x2c/0x3c [ 55.065065][ T5270] __dump_stack+0x30/0x40 [ 55.065838][ T5270] dump_stack_lvl+0xf4/0x15c [ 55.066653][ T5270] dump_stack+0x1c/0x5c [ 55.067394][ T5270] should_fail_ex+0x3cc/0x524 [ 55.068211][ T5270] __should_failslab+0xc0/0x11c [ 55.069059][ T5270] should_failslab+0x10/0x28 [ 55.069846][ T5270] __kmem_cache_alloc_node+0x7c/0x318 [ 55.070782][ T5270] __kmalloc+0xc4/0x180 [ 55.071505][ T5270] ovl_fill_super+0x11e0/0x3938 [ 55.072364][ T5270] mount_nodev+0x68/0x108 [ 55.073121][ T5270] ovl_mount+0x3c/0x50 [ 55.073829][ T5270] legacy_get_tree+0xd8/0x174 [ 55.074641][ T5270] vfs_get_tree+0x90/0x278 [ 55.075417][ T5270] do_new_mount+0x228/0x804 [ 55.076232][ T5270] path_mount+0x5ac/0xe6c [ 55.076987][ T5270] __arm64_sys_mount+0x4a0/0x5a0 [ 55.077849][ T5270] invoke_syscall+0x98/0x290 [ 55.078677][ T5270] el0_svc_common+0x13c/0x258 [ 55.079487][ T5270] do_el0_svc+0x5c/0x134 [ 55.080241][ T5270] el0_svc+0x58/0x128 [ 55.080951][ T5270] el0t_64_sync_handler+0x84/0xf0 [ 55.081825][ T5270] el0t_64_sync+0x18c/0x190 [ 55.243467][ T5281] bcache: register_bcache() error : failed to open device [ 56.697631][ T4338] Bluetooth: hci4: unexpected event 0x09 length: 12 > 3 [ 56.698928][ T5294] Bluetooth: MGMT ver 1.22 [ 56.726101][ T5289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.746583][ T5289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.750831][ T27] audit: type=1326 audit(56.740:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5295 comm="syz.0.235" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffffacd79368 code=0x0 [ 56.801562][ T5301] device syzkaller0 entered promiscuous mode [ 57.785020][ T5326] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input3 [ 57.902149][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 58.103514][ T5336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 58.623134][ T5327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 58.759970][ T5357] netlink: 4 bytes leftover after parsing attributes in process `syz.2.254'. [ 58.833895][ T5362] Set syz1 is full, maxelem 2 reached [ 64.478896][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.480187][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 69.603304][ T113] cfg80211: failed to load regulatory.db [ 70.015487][ T5379] i2c-slave-eeprom 0-0001: i2c_slave_register: client slave flag not set. You might see address collisions [ 70.017369][ T5379] i2c-slave-eeprom 0-0001: i2c_slave_register: invalid address [ 70.019376][ T5379] i2c-slave-eeprom: probe of 0-0001 failed with error -22 [ 70.021294][ T5379] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x01 [ 70.100515][ T5391] netlink: 64 bytes leftover after parsing attributes in process `syz.4.266'. [ 70.128730][ T5397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.131232][ T5397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.162438][ T5397] FAULT_INJECTION: forcing a failure. [ 70.162438][ T5397] name failslab, interval 1, probability 0, space 0, times 0 [ 70.169591][ T5397] CPU: 0 PID: 5397 Comm: syz.3.268 Not tainted syzkaller #0 [ 70.170944][ T5397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 70.172662][ T5397] Call trace: [ 70.173181][ T5397] dump_backtrace+0x1c4/0x1f0 [ 70.173935][ T5397] show_stack+0x2c/0x3c [ 70.174630][ T5397] __dump_stack+0x30/0x40 [ 70.175420][ T5397] dump_stack_lvl+0xf4/0x15c [ 70.176372][ T5397] dump_stack+0x1c/0x5c [ 70.177155][ T5397] should_fail_ex+0x3cc/0x524 [ 70.178004][ T5397] __should_failslab+0xc0/0x11c [ 70.179054][ T5397] should_failslab+0x10/0x28 [ 70.179988][ T5397] __kmem_cache_alloc_node+0x7c/0x318 [ 70.181048][ T5397] __kmalloc_node+0xc8/0x184 [ 70.181899][ T5397] get_callchain_buffers+0x1d8/0x440 [ 70.182844][ T5397] stack_map_alloc+0x2d0/0x480 [ 70.183733][ T5397] map_create+0x480/0xe38 [ 70.184650][ T5397] __sys_bpf+0x280/0x660 [ 70.185440][ T5397] __arm64_sys_bpf+0x80/0x98 [ 70.186308][ T5397] invoke_syscall+0x98/0x290 [ 70.187193][ T5397] el0_svc_common+0x13c/0x258 [ 70.188093][ T5397] do_el0_svc+0x5c/0x134 [ 70.188924][ T5397] el0_svc+0x58/0x128 [ 70.189664][ T5397] el0t_64_sync_handler+0x84/0xf0 [ 70.190570][ T5397] el0t_64_sync+0x18c/0x190 [ 70.243101][ T5409] netlink: 36 bytes leftover after parsing attributes in process `syz.2.273'. [ 70.302460][ T5421] netlink: 168 bytes leftover after parsing attributes in process `syz.4.279'. [ 70.388452][ T27] audit: type=1326 audit(70.380:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.400935][ T27] audit: type=1326 audit(70.390:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=293 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.405032][ T27] audit: type=1326 audit(70.390:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.414981][ T27] audit: type=1326 audit(70.400:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.421451][ T27] audit: type=1326 audit(70.400:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=69 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.425377][ T27] audit: type=1326 audit(70.400:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.430126][ T27] audit: type=1326 audit(70.400:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5433 comm="syz.2.286" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff85779368 code=0x7ffc0000 [ 70.499855][ T5446] netlink: 364 bytes leftover after parsing attributes in process `syz.4.292'. [ 70.800565][ T24] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 70.993336][ T24] usb 1-1: config index 0 descriptor too short (expected 45, got 36) [ 70.995001][ T24] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 70.996770][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 70.999544][ T24] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 71.001173][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.018648][ T24] usb 1-1: config 0 descriptor?? [ 71.021253][ T5448] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 71.031518][ T24] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 72.259334][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 72.278767][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 72.296075][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 72.342846][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 72.363823][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 72.399488][ T5489] sctp_transport_update_pmtu: 49 callbacks suppressed [ 72.399501][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.415166][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 72.416909][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.437067][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.440513][ T5472] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 72.443719][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.455346][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.462374][ T5492] netlink: 12 bytes leftover after parsing attributes in process `syz.4.305'. [ 72.464554][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.473069][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.500811][ T5492] netlink: 4 bytes leftover after parsing attributes in process `syz.4.305'. [ 72.503488][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.516708][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.544144][ T5489] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 72.581453][ T5492] IPv6: ADDRCONF(NETDEV_CHANGE): @: link becomes ready [ 72.592561][ T5492] IPv6: ADDRCONF(NETDEV_CHANGE): @: link becomes ready [ 72.780911][ T5530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.784941][ T5530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.984281][ T27] audit: type=1107 audit(72.950:21): pid=5534 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ÌçG'3š•lÕ¨‹K>uwIh$ô 0R ˜1L¾ÙñM6‘¢Ã"?À#êò0y' [ 73.053920][ T5550] device syzkaller0 entered promiscuous mode [ 73.642059][ T113] usb 1-1: USB disconnect, device number 3 [ 75.554815][ T5604] netlink: 'syz.4.334': attribute type 10 has an invalid length. [ 75.658864][ T5604] team0: Device wg1 is of different type [ 75.713825][ T5589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 76.081158][ T5657] FAULT_INJECTION: forcing a failure. [ 76.081158][ T5657] name failslab, interval 1, probability 0, space 0, times 0 [ 76.089094][ T5657] CPU: 1 PID: 5657 Comm: syz.2.346 Not tainted syzkaller #0 [ 76.090327][ T5657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 76.091971][ T5657] Call trace: [ 76.092520][ T5657] dump_backtrace+0x1c4/0x1f0 [ 76.093313][ T5657] show_stack+0x2c/0x3c [ 76.094031][ T5657] __dump_stack+0x30/0x40 [ 76.094778][ T5657] dump_stack_lvl+0xf4/0x15c [ 76.095589][ T5657] dump_stack+0x1c/0x5c [ 76.096343][ T5657] should_fail_ex+0x3cc/0x524 [ 76.097152][ T5657] __should_failslab+0xc0/0x11c [ 76.097983][ T5657] should_failslab+0x10/0x28 [ 76.098841][ T5657] __kmem_cache_alloc_node+0x7c/0x318 [ 76.099821][ T5657] __kmalloc+0xc4/0x180 [ 76.100529][ T5657] mpi_resize+0x80/0x1ac [ 76.101267][ T5657] mpi_powm+0x62c/0x13cc [ 76.102166][ T5657] rsa_enc+0x1e8/0x340 [ 76.103025][ T5657] pkcs1pad_verify+0x3ac/0x5a8 [ 76.104006][ T5657] public_key_verify_signature+0x720/0xb30 [ 76.105142][ T5657] x509_check_for_self_signed+0x2dc/0x3c0 [ 76.106267][ T5657] x509_cert_parse+0x4d8/0x6e0 [ 76.107212][ T5657] x509_key_preparse+0x74/0x5c8 [ 76.108171][ T5657] asymmetric_key_preparse+0xcc/0x17c [ 76.109232][ T5657] key_create_or_update+0x394/0x868 [ 76.110228][ T5657] __arm64_sys_add_key+0x40c/0x520 [ 76.111233][ T5657] invoke_syscall+0x98/0x290 [ 76.112121][ T5657] el0_svc_common+0x13c/0x258 [ 76.113005][ T5657] do_el0_svc+0x5c/0x134 [ 76.113817][ T5657] el0_svc+0x58/0x128 [ 76.114555][ T5657] el0t_64_sync_handler+0x84/0xf0 [ 76.115482][ T5657] el0t_64_sync+0x18c/0x190 [ 76.548877][ T5775] netlink: 4 bytes leftover after parsing attributes in process `syz.0.356'. [ 76.584440][ T4379] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 76.587024][ T4379] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 76.848583][ T113] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 77.315519][ T5843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.370'. [ 77.317384][ T5843] (unnamed net_device) (uninitialized): option mode: invalid value (255) [ 77.358360][ T113] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 77.471718][ T5781] ceph: No mds server is up or the cluster is laggy [ 77.585992][ T5887] FAT-fs (mtdblock0): bogus logical sector size 65535 [ 77.587247][ T5887] FAT-fs (mtdblock0): Can't find a valid FAT filesystem [ 77.636529][ T5892] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 77.672357][ T27] audit: type=1326 audit(77.660:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.677115][ T27] audit: type=1326 audit(77.660:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=208 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.685762][ T27] audit: type=1326 audit(77.660:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.692597][ T27] audit: type=1326 audit(77.660:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=107 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.697375][ T27] audit: type=1326 audit(77.660:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.710075][ T27] audit: type=1326 audit(77.660:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=25 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.713944][ T27] audit: type=1326 audit(77.660:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.722549][ T27] audit: type=1326 audit(77.660:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=226 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.726858][ T27] audit: type=1326 audit(77.660:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 77.736280][ T27] audit: type=1326 audit(77.660:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5896 comm="syz.1.377" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=110 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 78.296448][ T5939] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 78.338792][ T5939] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 78.570466][ T5955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.572490][ T5955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.591278][ T5953] IPVS: Scheduler module ip_vs_sip not found [ 78.705402][ T5961] device syzkaller0 entered promiscuous mode [ 78.709266][ T5961] tipc: Started in network mode [ 78.710241][ T5961] tipc: Node identity 7245a6bc48ac, cluster identity 4711 [ 78.711823][ T5961] tipc: Enabled bearer , priority 0 [ 78.720565][ T5960] tipc: Resetting bearer [ 78.812367][ T5960] tipc: Disabling bearer [ 78.931121][ T5979] capability: warning: `syz.1.412' uses 32-bit capabilities (legacy support in use) [ 79.023696][ T5985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.023812][ T5985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.617669][ T4338] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 79.619406][ T4338] CPU: 1 PID: 4338 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 79.620588][ T4338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 79.622191][ T4338] Workqueue: hci3 hci_rx_work [ 79.622918][ T4338] Call trace: [ 79.623445][ T4338] dump_backtrace+0x1c4/0x1f0 [ 79.624195][ T4338] show_stack+0x2c/0x3c [ 79.624884][ T4338] __dump_stack+0x30/0x40 [ 79.625585][ T4338] dump_stack_lvl+0xf4/0x15c [ 79.626309][ T4338] dump_stack+0x1c/0x5c [ 79.626963][ T4338] sysfs_create_dir_ns+0x244/0x264 [ 79.627826][ T4338] kobject_add_internal+0x5a8/0xb18 [ 79.628768][ T4338] kobject_add+0x144/0x20c [ 79.629571][ T4338] device_add+0x3dc/0xe4c [ 79.630326][ T4338] hci_conn_add_sysfs+0xb8/0x1bc [ 79.631189][ T4338] le_conn_complete_evt+0xd08/0x12c8 [ 79.632141][ T4338] hci_le_enh_conn_complete_evt+0x114/0x3b8 [ 79.633174][ T4338] hci_le_meta_evt+0x2c0/0x4a8 [ 79.633993][ T4338] hci_event_packet+0x64c/0xe60 [ 79.634844][ T4338] hci_rx_work+0x310/0xa70 [ 79.635621][ T4338] process_one_work+0x7e4/0x13bc [ 79.636488][ T4338] worker_thread+0x8cc/0xfe8 [ 79.637303][ T4338] kthread+0x254/0x2e0 [ 79.638024][ T4338] ret_from_fork+0x10/0x20 [ 79.638939][ T4338] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 79.641423][ T4338] Bluetooth: hci3: failed to register connection device [ 79.851328][ T6006] binder: 6004:6006 ioctl 4018620d 0 returned -22 [ 79.852802][ T6006] binder: 6004:6006 got transaction to invalid handle, 1 [ 79.854197][ T6006] binder: 6006:6004 cannot find target node [ 79.855218][ T6006] binder: 6004:6006 transaction async to 0:0 failed 25/29201/-22, size 0-0 line 3062 [ 79.857310][ T4339] binder: undelivered TRANSACTION_ERROR: 29201 [ 80.178956][ T6015] netlink: 'syz.0.425': attribute type 1 has an invalid length. [ 80.180346][ T6015] netlink: 'syz.0.425': attribute type 2 has an invalid length. [ 80.181625][ T6015] netlink: 'syz.0.425': attribute type 7 has an invalid length. [ 81.003592][ T5996] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 81.008936][ T5996] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 81.021572][ T5996] Bluetooth: hci0: Suspend notifier action (1) failed: -4 [ 81.023105][ T5996] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 81.024137][ T5996] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 81.052212][ T5996] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 81.055367][ T5996] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 81.056712][ T5996] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 81.064725][ T5996] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 81.082600][ T5996] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 81.086714][ T5996] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 81.091693][ T5996] Bluetooth: hci3: Suspend notifier action (1) failed: -4 [ 81.101626][ T5996] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 81.107020][ T5996] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 81.113847][ T5996] Bluetooth: hci4: Suspend notifier action (1) failed: -4 [ 81.172174][ T6044] overlayfs: failed to resolve '/ /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.172174][ T6044] /24 link UNICAST [ 81.207221][ T6054] gadgetfs: bound to dummy_udc driver [ 81.338568][ T6064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 81.350809][ T6064] netlink: 12 bytes leftover after parsing attributes in process `syz.1.440'. [ 81.455084][ T6064] jffs2: notice: (6064) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 81.511039][ T6063] gadgetfs: suspended from state 2 [ 81.574031][ T24] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 82.449816][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.552061][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.631416][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.712806][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.738034][ T4329] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.746321][ T4329] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.754030][ T4329] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.758379][ T4329] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.762134][ T4329] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.763547][ T4329] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.820916][ T9] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.835371][ T9] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.846603][ T9] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.863591][ T9] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 83.047765][ T4329] Bluetooth: hci1: command 0x0c1a tx timeout [ 83.137840][ T4338] Bluetooth: hci4: command 0x0c1a tx timeout [ 83.138867][ T4338] Bluetooth: hci3: command 0x0c1a tx timeout [ 83.139874][ T4338] Bluetooth: hci2: command 0x0c1a tx timeout [ 84.650531][ T6164] tipc: Started in network mode [ 84.651661][ T6164] tipc: Node identity 4, cluster identity 4711 [ 84.653124][ T6164] tipc: Node number set to 4 [ 84.711720][ T6113] chnl_net:caif_netlink_parms(): no params data found [ 84.798362][ T4329] Bluetooth: hci0: command 0x0409 tx timeout [ 84.820561][ T6196] FAULT_INJECTION: forcing a failure. [ 84.820561][ T6196] name failslab, interval 1, probability 0, space 0, times 0 [ 84.823021][ T6196] CPU: 0 PID: 6196 Comm: syz.4.472 Not tainted syzkaller #0 [ 84.824350][ T6196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 84.826166][ T6196] Call trace: [ 84.826780][ T6196] dump_backtrace+0x1c4/0x1f0 [ 84.827671][ T6196] show_stack+0x2c/0x3c [ 84.828425][ T6196] __dump_stack+0x30/0x40 [ 84.829175][ T6196] dump_stack_lvl+0xf4/0x15c [ 84.830022][ T6196] dump_stack+0x1c/0x5c [ 84.830752][ T6196] should_fail_ex+0x3cc/0x524 [ 84.831602][ T6196] __should_failslab+0xc0/0x11c [ 84.832452][ T6196] should_failslab+0x10/0x28 [ 84.833293][ T6196] __kmem_cache_alloc_node+0x7c/0x318 [ 84.834270][ T6196] kmalloc_trace+0x48/0x94 [ 84.835054][ T6196] __arm64_sys_fsopen+0x170/0x2d4 [ 84.835962][ T6196] invoke_syscall+0x98/0x290 [ 84.836770][ T6196] el0_svc_common+0x13c/0x258 [ 84.837574][ T6196] do_el0_svc+0x5c/0x134 [ 84.838325][ T6196] el0_svc+0x58/0x128 [ 84.839020][ T6196] el0t_64_sync_handler+0x84/0xf0 [ 84.839913][ T6196] el0t_64_sync+0x18c/0x190 [ 84.887421][ T6201] netlink: 'syz.4.473': attribute type 1 has an invalid length. [ 84.897706][ T6201] netlink: 'syz.4.473': attribute type 2 has an invalid length. [ 84.913703][ T6113] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.915339][ T6113] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.919463][ T6113] device bridge_slave_0 entered promiscuous mode [ 84.921987][ T6113] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.924294][ T6113] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.943301][ T6113] device bridge_slave_1 entered promiscuous mode [ 85.010967][ T6113] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.027045][ T6113] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.051980][ T6113] team0: Port device team_slave_0 added [ 85.059733][ T6113] team0: Port device team_slave_1 added [ 85.127785][ T4338] Bluetooth: hci1: command 0x0406 tx timeout [ 85.198003][ T4338] Bluetooth: hci2: command 0x0406 tx timeout [ 85.198028][ T48] Bluetooth: hci4: command 0x0406 tx timeout [ 85.198044][ T4329] Bluetooth: hci3: command 0x0406 tx timeout [ 85.431150][ T6113] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.432456][ T6113] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.438855][ T6113] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.442006][ T6113] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.443246][ T6113] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.450921][ T6113] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.583243][ T6246] random: crng reseeded on system resumption [ 85.594419][ T6248] netlink: 20 bytes leftover after parsing attributes in process `syz.3.482'. [ 85.600092][ T6113] device hsr_slave_0 entered promiscuous mode [ 85.648295][ T6113] device hsr_slave_1 entered promiscuous mode [ 85.697770][ T6113] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.699786][ T6113] Cannot create hsr debugfs directory [ 85.703313][ T6254] netlink: 'syz.1.479': attribute type 24 has an invalid length. [ 85.704721][ T6254] netlink: 'syz.1.479': attribute type 1 has an invalid length. [ 85.706101][ T6254] netlink: 224 bytes leftover after parsing attributes in process `syz.1.479'. [ 85.772440][ T6250] tipc: Started in network mode [ 85.773380][ T6250] tipc: Node identity feaa8a2c332d, cluster identity 4711 [ 85.774753][ T6250] tipc: Enabled bearer , priority 0 [ 85.792144][ T6250] device syzkaller0 entered promiscuous mode [ 86.136632][ T6250] tipc: Resetting bearer [ 86.157016][ T6113] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 86.190549][ T6113] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 86.239090][ T6249] tipc: Resetting bearer [ 86.328040][ T6249] tipc: Disabling bearer [ 86.379057][ T6113] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 86.516772][ T4347] Bluetooth: Wrong link type (-71) [ 86.703376][ T6113] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 86.770359][ T6325] tipc: Started in network mode [ 86.771321][ T6325] tipc: Node identity b6530a120ff5, cluster identity 4711 [ 86.772478][ T6325] tipc: Enabled bearer , priority 0 [ 86.793568][ T6333] device syzkaller0 entered promiscuous mode [ 86.795383][ T6333] tipc: Resetting bearer [ 86.803455][ T9] device hsr_slave_0 left promiscuous mode [ 86.827659][ T9] device hsr_slave_1 left promiscuous mode [ 86.887643][ T4347] Bluetooth: hci0: command 0x041b tx timeout [ 86.907603][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.909172][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.911307][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.912485][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.913949][ T9] device bridge_slave_1 left promiscuous mode [ 86.915761][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.968294][ T9] device bridge_slave_0 left promiscuous mode [ 86.969920][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.080555][ T6348] FAULT_INJECTION: forcing a failure. [ 87.080555][ T6348] name failslab, interval 1, probability 0, space 0, times 0 [ 87.083081][ T6348] CPU: 1 PID: 6348 Comm: syz.2.503 Not tainted syzkaller #0 [ 87.084492][ T6348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 87.086469][ T6348] Call trace: [ 87.087113][ T6348] dump_backtrace+0x1c4/0x1f0 [ 87.088004][ T6348] show_stack+0x2c/0x3c [ 87.088127][ T9] device veth1_macvtap left promiscuous mode [ 87.088777][ T6348] __dump_stack+0x30/0x40 [ 87.090048][ T9] device veth0_macvtap left promiscuous mode [ 87.090734][ T6348] dump_stack_lvl+0xf4/0x15c [ 87.090757][ T6348] dump_stack+0x1c/0x5c [ 87.091826][ T9] device veth1_vlan left promiscuous mode [ 87.092569][ T6348] should_fail_ex+0x3cc/0x524 [ 87.093402][ T9] device veth0_vlan left promiscuous mode [ 87.094267][ T6348] __should_failslab+0xc0/0x11c [ 87.096869][ T6348] should_failslab+0x10/0x28 [ 87.097683][ T6348] __kmem_cache_alloc_node+0x7c/0x318 [ 87.098586][ T6348] kmalloc_trace+0x48/0x94 [ 87.099373][ T6348] do_check_common+0x2730/0x9f10 [ 87.100282][ T6348] bpf_check+0x32ac/0xdfc0 [ 87.101054][ T6348] bpf_prog_load+0xe2c/0x12c0 [ 87.101867][ T6348] __sys_bpf+0x494/0x660 [ 87.102603][ T6348] __arm64_sys_bpf+0x80/0x98 [ 87.103412][ T6348] invoke_syscall+0x98/0x290 [ 87.104233][ T6348] el0_svc_common+0x13c/0x258 [ 87.105042][ T6348] do_el0_svc+0x5c/0x134 [ 87.105789][ T6348] el0_svc+0x58/0x128 [ 87.106512][ T6348] el0t_64_sync_handler+0x84/0xf0 [ 87.107423][ T6348] el0t_64_sync+0x18c/0x190 [ 88.957486][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 89.169507][ T9] team0 (unregistering): Port device team_slave_1 removed [ 89.328967][ T9] team0 (unregistering): Port device team_slave_0 removed [ 89.501290][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 89.707944][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.037993][ T4347] Bluetooth: hci0: command 0x0419 tx timeout [ 91.168637][ T9] bond0 (unregistering): Released all slaves [ 91.471533][ T6315] tipc: Resetting bearer [ 101.934908][ T48] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 101.937106][ T48] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 101.943005][ T48] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 101.945168][ T48] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 101.946607][ T48] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 101.948364][ T48] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 102.260129][ T6315] tipc: Disabling bearer [ 102.264956][ T1968] tipc: Node number set to 3114666514 [ 102.278048][ T6375] netlink: 8 bytes leftover after parsing attributes in process `syz.1.509'. [ 102.463557][ T6113] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.498562][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 102.500310][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 102.544489][ T6414] raw_sendmsg: syz.1.516 forgot to set AF_INET. Fix it! [ 102.558784][ T6113] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.561704][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 102.563457][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 102.568672][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.569991][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.590791][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 102.610194][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 102.611931][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 102.613784][ T4493] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.615048][ T4493] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.618938][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 102.622821][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 102.695006][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 102.697285][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 102.699541][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 102.701963][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 102.715346][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 102.719349][ T6377] chnl_net:caif_netlink_parms(): no params data found [ 102.752094][ T48] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 102.754326][ T48] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 102.755876][ T48] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 102.758878][ T48] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 102.760303][ T48] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 102.761675][ T48] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 102.786212][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 102.788216][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 102.811528][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 102.813346][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 102.896974][ T6113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 103.233078][ T6377] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.234365][ T6377] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.241405][ T6377] device bridge_slave_0 entered promiscuous mode [ 103.330607][ T6377] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.342745][ T6377] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.351042][ T6377] device bridge_slave_1 entered promiscuous mode [ 103.402456][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 103.404068][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 103.437249][ T6113] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.559931][ T6377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.562462][ T6377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.783777][ T6417] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 103.940586][ T9] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.959007][ T6377] team0: Port device team_slave_0 added [ 103.998065][ T4347] Bluetooth: hci5: command 0x0409 tx timeout [ 104.017037][ T6377] team0: Port device team_slave_1 added [ 104.059200][ T9] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.092877][ T6377] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.106328][ T6377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.123612][ T6377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.179193][ T9] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.183377][ T6422] chnl_net:caif_netlink_parms(): no params data found [ 104.192336][ T6377] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.197224][ T6377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.217598][ T6377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.288752][ T9] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.389004][ T6377] device hsr_slave_0 entered promiscuous mode [ 104.427748][ T6377] device hsr_slave_1 entered promiscuous mode [ 104.488039][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.489976][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.493811][ T6422] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.495024][ T6422] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.496660][ T6422] device bridge_slave_0 entered promiscuous mode [ 104.512782][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 104.514482][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.516205][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.521903][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.523657][ T6422] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.524925][ T6422] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.526654][ T6422] device bridge_slave_1 entered promiscuous mode [ 104.529293][ T6113] device veth0_vlan entered promiscuous mode [ 104.538244][ T6113] device veth1_vlan entered promiscuous mode [ 104.552995][ T6422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.556041][ T6422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.587120][ T9] netdevsim netdevsim3 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.604783][ T9] netdevsim netdevsim3 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.618235][ T9] netdevsim netdevsim3 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.628403][ T9] netdevsim netdevsim3 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.646493][ T6422] team0: Port device team_slave_0 added [ 104.660453][ T6113] device veth0_macvtap entered promiscuous mode [ 104.664947][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 104.666489][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 104.676691][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 104.679029][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 104.689159][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 104.691181][ T9] tipc: Left network mode [ 104.693021][ T6113] device veth1_macvtap entered promiscuous mode [ 104.711748][ T6422] team0: Port device team_slave_1 added [ 104.717189][ T6422] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.719977][ T6422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.724714][ T6422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.752584][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.755527][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.757046][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.759326][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.762346][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.764577][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.766242][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.768339][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.772600][ T6113] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.774437][ T6422] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.775677][ T6422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.780829][ T6422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.797919][ T48] Bluetooth: hci6: command 0x0409 tx timeout [ 104.821641][ T27] kauditd_printk_skb: 18 callbacks suppressed [ 104.821651][ T27] audit: type=1326 audit(104.810:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.826937][ T27] audit: type=1326 audit(104.810:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.844791][ T27] audit: type=1326 audit(104.820:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=293 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.860937][ T27] audit: type=1326 audit(104.820:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.867782][ T27] audit: type=1326 audit(104.820:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.871750][ T27] audit: type=1326 audit(104.820:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=203 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.875684][ T27] audit: type=1326 audit(104.820:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.886761][ T27] audit: type=1326 audit(104.820:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.892654][ T27] audit: type=1326 audit(104.820:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=442 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.896885][ T27] audit: type=1326 audit(104.820:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6545 comm="syz.1.527" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffba579368 code=0x7ffc0000 [ 104.922641][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 104.924334][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 104.926006][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 104.934161][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.935765][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.941073][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.942729][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.944339][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.946085][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.950823][ T6113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.952397][ T6113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.954678][ T6113] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.991352][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 104.993281][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 105.001976][ T6113] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.003844][ T6113] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.005434][ T6113] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.007239][ T6113] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.010865][ T6564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.530'. [ 105.012476][ T6564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.530'. [ 105.049211][ T6422] device hsr_slave_0 entered promiscuous mode [ 105.101698][ T6422] device hsr_slave_1 entered promiscuous mode [ 105.137524][ T6422] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 105.139074][ T6422] Cannot create hsr debugfs directory [ 105.296539][ T6377] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 105.436736][ T6377] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 105.470747][ T6377] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 105.509553][ T6377] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 105.550074][ T5870] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.551458][ T5870] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.610588][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 105.644129][ T4493] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.645543][ T4493] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.658454][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 105.744006][ T6422] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 105.748379][ T6595] netlink: 4 bytes leftover after parsing attributes in process `syz.2.535'. [ 105.832788][ T6422] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 105.860583][ T6422] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 105.893836][ T6422] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 106.058869][ T6377] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.074773][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 106.076292][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 106.077940][ T4347] Bluetooth: hci5: command 0x041b tx timeout [ 106.079639][ T9] IPVS: stopping master sync thread 4415 ... [ 106.084675][ T6377] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.102964][ T6631] jffs2: notice: (6631) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.106015][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.107970][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.109417][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.110660][ T5870] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.112547][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 106.127392][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 106.133005][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 106.134562][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.135706][ T5870] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.139305][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.295652][ T6653] jffs2: notice: (6653) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.413233][ T6660] jffs2: notice: (6660) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.420912][ T6655] netlink: 12 bytes leftover after parsing attributes in process `syz.5.552'. [ 106.434570][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.474914][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.476966][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.479875][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.484667][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.487008][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.493064][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.497988][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.505443][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 106.507233][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 106.511522][ T6377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 106.525585][ T6422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.696203][ T5872] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 106.698010][ T5872] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 106.704837][ T6422] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.715899][ T5872] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.718629][ T5872] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.720228][ T5872] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.721510][ T5872] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.723780][ T5872] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 106.740941][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 106.742779][ T4493] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 106.744277][ T4493] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.745507][ T4493] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.762530][ T6695] block nbd2: shutting down sockets [ 106.775936][ T9] device hsr_slave_0 left promiscuous mode [ 106.813521][ T9] device hsr_slave_1 left promiscuous mode [ 106.877313][ T6707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.877781][ T48] Bluetooth: hci6: command 0x041b tx timeout [ 106.892226][ T6707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.893914][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 106.895449][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 106.897118][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 106.899012][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 106.901860][ T9] device bridge_slave_1 left promiscuous mode [ 106.902944][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.941436][ T9] device bridge_slave_0 left promiscuous mode [ 106.942681][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.022053][ T6710] kAFS: No cell specified [ 107.087656][ T9] device veth1_macvtap left promiscuous mode [ 107.088834][ T9] device veth0_macvtap left promiscuous mode [ 107.089843][ T9] device veth1_vlan left promiscuous mode [ 107.090823][ T9] device veth0_vlan left promiscuous mode [ 107.776383][ T6724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.779084][ T6724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.157701][ T4347] Bluetooth: hci5: command 0x040f tx timeout [ 108.957643][ T4347] Bluetooth: hci6: command 0x040f tx timeout [ 109.059759][ T9] team0 (unregistering): Port device team_slave_1 removed [ 109.229695][ T9] team0 (unregistering): Port device team_slave_0 removed [ 109.408147][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.618902][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.237518][ T4347] Bluetooth: hci5: command 0x0419 tx timeout [ 111.037583][ T4347] Bluetooth: hci6: command 0x0419 tx timeout [ 111.088485][ T9] bond0 (unregistering): Released all slaves [ 111.393489][ T6703] netlink: 28 bytes leftover after parsing attributes in process `syz.1.562'. [ 111.396635][ T6703] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.398328][ T6703] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.412488][ T6721] netlink: 8 bytes leftover after parsing attributes in process `syz.2.565'. [ 111.414733][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 111.416626][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 111.422493][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 111.424678][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 111.426322][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 111.428858][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 111.431110][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 111.432955][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 111.434607][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 111.444103][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 111.445713][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 111.447416][ T6728] netlink: 4 bytes leftover after parsing attributes in process `syz.5.567'. [ 111.456795][ T6422] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 111.464667][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 111.466153][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 111.473536][ T6377] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.635572][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 111.637085][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 111.691999][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 111.693764][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 111.697905][ T6422] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.701109][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 111.702853][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 111.704495][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 111.706128][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 111.715236][ T6377] device veth0_vlan entered promiscuous mode [ 111.721774][ T6377] device veth1_vlan entered promiscuous mode [ 111.775682][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 111.777307][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 111.779982][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 111.781633][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 111.799479][ T6377] device veth0_macvtap entered promiscuous mode [ 111.805854][ T6377] device veth1_macvtap entered promiscuous mode [ 111.891711][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 111.893517][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 111.895271][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 111.896995][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 111.900339][ T6794] tipc: Started in network mode [ 111.901164][ T6794] tipc: Node identity 4, cluster identity 4711 [ 111.902100][ T6794] tipc: Node number set to 4 [ 111.904790][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.906488][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.915236][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.916873][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.919801][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.921477][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.923160][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.924911][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.945642][ T6377] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.954514][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 111.956296][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 111.959467][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 111.960985][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 111.962767][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 111.964542][ T6804] sctp: [Deprecated]: syz.5.582 (pid 6804) Use of struct sctp_assoc_value in delayed_ack socket option. [ 111.964542][ T6804] Use struct sctp_sack_info instead [ 111.965764][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 111.970169][ T6422] device veth0_vlan entered promiscuous mode [ 111.974583][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.976521][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.983520][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.988755][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.990550][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.993315][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.995402][ T6377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.997269][ T6377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.000826][ T6377] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.002978][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 112.004767][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 112.007080][ T6422] device veth1_vlan entered promiscuous mode [ 112.022584][ T6377] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.024381][ T6377] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.026029][ T6377] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.029724][ T6377] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.034775][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 112.036292][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 112.041609][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 112.043217][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 112.049844][ T6813] netlink: 16 bytes leftover after parsing attributes in process `syz.5.583'. [ 112.055204][ T6422] device veth0_macvtap entered promiscuous mode [ 112.070986][ T6422] device veth1_macvtap entered promiscuous mode [ 112.089173][ T6815] md: could not open device unknown-block(1,0). [ 112.101239][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.103822][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.105723][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.108169][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.110085][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.112290][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.114711][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.116701][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.121438][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.123532][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.126321][ T6422] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.130908][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 112.132532][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 112.134173][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 112.136825][ T5870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 112.140466][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.142346][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.144379][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.146468][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.148832][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.151072][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.152948][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.155087][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.157027][ T6422] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.159555][ T6422] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.163378][ T6422] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.183897][ T4997] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 112.185934][ T4997] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 112.192991][ T6422] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.194525][ T6422] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.195929][ T6422] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.197291][ T6422] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.220533][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.221911][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.225204][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 112.275247][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.276655][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.279735][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 112.320862][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.322296][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.326497][ T4997] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 112.343756][ T5236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.345347][ T5236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.346886][ T5236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 112.409009][ T6837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.414859][ T6837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.470924][ T6841] netlink: 28 bytes leftover after parsing attributes in process `syz.7.512'. [ 112.473916][ T6841] netlink: 28 bytes leftover after parsing attributes in process `syz.7.512'. [ 112.481518][ T6841] netlink: 8 bytes leftover after parsing attributes in process `syz.7.512'. [ 112.758738][ T6861] 8021q: adding VLAN 0 to HW filter on device bond1 [ 112.805336][ T6865] netlink: 8 bytes leftover after parsing attributes in process `syz.7.594'. [ 112.878657][ T24] atkbd serio0: keyboard reset failed on [ 112.938923][ T6882] device syzkaller0 entered promiscuous mode [ 112.974807][ T6888] FAULT_INJECTION: forcing a failure. [ 112.974807][ T6888] name failslab, interval 1, probability 0, space 0, times 0 [ 112.977046][ T6888] CPU: 1 PID: 6888 Comm: syz.5.602 Not tainted syzkaller #0 [ 112.978391][ T6888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 112.980296][ T6888] Call trace: [ 112.980910][ T6888] dump_backtrace+0x1c4/0x1f0 [ 112.981805][ T6888] show_stack+0x2c/0x3c [ 112.982594][ T6888] __dump_stack+0x30/0x40 [ 112.983416][ T6888] dump_stack_lvl+0xf4/0x15c [ 112.984297][ T6888] dump_stack+0x1c/0x5c [ 112.985091][ T6888] should_fail_ex+0x3cc/0x524 [ 112.985956][ T6888] __should_failslab+0xc0/0x11c [ 112.986882][ T6888] should_failslab+0x10/0x28 [ 112.987758][ T6888] kmem_cache_alloc+0x88/0x310 [ 112.988636][ T6888] alloc_vfsmnt+0x34/0x4b4 [ 112.989438][ T6888] vfs_create_mount+0x84/0x4b4 [ 112.990301][ T6888] do_new_mount+0x32c/0x804 [ 112.991094][ T6888] path_mount+0x5ac/0xe6c [ 112.991846][ T6888] __arm64_sys_mount+0x4a0/0x5a0 [ 112.992710][ T6888] invoke_syscall+0x98/0x290 [ 112.993526][ T6888] el0_svc_common+0x13c/0x258 [ 112.994370][ T6888] do_el0_svc+0x5c/0x134 [ 112.995151][ T6888] el0_svc+0x58/0x128 [ 112.995892][ T6888] el0t_64_sync_handler+0x84/0xf0 [ 112.995908][ T6888] el0t_64_sync+0x18c/0x190 [ 113.008399][ T4406] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 113.017138][ T4406] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 113.150852][ T6896] device ipvlan2 entered promiscuous mode [ 113.155955][ T6896] team0: Device ipvlan2 failed to register rx_handler [ 113.215423][ T6901] device ipvlan2 entered promiscuous mode [ 113.217278][ T6901] team0: Device ipvlan2 failed to register rx_handler [ 113.278745][ T1968] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 113.312490][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 113.312500][ T27] audit: type=1326 audit(113.300:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6909 comm="syz.7.608" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e579368 code=0x0 [ 113.345131][ T6915] syz.2.610 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 113.352377][ T6915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.353869][ T6915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.745718][ T6925] random: crng reseeded on system resumption [ 113.787911][ T24] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 113.807613][ T6888] ceph: No mds server is up or the cluster is laggy [ 113.828767][ T6937] binder: BINDER_SET_CONTEXT_MGR already set [ 113.830771][ T6937] binder: 6936:6937 ioctl 4018620d 20004a80 returned -16 [ 113.930371][ T6950] loop5: detected capacity change from 0 to 7 [ 113.934701][ T6950] Dev loop5: unable to read RDB block 7 [ 113.935935][ T6950] loop5: AHDI p1 p3 p4 [ 113.936661][ T6950] loop5: partition table partially beyond EOD, truncated [ 113.941699][ T6950] loop5: p1 start 4294967295 is beyond EOD, truncated [ 113.942930][ T6950] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 113.988225][ T6113] Dev loop5: unable to read RDB block 7 [ 113.989487][ T6113] loop5: AHDI p1 p3 p4 [ 113.990242][ T6113] loop5: partition table partially beyond EOD, truncated [ 113.992163][ T6113] loop5: p1 start 4294967295 is beyond EOD, truncated [ 113.993337][ T6113] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 114.001480][ T6950] Dev loop5: unable to read RDB block 7 [ 114.002711][ T6950] loop5: AHDI p1 p3 p4 [ 114.003523][ T6950] loop5: partition table partially beyond EOD, truncated [ 114.004971][ T6950] loop5: p1 start 4294967295 is beyond EOD, truncated [ 114.006172][ T6950] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 114.069846][ T6954] netlink: 'syz.2.620': attribute type 1 has an invalid length. [ 114.071267][ T6954] netlink: 'syz.2.620': attribute type 2 has an invalid length. [ 114.072744][ T6954] netlink: 'syz.2.620': attribute type 7 has an invalid length. [ 114.344371][ T6733] udevd[6733]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 114.362700][ T6733] udevd[6733]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 114.372550][ T6733] udevd[6733]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 114.376244][ T6958] tipc: New replicast peer: 255.255.255.255 [ 114.389728][ T6958] tipc: Enabled bearer , priority 10 [ 114.502304][ T6973] netlink: 36 bytes leftover after parsing attributes in process `syz.6.629'. [ 114.612661][ T6982] device syzkaller0 entered promiscuous mode [ 114.861696][ T4347] Bluetooth: hci3: unexpected event 0x01 length: 4 > 1 [ 115.413129][ T7024] 8021q: adding VLAN 0 to HW filter on device bond1 [ 115.465625][ T7024] netlink: 52 bytes leftover after parsing attributes in process `syz.7.635'. [ 115.501276][ T4347] Bluetooth: hci4: unexpected event for opcode 0x0c03 [ 115.540626][ T4347] Bluetooth: hci6: unexpected cc 0x2029 length: 100 > 1 [ 116.109184][ T7089] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.110700][ T7089] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.460559][ T7125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.463048][ T7125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.777998][ T7141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.779752][ T7141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.799447][ T7141] can: request_module (can-proto-0) failed. [ 116.850700][ T7141] zswap: compressor zst not available [ 117.343893][ T7208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.345527][ T7208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.383870][ T7212] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.386987][ T7212] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.403843][ T7212] can: request_module (can-proto-0) failed. [ 117.431502][ T7215] __nla_validate_parse: 1 callbacks suppressed [ 117.431515][ T7215] netlink: 12 bytes leftover after parsing attributes in process `syz.6.674'. [ 117.562757][ T7225] ALSA: seq fatal error: cannot create timer (-16) [ 117.636364][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 117.644122][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 117.663112][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 117.678782][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 117.682902][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 117.685244][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 117.700017][ T7226] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 117.739878][ T7226] sctp_transport_update_pmtu: 48 callbacks suppressed [ 117.739888][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.743519][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.745766][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.751365][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.759693][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.761760][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.764176][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.766355][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.775317][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.777332][ T7226] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 117.976204][ T7235] FAULT_INJECTION: forcing a failure. [ 117.976204][ T7235] name failslab, interval 1, probability 0, space 0, times 0 [ 117.978910][ T7235] CPU: 1 PID: 7235 Comm: syz.2.679 Not tainted syzkaller #0 [ 117.980154][ T7235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.981970][ T7235] Call trace: [ 117.982595][ T7235] dump_backtrace+0x1c4/0x1f0 [ 117.983483][ T7235] show_stack+0x2c/0x3c [ 117.984249][ T7235] __dump_stack+0x30/0x40 [ 117.985017][ T7235] dump_stack_lvl+0xf4/0x15c [ 117.985852][ T7235] dump_stack+0x1c/0x5c [ 117.986590][ T7235] should_fail_ex+0x3cc/0x524 [ 117.987451][ T7235] __should_failslab+0xc0/0x11c [ 117.988353][ T7235] should_failslab+0x10/0x28 [ 117.989146][ T7235] __kmem_cache_alloc_node+0x7c/0x318 [ 117.990145][ T7235] __kmalloc+0xc4/0x180 [ 117.990880][ T7235] memcg_list_lru_alloc+0x280/0x8bc [ 117.991849][ T7235] slab_pre_alloc_hook+0x2cc/0x31c [ 117.992817][ T7235] kmem_cache_alloc_lru+0x60/0x284 [ 117.993782][ T7235] proc_alloc_inode+0x2c/0xb8 [ 117.994677][ T7235] new_inode_pseudo+0x68/0x1cc [ 117.995569][ T7235] new_inode+0x38/0x174 [ 117.996307][ T7235] proc_get_inode+0x30/0x624 [ 117.997149][ T7235] proc_fill_super+0x40c/0x6ac [ 117.998051][ T7235] get_tree_nodev+0xb4/0x16c [ 117.998870][ T7235] proc_get_tree+0x28/0x38 [ 117.999682][ T7235] vfs_get_tree+0x90/0x278 [ 118.000447][ T7235] do_new_mount+0x228/0x804 [ 118.001243][ T7235] path_mount+0x5ac/0xe6c [ 118.001995][ T7235] __arm64_sys_mount+0x4a0/0x5a0 [ 118.002813][ T7235] invoke_syscall+0x98/0x290 [ 118.003594][ T7235] el0_svc_common+0x13c/0x258 [ 118.004370][ T7235] do_el0_svc+0x5c/0x134 [ 118.005088][ T7235] el0_svc+0x58/0x128 [ 118.005792][ T7235] el0t_64_sync_handler+0x84/0xf0 [ 118.006651][ T7235] el0t_64_sync+0x18c/0x190 [ 118.040131][ T7235] proc_fill_super: get root inode failed [ 118.118504][ T6080] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 118.623074][ T7276] binder: 7275:7276 tried to acquire reference to desc 0, got 1 instead [ 118.625325][ T7276] binder: 7275:7276 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 118.627683][ T7276] binder: 7276 RLIMIT_NICE not set [ 118.628622][ T7276] binder: 7276 RLIMIT_NICE not set [ 118.630857][ T7276] binder: release 7275:7276 transaction 31 in, still active [ 118.632033][ T7276] binder: send failed reply for transaction 31 to 7275:7276 [ 118.633685][ T24] binder: undelivered TRANSACTION_COMPLETE [ 118.634812][ T24] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.911006][ T7237] ceph: No mds server is up or the cluster is laggy [ 118.911096][ T4376] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 118.925000][ T3901] syzkaller0: tun_net_xmit 76 [ 118.926127][ T3901] syzkaller0: tun_net_xmit 48 [ 118.931854][ T7296] syzkaller0: create flow: hash 2389431712 index 1 [ 118.945497][ T7295] syzkaller0: delete flow: hash 2389431712 index 1 [ 119.114593][ T7317] FAULT_INJECTION: forcing a failure. [ 119.114593][ T7317] name failslab, interval 1, probability 0, space 0, times 0 [ 119.114632][ T7317] CPU: 0 PID: 7317 Comm: syz.2.707 Not tainted syzkaller #0 [ 119.114639][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 119.114644][ T7317] Call trace: [ 119.114647][ T7317] dump_backtrace+0x1c4/0x1f0 [ 119.114659][ T7317] show_stack+0x2c/0x3c [ 119.114664][ T7317] __dump_stack+0x30/0x40 [ 119.114674][ T7317] dump_stack_lvl+0xf4/0x15c [ 119.114680][ T7317] dump_stack+0x1c/0x5c [ 119.114686][ T7317] should_fail_ex+0x3cc/0x524 [ 119.114696][ T7317] __should_failslab+0xc0/0x11c [ 119.114705][ T7317] should_failslab+0x10/0x28 [ 119.114713][ T7317] __kmem_cache_alloc_node+0x7c/0x318 [ 119.114721][ T7317] __kmalloc_node_track_caller+0xb8/0x174 [ 119.114728][ T7317] kstrdup_const+0x90/0xdc [ 119.114735][ T7317] __kernfs_new_node+0xb0/0x5fc [ 119.114741][ T7317] kernfs_new_node+0x120/0x230 [ 119.114747][ T7317] kernfs_create_link+0x98/0x1e4 [ 119.114754][ T7317] sysfs_do_create_link_sd+0x8c/0x120 [ 119.114761][ T7317] sysfs_create_link+0x74/0x94 [ 119.114768][ T7317] device_create_sys_dev_entry+0x118/0x18c [ 119.114778][ T7317] device_add+0x8bc/0xe4c [ 119.114786][ T7317] device_create_groups_vargs+0x1fc/0x298 [ 119.114795][ T7317] device_create+0xf4/0x148 [ 119.114803][ T7317] vcs_make_sysfs+0x44/0xa0 [ 119.114809][ T7317] vc_allocate+0x52c/0x63c [ 119.114817][ T7317] con_install+0xa0/0x5cc [ 119.114826][ T7317] tty_init_dev+0xb4/0x3f4 [ 119.114834][ T7317] tty_open+0x6dc/0xb5c [ 119.114843][ T7317] chrdev_open+0x3d0/0x51c [ 119.114851][ T7317] do_dentry_open+0x738/0xf8c [ 119.114856][ T7317] vfs_open+0x7c/0x90 [ 119.114860][ T7317] path_openat+0x1fc0/0x27a0 [ 119.114867][ T7317] do_filp_open+0x198/0x38c [ 119.114873][ T7317] do_sys_openat2+0x134/0x3fc [ 119.114878][ T7317] __arm64_sys_openat+0x11c/0x150 [ 119.114884][ T7317] invoke_syscall+0x98/0x290 [ 119.114893][ T7317] el0_svc_common+0x13c/0x258 [ 119.114902][ T7317] do_el0_svc+0x5c/0x134 [ 119.114910][ T7317] el0_svc+0x58/0x128 [ 119.114917][ T7317] el0t_64_sync_handler+0x84/0xf0 [ 119.114924][ T7317] el0t_64_sync+0x18c/0x190 [ 119.699614][ T7331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.701487][ T7331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.705789][ T7332] FAULT_INJECTION: forcing a failure. [ 119.705789][ T7332] name failslab, interval 1, probability 0, space 0, times 0 [ 119.708647][ T7332] CPU: 1 PID: 7332 Comm: syz.2.710 Not tainted syzkaller #0 [ 119.709896][ T7332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 119.711617][ T7332] Call trace: [ 119.712205][ T7332] dump_backtrace+0x1c4/0x1f0 [ 119.713045][ T7332] show_stack+0x2c/0x3c [ 119.713792][ T7332] __dump_stack+0x30/0x40 [ 119.714571][ T7332] dump_stack_lvl+0xf4/0x15c [ 119.715416][ T7332] dump_stack+0x1c/0x5c [ 119.716167][ T7332] should_fail_ex+0x3cc/0x524 [ 119.717096][ T7332] __should_failslab+0xc0/0x11c [ 119.718061][ T7332] should_failslab+0x10/0x28 [ 119.718961][ T7332] slab_pre_alloc_hook+0x6c/0x31c [ 119.719944][ T7332] kmem_cache_alloc_lru+0x60/0x284 [ 119.720898][ T7332] __d_alloc+0x40/0x68c [ 119.721649][ T7332] d_alloc_pseudo+0x28/0x8c [ 119.722456][ T7332] alloc_file_pseudo+0xd8/0x1f4 [ 119.723329][ T7332] anon_inode_getfd+0xe8/0x1a8 [ 119.724216][ T7332] fscontext_create_fd+0x38/0x74 [ 119.725150][ T7332] __arm64_sys_fspick+0x2d8/0x388 [ 119.726073][ T7332] invoke_syscall+0x98/0x290 [ 119.726899][ T7332] el0_svc_common+0x13c/0x258 [ 119.727691][ T7332] do_el0_svc+0x5c/0x134 [ 119.728432][ T7332] el0_svc+0x58/0x128 [ 119.729258][ T7332] el0t_64_sync_handler+0x84/0xf0 [ 119.730184][ T7332] el0t_64_sync+0x18c/0x190 [ 119.905296][ T7331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.906861][ T7331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.918124][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.919332][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 129.732252][ T7323] netlink: 14 bytes leftover after parsing attributes in process `syz.6.708'. [ 129.772964][ T7351] binder: 7350:7351 ioctl 40182103 0 returned -22 [ 129.775693][ T7351] binder: 7350:7351 tried to acquire reference to desc 0, got 1 instead [ 129.778325][ T7351] binder: 7350:7351 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 129.780519][ T7351] binder: 7351 RLIMIT_NICE not set [ 129.781488][ T7351] binder: 7351 RLIMIT_NICE not set [ 129.789589][ T3901] binder: release 7350:7351 transaction 36 out, still active [ 129.790981][ T3901] binder: undelivered TRANSACTION_COMPLETE [ 129.791980][ T3901] binder: send failed reply for transaction 43 to 7350:7351 [ 129.793298][ T3901] binder: release 7350:7351 transaction 36 in, still active [ 129.794500][ T3901] binder: send failed reply for transaction 36, target dead [ 129.795781][ T3901] binder: undelivered TRANSACTION_COMPLETE [ 129.796671][ T3901] binder: undelivered TRANSACTION_ERROR: 29189 [ 129.813549][ T7323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 129.818688][ T7357] FAULT_INJECTION: forcing a failure. [ 129.818688][ T7357] name failslab, interval 1, probability 0, space 0, times 0 [ 129.820841][ T7357] CPU: 1 PID: 7357 Comm: syz.7.720 Not tainted syzkaller #0 [ 129.822010][ T7357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 129.824062][ T7357] Call trace: [ 129.824675][ T7357] dump_backtrace+0x1c4/0x1f0 [ 129.825528][ T7357] show_stack+0x2c/0x3c [ 129.826271][ T7357] __dump_stack+0x30/0x40 [ 129.827049][ T7357] dump_stack_lvl+0xf4/0x15c [ 129.827867][ T7357] dump_stack+0x1c/0x5c [ 129.828600][ T7357] should_fail_ex+0x3cc/0x524 [ 129.829465][ T7357] __should_failslab+0xc0/0x11c [ 129.830388][ T7357] should_failslab+0x10/0x28 [ 129.831211][ T7357] kmem_cache_alloc+0x88/0x310 [ 129.832076][ T7357] skb_clone+0x194/0x308 [ 129.832854][ T7357] __netlink_deliver_tap+0x364/0x6d8 [ 129.833809][ T7357] netlink_deliver_tap+0x1ac/0x1b0 [ 129.834787][ T7357] netlink_unicast+0x5e0/0x80c [ 129.835618][ T7357] netlink_sendmsg+0x6f0/0x9d8 [ 129.836449][ T7357] ____sys_sendmsg+0x588/0x90c [ 129.837270][ T7357] __sys_sendmsg+0x288/0x374 [ 129.838103][ T7357] __arm64_sys_sendmsg+0x80/0x94 [ 129.838963][ T7357] invoke_syscall+0x98/0x290 [ 129.839797][ T7357] el0_svc_common+0x13c/0x258 [ 129.840628][ T7357] do_el0_svc+0x5c/0x134 [ 129.841392][ T7357] el0_svc+0x58/0x128 [ 129.842102][ T7357] el0t_64_sync_handler+0x84/0xf0 [ 129.842986][ T7357] el0t_64_sync+0x18c/0x190 [ 129.881840][ T7323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 129.921126][ T7323] bond0 (unregistering): Released all slaves [ 130.031705][ T7342] netlink: 16 bytes leftover after parsing attributes in process `syz.2.713'. [ 130.660488][ T7408] netlink: 4 bytes leftover after parsing attributes in process `syz.1.722'. [ 130.970039][ T7408] device hsr_slave_1 left promiscuous mode [ 131.006858][ T7435] device syzkaller0 entered promiscuous mode [ 131.319938][ T4347] Bluetooth: hci3: unexpected cc 0x0c24 length: 3 > 1 [ 131.321180][ T4347] Bluetooth: hci3: unexpected event for opcode 0x0c24 [ 133.086073][ T7370] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 133.136631][ T7472] FAULT_INJECTION: forcing a failure. [ 133.136631][ T7472] name fail_futex, interval 1, probability 0, space 0, times 0 [ 133.140798][ T7472] CPU: 0 PID: 7472 Comm: syz.1.738 Not tainted syzkaller #0 [ 133.142166][ T7472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 133.143912][ T7472] Call trace: [ 133.144595][ T7472] dump_backtrace+0x1c4/0x1f0 [ 133.145588][ T7472] show_stack+0x2c/0x3c [ 133.146451][ T7472] __dump_stack+0x30/0x40 [ 133.147281][ T7472] dump_stack_lvl+0xf4/0x15c [ 133.148141][ T7472] dump_stack+0x1c/0x5c [ 133.148928][ T7472] should_fail_ex+0x3cc/0x524 [ 133.149795][ T7472] should_fail+0x14/0x24 [ 133.150591][ T7472] get_futex_key+0x904/0xfb0 [ 133.151447][ T7472] futex_wake+0x10c/0x458 [ 133.152267][ T7472] do_futex+0x2c4/0x340 [ 133.153052][ T7472] __arm64_sys_futex+0x390/0x414 [ 133.153998][ T7472] invoke_syscall+0x98/0x290 [ 133.154830][ T7472] el0_svc_common+0x13c/0x258 [ 133.155657][ T7472] do_el0_svc+0x5c/0x134 [ 133.156442][ T7472] el0_svc+0x58/0x128 [ 133.157196][ T7472] el0t_64_sync_handler+0x84/0xf0 [ 133.158103][ T7472] el0t_64_sync+0x18c/0x190 [ 133.164106][ T7473] binder: 7471:7473 tried to acquire reference to desc 0, got 1 instead [ 133.171059][ T7473] binder: 7471:7473 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 133.173223][ T7473] binder: 7473 RLIMIT_NICE not set [ 133.194435][ T4347] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci6/hci6:201' [ 133.196288][ T4347] CPU: 1 PID: 4347 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 133.197470][ T4347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 133.199291][ T4347] Workqueue: hci6 hci_rx_work [ 133.200164][ T4347] Call trace: [ 133.200742][ T4347] dump_backtrace+0x1c4/0x1f0 [ 133.201586][ T4347] show_stack+0x2c/0x3c [ 133.202359][ T4347] __dump_stack+0x30/0x40 [ 133.203196][ T4347] dump_stack_lvl+0xf4/0x15c [ 133.204068][ T4347] dump_stack+0x1c/0x5c [ 133.204848][ T4347] sysfs_create_dir_ns+0x244/0x264 [ 133.205798][ T4347] kobject_add_internal+0x5a8/0xb18 [ 133.206722][ T4347] kobject_add+0x144/0x20c [ 133.207504][ T4347] device_add+0x3dc/0xe4c [ 133.208256][ T4347] hci_conn_add_sysfs+0xb8/0x1bc [ 133.209131][ T4347] le_conn_complete_evt+0xd08/0x12c8 [ 133.210138][ T4347] hci_le_conn_complete_evt+0x114/0x3b8 [ 133.211130][ T4347] hci_le_meta_evt+0x2c0/0x4a8 [ 133.212016][ T4347] hci_event_packet+0x64c/0xe60 [ 133.212906][ T4347] hci_rx_work+0x310/0xa70 [ 133.213708][ T4347] process_one_work+0x7e4/0x13bc [ 133.214592][ T4347] worker_thread+0x8cc/0xfe8 [ 133.215431][ T4347] kthread+0x254/0x2e0 [ 133.216167][ T4347] ret_from_fork+0x10/0x20 [ 133.223230][ T4347] kobject_add_internal failed for hci6:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 133.225501][ T4347] Bluetooth: hci6: failed to register connection device [ 133.248827][ T7476] binder: 7471:7476 unknown command 0 [ 133.251239][ T7476] binder: 7471:7476 ioctl c0306201 20000480 returned -22 [ 133.252969][ T4376] binder: release 7471:7476 transaction 48 out, still active [ 133.254307][ T4376] binder: undelivered TRANSACTION_COMPLETE [ 133.281962][ T4376] binder: send failed reply for transaction 48, target dead [ 133.322724][ T7484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.325213][ T7484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.346384][ T7484] can: request_module (can-proto-0) failed. [ 142.215761][ T7512] 9pnet_virtio: no channels available for device syz [ 142.258978][ T7519] FAULT_INJECTION: forcing a failure. [ 142.258978][ T7519] name failslab, interval 1, probability 0, space 0, times 0 [ 142.261443][ T7519] CPU: 0 PID: 7519 Comm: syz.6.756 Not tainted syzkaller #0 [ 142.262675][ T7519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 142.264379][ T7519] Call trace: [ 142.264958][ T7519] dump_backtrace+0x1c4/0x1f0 [ 142.265792][ T7519] show_stack+0x2c/0x3c [ 142.266527][ T7519] __dump_stack+0x30/0x40 [ 142.267292][ T7519] dump_stack_lvl+0xf4/0x15c [ 142.268105][ T7519] dump_stack+0x1c/0x5c [ 142.268838][ T7519] should_fail_ex+0x3cc/0x524 [ 142.269672][ T7519] __should_failslab+0xc0/0x11c [ 142.270538][ T7519] should_failslab+0x10/0x28 [ 142.271438][ T7519] kmem_cache_alloc+0x88/0x310 [ 142.272307][ T7519] security_inode_alloc+0x38/0x11c [ 142.273215][ T7519] inode_init_always+0x6c8/0xb28 [ 142.274109][ T7519] new_inode_pseudo+0x7c/0x1cc [ 142.274992][ T7519] alloc_anon_inode+0x28/0x2c4 [ 142.275899][ T7519] aio_setup_ring+0xe0/0xbec [ 142.276749][ T7519] ioctx_alloc+0x2f8/0x734 [ 142.277573][ T7519] __arm64_sys_io_setup+0x134/0x30c [ 142.278529][ T7519] invoke_syscall+0x98/0x290 [ 142.279378][ T7519] el0_svc_common+0x13c/0x258 [ 142.280250][ T7519] do_el0_svc+0x5c/0x134 [ 142.281030][ T7519] el0_svc+0x58/0x128 [ 142.281753][ T7519] el0t_64_sync_handler+0x84/0xf0 [ 142.282692][ T7519] el0t_64_sync+0x18c/0x190 [ 142.452567][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 142.464718][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 142.475742][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 142.505793][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 142.521555][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 142.531565][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 142.554609][ T7537] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 142.583511][ T7536] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 142.603503][ T7536] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 142.677135][ T7552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.705049][ T7552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.603708][ T7575] FAULT_INJECTION: forcing a failure. [ 143.603708][ T7575] name failslab, interval 1, probability 0, space 0, times 0 [ 143.605979][ T7575] CPU: 0 PID: 7575 Comm: syz.6.767 Not tainted syzkaller #0 [ 143.607361][ T7575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 143.609366][ T7575] Call trace: [ 143.610049][ T7575] dump_backtrace+0x1c4/0x1f0 [ 143.610922][ T7575] show_stack+0x2c/0x3c [ 143.611713][ T7575] __dump_stack+0x30/0x40 [ 143.612540][ T7575] dump_stack_lvl+0xf4/0x15c [ 143.613373][ T7575] dump_stack+0x1c/0x5c [ 143.614266][ T7575] should_fail_ex+0x3cc/0x524 [ 143.615219][ T7575] __should_failslab+0xc0/0x11c [ 143.616139][ T7575] should_failslab+0x10/0x28 [ 143.616981][ T7575] slab_pre_alloc_hook+0x6c/0x31c [ 143.617925][ T7575] kmem_cache_alloc_lru+0x60/0x284 [ 143.618894][ T7575] proc_alloc_inode+0x2c/0xb8 [ 143.619786][ T7575] new_inode_pseudo+0x68/0x1cc [ 143.620666][ T7575] new_inode+0x38/0x174 [ 143.621432][ T7575] proc_get_inode+0x30/0x624 [ 143.622292][ T7575] proc_fill_super+0x40c/0x6ac [ 143.623138][ T7575] get_tree_nodev+0xb4/0x16c [ 143.623977][ T7575] proc_get_tree+0x28/0x38 [ 143.624761][ T7575] vfs_get_tree+0x90/0x278 [ 143.625510][ T7575] do_new_mount+0x228/0x804 [ 143.626393][ T7575] path_mount+0x5ac/0xe6c [ 143.627151][ T7575] __arm64_sys_mount+0x4a0/0x5a0 [ 143.628091][ T7575] invoke_syscall+0x98/0x290 [ 143.628923][ T7575] el0_svc_common+0x13c/0x258 [ 143.629801][ T7575] do_el0_svc+0x5c/0x134 [ 143.630586][ T7575] el0_svc+0x58/0x128 [ 143.631294][ T7575] el0t_64_sync_handler+0x84/0xf0 [ 143.632192][ T7575] el0t_64_sync+0x18c/0x190 [ 143.641904][ T7575] proc_fill_super: get root inode failed [ 143.822816][ T7605] FAULT_INJECTION: forcing a failure. [ 143.822816][ T7605] name failslab, interval 1, probability 0, space 0, times 0 [ 143.825102][ T7605] CPU: 0 PID: 7605 Comm: syz.6.782 Not tainted syzkaller #0 [ 143.826286][ T7605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 143.828053][ T7605] Call trace: [ 143.828687][ T7605] dump_backtrace+0x1c4/0x1f0 [ 143.829585][ T7605] show_stack+0x2c/0x3c [ 143.830379][ T7605] __dump_stack+0x30/0x40 [ 143.831216][ T7605] dump_stack_lvl+0xf4/0x15c [ 143.832041][ T7605] dump_stack+0x1c/0x5c [ 143.832783][ T7605] should_fail_ex+0x3cc/0x524 [ 143.833635][ T7605] __should_failslab+0xc0/0x11c [ 143.834505][ T7605] should_failslab+0x10/0x28 [ 143.835363][ T7605] __kmem_cache_alloc_node+0x7c/0x318 [ 143.836389][ T7605] kmalloc_trace+0x48/0x94 [ 143.837214][ T7605] __arm64_sys_fspick+0x214/0x388 [ 143.838149][ T7605] invoke_syscall+0x98/0x290 [ 143.839001][ T7605] el0_svc_common+0x13c/0x258 [ 143.839872][ T7605] do_el0_svc+0x5c/0x134 [ 143.840656][ T7605] el0_svc+0x58/0x128 [ 143.841432][ T7605] el0t_64_sync_handler+0x84/0xf0 [ 143.842378][ T7605] el0t_64_sync+0x18c/0x190 [ 143.881356][ T7610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.887099][ T7610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.074975][ T7626] netlink: 'syz.7.777': attribute type 1 has an invalid length. [ 144.076456][ T7626] netlink: 'syz.7.777': attribute type 2 has an invalid length. [ 144.077900][ T7626] netlink: 'syz.7.777': attribute type 7 has an invalid length. [ 144.405421][ T7635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.414233][ T7635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.417323][ T7636] netlink: 4 bytes leftover after parsing attributes in process `syz.6.784'. [ 144.441187][ T7636] netlink: 12 bytes leftover after parsing attributes in process `syz.6.784'. [ 144.452044][ T7635] can: request_module (can-proto-0) failed. [ 145.347121][ T7701] 9pnet_fd: Insufficient options for proto=fd [ 145.573267][ T7716] netlink: 'syz.5.797': attribute type 1 has an invalid length. [ 145.574606][ T7716] netlink: 'syz.5.797': attribute type 2 has an invalid length. [ 145.575965][ T7716] netlink: 'syz.5.797': attribute type 7 has an invalid length. [ 145.997554][ T113] atkbd serio3: keyboard reset failed on [ 146.284429][ T7756] FAULT_INJECTION: forcing a failure. [ 146.284429][ T7756] name failslab, interval 1, probability 0, space 0, times 0 [ 146.286640][ T7756] CPU: 1 PID: 7756 Comm: syz.5.801 Not tainted syzkaller #0 [ 146.288090][ T7756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 146.290049][ T7756] Call trace: [ 146.290690][ T7756] dump_backtrace+0x1c4/0x1f0 [ 146.291615][ T7756] show_stack+0x2c/0x3c [ 146.292434][ T7756] __dump_stack+0x30/0x40 [ 146.293285][ T7756] dump_stack_lvl+0xf4/0x15c [ 146.294175][ T7756] dump_stack+0x1c/0x5c [ 146.294988][ T7756] should_fail_ex+0x3cc/0x524 [ 146.295898][ T7756] __should_failslab+0xc0/0x11c [ 146.296930][ T7756] should_failslab+0x10/0x28 [ 146.297872][ T7756] __kmem_cache_alloc_node+0x7c/0x318 [ 146.299033][ T7756] __kmalloc+0xc4/0x180 [ 146.299947][ T7756] memcg_list_lru_alloc+0x280/0x8bc [ 146.301072][ T7756] slab_pre_alloc_hook+0x2cc/0x31c [ 146.302036][ T7756] kmem_cache_alloc_lru+0x60/0x284 [ 146.303000][ T7756] proc_alloc_inode+0x2c/0xb8 [ 146.303902][ T7756] new_inode_pseudo+0x68/0x1cc [ 146.304918][ T7756] new_inode+0x38/0x174 [ 146.305808][ T7756] proc_get_inode+0x30/0x624 [ 146.306758][ T7756] proc_fill_super+0x40c/0x6ac [ 146.307755][ T7756] get_tree_nodev+0xb4/0x16c [ 146.308704][ T7756] proc_get_tree+0x28/0x38 [ 146.309611][ T7756] vfs_get_tree+0x90/0x278 [ 146.310477][ T7756] do_new_mount+0x228/0x804 [ 146.311437][ T7756] path_mount+0x5ac/0xe6c [ 146.312322][ T7756] __arm64_sys_mount+0x4a0/0x5a0 [ 146.313359][ T7756] invoke_syscall+0x98/0x290 [ 146.314355][ T7756] el0_svc_common+0x13c/0x258 [ 146.315391][ T7756] do_el0_svc+0x5c/0x134 [ 146.316320][ T7756] el0_svc+0x58/0x128 [ 146.317167][ T7756] el0t_64_sync_handler+0x84/0xf0 [ 146.318238][ T7756] el0t_64_sync+0x18c/0x190 [ 146.319232][ C1] vkms_vblank_simulate: vblank timer overrun [ 146.452905][ T7756] proc_fill_super: get root inode failed [ 146.663068][ T7798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.678486][ T7798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.035328][ T7812] scsi_nl_rcv_msg: discarding partial skb [ 147.427039][ T7848] netlink: 14 bytes leftover after parsing attributes in process `syz.7.815'. [ 147.429087][ T7848] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.638844][ T7861] netlink: 'syz.6.814': attribute type 1 has an invalid length. [ 147.640583][ T7861] netlink: 'syz.6.814': attribute type 2 has an invalid length. [ 147.642021][ T7861] netlink: 'syz.6.814': attribute type 7 has an invalid length. [ 147.888982][ T7848] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 149.047826][ T6080] atkbd serio6: keyboard reset failed on [ 149.244473][ T7920] Device name cannot be null; rc = [-22] [ 149.330378][ T113] kernel read not supported for file /dsp1 (pid: 113 comm: kworker/0:2) [ 150.417808][ T7947] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 150.419511][ T7947] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 150.426759][ T7949] FAULT_INJECTION: forcing a failure. [ 150.426759][ T7949] name failslab, interval 1, probability 0, space 0, times 0 [ 150.429448][ T7949] CPU: 1 PID: 7949 Comm: syz.6.856 Not tainted syzkaller #0 [ 150.430713][ T7949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 150.432310][ T7949] Call trace: [ 150.432845][ T7949] dump_backtrace+0x1c4/0x1f0 [ 150.433618][ T7949] show_stack+0x2c/0x3c [ 150.434259][ T7949] __dump_stack+0x30/0x40 [ 150.434957][ T7949] dump_stack_lvl+0xf4/0x15c [ 150.435745][ T7949] dump_stack+0x1c/0x5c [ 150.436459][ T7949] should_fail_ex+0x3cc/0x524 [ 150.437245][ T7949] __should_failslab+0xc0/0x11c [ 150.438099][ T7949] should_failslab+0x10/0x28 [ 150.438898][ T7949] slab_pre_alloc_hook+0x6c/0x31c [ 150.439820][ T7949] kmem_cache_alloc_lru+0x60/0x284 [ 150.440722][ T7949] __d_alloc+0x40/0x68c [ 150.441463][ T7949] d_alloc_name+0xbc/0x2a8 [ 150.442216][ T7949] proc_setup_thread_self+0xa8/0x280 [ 150.443137][ T7949] proc_fill_super+0x46c/0x6ac [ 150.444008][ T7949] get_tree_nodev+0xb4/0x16c [ 150.444831][ T7949] proc_get_tree+0x28/0x38 [ 150.445619][ T7949] vfs_get_tree+0x90/0x278 [ 150.446399][ T7949] do_new_mount+0x228/0x804 [ 150.447223][ T7949] path_mount+0x5ac/0xe6c [ 150.448002][ T7949] __arm64_sys_mount+0x4a0/0x5a0 [ 150.448909][ T7949] invoke_syscall+0x98/0x290 [ 150.449719][ T7949] el0_svc_common+0x13c/0x258 [ 150.450535][ T7949] do_el0_svc+0x5c/0x134 [ 150.451288][ T7949] el0_svc+0x58/0x128 [ 150.451992][ T7949] el0t_64_sync_handler+0x84/0xf0 [ 150.452901][ T7949] el0t_64_sync+0x18c/0x190 [ 150.456392][ T7949] proc_fill_super: can't allocate /proc/thread-self [ 150.640962][ T7974] misc userio: The device must be registered before sending interrupts [ 151.162681][ T7992] sctp: [Deprecated]: syz.7.873 (pid 7992) Use of struct sctp_assoc_value in delayed_ack socket option. [ 151.162681][ T7992] Use struct sctp_sack_info instead [ 151.351162][ T7956] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 151.367283][ T7956] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 151.546993][ T8001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.548788][ T8001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.655110][ T7956] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.656580][ T7956] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.658379][ T7956] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.659822][ T7956] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.740677][ T8003] misc userio: The device must be registered before sending interrupts [ 151.936251][ T8020] netlink: 'syz.1.878': attribute type 1 has an invalid length. [ 151.937863][ T8020] netlink: 'syz.1.878': attribute type 2 has an invalid length. [ 151.939313][ T8020] netlink: 'syz.1.878': attribute type 7 has an invalid length. [ 152.208896][ T8015] FAULT_INJECTION: forcing a failure. [ 152.208896][ T8015] name failslab, interval 1, probability 0, space 0, times 0 [ 152.211185][ T8015] CPU: 0 PID: 8015 Comm: syz.6.880 Not tainted syzkaller #0 [ 152.212341][ T8015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 152.213937][ T8015] Call trace: [ 152.214441][ T8015] dump_backtrace+0x1c4/0x1f0 [ 152.215173][ T8015] show_stack+0x2c/0x3c [ 152.215844][ T8015] __dump_stack+0x30/0x40 [ 152.216555][ T8015] dump_stack_lvl+0xf4/0x15c [ 152.217283][ T8015] dump_stack+0x1c/0x5c [ 152.218044][ T8015] should_fail_ex+0x3cc/0x524 [ 152.219051][ T8015] __should_failslab+0xc0/0x11c [ 152.220104][ T8015] should_failslab+0x10/0x28 [ 152.221078][ T8015] slab_pre_alloc_hook+0x6c/0x31c [ 152.222104][ T8015] kmem_cache_alloc_lru+0x60/0x284 [ 152.223123][ T8015] __d_alloc+0x40/0x68c [ 152.224023][ T8015] d_alloc_name+0xbc/0x2a8 [ 152.224934][ T8015] devpts_pty_new+0x2c4/0x548 [ 152.225788][ T8015] ptmx_open+0x1d0/0x2d4 [ 152.226557][ T8015] chrdev_open+0x3d0/0x51c [ 152.227356][ T8015] do_dentry_open+0x738/0xf8c [ 152.228205][ T8015] vfs_open+0x7c/0x90 [ 152.228945][ T8015] path_openat+0x1fc0/0x27a0 [ 152.229783][ T8015] do_filp_open+0x198/0x38c [ 152.230622][ T8015] do_sys_openat2+0x134/0x3fc [ 152.231470][ T8015] __arm64_sys_openat+0x11c/0x150 [ 152.232367][ T8015] invoke_syscall+0x98/0x290 [ 152.233208][ T8015] el0_svc_common+0x13c/0x258 [ 152.234046][ T8015] do_el0_svc+0x5c/0x134 [ 152.234824][ T8015] el0_svc+0x58/0x128 [ 152.235549][ T8015] el0t_64_sync_handler+0x84/0xf0 [ 152.236492][ T8015] el0t_64_sync+0x18c/0x190 [ 152.287012][ T8031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.885'. [ 152.352402][ T8037] misc userio: The device must be registered before sending interrupts [ 152.769044][ T8045] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 152.788380][ T8050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.792206][ T8050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.086318][ T8090] misc userio: No port type given on /dev/userio [ 153.089161][ T8090] misc userio: The device must be registered before sending interrupts [ 153.175779][ T8101] netlink: 'syz.6.904': attribute type 1 has an invalid length. [ 153.196358][ T8101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.215575][ T8101] bond0: (slave geneve2): making interface the new active one [ 153.256349][ T8101] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 153.260225][ T4997] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 153.330211][ T8112] netlink: 'syz.1.901': attribute type 1 has an invalid length. [ 153.331607][ T8112] netlink: 'syz.1.901': attribute type 2 has an invalid length. [ 153.332935][ T8112] netlink: 'syz.1.901': attribute type 7 has an invalid length. [ 153.622965][ T8119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.624982][ T8119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.317271][ T8145] FAULT_INJECTION: forcing a failure. [ 154.317271][ T8145] name failslab, interval 1, probability 0, space 0, times 0 [ 154.323156][ T8145] CPU: 1 PID: 8145 Comm: syz.1.916 Not tainted syzkaller #0 [ 154.324510][ T8145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 154.326399][ T8145] Call trace: [ 154.327091][ T8145] dump_backtrace+0x1c4/0x1f0 [ 154.328081][ T8145] show_stack+0x2c/0x3c [ 154.328966][ T8145] __dump_stack+0x30/0x40 [ 154.329890][ T8145] dump_stack_lvl+0xf4/0x15c [ 154.330799][ T8145] dump_stack+0x1c/0x5c [ 154.331639][ T8145] should_fail_ex+0x3cc/0x524 [ 154.332563][ T8145] __should_failslab+0xc0/0x11c [ 154.333431][ T8145] should_failslab+0x10/0x28 [ 154.334260][ T8145] __kmem_cache_alloc_node+0x7c/0x318 [ 154.335249][ T8145] kmalloc_trace+0x48/0x94 [ 154.336067][ T8145] sctp_add_bind_addr+0x9c/0x2e8 [ 154.336958][ T8145] sctp_copy_local_addr_list+0x2d4/0x474 [ 154.338050][ T8145] sctp_copy_one_addr+0xb0/0x33c [ 154.339051][ T8145] sctp_bind_addr_copy+0x178/0x39c [ 154.340043][ T8145] sctp_assoc_set_bind_addr_from_ep+0x128/0x184 [ 154.341357][ T8145] sctp_connect_new_asoc+0x28c/0x5f4 [ 154.342476][ T8145] __sctp_connect+0x4bc/0xb54 [ 154.343482][ T8145] sctp_inet_connect+0x124/0x1d8 [ 154.344536][ T8145] __sys_connect+0x28c/0x2b4 [ 154.345523][ T8145] __arm64_sys_connect+0x7c/0x94 [ 154.346595][ T8145] invoke_syscall+0x98/0x290 [ 154.347596][ T8145] el0_svc_common+0x13c/0x258 [ 154.348613][ T8145] do_el0_svc+0x5c/0x134 [ 154.349505][ T8145] el0_svc+0x58/0x128 [ 154.350371][ T8145] el0t_64_sync_handler+0x84/0xf0 [ 154.351379][ T8145] el0t_64_sync+0x18c/0x190 [ 154.366753][ T8147] device syzkaller0 entered promiscuous mode [ 154.406405][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x1192 instead [ 154.415836][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 154.417928][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 154.419757][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 154.421612][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 154.423308][ T8149] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001998: 0x00e4 instead [ 154.430525][ T8149] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 154.432063][ T8149] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 154.466534][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x1192 instead [ 154.471547][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 154.473770][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 154.475798][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 154.477979][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 154.479953][ T8151] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001998: 0x00e4 instead [ 154.486933][ T8151] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 154.494350][ T8151] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 154.535273][ T8153] netlink: 12 bytes leftover after parsing attributes in process `syz.1.920'. [ 154.539975][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x1192 instead [ 154.542501][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 154.544569][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 154.546798][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 154.552102][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 154.554069][ T8153] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001998: 0x00e4 instead [ 154.563314][ T8153] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 154.565074][ T8153] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 154.590395][ T8155] netlink: 8 bytes leftover after parsing attributes in process `syz.5.921'. [ 154.615271][ T27] audit: type=1400 audit(154.600:63): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=8154 comm="syz.5.921" [ 154.693945][ T8160] netlink: 28 bytes leftover after parsing attributes in process `syz.5.924'. [ 154.695708][ T8160] netlink: 28 bytes leftover after parsing attributes in process `syz.5.924'. [ 154.697739][ T8160] netlink: 8 bytes leftover after parsing attributes in process `syz.5.924'. [ 155.091185][ T4347] Bluetooth: Wrong link type (-71) [ 155.092376][ T4347] Bluetooth: hci6: link tx timeout [ 155.093702][ T4347] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 155.176528][ T8170] misc userio: No port type given on /dev/userio [ 155.178343][ T8170] misc userio: The device must be registered before sending interrupts [ 155.204954][ T8171] device syzkaller0 entered promiscuous mode [ 155.461128][ T8178] binder: 8176:8178 tried to acquire reference to desc 0, got 1 instead [ 155.464991][ T8178] binder: 8176:8178 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 155.471000][ T8178] binder: 8178 RLIMIT_NICE not set [ 155.473473][ T8178] binder: 8178 RLIMIT_NICE not set [ 155.475574][ T8178] binder: 8176:8178 ioctl c0306201 0 returned -14 [ 155.479279][ T8178] binder: 8176:8178 got new transaction with bad transaction stack, transaction 53 has target 8176:8178 [ 155.482660][ T8178] binder: 8176:8178 transaction call to 8176:0 failed 54/29201/-71, size 0-0 line 3122 [ 155.487228][ T4376] binder: release 8176:8178 transaction 53 out, still active [ 155.488789][ T4376] binder: undelivered TRANSACTION_COMPLETE [ 155.489837][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 155.498693][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x1192 instead [ 155.500782][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 155.502646][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 155.502847][ T4376] binder: release 8176:8178 transaction 53 in, still active [ 155.504812][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 155.505819][ T4376] binder: send failed reply for transaction 53, target dead [ 155.516344][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 155.518395][ T8179] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001998: 0x00e4 instead [ 155.524927][ T8179] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 155.526374][ T8179] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 155.586346][ T8185] binder: 8182:8185 tried to acquire reference to desc 0, got 1 instead [ 155.594687][ T8185] binder: 8182:8185 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 155.605852][ T8185] binder: 8185 RLIMIT_NICE not set [ 155.606808][ T8185] binder: 8185 RLIMIT_NICE not set [ 155.623401][ T8185] binder: 8182:8185 ioctl c0306201 0 returned -14 [ 155.625644][ T8185] binder: 8182:8185 got new transaction with bad transaction stack, transaction 59 has target 8182:8185 [ 155.627712][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x1192 instead [ 155.627811][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 155.631490][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 155.633131][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 155.634935][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 155.636278][ T8185] binder: 8182:8185 transaction call to 8182:0 failed 60/29201/-71, size 0-0 line 3122 [ 155.643067][ T4376] binder: release 8182:8185 transaction 59 out, still active [ 155.644512][ T4376] binder: undelivered TRANSACTION_COMPLETE [ 155.645452][ T8184] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001998: 0x00e4 instead [ 155.645532][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 155.651500][ T8184] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 155.652967][ T8184] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 156.015074][ T8193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.934'. [ 156.050401][ T27] audit: type=1400 audit(156.040:64): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=8191 comm="syz.1.934" [ 156.071824][ T8194] netlink: 12 bytes leftover after parsing attributes in process `syz.7.933'. [ 156.086488][ T8197] MTD: Couldn't look up './dev/mtdblock0': -2 [ 156.980823][ T8231] FAULT_INJECTION: forcing a failure. [ 156.980823][ T8231] name failslab, interval 1, probability 0, space 0, times 0 [ 156.994669][ T8230] netlink: 28 bytes leftover after parsing attributes in process `syz.1.949'. [ 156.996458][ T8231] CPU: 1 PID: 8231 Comm: syz.5.948 Not tainted syzkaller #0 [ 156.997711][ T8231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 156.999534][ T8231] Call trace: [ 157.000157][ T8231] dump_backtrace+0x1c4/0x1f0 [ 157.001094][ T8231] show_stack+0x2c/0x3c [ 157.001890][ T8231] __dump_stack+0x30/0x40 [ 157.002745][ T8231] dump_stack_lvl+0xf4/0x15c [ 157.003634][ T8231] dump_stack+0x1c/0x5c [ 157.004413][ T8231] should_fail_ex+0x3cc/0x524 [ 157.005290][ T8231] __should_failslab+0xc0/0x11c [ 157.006210][ T8231] should_failslab+0x10/0x28 [ 157.007035][ T8231] __kmem_cache_alloc_node+0x7c/0x318 [ 157.008061][ T8231] __kmalloc+0xc4/0x180 [ 157.008814][ T8231] sctp_bind_addrs_to_raw+0x108/0x2c4 [ 157.009785][ T8231] sctp_make_init+0xdc/0x19f4 [ 157.010639][ T8231] sctp_sf_do_prm_asoc+0xb8/0x308 [ 157.011542][ T8231] sctp_do_sm+0x1e0/0x49ec [ 157.012326][ T8231] sctp_primitive_ASSOCIATE+0x98/0xcc [ 157.013278][ T8231] __sctp_connect+0x768/0xb54 [ 157.014107][ T8231] sctp_inet_connect+0x124/0x1d8 [ 157.015000][ T8231] __sys_connect+0x28c/0x2b4 [ 157.015810][ T8231] __arm64_sys_connect+0x7c/0x94 [ 157.016691][ T8231] invoke_syscall+0x98/0x290 [ 157.017512][ T8231] el0_svc_common+0x13c/0x258 [ 157.018357][ T8231] do_el0_svc+0x5c/0x134 [ 157.019125][ T8231] el0_svc+0x58/0x128 [ 157.019852][ T8231] el0t_64_sync_handler+0x84/0xf0 [ 157.020757][ T8231] el0t_64_sync+0x18c/0x190 [ 157.035088][ T8230] netlink: 28 bytes leftover after parsing attributes in process `syz.1.949'. [ 157.168186][ T4347] Bluetooth: hci6: command 0x0406 tx timeout [ 157.223632][ T8243] FAULT_INJECTION: forcing a failure. [ 157.223632][ T8243] name failslab, interval 1, probability 0, space 0, times 0 [ 157.523582][ T8236] __nla_validate_parse: 1 callbacks suppressed [ 157.523596][ T8236] netlink: 8 bytes leftover after parsing attributes in process `syz.7.951'. [ 157.541409][ T8243] CPU: 1 PID: 8243 Comm: syz.6.953 Not tainted syzkaller #0 [ 157.542787][ T8243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 157.544833][ T8243] Call trace: [ 157.545498][ T8243] dump_backtrace+0x1c4/0x1f0 [ 157.546457][ T8243] show_stack+0x2c/0x3c [ 157.547292][ T8243] __dump_stack+0x30/0x40 [ 157.548145][ T8243] dump_stack_lvl+0xf4/0x15c [ 157.549046][ T8243] dump_stack+0x1c/0x5c [ 157.549867][ T8243] should_fail_ex+0x3cc/0x524 [ 157.550809][ T8243] __should_failslab+0xc0/0x11c [ 157.551735][ T8243] should_failslab+0x10/0x28 [ 157.552629][ T8243] __kmem_cache_alloc_node+0x7c/0x318 [ 157.553686][ T8243] __kmalloc+0xc4/0x180 [ 157.554498][ T8243] __register_sysctl_table+0x844/0xc88 [ 157.555504][ T8243] setup_mq_sysctls+0x4b4/0x5b0 [ 157.556418][ T8243] copy_ipcs+0x298/0x4d4 [ 157.557220][ T8243] create_new_namespaces+0x1b0/0x604 [ 157.558190][ T8243] unshare_nsproxy_namespaces+0x108/0x160 [ 157.559234][ T8243] ksys_unshare+0x3f0/0x70c [ 157.560031][ T8243] __arm64_sys_unshare+0x3c/0x50 [ 157.560931][ T8243] invoke_syscall+0x98/0x290 [ 157.561769][ T8243] el0_svc_common+0x13c/0x258 [ 157.562604][ T8243] do_el0_svc+0x5c/0x134 [ 157.563365][ T8243] el0_svc+0x58/0x128 [ 157.564095][ T8243] el0t_64_sync_handler+0x84/0xf0 [ 157.564998][ T8243] el0t_64_sync+0x18c/0x190 [ 157.612439][ T8243] sysctl could not get directory: /fs -12 [ 157.614069][ T8243] CPU: 0 PID: 8243 Comm: syz.6.953 Not tainted syzkaller #0 [ 157.615253][ T8243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 157.617071][ T8243] Call trace: [ 157.617660][ T8243] dump_backtrace+0x1c4/0x1f0 [ 157.618505][ T8243] show_stack+0x2c/0x3c [ 157.619281][ T8243] __dump_stack+0x30/0x40 [ 157.620046][ T8243] dump_stack_lvl+0xf4/0x15c [ 157.620868][ T8243] dump_stack+0x1c/0x5c [ 157.621595][ T8243] __register_sysctl_table+0xc10/0xc88 [ 157.622551][ T8243] setup_mq_sysctls+0x4b4/0x5b0 [ 157.623409][ T8243] copy_ipcs+0x298/0x4d4 [ 157.624158][ T8243] create_new_namespaces+0x1b0/0x604 [ 157.625089][ T8243] unshare_nsproxy_namespaces+0x108/0x160 [ 157.626094][ T8243] ksys_unshare+0x3f0/0x70c [ 157.626940][ T8243] __arm64_sys_unshare+0x3c/0x50 [ 157.627859][ T8243] invoke_syscall+0x98/0x290 [ 157.628702][ T8243] el0_svc_common+0x13c/0x258 [ 157.629534][ T8243] do_el0_svc+0x5c/0x134 [ 157.630302][ T8243] el0_svc+0x58/0x128 [ 157.631041][ T8243] el0t_64_sync_handler+0x84/0xf0 [ 157.631945][ T8243] el0t_64_sync+0x18c/0x190 [ 157.746389][ T8262] [ 157.746906][ T8262] ====================================================== [ 157.748114][ T8262] WARNING: possible circular locking dependency detected [ 157.749337][ T8262] syzkaller #0 Not tainted [ 157.750151][ T8262] ------------------------------------------------------ [ 157.751394][ T8262] syz.1.964/8262 is trying to acquire lock: [ 157.752423][ T8262] ffff0000cb360428 (&hdev->lock){+.+.}-{3:3}, at: l2cap_chan_connect+0xd0/0xba0 [ 157.754086][ T8262] [ 157.754086][ T8262] but task is already holding lock: [ 157.755426][ T8262] ffff800017bb6ac8 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0xa8/0xcf4 [ 157.757039][ T8262] [ 157.757039][ T8262] which lock already depends on the new lock. [ 157.757039][ T8262] [ 157.758884][ T8262] [ 157.758884][ T8262] the existing dependency chain (in reverse order) is: [ 157.760516][ T8262] [ 157.760516][ T8262] -> #2 (rfcomm_mutex){+.+.}-{3:3}: [ 157.761842][ T8262] __mutex_lock_common+0x1a0/0x1f3c [ 157.762847][ T8262] mutex_lock_nested+0x38/0x44 [ 157.763767][ T8262] rfcomm_security_cfm+0x9c/0x674 [ 157.764745][ T8262] hci_auth_complete_evt+0x2e4/0xa68 [ 157.765768][ T8262] hci_event_packet+0x698/0xe60 [ 157.766741][ T8262] hci_rx_work+0x310/0xa70 [ 157.767680][ T8262] process_one_work+0x7e4/0x13bc [ 157.768674][ T8262] worker_thread+0x8cc/0xfe8 [ 157.769601][ T8262] kthread+0x254/0x2e0 [ 157.770422][ T8262] ret_from_fork+0x10/0x20 [ 157.771286][ T8262] [ 157.771286][ T8262] -> #1 (hci_cb_list_lock){+.+.}-{3:3}: [ 157.772732][ T8262] __mutex_lock_common+0x1a0/0x1f3c [ 157.773982][ T8262] mutex_lock_nested+0x38/0x44 [ 157.775038][ T8262] hci_remote_features_evt+0x410/0x840 [ 157.776235][ T8262] hci_event_packet+0x698/0xe60 [ 157.777322][ T8262] hci_rx_work+0x310/0xa70 [ 157.778279][ T8262] process_one_work+0x7e4/0x13bc [ 157.779365][ T8262] worker_thread+0x8cc/0xfe8 [ 157.780348][ T8262] kthread+0x254/0x2e0 [ 157.781222][ T8262] ret_from_fork+0x10/0x20 [ 157.782217][ T8262] [ 157.782217][ T8262] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 157.783544][ T8262] __lock_acquire+0x2808/0x6634 [ 157.784557][ T8262] lock_acquire+0x20c/0x638 [ 157.785532][ T8262] __mutex_lock_common+0x1a0/0x1f3c [ 157.786594][ T8262] mutex_lock_nested+0x38/0x44 [ 157.787580][ T8262] l2cap_chan_connect+0xd0/0xba0 [ 157.788647][ T8262] l2cap_sock_connect+0x414/0x600 [ 157.789709][ T8262] kernel_connect+0x124/0x190 [ 157.790719][ T8262] rfcomm_dlc_open+0x4f4/0xcf4 [ 157.791737][ T8262] rfcomm_sock_connect+0x25c/0x57c [ 157.792796][ T8262] __sys_connect+0x28c/0x2b4 [ 157.793718][ T8262] __arm64_sys_connect+0x7c/0x94 [ 157.794712][ T8262] invoke_syscall+0x98/0x290 [ 157.795630][ T8262] el0_svc_common+0x13c/0x258 [ 157.796584][ T8262] do_el0_svc+0x5c/0x134 [ 157.797432][ T8262] el0_svc+0x58/0x128 [ 157.798229][ T8262] el0t_64_sync_handler+0x84/0xf0 [ 157.799208][ T8262] el0t_64_sync+0x18c/0x190 [ 157.800108][ T8262] [ 157.800108][ T8262] other info that might help us debug this: [ 157.800108][ T8262] [ 157.801845][ T8262] Chain exists of: [ 157.801845][ T8262] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 157.801845][ T8262] [ 157.804085][ T8262] Possible unsafe locking scenario: [ 157.804085][ T8262] [ 157.805388][ T8262] CPU0 CPU1 [ 157.806327][ T8262] ---- ---- [ 157.807304][ T8262] lock(rfcomm_mutex); [ 157.808050][ T8262] lock(hci_cb_list_lock); [ 157.809307][ T8262] lock(rfcomm_mutex); [ 157.810604][ T8262] lock(&hdev->lock); [ 157.811422][ T8262] [ 157.811422][ T8262] *** DEADLOCK *** [ 157.811422][ T8262] [ 157.812925][ T8262] 1 lock held by syz.1.964/8262: [ 157.813851][ T8262] #0: ffff800017bb6ac8 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0xa8/0xcf4 [ 157.815606][ T8262] [ 157.815606][ T8262] stack backtrace: [ 157.816697][ T8262] CPU: 0 PID: 8262 Comm: syz.1.964 Not tainted syzkaller #0 [ 157.818007][ T8262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 157.819918][ T8262] Call trace: [ 157.820539][ T8262] dump_backtrace+0x1c4/0x1f0 [ 157.821370][ T8262] show_stack+0x2c/0x3c [ 157.822124][ T8262] __dump_stack+0x30/0x40 [ 157.822890][ T8262] dump_stack_lvl+0xf4/0x15c [ 157.823683][ T8262] dump_stack+0x1c/0x5c [ 157.824418][ T8262] print_circular_bug+0x148/0x1b0 [ 157.825318][ T8262] check_noncircular+0x264/0x2f8 [ 157.826222][ T8262] __lock_acquire+0x2808/0x6634 [ 157.827108][ T8262] lock_acquire+0x20c/0x638 [ 157.827898][ T8262] __mutex_lock_common+0x1a0/0x1f3c [ 157.828843][ T8262] mutex_lock_nested+0x38/0x44 [ 157.829692][ T8262] l2cap_chan_connect+0xd0/0xba0 [ 157.830586][ T8262] l2cap_sock_connect+0x414/0x600 [ 157.831477][ T8262] kernel_connect+0x124/0x190 [ 157.832300][ T8262] rfcomm_dlc_open+0x4f4/0xcf4 [ 157.833133][ T8262] rfcomm_sock_connect+0x25c/0x57c [ 157.834046][ T8262] __sys_connect+0x28c/0x2b4 [ 157.834853][ T8262] __arm64_sys_connect+0x7c/0x94 [ 157.835710][ T8262] invoke_syscall+0x98/0x290 [ 157.836529][ T8262] el0_svc_common+0x13c/0x258 [ 157.837346][ T8262] do_el0_svc+0x5c/0x134 [ 157.838092][ T8262] el0_svc+0x58/0x128 [ 157.838814][ T8262] el0t_64_sync_handler+0x84/0xf0 [ 157.839683][ T8262] el0t_64_sync+0x18c/0x190 [ 158.010478][ T48] Bluetooth: hci6: link tx timeout [ 158.011583][ T48] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 158.018526][ T8259] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 158.022215][ T8260] device syzkaller0 entered promiscuous mode [ 167.098459][ T4997] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.178395][ T4997] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.259276][ T4997] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.338894][ T4997] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.461960][ T4997] netdevsim netdevsim4 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.468927][ T4997] netdevsim netdevsim4 eth9: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.472097][ T4997] netdevsim netdevsim4 eth10: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.474773][ T4997] netdevsim netdevsim4 eth11: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.539329][ T4997] tipc: Left network mode