last executing test programs: 8.515388638s ago: executing program 0 (id=807): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0x2) listen(0xffffffffffffffff, 0xa) connect$rxrpc(r4, 0x0, 0x0) sendmsg(r4, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 7.110989582s ago: executing program 0 (id=813): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs]}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000340)=[@request_death]}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000005180)={0x2020}, 0x2020) 6.927754686s ago: executing program 0 (id=817): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000ac0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000b00)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000b40)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000b80)={0x8, 0x0, &(0x7f0000000bc0)=[@increfs]}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000c00)='./binderfs/binder0\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000002e00)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002fc0)={0x4c, 0x0, &(0x7f0000003000)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x48, 0x18, &(0x7f0000003080)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000003100)={0x0, 0x18, 0x30}}}]}) prlimit64(0x0, 0x7, &(0x7f0000003140), 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000003180)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f00000031c0)}) 5.996642208s ago: executing program 0 (id=823): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0x2) listen(0xffffffffffffffff, 0xa) connect$rxrpc(r4, 0x0, 0x0) sendmsg(r4, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 4.63770012s ago: executing program 0 (id=839): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="64000000100001060000000000000000000000003f000000000000000000000010000300766574683000000000000000100012", 0x33}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write(0xffffffffffffffff, &(0x7f0000000800)="2c0000001a000100000000000000000002200000000000000000000008000160e00000010800030001", 0x29) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000380)={0x4, 0x0, [{0xc0000001, 0x2, 0x1, 0x6, 0x7, 0x10001, 0x44}, {0xc0000000, 0xffff7fff, 0x2, 0x80000001, 0x1, 0x3ff, 0x2}, {0x80000008, 0x9, 0x0, 0x1000005, 0xfffffffc, 0x4, 0x80000001}, {0x80000007, 0x33, 0x4, 0xe, 0x10000, 0x0, 0x1}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.378397757s ago: executing program 4 (id=842): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="64000000100001060000000000000000000000003f000000000000000000000010000300766574683000000000000000100012000800010076657468180002000a00", 0x42}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000380)={0x5, 0x0, [{0xc0000001, 0x2, 0x1, 0x6, 0x7, 0x10001, 0x44}, {0xc0000000, 0xffff7fff, 0x2, 0x80000001, 0x1, 0x3ff, 0x2}, {0x80000008, 0x9, 0x0, 0x1000005, 0xfffffffc, 0x4, 0x80000001}, {0x80000008, 0xb, 0x2, 0x0, 0x8, 0x37b5c985, 0x9}, {0x80000007, 0x33, 0x4, 0xe, 0x10000, 0x0, 0x1}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.074946134s ago: executing program 0 (id=846): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x8000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000340)=0xf) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$TCFLSH(r2, 0x400455c8, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000380)=0x2) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0xd) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000400)=0x3) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000440)=0x7) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000480)=0x1e) 3.746468081s ago: executing program 1 (id=849): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x2, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x2, 0xffffffff, 0x91, 0x4, 0x4, 0x16, 0x10, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x1, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x8, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa3, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x3, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xffff, 0x4, 0x2, 0x7, 0x6, 0x2, 0x1, 0x4e162a2a, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1001, 0x80000004, 0x6, 0x438, 0x5, 0x9, 0x7, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x2, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x9e9, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf47, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x7973, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0x2, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.306273222s ago: executing program 4 (id=850): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000700)=0x2000008, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(0xffffffffffffffff, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) listen(0xffffffffffffffff, 0xa) connect$rxrpc(r3, 0x0, 0x0) sendmsg(r3, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 2.923165991s ago: executing program 3 (id=853): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs]}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000340)=[@request_death]}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000005180)={0x2020}, 0x2020) 2.763218785s ago: executing program 3 (id=855): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="e0000000000101040000000000000000020000001c00188008000140a080000008000240000000020800034000000002240001801400018008000100e000000108000200e00000010c0002800500010000000000040016404400108008000140fffff800080002400000000108000140ffff1fc508000140000006870800014000000004080003"], 0xe0}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.645399458s ago: executing program 1 (id=856): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="64000000100001060000000000000000000000003f000000000000000000000010000300766574683000000000000000100012", 0x33}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write(0xffffffffffffffff, &(0x7f0000000800)="2c0000001a000100000000000000000002200000000000000000000008000160e00000010800030001", 0x29) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000380)={0x4, 0x0, [{0xc0000001, 0x2, 0x1, 0x6, 0x7, 0x10001, 0x44}, {0xc0000000, 0xffff7fff, 0x2, 0x80000001, 0x1, 0x3ff, 0x2}, {0x80000008, 0x9, 0x0, 0x1000005, 0xfffffffc, 0x4, 0x80000001}, {0x80000007, 0x33, 0x4, 0xe, 0x10000, 0x0, 0x1}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.55384786s ago: executing program 3 (id=857): socket$inet6(0xa, 0x80001, 0x100) 2.360425065s ago: executing program 3 (id=859): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000100), 0x12) read$FUSE(r0, &(0x7f00000014c0)={0x2020}, 0x2020) 2.206080288s ago: executing program 2 (id=860): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="64000000100001060000000000000000000000003f000000000000000000000010000300766574683000000000000000100012000800010076657468180002000a00", 0x42}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000380)={0x5, 0x0, [{0xc0000001, 0x2, 0x1, 0x6, 0x7, 0x10001, 0x44}, {0xc0000000, 0xffff7fff, 0x2, 0x80000001, 0x1, 0x3ff, 0x2}, {0x80000008, 0x9, 0x0, 0x1000005, 0xfffffffc, 0x4, 0x80000001}, {0x80000008, 0xb, 0x2, 0x0, 0x8, 0x37b5c985, 0x9}, {0x80000007, 0x33, 0x4, 0xe, 0x10000, 0x0, 0x1}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.205903818s ago: executing program 3 (id=861): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000700)=0x2000008, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(0xffffffffffffffff, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) listen(0xffffffffffffffff, 0xa) connect$rxrpc(r3, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[{0x10, 0x110, 0xe}], 0x10}, 0x0) 2.016258082s ago: executing program 4 (id=862): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000380)={0x4, 0x0, [{0xc0000001, 0x2, 0x1, 0x6, 0x7, 0x10001, 0x44}, {0xc0000000, 0xffff7fff, 0x2, 0x80000001, 0x1, 0x3ff, 0x2}, {0x80000008, 0x9, 0x0, 0x1000005, 0xfffffffc, 0x4, 0x80000001}, {0x80000007, 0x33, 0x4, 0xe, 0x10000, 0x0, 0x1}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.566395153s ago: executing program 4 (id=863): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) write(r0, &(0x7f0000000100)='27', 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) 1.511524934s ago: executing program 1 (id=864): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000ac0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000b00)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000b40)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000b80)={0x8, 0x0, &(0x7f0000000bc0)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000c00)='./binderfs/binder0\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000002e40)={0x54, 0x0, &(0x7f0000002e80)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f0000002f00)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000002f80)={0x0, 0x28, 0x40}}, 0x1000}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002fc0)={0x4c, 0x0, &(0x7f0000003000)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x48, 0x18, &(0x7f0000003080)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000003100)={0x0, 0x18, 0x30}}}]}) prlimit64(0x0, 0x7, &(0x7f0000003140), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000003180)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f00000031c0)}) 1.170003122s ago: executing program 1 (id=865): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs]}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000005180)={0x2020}, 0x2020) 1.050151385s ago: executing program 4 (id=866): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x2, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x2, 0xffffffff, 0x91, 0x4, 0x4, 0x16, 0x10, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x1, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x8, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa3, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x3, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xffff, 0x4, 0x2, 0x7, 0x6, 0x2, 0x1, 0x4e162a2a, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1001, 0x80000004, 0x6, 0x438, 0x5, 0x9, 0x7, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x2, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x9e9, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf47, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x7973, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0x2, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) ioctl$KVM_RUN(r5, 0xae80, 0x0) 972.778097ms ago: executing program 2 (id=867): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}]}], {0x14}}, 0x48}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) 883.48472ms ago: executing program 2 (id=868): bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x0}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104", @ANYBLOB="000000000000000028001280"], 0x48}}, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280), 0x22802, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 662.830905ms ago: executing program 3 (id=869): openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000600)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000640)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000700)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000740)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000780)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000800)=[@acquire]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000840)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000900)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000980)={0x0, 0x18, 0x30}}}]}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000a00)}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000a40), 0x40002, 0x0) epoll_create1(0x80000) pselect6(0x40, &(0x7f0000000a80)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000ac0)={0x1ff, 0x1000000000, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000b00)={0x44, 0x0, &(0x7f0000000b40)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) 589.031456ms ago: executing program 2 (id=870): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x8000) 430.27694ms ago: executing program 2 (id=871): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000140)=0x1a6, 0x4) sendmmsg$inet(r0, &(0x7f0000000280)=[{{&(0x7f0000000300)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) recvfrom(r0, 0x0, 0x0, 0x2100, 0x0, 0x0) 385.920751ms ago: executing program 2 (id=872): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000700)=0x2000008, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(0xffffffffffffffff, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) listen(0xffffffffffffffff, 0xa) connect$rxrpc(r3, 0x0, 0x0) sendmsg(r3, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 255.926694ms ago: executing program 1 (id=873): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000200)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x0, [0x39, 0x3, 0x4000401, 0x8, 0xe, 0x0, 0x0, 0x6, 0x3, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0xfffffffd, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x8, 0x0, 0x0, 0xfffffffd, 0x0, 0x7fffffff, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0x800000, 0x0, 0xffff8001, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x2, 0x5, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x2, 0x0, 0x5, 0x400, 0x0, 0x0, 0x8, 0x40000, 0x0, 0xc0804000, 0x100, 0x0, 0xfffffffd, 0x4, 0x0, 0x10000, 0x0, 0x0, 0x5, 0x4, 0x7, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0xfffffffe, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0xc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x8000, 0x0, 0x20, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0xe, 0x80000000, 0x2, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0xfffffffd, 0xf, 0x3, 0xffffff85, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4, 0xf88, 0x0, 0x0, 0x0, 0x7ff], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffefffe, 0x0, 0x2, 0x4, 0xfffffffc, 0xffffffff, 0x0, 0x2, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10, 0x5, 0xfffffffe, 0xfff, 0x8, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x1, 0x200, 0x8000000, 0x4, 0xffffffff, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) 29.60525ms ago: executing program 1 (id=874): syz_open_dev$sndmidi(&(0x7f0000000280), 0x2, 0x143102) r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda44300009040101010102300009050109"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/c1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000001c0)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/c1/comms/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000300)='1\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/dlm/c1/comms/1/addr\x00', 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) write(r1, &(0x7f0000000400)="020000007f00000100"/128, 0x80) 0s ago: executing program 4 (id=875): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001280)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000012c0), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000013c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001440)={&(0x7f0000001480)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbf, {0x0, 0x0, 0x0, r4, {0x5, 0x3da48c8682330ab8}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x2, 0x7, 0x2}, {{0x1, 0x0, 0x0, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x5, 0x1, 0x1}, {0x8, 0x1, 0x7, 0x2, 0x5, 0x1}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20045081}, 0x20004004) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000001500)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f0000001540)={&(0x7f0000001580)=@xdp={0x2c, 0x7, r4, 0x3d}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001640)="5b9d6d112901364495", 0x9}], 0x1}, 0x5) kernel console output (not intermixed with test programs): 3][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.303880][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.320025][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.329920][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.348378][ T4195] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.358057][ T4195] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.367904][ T4195] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.378180][ T4195] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.418167][ T4193] device veth1_macvtap entered promiscuous mode [ 72.465730][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.477462][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.493519][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.504882][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.521953][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.533169][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.545618][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.588468][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.604015][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.619943][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.631709][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.641741][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.652446][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.664925][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.675776][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.688839][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.700944][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.712752][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.723118][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.733820][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.746817][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.759132][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.769411][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.779702][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.789071][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.800994][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.810716][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.820024][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.829007][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.838041][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.847121][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.856101][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.864114][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.889236][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.903245][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.913556][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.927888][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.938139][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.948808][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.960600][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.977991][ T4189] device veth0_vlan entered promiscuous mode [ 73.007637][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.018501][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.069268][ T4189] device veth1_vlan entered promiscuous mode [ 73.083299][ T4193] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.100269][ T4193] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.109877][ T4193] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.123050][ T4193] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.174032][ T1238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.201510][ T1238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.215028][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.223406][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.253058][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.267742][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.276596][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.285214][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.293222][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.304475][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.321477][ T4189] device veth0_macvtap entered promiscuous mode [ 73.381060][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.390878][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.408614][ T4189] device veth1_macvtap entered promiscuous mode [ 73.426654][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.442766][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.453244][ T629] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.473446][ T629] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.484717][ T1238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.492597][ T1238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.510771][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.522938][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.577315][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.595528][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.605870][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.629350][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.645569][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.656181][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.667645][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.678673][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.691625][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.699886][ T4260] Bluetooth: hci0: command 0x0419 tx timeout [ 73.719009][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.730122][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.740214][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.750795][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.761160][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.772041][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.775510][ T4260] Bluetooth: hci1: command 0x0419 tx timeout [ 73.788095][ T4260] Bluetooth: hci2: command 0x0419 tx timeout [ 73.795510][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.806433][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.819204][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.828969][ T4259] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.837000][ T4259] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.845186][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.854080][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.855582][ T4260] Bluetooth: hci4: command 0x0419 tx timeout [ 73.874060][ T4260] Bluetooth: hci3: command 0x0419 tx timeout [ 73.894926][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.910736][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.920433][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.962398][ T4189] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.976534][ T4189] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.994912][ T4189] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.013737][ T4189] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.038324][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.087454][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.095334][ T629] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.103283][ T629] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.118779][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.130491][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.293539][ T629] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.316093][ T629] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.331620][ T4304] ubi0: attaching mtd0 [ 74.352371][ T4307] loop7: detected capacity change from 0 to 7 [ 74.363266][ T4304] ubi0: scanning is finished [ 74.370602][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.394743][ T4304] ubi0: empty MTD device detected [ 74.418182][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.429747][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.443889][ T629] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.457975][ T629] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.469185][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.477843][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.489192][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.511298][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.522332][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.530981][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.542008][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.555724][ T4308] batman_adv: batadv0: Adding interface: syzkaller0 [ 74.557368][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.573458][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.583303][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.583842][ T4308] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.594325][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.610532][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.640123][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.651621][ T4308] batman_adv: batadv0: Interface activated: syzkaller0 [ 74.658850][ T4307] ldm_validate_partition_table(): Disk read failed. [ 74.693209][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.704255][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.714185][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.725189][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.742837][ C0] blk_update_request: I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 74.753887][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 74.772780][ T4307] Dev loop7: unable to read RDB block 0 [ 74.805273][ T4305] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 74.824023][ T4307] loop7: unable to read partition table [ 74.831378][ T4304] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 74.847731][ T4307] loop7: partition table beyond EOD, truncated [ 74.864860][ T4304] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 74.873898][ T4307] loop_reread_partitions: partition scan of loop7 (Cj̖4FLQk5) failed (rc=-5) [ 74.905330][ T4304] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 74.912491][ T4304] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 74.915606][ T4305] batman_adv: batadv0: Removing interface: syzkaller0 [ 74.927845][ T4309] ldm_validate_partition_table(): Disk read failed. [ 74.945070][ T4304] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 74.962945][ T4304] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 74.981736][ T4304] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3576184258 [ 74.992446][ T4309] Dev loop7: unable to read RDB block 0 [ 75.002114][ T4309] loop7: unable to read partition table [ 75.014237][ T4304] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 75.031581][ T4309] loop7: partition table beyond EOD, truncated [ 75.044701][ T4314] ubi0: background thread "ubi_bgt0d" started, PID 4314 [ 75.106114][ T4313] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 75.153427][ T4315] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5'. [ 75.204304][ T4318] netlink: 'syz.4.5': attribute type 10 has an invalid length. [ 75.211956][ T4318] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5'. [ 75.279300][ T4318] device dummy0 entered promiscuous mode [ 75.302949][ T4322] FAULT_INJECTION: forcing a failure. [ 75.302949][ T4322] name failslab, interval 1, probability 0, space 0, times 1 [ 75.423184][ T26] audit: type=1800 audit(1792171839.691:2): pid=4324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="memory_backed" dev="configfs" ino=32587 res=0 errno=0 [ 75.445284][ T4322] CPU: 1 PID: 4322 Comm: syz.0.8 Not tainted syzkaller #0 [ 75.452464][ T4322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 75.462583][ T4322] Call Trace: [ 75.465898][ T4322] [ 75.468886][ T4322] dump_stack_lvl+0x188/0x250 [ 75.473638][ T4322] ? show_regs_print_info+0x20/0x20 [ 75.479070][ T4322] ? load_image+0x410/0x410 [ 75.483693][ T4322] ? __might_sleep+0xf0/0xf0 [ 75.488357][ T4322] ? __lock_acquire+0x7d40/0x7d40 [ 75.493445][ T4322] should_fail+0x383/0x4b0 [ 75.497915][ T4322] should_failslab+0x5/0x20 [ 75.502586][ T4322] slab_pre_alloc_hook+0x51/0xc0 [ 75.507583][ T4322] kmem_cache_alloc_trace+0x47/0x290 [ 75.513173][ T4322] ? nci_hci_allocate+0x4f/0x2a0 [ 75.518171][ T4322] nci_hci_allocate+0x4f/0x2a0 [ 75.523077][ T4322] nci_allocate_device+0x205/0x350 [ 75.528238][ T4322] virtual_ncidev_open+0x41/0xc0 [ 75.533237][ T4322] ? virtual_ncidev_ioctl+0x90/0x90 [ 75.533252][ T26] audit: type=1800 audit(1792171839.691:3): pid=4324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="zoned" dev="configfs" ino=32590 res=0 errno=0 [ 75.559332][ T4322] misc_open+0x31f/0x390 [ 75.563637][ T4322] chrdev_open+0x585/0x5f0 [ 75.568103][ T4322] ? cd_forget+0x160/0x160 [ 75.572597][ T4322] ? fsnotify_perm+0x3a7/0x560 [ 75.577402][ T4322] ? cd_forget+0x160/0x160 [ 75.582007][ T4322] do_dentry_open+0x7f7/0xf90 [ 75.586736][ T4322] ? vfs_open+0x2b/0x80 [ 75.591033][ T4322] path_openat+0x2718/0x2fb0 [ 75.595808][ T4322] ? __kasan_slab_alloc+0xa9/0xc0 [ 75.600914][ T4322] ? do_filp_open+0x400/0x400 [ 75.605687][ T4322] do_filp_open+0x1df/0x400 [ 75.610270][ T4322] ? vfs_tmpfile+0x300/0x300 [ 75.614934][ T4322] ? _raw_spin_unlock+0x24/0x40 [ 75.619836][ T4322] ? alloc_fd+0x59e/0x650 [ 75.624220][ T4322] do_sys_openat2+0x14b/0x500 [ 75.628944][ T4322] ? __lock_acquire+0x7d40/0x7d40 [ 75.634038][ T4322] ? do_sys_open+0xe0/0xe0 [ 75.638504][ T4322] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 75.644559][ T4322] ? lock_chain_count+0x20/0x20 [ 75.650044][ T4322] __x64_sys_openat+0x135/0x160 [ 75.655062][ T4322] do_syscall_64+0x4c/0xa0 [ 75.659808][ T4322] ? clear_bhb_loop+0x30/0x80 [ 75.664556][ T4322] ? clear_bhb_loop+0x30/0x80 [ 75.669401][ T4322] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 75.675412][ T4322] RIP: 0033:0x7fa79f683559 [ 75.679881][ T4322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.699684][ T4322] RSP: 002b:00007fa79d8db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 75.708807][ T4322] RAX: ffffffffffffffda RBX: 00007fa79f90afa0 RCX: 00007fa79f683559 [ 75.717111][ T4322] RDX: 0000000000000002 RSI: 0000200000000400 RDI: ffffffffffffff9c [ 75.725503][ T4322] RBP: 00007fa79f71a8b0 R08: 0000000000000000 R09: 0000000000000000 [ 75.733566][ T4322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.741852][ T4322] R13: 00007fa79f90b038 R14: 00007fa79f90afa0 R15: 00007ffe1dff7ac8 [ 75.750363][ T4322] [ 75.776877][ T4324] Zero length message leads to an empty skb [ 75.831757][ T26] audit: type=1800 audit(1792171840.101:4): pid=4324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="power" dev="configfs" ino=32596 res=0 errno=0 [ 76.165369][ T4341] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 76.202825][ T4343] FAULT_INJECTION: forcing a failure. [ 76.202825][ T4343] name failslab, interval 1, probability 0, space 0, times 0 [ 76.229549][ T4343] CPU: 0 PID: 4343 Comm: syz.1.15 Not tainted syzkaller #0 [ 76.236829][ T4343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 76.247042][ T4343] Call Trace: [ 76.250355][ T4343] [ 76.253411][ T4343] dump_stack_lvl+0x188/0x250 [ 76.258148][ T4343] ? show_regs_print_info+0x20/0x20 [ 76.263385][ T4343] ? load_image+0x410/0x410 [ 76.268032][ T4343] ? __lock_acquire+0x7d40/0x7d40 [ 76.273095][ T4343] should_fail+0x383/0x4b0 [ 76.277591][ T4343] should_failslab+0x5/0x20 [ 76.282126][ T4343] slab_pre_alloc_hook+0x51/0xc0 [ 76.287131][ T4343] kmem_cache_alloc_node+0x47/0x2c0 [ 76.292362][ T4343] ? __alloc_skb+0xf4/0x750 [ 76.296894][ T4343] ? __lock_acquire+0x7d40/0x7d40 [ 76.302381][ T4343] __alloc_skb+0xf4/0x750 [ 76.306752][ T4343] sk_stream_alloc_skb+0x204/0xb50 [ 76.311999][ T4343] tcp_connect+0x16d6/0x4970 [ 76.316674][ T4343] ? prandom_u32+0x217/0x250 [ 76.321310][ T4343] tcp_v6_connect+0x11cf/0x1a10 [ 76.326378][ T4343] ? tcp_v6_pre_connect+0xf0/0xf0 [ 76.331434][ T4343] ? tcp_sendmsg_fastopen+0x1d5/0x600 [ 76.336826][ T4343] ? tcp_sendmsg_locked+0x2efb/0x3330 [ 76.342236][ T4343] ? tcp_sendmsg+0x2b/0x40 [ 76.346775][ T4343] ? __sys_sendto+0x46d/0x620 [ 76.351515][ T4343] ? __x64_sys_sendto+0xda/0xf0 [ 76.356391][ T4343] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 76.362845][ T4343] __inet_stream_connect+0x244/0xd80 [ 76.368204][ T4343] ? inet_dgram_connect+0x340/0x340 [ 76.373436][ T4343] tcp_sendmsg_fastopen+0x38f/0x600 [ 76.378660][ T4343] tcp_sendmsg_locked+0x2efb/0x3330 [ 76.383884][ T4343] ? aa_sk_perm+0x910/0x910 [ 76.388419][ T4343] ? mark_lock+0x94/0x320 [ 76.392773][ T4343] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 76.398861][ T4343] ? lock_chain_count+0x20/0x20 [ 76.403770][ T4343] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 76.409864][ T4343] ? tcp_free_fastopen_req+0x70/0x70 [ 76.415188][ T4343] tcp_sendmsg+0x2b/0x40 [ 76.419546][ T4343] __sys_sendto+0x46d/0x620 [ 76.424073][ T4343] ? __ia32_sys_getpeername+0x80/0x80 [ 76.429491][ T4343] ? lock_chain_count+0x20/0x20 [ 76.434369][ T4343] __x64_sys_sendto+0xda/0xf0 [ 76.439069][ T4343] do_syscall_64+0x4c/0xa0 [ 76.443522][ T4343] ? clear_bhb_loop+0x30/0x80 [ 76.448221][ T4343] ? clear_bhb_loop+0x30/0x80 [ 76.452922][ T4343] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 76.458846][ T4343] RIP: 0033:0x7f7086ce4559 [ 76.463291][ T4343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.482924][ T4343] RSP: 002b:00007f7084f3c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 76.491376][ T4343] RAX: ffffffffffffffda RBX: 00007f7086f6bfa0 RCX: 00007f7086ce4559 [ 76.499380][ T4343] RDX: 0000000000000091 RSI: 0000000000000000 RDI: 0000000000000003 [ 76.507374][ T4343] RBP: 00007f7086d7b8b0 R08: 00002000000001c0 R09: 000000000000001c [ 76.515378][ T4343] R10: 0000000024000045 R11: 0000000000000246 R12: 0000000000000000 [ 76.523374][ T4343] R13: 00007f7086f6c038 R14: 00007f7086f6bfa0 R15: 00007ffeb443db98 [ 76.531388][ T4343] [ 76.741358][ T4358] netlink: 'syz.0.22': attribute type 1 has an invalid length. [ 76.757903][ T4360] syz.1.23 uses obsolete (PF_INET,SOCK_PACKET) [ 76.782468][ T4358] 8021q: VLANs not supported on ip6gre0 [ 76.830859][ T4364] CIFS: Attempting to mount \\127.0.0.1\share [ 76.851901][ T4364] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 76.941027][ T4371] CIFS: VFS: \\127.0.0.1 SMB response too short (0 bytes) [ 76.953680][ T26] audit: type=1800 audit(1792171841.221:5): pid=4369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.26" name="nexus" dev="configfs" ino=33422 res=0 errno=0 [ 77.184743][ T4364] CIFS: VFS: \\127.0.0.1 Invalid 0x0 dialect returned: not requested [ 77.206425][ T4377] device syzkaller0 entered promiscuous mode [ 77.219834][ T4364] CIFS: VFS: cifs_mount failed w/return code = -5 [ 77.390367][ T7] rxe_eth0 speed is unknown, defaulting to 1000 [ 78.347221][ T4422] fscrypt (sda1, inode 1262): Can't use IV_INO_LBLK_32 policy with contents mode other than AES-256-XTS [ 78.517188][ T4426] block device autoloading is deprecated and will be removed. [ 78.592784][ T4435] FAULT_INJECTION: forcing a failure. [ 78.592784][ T4435] name failslab, interval 1, probability 0, space 0, times 0 [ 78.647569][ T4435] CPU: 0 PID: 4435 Comm: syz.0.41 Not tainted syzkaller #0 [ 78.654848][ T4435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 78.665444][ T4435] Call Trace: [ 78.668784][ T4435] [ 78.671752][ T4435] dump_stack_lvl+0x188/0x250 [ 78.676524][ T4435] ? show_regs_print_info+0x20/0x20 [ 78.681782][ T4435] ? load_image+0x410/0x410 [ 78.686347][ T4435] ? rcu_lock_release+0x5/0x20 [ 78.691161][ T4435] should_fail+0x383/0x4b0 [ 78.695861][ T4435] should_failslab+0x5/0x20 [ 78.700560][ T4435] slab_pre_alloc_hook+0x51/0xc0 [ 78.705648][ T4435] kmem_cache_alloc_trace+0x47/0x290 [ 78.711087][ T4435] ? proc_self_get_link+0xe1/0x170 [ 78.716288][ T4435] proc_self_get_link+0xe1/0x170 [ 78.721274][ T4435] ? proc_setup_self+0x2d0/0x2d0 [ 78.726342][ T4435] pick_link+0x701/0xdc0 [ 78.730816][ T4435] step_into+0xac6/0xcd0 [ 78.735209][ T4435] ? set_root+0x3a0/0x3a0 [ 78.739589][ T4435] ? walk_component+0x1b6/0x460 [ 78.744486][ T4435] link_path_walk+0x688/0xde0 [ 78.749399][ T4435] ? handle_lookup_down+0x130/0x130 [ 78.754673][ T4435] path_openat+0x28e/0x2fb0 [ 78.759803][ T4435] ? __kasan_slab_alloc+0xa9/0xc0 [ 78.764912][ T4435] ? do_filp_open+0x400/0x400 [ 78.769663][ T4435] do_filp_open+0x1df/0x400 [ 78.774303][ T4435] ? vfs_tmpfile+0x300/0x300 [ 78.779040][ T4435] ? _raw_spin_unlock+0x24/0x40 [ 78.783939][ T4435] ? alloc_fd+0x59e/0x650 [ 78.788333][ T4435] do_sys_openat2+0x14b/0x500 [ 78.793061][ T4435] ? __lock_acquire+0x7d40/0x7d40 [ 78.798174][ T4435] ? do_sys_open+0xe0/0xe0 [ 78.802728][ T4435] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 78.808872][ T4435] ? lock_chain_count+0x20/0x20 [ 78.813868][ T4435] __x64_sys_openat+0x135/0x160 [ 78.818808][ T4435] do_syscall_64+0x4c/0xa0 [ 78.823273][ T4435] ? clear_bhb_loop+0x30/0x80 [ 78.828000][ T4435] ? clear_bhb_loop+0x30/0x80 [ 78.832783][ T4435] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 78.840542][ T4435] RIP: 0033:0x7fa79f643d8e [ 78.845104][ T4435] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 78.864922][ T4435] RSP: 002b:00007fa79d8daf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 78.873405][ T4435] RAX: ffffffffffffffda RBX: 00007fa79d8db6c0 RCX: 00007fa79f643d8e [ 78.881520][ T4435] RDX: 0000000000000000 RSI: 00007fa79f719fde RDI: ffffffffffffff9c [ 78.889633][ T4435] RBP: 00007fa79f71a8b0 R08: 0000000000000000 R09: 0000000000000000 [ 78.897738][ T4435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.905759][ T4435] R13: 00007fa79f90b038 R14: 00007fa79f90afa0 R15: 00007ffe1dff7ac8 [ 78.913814][ T4435] [ 78.920562][ T7] Bluetooth: hci1: command 0x0c24 tx timeout [ 80.145343][ T26] audit: type=1800 audit(1792171844.421:6): pid=4479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.56" name="nexus" dev="configfs" ino=33681 res=0 errno=0 [ 80.415022][ T4260] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 80.698310][ T4503] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 80.722233][ T4503] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 80.784444][ T4260] usb 2-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 80.811410][ T4260] usb 2-1: config 0 interface 0 has no altsetting 0 [ 80.827079][ T4522] FAULT_INJECTION: forcing a failure. [ 80.827079][ T4522] name failslab, interval 1, probability 0, space 0, times 0 [ 80.870884][ T4522] CPU: 0 PID: 4522 Comm: syz.2.66 Not tainted syzkaller #0 [ 80.878170][ T4522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 80.888268][ T4522] Call Trace: [ 80.891595][ T4522] [ 80.894555][ T4522] dump_stack_lvl+0x188/0x250 [ 80.899289][ T4522] ? show_regs_print_info+0x20/0x20 [ 80.904544][ T4522] ? load_image+0x410/0x410 [ 80.909107][ T4522] ? __lock_acquire+0x7d40/0x7d40 [ 80.914186][ T4522] ? rcu_lock_acquire+0x30/0x30 [ 80.919128][ T4522] should_fail+0x383/0x4b0 [ 80.923692][ T4522] should_failslab+0x5/0x20 [ 80.928262][ T4522] slab_pre_alloc_hook+0x51/0xc0 [ 80.933242][ T4522] ? security_file_alloc+0x30/0x110 [ 80.938501][ T4522] kmem_cache_alloc+0x3d/0x280 [ 80.943315][ T4522] ? rcu_is_watching+0x11/0xa0 [ 80.948133][ T4522] security_file_alloc+0x30/0x110 [ 80.953213][ T4522] __alloc_file+0xc2/0x240 [ 80.957686][ T4522] alloc_empty_file+0x90/0x180 [ 80.962501][ T4522] path_openat+0x11c/0x2fb0 [ 80.967058][ T4522] ? stack_trace_snprint+0xe0/0xe0 [ 80.972219][ T4522] ? verify_lock_unused+0x140/0x140 [ 80.977496][ T4522] ? verify_lock_unused+0x140/0x140 [ 80.982764][ T4522] ? __kasan_slab_alloc+0xa9/0xc0 [ 80.987949][ T4522] ? __kasan_slab_alloc+0x92/0xc0 [ 80.993024][ T4522] ? slab_post_alloc_hook+0x4c/0x380 [ 80.998369][ T4522] ? verify_lock_unused+0x140/0x140 [ 81.003624][ T4522] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.009746][ T4522] ? do_filp_open+0x400/0x400 [ 81.014494][ T4522] do_filp_open+0x1df/0x400 [ 81.019056][ T4522] ? vfs_tmpfile+0x300/0x300 [ 81.023711][ T4522] ? _raw_spin_unlock+0x24/0x40 [ 81.028602][ T4522] ? alloc_fd+0x59e/0x650 [ 81.033074][ T4522] do_sys_openat2+0x14b/0x500 [ 81.037797][ T4522] ? __lock_acquire+0x7d40/0x7d40 [ 81.042875][ T4522] ? do_sys_open+0xe0/0xe0 [ 81.047356][ T4522] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 81.053398][ T4522] ? lock_chain_count+0x20/0x20 [ 81.058306][ T4522] __x64_sys_openat+0x135/0x160 [ 81.063209][ T4522] do_syscall_64+0x4c/0xa0 [ 81.067671][ T4522] ? clear_bhb_loop+0x30/0x80 [ 81.072753][ T4522] ? clear_bhb_loop+0x30/0x80 [ 81.078093][ T4522] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.084085][ T4522] RIP: 0033:0x7f92d9fa7d8e [ 81.088553][ T4522] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 81.108285][ T4522] RSP: 002b:00007f92d823ef18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 81.116942][ T4522] RAX: ffffffffffffffda RBX: 00007f92d823f6c0 RCX: 00007f92d9fa7d8e [ 81.124961][ T4522] RDX: 0000000000000000 RSI: 00007f92da07dfde RDI: ffffffffffffff9c [ 81.133007][ T4522] RBP: 00007f92da07e8b0 R08: 0000000000000000 R09: 0000000000000000 [ 81.141049][ T4522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.149091][ T4522] R13: 00007f92da26f038 R14: 00007f92da26efa0 R15: 00007ffc4be1aad8 [ 81.157299][ T4522] [ 81.209734][ T4530] fuse: Bad value for 'fd' [ 81.294777][ T4260] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 81.303890][ T4260] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 81.317487][ T4260] usb 2-1: Product: syz [ 81.321721][ T4260] usb 2-1: Manufacturer: syz [ 81.326562][ T4260] usb 2-1: SerialNumber: syz [ 81.371582][ T4260] usb 2-1: config 0 descriptor?? [ 81.446667][ T4260] usb 2-1: selecting invalid altsetting 0 [ 81.712505][ T4472] usb 2-1: selecting invalid altsetting 0 [ 81.729847][ T4472] usb 2-1: 0:0: usb_set_interface failed (-22) [ 81.749273][ T4254] usb 2-1: USB disconnect, device number 2 [ 81.859669][ T4561] netlink: 'syz.2.77': attribute type 1 has an invalid length. [ 81.902328][ T4561] netlink: 28 bytes leftover after parsing attributes in process `syz.2.77'. [ 81.948453][ T26] audit: type=1800 audit(1792171846.221:7): pid=4563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.78" name="nexus" dev="configfs" ino=35873 res=0 errno=0 [ 81.993687][ T4564] netlink: 'syz.2.77': attribute type 10 has an invalid length. [ 82.024427][ T4564] netlink: 40 bytes leftover after parsing attributes in process `syz.2.77'. [ 82.033426][ T4564] device dummy0 entered promiscuous mode [ 82.163613][ T4574] fuse: Bad value for 'fd' [ 83.230325][ T4603] netlink: 'syz.0.92': attribute type 1 has an invalid length. [ 83.266171][ T4603] netlink: 28 bytes leftover after parsing attributes in process `syz.0.92'. [ 83.373706][ T4603] netlink: 'syz.0.92': attribute type 10 has an invalid length. [ 83.416192][ T4603] netlink: 40 bytes leftover after parsing attributes in process `syz.0.92'. [ 83.441583][ T4603] device dummy0 entered promiscuous mode [ 83.474044][ T4608] 9pnet_virtio: no channels available for device syz [ 83.643832][ T4616] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 83.823774][ T4627] netlink: 'syz.0.102': attribute type 1 has an invalid length. [ 83.833565][ T4627] netlink: 28 bytes leftover after parsing attributes in process `syz.0.102'. [ 83.880978][ T4627] device dummy0 left promiscuous mode [ 83.889981][ T26] audit: type=1800 audit(1792171848.161:8): pid=4629 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.104" name="memory_backed" dev="configfs" ino=36112 res=0 errno=0 [ 83.910554][ C0] vkms_vblank_simulate: vblank timer overrun [ 84.219282][ T4648] bridge0: port 3(syz_tun) entered blocking state [ 84.243141][ T4648] bridge0: port 3(syz_tun) entered disabled state [ 84.278488][ T4648] device syz_tun entered promiscuous mode [ 84.304232][ T4648] bridge0: port 3(syz_tun) entered blocking state [ 84.311522][ T4648] bridge0: port 3(syz_tun) entered forwarding state [ 84.463652][ T4651] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.555781][ T4651] device bridge_slave_0 left promiscuous mode [ 84.581567][ T4651] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.054373][ T4681] input: syz0 as /devices/virtual/input/input5 [ 85.258885][ T26] audit: type=1800 audit(1792171849.531:9): pid=4695 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.119" name="nexus" dev="configfs" ino=36355 res=0 errno=0 [ 86.742320][ T1111] cfg80211: failed to load regulatory.db [ 88.796450][ T26] audit: type=1800 audit(1792171853.071:10): pid=4810 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.155" name="memory_backed" dev="configfs" ino=37415 res=0 errno=0 [ 89.097133][ T26] audit: type=1800 audit(1792171853.371:11): pid=4834 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.166" name="nexus" dev="configfs" ino=37456 res=0 errno=0 [ 89.150118][ T4840] fuse: Bad value for 'fd' [ 89.470242][ T4855] netlink: 'syz.1.174': attribute type 1 has an invalid length. [ 89.495579][ T4855] 8021q: adding VLAN 0 to HW filter on device bond1 [ 89.533122][ T4855] netlink: 28 bytes leftover after parsing attributes in process `syz.1.174'. [ 89.787074][ T4862] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 89.790420][ T26] audit: type=1800 audit(1792171854.061:12): pid=4868 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.179" name="nexus" dev="configfs" ino=37592 res=0 errno=0 [ 89.829809][ T4862] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 90.138310][ T4884] netlink: 'syz.4.187': attribute type 1 has an invalid length. [ 90.176320][ T4884] 8021q: adding VLAN 0 to HW filter on device bond1 [ 90.188161][ T4884] netlink: 28 bytes leftover after parsing attributes in process `syz.4.187'. [ 90.498273][ T4910] fuse: Bad value for 'fd' [ 91.131660][ T4928] netlink: 'syz.1.201': attribute type 1 has an invalid length. [ 91.294569][ T4928] 8021q: adding VLAN 0 to HW filter on device bond2 [ 91.350543][ T4931] netlink: 28 bytes leftover after parsing attributes in process `syz.1.201'. [ 91.417190][ T4942] fuse: Bad value for 'fd' [ 91.594537][ T4950] netlink: 'syz.1.209': attribute type 1 has an invalid length. [ 91.719805][ T4950] 8021q: adding VLAN 0 to HW filter on device bond3 [ 92.758947][ T4988] fuse: Bad value for 'fd' [ 92.888267][ T4994] netlink: 'syz.0.223': attribute type 1 has an invalid length. [ 92.949929][ T4994] 8021q: adding VLAN 0 to HW filter on device bond1 [ 92.970128][ T4997] bond1: (slave dummy0): making interface the new active one [ 92.981185][ T4997] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 92.992225][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 93.185730][ T5010] netlink: 'syz.3.227': attribute type 10 has an invalid length. [ 93.193785][ T5010] netlink: 40 bytes leftover after parsing attributes in process `syz.3.227'. [ 93.231504][ T5010] device dummy0 entered promiscuous mode [ 93.398066][ T5018] netlink: 'syz.1.230': attribute type 3 has an invalid length. [ 93.431657][ T5018] netlink: 40 bytes leftover after parsing attributes in process `syz.1.230'. [ 93.641608][ T5033] program syz.1.236 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 93.938944][ T5048] device dummy0 left promiscuous mode [ 93.981551][ T5048] netlink: 'syz.4.242': attribute type 10 has an invalid length. [ 94.004611][ T5048] netlink: 40 bytes leftover after parsing attributes in process `syz.4.242'. [ 94.013663][ T5048] device dummy0 entered promiscuous mode [ 94.135158][ T5061] o2cb: This node has not been configured. [ 94.154377][ T5061] o2cb: Cluster check failed. Fix errors before retrying. [ 94.185806][ T5061] (syz.1.248,5061,0):user_dlm_register:675 ERROR: status = -22 [ 94.219103][ T5061] (syz.1.248,5061,0):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "file0" [ 94.659551][ T5090] netlink: 'syz.1.258': attribute type 10 has an invalid length. [ 94.694355][ T5090] netlink: 40 bytes leftover after parsing attributes in process `syz.1.258'. [ 94.713996][ T5090] device dummy0 entered promiscuous mode [ 94.747662][ T5094] netlink: 8 bytes leftover after parsing attributes in process `syz.4.260'. [ 94.891521][ T5100] netlink: 'syz.4.263': attribute type 5 has an invalid length. [ 95.295423][ T5122] device dummy0 left promiscuous mode [ 95.631629][ T26] audit: type=1800 audit(1792171859.901:13): pid=5136 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.275" name="memory_backed" dev="configfs" ino=42137 res=0 errno=0 [ 96.034222][ T4174] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 96.259881][ T4255] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 96.404680][ T4174] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 96.429940][ T4174] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 96.480978][ T5157] device dummy0 left promiscuous mode [ 96.541465][ T4174] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 96.568883][ T4174] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 96.624584][ T4255] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.645121][ T4255] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.668849][ T4255] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 96.680948][ T4255] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.709985][ T26] audit: type=1800 audit(1792171860.981:14): pid=5163 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.287" name="nexus" dev="configfs" ino=42332 res=0 errno=0 [ 96.754576][ T4174] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 96.763752][ T4174] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.788440][ T4174] usb 5-1: Product: syz [ 96.792806][ T4174] usb 5-1: Manufacturer: syz [ 96.799820][ T4174] usb 5-1: SerialNumber: syz [ 96.810107][ T26] audit: type=1800 audit(1792171861.081:15): pid=5165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.286" name="memory_backed" dev="configfs" ino=41150 res=0 errno=0 [ 96.866066][ T4174] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 96.896174][ T4174] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 96.923998][ T4174] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 96.994335][ T4255] usb 1-1: usb_control_msg returned -32 [ 97.000139][ T4255] usbtmc 1-1:16.0: can't read capabilities [ 97.109889][ T5138] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 97.136091][ T4255] usb 5-1: USB disconnect, device number 2 [ 97.158565][ T4255] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 97.203166][ T4255] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 97.242828][ T4255] ti_usb_3410_5052 5-1:2.0: device disconnected [ 97.584467][ T23] usb 1-1: USB disconnect, device number 2 [ 97.775837][ T5182] XFS (loop0): Invalid device [./loop0], error=-16 [ 98.262860][ T5208] device dummy0 left promiscuous mode [ 98.773977][ T5231] netlink: 'syz.4.308': attribute type 1 has an invalid length. [ 98.798351][ T5231] 8021q: adding VLAN 0 to HW filter on device bond2 [ 98.816806][ T5231] bond2: (slave dummy0): making interface the new active one [ 98.827766][ T5231] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 98.837917][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 98.871886][ T5231] netlink: 'syz.4.308': attribute type 10 has an invalid length. [ 98.892386][ T5231] netlink: 40 bytes leftover after parsing attributes in process `syz.4.308'. [ 98.928496][ T5231] device dummy0 entered promiscuous mode [ 98.957318][ T5231] bond2: (slave dummy0): Releasing active interface [ 99.008944][ T5231] syz.4.308 (5231) used greatest stack depth: 20976 bytes left [ 99.513562][ T26] audit: type=1800 audit(1792171863.781:16): pid=5269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.321" name="nexus" dev="configfs" ino=41853 res=0 errno=0 [ 100.861617][ T5314] netlink: 'syz.2.336': attribute type 1 has an invalid length. [ 100.933030][ T5314] 8021q: adding VLAN 0 to HW filter on device bond1 [ 101.089156][ T5317] bond1: (slave dummy0): making interface the new active one [ 101.141898][ T5317] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 101.195317][ T4259] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 103.230390][ T5367] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input6 [ 103.450475][ T5378] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 104.538833][ T5428] 9pnet_virtio: no channels available for device syz [ 106.575996][ T4255] Bluetooth: hci0: command 0x0c13 tx timeout [ 106.590049][ T4259] net_ratelimit: 60 callbacks suppressed [ 106.901362][ T5504] netlink: 'syz.2.394': attribute type 1 has an invalid length. [ 106.981642][ T5504] 8021q: adding VLAN 0 to HW filter on device bond2 [ 107.084995][ T5507] bond1: (slave dummy0): Releasing active interface [ 107.129529][ T5507] bond2: (slave dummy0): making interface the new active one [ 107.173185][ T5507] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 107.213458][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 107.438936][ T5526] netlink: 'syz.2.400': attribute type 1 has an invalid length. [ 107.550394][ T5526] 8021q: adding VLAN 0 to HW filter on device bond3 [ 107.711697][ T5528] bond2: (slave dummy0): Releasing active interface [ 107.766574][ T5528] bond3: (slave dummy0): making interface the new active one [ 107.790980][ T5528] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 107.802912][ T5530] netlink: 'syz.2.400': attribute type 10 has an invalid length. [ 107.831585][ T5530] netlink: 40 bytes leftover after parsing attributes in process `syz.2.400'. [ 107.882037][ T5530] device dummy0 entered promiscuous mode [ 107.923219][ T5530] bond3: (slave dummy0): Releasing active interface [ 108.252270][ T5544] nfs4: Unknown parameter 'a' [ 108.515193][ T5560] netlink: 'syz.1.409': attribute type 1 has an invalid length. [ 108.615942][ T5563] binder: 5562:5563 ioctl c0306201 2000000001c0 returned -14 [ 108.667089][ T5560] 8021q: adding VLAN 0 to HW filter on device bond4 [ 108.769399][ T5573] netlink: 'syz.0.413': attribute type 1 has an invalid length. [ 108.971221][ T5573] 8021q: adding VLAN 0 to HW filter on device bond2 [ 109.906896][ T5612] XFS (loop0): Invalid device [./loop0], error=-16 [ 110.011120][ T5617] netlink: 'syz.1.424': attribute type 1 has an invalid length. [ 110.115385][ T5617] 8021q: adding VLAN 0 to HW filter on device bond5 [ 110.157618][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 110.192010][ T5622] device dummy0 left promiscuous mode [ 110.251028][ T5622] bond5: (slave dummy0): making interface the new active one [ 110.267406][ T5622] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 110.309499][ T5625] netlink: 'syz.3.426': attribute type 1 has an invalid length. [ 110.334936][ T4254] Bluetooth: hci0: command 0x0c1a tx timeout [ 110.458039][ T5625] 8021q: adding VLAN 0 to HW filter on device bond1 [ 110.749011][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond5: link becomes ready [ 110.770172][ T5628] netlink: 'syz.3.426': attribute type 10 has an invalid length. [ 110.784309][ T5628] netlink: 40 bytes leftover after parsing attributes in process `syz.3.426'. [ 110.803085][ T5628] device dummy0 entered promiscuous mode [ 111.614196][ C1] net_ratelimit: 60 callbacks suppressed [ 111.854403][ T21] Bluetooth: hci3: command 0x0406 tx timeout [ 112.424233][ T5666] netlink: 'syz.2.437': attribute type 1 has an invalid length. [ 112.545482][ T5666] 8021q: adding VLAN 0 to HW filter on device bond4 [ 112.569833][ T5669] device dummy0 left promiscuous mode [ 112.598574][ T5671] netlink: 'syz.4.439': attribute type 1 has an invalid length. [ 112.704757][ T5671] 8021q: adding VLAN 0 to HW filter on device bond3 [ 112.798502][ T5674] device dummy0 left promiscuous mode [ 112.806281][ T5676] netlink: 'syz.4.439': attribute type 10 has an invalid length. [ 112.859706][ T5676] netlink: 40 bytes leftover after parsing attributes in process `syz.4.439'. [ 112.875924][ T5676] device dummy0 entered promiscuous mode [ 113.732503][ T5712] binder_alloc: 5711: binder_alloc_buf, no vma [ 114.292720][ T5722] netlink: 'syz.1.452': attribute type 1 has an invalid length. [ 114.341856][ T5722] 8021q: adding VLAN 0 to HW filter on device bond6 [ 114.411991][ T5724] bond5: (slave dummy0): Releasing active interface [ 114.517845][ T5728] device dummy0 left promiscuous mode [ 114.578728][ T5728] netlink: 'syz.4.454': attribute type 10 has an invalid length. [ 114.592941][ T5728] netlink: 40 bytes leftover after parsing attributes in process `syz.4.454'. [ 114.603355][ T5728] device dummy0 entered promiscuous mode [ 114.719416][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 116.099097][ T5763] binder_alloc: 5762: binder_alloc_buf, no vma [ 116.330006][ T5775] device dummy0 left promiscuous mode [ 116.344966][ T4254] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 116.367789][ T5775] netlink: 'syz.3.469': attribute type 10 has an invalid length. [ 116.390493][ T5775] netlink: 40 bytes leftover after parsing attributes in process `syz.3.469'. [ 116.400930][ T5775] device dummy0 entered promiscuous mode [ 116.654183][ C0] net_ratelimit: 70 callbacks suppressed [ 116.772276][ T4254] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 116.793259][ T4254] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 116.827330][ T4254] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 116.847037][ T4254] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.138132][ T4254] usb 5-1: usb_control_msg returned -32 [ 117.145365][ T4254] usbtmc 5-1:16.0: can't read capabilities [ 117.906939][ T5812] bond1: (slave dummy0): Releasing active interface [ 117.936738][ T5813] netlink: 'syz.0.481': attribute type 10 has an invalid length. [ 117.954385][ T5813] netlink: 40 bytes leftover after parsing attributes in process `syz.0.481'. [ 118.003180][ T5813] device dummy0 entered promiscuous mode [ 118.333737][ T5823] netlink: 'syz.0.485': attribute type 10 has an invalid length. [ 118.352027][ T5823] bridge0: port 3(syz_tun) entered disabled state [ 118.358739][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.383003][ T5823] bridge0: port 3(syz_tun) entered blocking state [ 118.383125][ T5823] bridge0: port 3(syz_tun) entered forwarding state [ 118.398502][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.405804][ T5823] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.479804][ T5823] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 119.017120][ T629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 119.109017][ T21] usb 5-1: USB disconnect, device number 3 [ 119.224375][ T5839] device dummy0 left promiscuous mode [ 119.858056][ T5851] netlink: 'syz.2.493': attribute type 10 has an invalid length. [ 119.884477][ T5851] netlink: 40 bytes leftover after parsing attributes in process `syz.2.493'. [ 119.914784][ T5851] device dummy0 entered promiscuous mode [ 120.054258][ T5856] FAULT_INJECTION: forcing a failure. [ 120.054258][ T5856] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 120.103310][ T5856] CPU: 1 PID: 5856 Comm: syz.2.496 Not tainted syzkaller #0 [ 120.110774][ T5856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 120.120975][ T5856] Call Trace: [ 120.124299][ T5856] [ 120.127619][ T5856] dump_stack_lvl+0x188/0x250 [ 120.132376][ T5856] ? show_regs_print_info+0x20/0x20 [ 120.137618][ T5856] ? load_image+0x410/0x410 [ 120.142167][ T5856] ? __lock_acquire+0x7d40/0x7d40 [ 120.147335][ T5856] should_fail+0x383/0x4b0 [ 120.151807][ T5856] prepare_alloc_pages+0x1e3/0x5b0 [ 120.157029][ T5856] __alloc_pages+0x11b/0x480 [ 120.161697][ T5856] ? zone_statistics+0x170/0x170 [ 120.166687][ T5856] ? __rwlock_init+0x140/0x140 [ 120.171502][ T5856] ? alloc_pages+0x452/0x560 [ 120.176259][ T5856] __get_free_pages+0x8/0x30 [ 120.180958][ T5856] kasan_populate_vmalloc_pte+0x21/0xc0 [ 120.186557][ T5856] __apply_to_page_range+0x987/0xd10 [ 120.191934][ T5856] ? kasan_populate_vmalloc+0x70/0x70 [ 120.197351][ T5856] alloc_vmap_area+0x19e8/0x1b30 [ 120.202352][ T5856] ? vm_map_ram+0xba0/0xba0 [ 120.206901][ T5856] __get_vm_area_node+0x14f/0x2d0 [ 120.211971][ T5856] __vmalloc_node_range+0xef/0x8b0 [ 120.217139][ T5856] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 120.222387][ T5856] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 120.228063][ T5856] ? mutex_unlock+0x10/0x10 [ 120.232605][ T5856] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 120.237889][ T5856] __vmalloc+0x76/0x80 [ 120.242178][ T5856] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 120.247432][ T5856] snd_dma_alloc_pages+0xfb/0x1d0 [ 120.252554][ T5856] do_alloc_pages+0xee/0x210 [ 120.257233][ T5856] snd_pcm_lib_malloc_pages+0x2e5/0x720 [ 120.263173][ T5856] snd_pcm_hw_params+0x814/0x1cf0 [ 120.268349][ T5856] ? kasan_quarantine_put+0xd4/0x210 [ 120.273821][ T5856] ? slab_free_freelist_hook+0xec/0x170 [ 120.279420][ T5856] ? snd_pcm_hw_param_first+0x5de/0xa60 [ 120.285134][ T5856] ? snd_pcm_forward+0x580/0x580 [ 120.290122][ T5856] ? snd_pcm_hw_param_near+0x3da/0x460 [ 120.295632][ T5856] ? snd_pcm_kernel_ioctl+0xf1/0x340 [ 120.301064][ T5856] snd_pcm_oss_change_params_locked+0x1e46/0x3cf0 [ 120.307588][ T5856] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 120.312759][ T5856] ? memset+0x1e/0x40 [ 120.316779][ T5856] ? __fsnotify_parent+0x72a/0x820 [ 120.322054][ T5856] snd_pcm_oss_read+0x26f/0x890 [ 120.326955][ T5856] ? snd_pcm_oss_unregister_minor+0x210/0x210 [ 120.333076][ T5856] vfs_read+0x2ff/0xd50 [ 120.337294][ T5856] ? __lock_acquire+0x7d40/0x7d40 [ 120.342465][ T5856] ? kernel_read+0x1e0/0x1e0 [ 120.347104][ T5856] ? __fget_files+0x402/0x470 [ 120.351832][ T5856] ? __fdget_pos+0x1e2/0x370 [ 120.356461][ T5856] ? ksys_read+0x70/0x260 [ 120.360845][ T5856] ksys_read+0x153/0x260 [ 120.365127][ T5856] ? vfs_write+0xd70/0xd70 [ 120.369597][ T5856] ? lockdep_hardirqs_on+0x94/0x140 [ 120.374838][ T5856] do_syscall_64+0x4c/0xa0 [ 120.379291][ T5856] ? clear_bhb_loop+0x30/0x80 [ 120.384001][ T5856] ? clear_bhb_loop+0x30/0x80 [ 120.388736][ T5856] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 120.394670][ T5856] RIP: 0033:0x7f92d9fe7559 [ 120.399125][ T5856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.418765][ T5856] RSP: 002b:00007f92d823f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 120.427234][ T5856] RAX: ffffffffffffffda RBX: 00007f92da26efa0 RCX: 00007f92d9fe7559 [ 120.435333][ T5856] RDX: 0000000000001000 RSI: 0000200000000a00 RDI: 0000000000000004 [ 120.443350][ T5856] RBP: 00007f92da07e8b0 R08: 0000000000000000 R09: 0000000000000000 [ 120.451367][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.459379][ T5856] R13: 00007f92da26f038 R14: 00007f92da26efa0 R15: 00007ffc4be1aad8 [ 120.467411][ T5856] [ 120.470581][ C1] vkms_vblank_simulate: vblank timer overrun [ 120.630859][ T5856] syz.2.496: vmalloc error: size 2097152, vm_struct allocation failed, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 120.672629][ T5856] CPU: 0 PID: 5856 Comm: syz.2.496 Not tainted syzkaller #0 [ 120.680116][ T5856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 120.690224][ T5856] Call Trace: [ 120.693745][ T5856] [ 120.696771][ T5856] dump_stack_lvl+0x188/0x250 [ 120.701513][ T5856] ? rcu_lock_release+0x5/0x20 [ 120.706340][ T5856] ? show_regs_print_info+0x20/0x20 [ 120.711887][ T5856] ? load_image+0x410/0x410 [ 120.711966][ T5856] warn_alloc+0x245/0x320 [ 120.711999][ T5856] ? zone_watermark_ok_safe+0x250/0x250 [ 120.721167][ T5856] ? __get_vm_area_node+0x164/0x2d0 [ 120.732173][ T5856] __vmalloc_node_range+0x2b1/0x8b0 [ 120.732207][ T5856] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 120.743309][ T5856] ? mutex_unlock+0x10/0x10 [ 120.747875][ T5856] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 120.747902][ T5856] __vmalloc+0x76/0x80 [ 120.747928][ T5856] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 120.757221][ T5856] snd_dma_alloc_pages+0xfb/0x1d0 [ 120.757255][ T5856] do_alloc_pages+0xee/0x210 [ 120.767904][ T5856] snd_pcm_lib_malloc_pages+0x2e5/0x720 [ 120.767941][ T5856] snd_pcm_hw_params+0x814/0x1cf0 [ 120.778123][ T5856] ? kasan_quarantine_put+0xd4/0x210 [ 120.778157][ T5856] ? slab_free_freelist_hook+0xec/0x170 [ 120.778189][ T5856] ? snd_pcm_hw_param_first+0x5de/0xa60 [ 120.788525][ T5856] ? snd_pcm_forward+0x580/0x580 [ 120.788560][ T5856] ? snd_pcm_hw_param_near+0x3da/0x460 [ 120.788586][ T5856] ? snd_pcm_kernel_ioctl+0xf1/0x340 [ 120.815775][ T5856] snd_pcm_oss_change_params_locked+0x1e46/0x3cf0 [ 120.822470][ T5856] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 120.828168][ T5856] ? memset+0x1e/0x40 [ 120.832256][ T5856] ? __fsnotify_parent+0x72a/0x820 [ 120.837439][ T5856] snd_pcm_oss_read+0x26f/0x890 [ 120.842373][ T5856] ? snd_pcm_oss_unregister_minor+0x210/0x210 [ 120.848588][ T5856] vfs_read+0x2ff/0xd50 [ 120.852994][ T5856] ? __lock_acquire+0x7d40/0x7d40 [ 120.858081][ T5856] ? kernel_read+0x1e0/0x1e0 [ 120.862735][ T5856] ? __fget_files+0x402/0x470 [ 120.867910][ T5856] ? __fdget_pos+0x1e2/0x370 [ 120.872557][ T5856] ? ksys_read+0x70/0x260 [ 120.876998][ T5856] ksys_read+0x153/0x260 [ 120.881378][ T5856] ? vfs_write+0xd70/0xd70 [ 120.885961][ T5856] ? lockdep_hardirqs_on+0x94/0x140 [ 120.891293][ T5856] do_syscall_64+0x4c/0xa0 [ 120.891319][ T5856] ? clear_bhb_loop+0x30/0x80 [ 120.891345][ T5856] ? clear_bhb_loop+0x30/0x80 [ 120.891369][ T5856] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 120.891391][ T5856] RIP: 0033:0x7f92d9fe7559 [ 120.891410][ T5856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.900803][ T5856] RSP: 002b:00007f92d823f028 EFLAGS: 00000246 [ 120.911399][ T5856] ORIG_RAX: 0000000000000000 [ 120.935475][ T5856] RAX: ffffffffffffffda RBX: 00007f92da26efa0 RCX: 00007f92d9fe7559 [ 120.935497][ T5856] RDX: 0000000000001000 RSI: 0000200000000a00 RDI: 0000000000000004 [ 120.935512][ T5856] RBP: 00007f92da07e8b0 R08: 0000000000000000 R09: 0000000000000000 [ 120.935525][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.935538][ T5856] R13: 00007f92da26f038 R14: 00007f92da26efa0 R15: 00007ffc4be1aad8 [ 120.935594][ T5856] [ 121.034977][ T5856] Mem-Info: [ 121.038256][ T5856] active_anon:278 inactive_anon:11572 isolated_anon:0 [ 121.038256][ T5856] active_file:4782 inactive_file:36585 isolated_file:0 [ 121.038256][ T5856] unevictable:768 dirty:226 writeback:0 [ 121.038256][ T5856] slab_reclaimable:21819 slab_unreclaimable:98172 [ 121.038256][ T5856] mapped:35653 shmem:7356 pagetables:705 bounce:0 [ 121.038256][ T5856] kernel_misc_reclaimable:0 [ 121.038256][ T5856] free:1373739 free_pcp:7586 free_cma:0 [ 121.080256][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.134941][ T5856] Node 0 active_anon:4680kB inactive_anon:42076kB active_file:18924kB inactive_file:146340kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:138912kB dirty:904kB writeback:0kB shmem:27344kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:10880kB pagetables:2720kB all_unreclaimable? no [ 121.166264][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.326196][ T5856] Node 1 active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2080kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 121.355469][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.468597][ T5856] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 121.495037][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.603686][ T5856] lowmem_reserve[]: 0 2523 2524 2524 2524 [ 121.630320][ T5856] Node 0 DMA32 free:1562724kB min:34648kB low:43308kB high:51968kB reserved_highatomic:0KB active_anon:1080kB inactive_anon:34176kB active_file:18924kB inactive_file:146340kB unevictable:1536kB writepending:904kB present:3129332kB managed:2591004kB mlocked:0kB bounce:0kB free_pcp:29448kB local_pcp:8440kB free_cma:0kB [ 121.660751][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.877627][ T5856] lowmem_reserve[]: 0 0 0 0 0 [ 121.882437][ T5856] Node 0 Normal free:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:916kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 121.908327][ C1] vkms_vblank_simulate: vblank timer overrun [ 122.014210][ C1] net_ratelimit: 60 callbacks suppressed [ 122.142636][ T5856] lowmem_reserve[]: 0 0 0 0 0 [ 122.166567][ T5856] Node 1 Normal free:3916728kB min:55240kB low:69048kB high:82856kB reserved_highatomic:0KB active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:8392kB local_pcp:5768kB free_cma:0kB [ 122.195489][ C1] vkms_vblank_simulate: vblank timer overrun [ 122.298789][ T5856] lowmem_reserve[]: 0 0 0 0 0 [ 122.316126][ T5856] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 122.356353][ T5856] Node 0 DMA32: 864*4kB (UM) 332*8kB (UME) 83*16kB (UME) 116*32kB (UME) 28*64kB (UME) 13*128kB (UME) 4*256kB (UM) 2*512kB (UE) 1*1024kB (U) 2*2048kB (M) 379*4096kB (UM) = 1574160kB [ 122.423557][ T5856] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 122.487000][ T5856] Node 1 Normal: 90*4kB (UME) 24*8kB (UME) 35*16kB (UME) 129*32kB (UME) 53*64kB (UME) 14*128kB (UE) 11*256kB (UME) 6*512kB (U) 1*1024kB (U) 2*2048kB (ME) 951*4096kB (M) = 3916728kB [ 122.628134][ T5856] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 122.670387][ T5900] netlink: 44 bytes leftover after parsing attributes in process `syz.0.512'. [ 122.680743][ T5856] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 122.704326][ T5900] netlink: 'syz.0.512': attribute type 6 has an invalid length. [ 122.731520][ T5856] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 122.742554][ T5900] netlink: 'syz.0.512': attribute type 5 has an invalid length. [ 122.742635][ T5900] netlink: 'syz.0.512': attribute type 4 has an invalid length. [ 122.831021][ T5856] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 122.897124][ T5856] 45879 total pagecache pages [ 122.901888][ T5856] 0 pages in swap cache [ 122.948023][ T5856] Swap cache stats: add 178, delete 178, find 40/76 [ 122.985982][ T5856] Free swap = 124728kB [ 122.990204][ T5856] Total swap = 124996kB [ 123.019866][ T5856] 2097051 pages RAM [ 123.031806][ T5856] 0 pages HighMem/MovableOnly [ 123.036826][ T5856] 415313 pages reserved [ 123.041037][ T5856] 0 pages cma reserved [ 123.079205][ T5911] netlink: 'syz.1.515': attribute type 10 has an invalid length. [ 123.104008][ T5911] netlink: 40 bytes leftover after parsing attributes in process `syz.1.515'. [ 123.185915][ T5911] device dummy0 entered promiscuous mode [ 123.218405][ T4188] Bluetooth: hci2: link tx timeout [ 123.224370][ T4188] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 124.214400][ T154] Bluetooth: hci5: Frame reassembly failed (-84) [ 124.318848][ T5954] FAULT_INJECTION: forcing a failure. [ 124.318848][ T5954] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 124.383042][ T5954] CPU: 1 PID: 5954 Comm: syz.3.527 Not tainted syzkaller #0 [ 124.390786][ T5954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 124.390816][ T5954] Call Trace: [ 124.390828][ T5954] [ 124.390840][ T5954] dump_stack_lvl+0x188/0x250 [ 124.390876][ T5954] ? show_regs_print_info+0x20/0x20 [ 124.390906][ T5954] ? load_image+0x410/0x410 [ 124.390933][ T5954] ? __lock_acquire+0x7d40/0x7d40 [ 124.427323][ T5954] should_fail+0x383/0x4b0 [ 124.431825][ T5954] prepare_alloc_pages+0x1e3/0x5b0 [ 124.436996][ T5954] __alloc_pages+0x11b/0x480 [ 124.441644][ T5954] ? zone_statistics+0x170/0x170 [ 124.446629][ T5954] ? __rwlock_init+0x140/0x140 [ 124.451458][ T5954] ? alloc_pages+0x452/0x560 [ 124.456120][ T5954] __get_free_pages+0x8/0x30 [ 124.460859][ T5954] kasan_populate_vmalloc_pte+0x21/0xc0 [ 124.467582][ T5954] __apply_to_page_range+0x987/0xd10 [ 124.467619][ T5954] ? kasan_populate_vmalloc+0x70/0x70 [ 124.467646][ T5954] alloc_vmap_area+0x19e8/0x1b30 [ 124.467694][ T5954] ? vm_map_ram+0xba0/0xba0 [ 124.467727][ T5954] __get_vm_area_node+0x14f/0x2d0 [ 124.467755][ T5954] __vmalloc_node_range+0xef/0x8b0 [ 124.467776][ T5954] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 124.478741][ T5954] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 124.478775][ T5954] ? mutex_unlock+0x10/0x10 [ 124.478798][ T5954] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 124.488378][ T5954] __vmalloc+0x76/0x80 [ 124.488407][ T5954] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 124.488436][ T5954] snd_dma_alloc_pages+0xfb/0x1d0 [ 124.498711][ T5954] do_alloc_pages+0xee/0x210 [ 124.498744][ T5954] snd_pcm_lib_malloc_pages+0x2e5/0x720 [ 124.509737][ T5954] snd_pcm_hw_params+0x814/0x1cf0 [ 124.509768][ T5954] ? kasan_quarantine_put+0xd4/0x210 [ 124.519718][ T5954] ? slab_free_freelist_hook+0xec/0x170 [ 124.529124][ T5954] ? snd_pcm_hw_param_first+0x5de/0xa60 [ 124.529160][ T5954] ? snd_pcm_forward+0x580/0x580 [ 124.529194][ T5954] ? snd_pcm_hw_param_near+0x3da/0x460 [ 124.538993][ T5954] ? snd_pcm_kernel_ioctl+0xf1/0x340 [ 124.549625][ T5954] snd_pcm_oss_change_params_locked+0x1e46/0x3cf0 [ 124.588464][ T5954] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 124.593655][ T5954] ? memset+0x1e/0x40 [ 124.597693][ T5954] ? __fsnotify_parent+0x72a/0x820 [ 124.603067][ T5954] snd_pcm_oss_read+0x26f/0x890 [ 124.608296][ T5954] ? snd_pcm_oss_unregister_minor+0x210/0x210 [ 124.615207][ T5954] vfs_read+0x2ff/0xd50 [ 124.619532][ T5954] ? __lock_acquire+0x7d40/0x7d40 [ 124.624759][ T5954] ? kernel_read+0x1e0/0x1e0 [ 124.629422][ T5954] ? __fget_files+0x402/0x470 [ 124.634161][ T5954] ? __fdget_pos+0x1e2/0x370 [ 124.638922][ T5954] ? ksys_read+0x70/0x260 [ 124.643308][ T5954] ksys_read+0x153/0x260 [ 124.647706][ T5954] ? vfs_write+0xd70/0xd70 [ 124.652189][ T5954] ? lockdep_hardirqs_on+0x94/0x140 [ 124.657457][ T5954] do_syscall_64+0x4c/0xa0 [ 124.661953][ T5954] ? clear_bhb_loop+0x30/0x80 [ 124.666719][ T5954] ? clear_bhb_loop+0x30/0x80 [ 124.671580][ T5954] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 124.677974][ T5954] RIP: 0033:0x7ff343a9d559 [ 124.682447][ T5954] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.702188][ T5954] RSP: 002b:00007ff341cf5028 EFLAGS: 00000246 [ 124.708468][ T5954] ORIG_RAX: 0000000000000000 [ 124.708485][ T5954] RAX: ffffffffffffffda RBX: 00007ff343d24fa0 RCX: 00007ff343a9d559 [ 124.708502][ T5954] RDX: 0000000000001000 RSI: 0000200000000a00 RDI: 0000000000000004 [ 124.708516][ T5954] RBP: 00007ff343b348b0 R08: 0000000000000000 R09: 0000000000000000 [ 124.708531][ T5954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.708546][ T5954] R13: 00007ff343d25038 R14: 00007ff343d24fa0 R15: 00007ffdbf480a08 [ 124.754633][ T5954] [ 124.757745][ C1] vkms_vblank_simulate: vblank timer overrun [ 124.896829][ T5963] netlink: 'syz.0.530': attribute type 1 has an invalid length. [ 124.943610][ T5963] 8021q: adding VLAN 0 to HW filter on device bond3 [ 124.987885][ T5963] device dummy0 left promiscuous mode [ 125.105221][ T5963] bond3: (slave dummy0): making interface the new active one [ 125.149386][ T5963] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 125.191638][ T5967] netlink: 'syz.0.530': attribute type 10 has an invalid length. [ 125.218677][ T5967] netlink: 40 bytes leftover after parsing attributes in process `syz.0.530'. [ 125.254309][ T5967] device dummy0 entered promiscuous mode [ 125.283145][ T5967] bond3: (slave dummy0): Releasing active interface [ 125.294428][ T4174] Bluetooth: hci2: command 0x0406 tx timeout [ 125.776270][ T5986] FAULT_INJECTION: forcing a failure. [ 125.776270][ T5986] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 125.792780][ T5986] CPU: 1 PID: 5986 Comm: syz.3.536 Not tainted syzkaller #0 [ 125.800215][ T5986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 125.800266][ T5986] Call Trace: [ 125.800276][ T5986] [ 125.800286][ T5986] dump_stack_lvl+0x188/0x250 [ 125.800317][ T5986] ? show_regs_print_info+0x20/0x20 [ 125.800341][ T5986] ? load_image+0x410/0x410 [ 125.800366][ T5986] ? __lock_acquire+0x7d40/0x7d40 [ 125.800404][ T5986] should_fail+0x383/0x4b0 [ 125.800435][ T5986] _copy_to_user+0x2e/0x130 [ 125.800461][ T5986] do_ipt_get_ctl+0xb90/0x1110 [ 125.800503][ T5986] ? do_ipt_set_ctl+0xd70/0xd70 [ 125.800542][ T5986] ? nf_getsockopt+0x21b/0x280 [ 125.860622][ T5986] ? __lock_acquire+0x7d40/0x7d40 [ 125.865700][ T5986] ? __mutex_lock_common+0x435/0x2400 [ 125.865743][ T5986] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 125.877313][ T5986] ? mutex_unlock+0x10/0x10 [ 125.877350][ T5986] ? __might_fault+0xb7/0x110 [ 125.877377][ T5986] ? __lock_acquire+0x7d40/0x7d40 [ 125.877401][ T5986] ? __local_bh_enable_ip+0x136/0x1c0 [ 125.877426][ T5986] nf_getsockopt+0x25e/0x280 [ 125.877493][ T5986] ip_getsockopt+0x1219/0x1660 [ 125.877525][ T5986] ? ip_setsockopt+0x31e0/0x31e0 [ 125.877552][ T5986] ? __might_sleep+0xf0/0xf0 [ 125.877578][ T5986] ? rcu_lock_release+0x9/0x20 [ 125.877604][ T5986] ? __lock_acquire+0x7d40/0x7d40 [ 125.877635][ T5986] ? aa_sk_perm+0x7dc/0x910 [ 125.877666][ T5986] ? aa_af_perm+0x340/0x340 [ 125.877689][ T5986] ? __fget_files+0x402/0x470 [ 125.877714][ T5986] ? aa_sock_opt_perm+0x74/0x100 [ 125.877740][ T5986] ? sock_recv_errqueue+0x580/0x580 [ 125.921540][ T5986] __sys_getsockopt+0x1b0/0x230 [ 125.955465][ T5986] __x64_sys_getsockopt+0xb1/0xc0 [ 125.960563][ T5986] do_syscall_64+0x4c/0xa0 [ 125.965017][ T5986] ? clear_bhb_loop+0x30/0x80 [ 125.965046][ T5986] ? clear_bhb_loop+0x30/0x80 [ 125.965071][ T5986] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 125.965097][ T5986] RIP: 0033:0x7ff343a9d559 [ 125.965119][ T5986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.965137][ T5986] RSP: 002b:00007ff341cf5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 125.965172][ T5986] RAX: ffffffffffffffda RBX: 00007ff343d24fa0 RCX: 00007ff343a9d559 [ 125.965188][ T5986] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000004 [ 125.965203][ T5986] RBP: 00007ff343b348b0 R08: 00002000000001c0 R09: 0000000000000000 [ 126.029727][ T5986] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 126.045979][ T5986] R13: 00007ff343d25038 R14: 00007ff343d24fa0 R15: 00007ffdbf480a08 [ 126.054020][ T5986] [ 126.057196][ C1] vkms_vblank_simulate: vblank timer overrun [ 126.254434][ T21] Bluetooth: hci5: command 0xfc11 tx timeout [ 126.261085][ T4188] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 126.707610][ T6007] FAULT_INJECTION: forcing a failure. [ 126.707610][ T6007] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 126.747190][ T6007] CPU: 1 PID: 6007 Comm: syz.4.542 Not tainted syzkaller #0 [ 126.754560][ T6007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 126.765129][ T6007] Call Trace: [ 126.768452][ T6007] [ 126.771516][ T6007] dump_stack_lvl+0x188/0x250 [ 126.776257][ T6007] ? show_regs_print_info+0x20/0x20 [ 126.781561][ T6007] ? load_image+0x410/0x410 [ 126.786386][ T6007] ? __lock_acquire+0x7d40/0x7d40 [ 126.791481][ T6007] should_fail+0x383/0x4b0 [ 126.795975][ T6007] prepare_alloc_pages+0x1e3/0x5b0 [ 126.801153][ T6007] __alloc_pages+0x11b/0x480 [ 126.805800][ T6007] ? zone_statistics+0x170/0x170 [ 126.810794][ T6007] ? __rwlock_init+0x140/0x140 [ 126.815618][ T6007] ? alloc_pages+0x452/0x560 [ 126.820793][ T6007] __get_free_pages+0x8/0x30 [ 126.825544][ T6007] kasan_populate_vmalloc_pte+0x21/0xc0 [ 126.831260][ T6007] __apply_to_page_range+0x987/0xd10 [ 126.836718][ T6007] ? kasan_populate_vmalloc+0x70/0x70 [ 126.842242][ T6007] alloc_vmap_area+0x19e8/0x1b30 [ 126.847289][ T6007] ? vm_map_ram+0xba0/0xba0 [ 126.851854][ T6007] __get_vm_area_node+0x14f/0x2d0 [ 126.857074][ T6007] __vmalloc_node_range+0xef/0x8b0 [ 126.862230][ T6007] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 126.867487][ T6007] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 126.873169][ T6007] ? mutex_unlock+0x10/0x10 [ 126.877754][ T6007] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 126.883011][ T6007] __vmalloc+0x76/0x80 [ 126.887137][ T6007] ? snd_dma_alloc_pages+0xfb/0x1d0 [ 126.892387][ T6007] snd_dma_alloc_pages+0xfb/0x1d0 [ 126.897473][ T6007] do_alloc_pages+0xee/0x210 [ 126.902121][ T6007] snd_pcm_lib_malloc_pages+0x2e5/0x720 [ 126.902162][ T6007] snd_pcm_hw_params+0x814/0x1cf0 [ 126.902189][ T6007] ? kasan_quarantine_put+0xd4/0x210 [ 126.913185][ T6007] ? slab_free_freelist_hook+0xec/0x170 [ 126.924054][ T6007] ? snd_pcm_hw_param_first+0x5de/0xa60 [ 126.929647][ T6007] ? snd_pcm_forward+0x580/0x580 [ 126.934647][ T6007] ? snd_pcm_hw_param_near+0x3da/0x460 [ 126.940173][ T6007] ? snd_pcm_kernel_ioctl+0xf1/0x340 [ 126.945596][ T6007] snd_pcm_oss_change_params_locked+0x1e46/0x3cf0 [ 126.945654][ T6007] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 126.957369][ T6007] ? memset+0x1e/0x40 [ 126.957398][ T6007] ? __fsnotify_parent+0x72a/0x820 [ 126.966544][ T6007] snd_pcm_oss_read+0x26f/0x890 [ 126.966588][ T6007] ? snd_pcm_oss_unregister_minor+0x210/0x210 [ 126.977668][ T6007] vfs_read+0x2ff/0xd50 [ 126.977700][ T6007] ? __lock_acquire+0x7d40/0x7d40 [ 126.977732][ T6007] ? kernel_read+0x1e0/0x1e0 [ 126.987017][ T6007] ? __fget_files+0x402/0x470 [ 126.987051][ T6007] ? __fdget_pos+0x1e2/0x370 [ 126.996364][ T6007] ? ksys_read+0x70/0x260 [ 126.996392][ T6007] ksys_read+0x153/0x260 [ 126.996419][ T6007] ? vfs_write+0xd70/0xd70 [ 127.005375][ T6007] ? lockdep_hardirqs_on+0x94/0x140 [ 127.005408][ T6007] do_syscall_64+0x4c/0xa0 [ 127.014102][ T6007] ? clear_bhb_loop+0x30/0x80 [ 127.014133][ T6007] ? clear_bhb_loop+0x30/0x80 [ 127.014161][ T6007] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 127.023888][ T6007] RIP: 0033:0x7f1eeff7e559 [ 127.033426][ T6007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.033453][ T6007] RSP: 002b:00007f1eee1d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 127.044116][ T6007] RAX: ffffffffffffffda RBX: 00007f1ef0205fa0 RCX: 00007f1eeff7e559 [ 127.044136][ T6007] RDX: 0000000000001000 RSI: 0000200000000a00 RDI: 0000000000000004 [ 127.044152][ T6007] RBP: 00007f1ef00158b0 R08: 0000000000000000 R09: 0000000000000000 [ 127.072571][ T6007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.088658][ T6007] R13: 00007f1ef0206038 R14: 00007f1ef0205fa0 R15: 00007fff665ad718 [ 127.088697][ T6007] [ 127.088826][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.122631][ C1] net_ratelimit: 60 callbacks suppressed [ 127.269619][ T6014] netlink: 'syz.2.545': attribute type 1 has an invalid length. [ 127.429652][ T6014] 8021q: adding VLAN 0 to HW filter on device bond5 [ 127.480738][ T6018] device dummy0 left promiscuous mode [ 127.531343][ T6018] bond5: (slave dummy0): making interface the new active one [ 127.575152][ T6018] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 127.613165][ T6019] netlink: 'syz.2.545': attribute type 10 has an invalid length. [ 127.643486][ T6019] netlink: 40 bytes leftover after parsing attributes in process `syz.2.545'. [ 127.687746][ T6019] device dummy0 entered promiscuous mode [ 127.716771][ T6025] binder: 6022:6025 ioctl 4018620d 0 returned -22 [ 127.787066][ T6019] bond5: (slave dummy0): Releasing active interface [ 127.918161][ T6024] ======================================================= [ 127.918161][ T6024] WARNING: The mand mount option has been deprecated and [ 127.918161][ T6024] and is ignored by this kernel. Remove the mand [ 127.918161][ T6024] option from the mount to silence this warning. [ 127.918161][ T6024] ======================================================= [ 128.284370][ T6038] netlink: 'syz.2.553': attribute type 1 has an invalid length. [ 128.322138][ T6038] 8021q: adding VLAN 0 to HW filter on device bond6 [ 128.341978][ T6038] device dummy0 left promiscuous mode [ 128.363091][ T6038] bond6: (slave dummy0): making interface the new active one [ 128.377974][ T6038] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 128.395579][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond6: link becomes ready [ 128.946504][ T6064] netlink: 'syz.4.560': attribute type 1 has an invalid length. [ 129.320435][ T6064] 8021q: adding VLAN 0 to HW filter on device bond4 [ 129.391686][ T6061] bond4: (slave dummy0): Enslaving as a backup interface with an up link [ 129.461055][ T6075] netlink: 'syz.4.560': attribute type 10 has an invalid length. [ 129.503017][ T6075] netlink: 40 bytes leftover after parsing attributes in process `syz.4.560'. [ 129.560233][ T6075] device dummy0 entered promiscuous mode [ 129.600898][ T6075] bond4: (slave dummy0): Removing an active aggregator [ 129.634390][ T154] bond4: (slave dummy0): link status up again after 0 ms [ 129.661710][ T6075] bond4: (slave dummy0): Releasing backup interface [ 129.733025][ T6079] netlink: 'syz.3.565': attribute type 1 has an invalid length. [ 129.935030][ T6079] 8021q: adding VLAN 0 to HW filter on device bond2 [ 129.954009][ T6081] device dummy0 left promiscuous mode [ 130.052857][ T6081] bond2: (slave dummy0): Enslaving as a backup interface with an up link [ 130.163543][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 130.949854][ T6126] netlink: 'syz.3.582': attribute type 1 has an invalid length. [ 131.072235][ T6126] 8021q: adding VLAN 0 to HW filter on device bond3 [ 131.083649][ T6135] netlink: 'syz.0.584': attribute type 1 has an invalid length. [ 131.123026][ T6135] 8021q: adding VLAN 0 to HW filter on device bond4 [ 131.182313][ T6133] bond2: (slave dummy0): Removing an active aggregator [ 131.202146][ T6133] bond2: (slave dummy0): Releasing backup interface [ 131.312745][ T6133] bond3: (slave dummy0): making interface the new active one [ 131.368498][ T6133] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 131.408385][ T6136] netlink: 'syz.3.582': attribute type 10 has an invalid length. [ 131.458771][ T6136] netlink: 40 bytes leftover after parsing attributes in process `syz.3.582'. [ 131.487009][ T6136] device dummy0 entered promiscuous mode [ 131.513417][ T6136] bond3: (slave dummy0): Releasing active interface [ 131.597851][ T6135] device dummy0 left promiscuous mode [ 131.621381][ T6135] bond4: (slave dummy0): Enslaving as a backup interface with an up link [ 131.732849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 132.174380][ C0] net_ratelimit: 71 callbacks suppressed [ 132.686561][ T6186] netlink: 8 bytes leftover after parsing attributes in process `syz.4.598'. [ 132.720847][ T6189] netlink: 'syz.1.599': attribute type 1 has an invalid length. [ 132.812163][ T6189] 8021q: adding VLAN 0 to HW filter on device bond7 [ 132.824536][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.830889][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.934564][ T6192] device dummy0 left promiscuous mode [ 132.981153][ T6192] bond7: (slave dummy0): making interface the new active one [ 132.997348][ T6192] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 133.034721][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): bond7: link becomes ready [ 133.052609][ T6193] netlink: 'syz.1.599': attribute type 10 has an invalid length. [ 133.084408][ T6193] netlink: 40 bytes leftover after parsing attributes in process `syz.1.599'. [ 133.106823][ T6193] device dummy0 entered promiscuous mode [ 133.129347][ T6193] bond7: (slave dummy0): Releasing active interface [ 133.170329][ T6196] netlink: 'syz.4.600': attribute type 1 has an invalid length. [ 133.315807][ T6202] binder: 6201:6202 ioctl c0306201 0 returned -14 [ 133.379230][ T6196] 8021q: adding VLAN 0 to HW filter on device bond5 [ 133.416340][ T6197] device dummy0 left promiscuous mode [ 133.468679][ T6197] bond5: (slave dummy0): Enslaving as a backup interface with an up link [ 133.526812][ T1238] IPv6: ADDRCONF(NETDEV_CHANGE): bond5: link becomes ready [ 134.176918][ T6224] FAULT_INJECTION: forcing a failure. [ 134.176918][ T6224] name failslab, interval 1, probability 0, space 0, times 0 [ 134.211057][ T6224] CPU: 0 PID: 6224 Comm: syz.0.610 Not tainted syzkaller #0 [ 134.218422][ T6224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 134.228506][ T6224] Call Trace: [ 134.231817][ T6224] [ 134.234793][ T6224] dump_stack_lvl+0x188/0x250 [ 134.239534][ T6224] ? show_regs_print_info+0x20/0x20 [ 134.244784][ T6224] ? load_image+0x410/0x410 [ 134.249344][ T6224] ? rcu_lock_release+0x5/0x20 [ 134.254283][ T6224] should_fail+0x383/0x4b0 [ 134.258758][ T6224] should_failslab+0x5/0x20 [ 134.263322][ T6224] slab_pre_alloc_hook+0x51/0xc0 [ 134.268415][ T6224] ? __nf_conntrack_alloc+0x93/0x370 [ 134.273766][ T6224] kmem_cache_alloc+0x3d/0x280 [ 134.278596][ T6224] __nf_conntrack_alloc+0x93/0x370 [ 134.283775][ T6224] init_conntrack+0x2fd/0x1530 [ 134.288794][ T6224] ? get_l4proto+0x670/0x670 [ 134.293438][ T6224] ? early_drop+0x800/0x800 [ 134.298001][ T6224] ? nf_conntrack_find_get+0x640/0x640 [ 134.303518][ T6224] ? __siphash_unaligned+0x286/0x3d0 [ 134.308963][ T6224] nf_conntrack_in+0xd76/0x17b0 [ 134.313910][ T6224] ? nf_ct_pernet+0x240/0x240 [ 134.318667][ T6224] ? ip6t_alloc_initial_table+0x640/0x640 [ 134.324563][ T6224] ? ipv6_defrag+0x2d2/0x3a0 [ 134.329210][ T6224] ? ipv6_conntrack_in+0x20/0x20 [ 134.334201][ T6224] nf_hook_slow+0xb9/0x200 [ 134.338692][ T6224] ? rcu_read_unlock+0xa0/0xa0 [ 134.343516][ T6224] nf_hook+0x205/0x360 [ 134.347631][ T6224] ? ip6_make_skb+0x530/0x530 [ 134.352345][ T6224] ? rcu_read_unlock+0xa0/0xa0 [ 134.357156][ T6224] ip6_xmit+0xfa5/0x16e0 [ 134.361454][ T6224] ? rcu_read_unlock+0xa0/0xa0 [ 134.366365][ T6224] ? ip6_autoflowlabel+0xd0/0xd0 [ 134.371356][ T6224] ? __sk_dst_check+0x14e/0x290 [ 134.376261][ T6224] ? read_lock_is_recursive+0x10/0x10 [ 134.381700][ T6224] ? inet6_csk_route_socket+0x613/0xed0 [ 134.387313][ T6224] inet6_csk_xmit+0x405/0x680 [ 134.392045][ T6224] ? inet6_csk_addr2sockaddr+0x1d0/0x1d0 [ 134.397736][ T6224] ? csum_ipv6_magic+0x1e/0x80 [ 134.402554][ T6224] __tcp_transmit_skb+0x1ca3/0x31e0 [ 134.407814][ T6224] ? __tcp_send_ack+0x5d0/0x5d0 [ 134.412735][ T6224] ? tcp_fastopen_cookie_check+0x269/0x3c0 [ 134.418593][ T6224] tcp_connect+0x2d1a/0x4970 [ 134.418662][ T6224] tcp_v6_connect+0x11cf/0x1a10 [ 134.428139][ T6224] ? tcp_v6_pre_connect+0xf0/0xf0 [ 134.428181][ T6224] ? tcp_sendmsg_fastopen+0x1d5/0x600 [ 134.438689][ T6224] ? tcp_sendmsg_locked+0x2efb/0x3330 [ 134.438713][ T6224] ? tcp_sendmsg+0x2b/0x40 [ 134.438730][ T6224] ? __sys_sendto+0x46d/0x620 [ 134.438753][ T6224] ? __x64_sys_sendto+0xda/0xf0 [ 134.448567][ T6224] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 134.458216][ T6224] __inet_stream_connect+0x244/0xd80 [ 134.469633][ T6224] ? inet_dgram_connect+0x340/0x340 [ 134.474893][ T6224] tcp_sendmsg_fastopen+0x38f/0x600 [ 134.480135][ T6224] tcp_sendmsg_locked+0x2efb/0x3330 [ 134.485371][ T6224] ? aa_sk_perm+0x910/0x910 [ 134.485418][ T6224] ? mark_lock+0x94/0x320 [ 134.494425][ T6224] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 134.494460][ T6224] ? lock_chain_count+0x20/0x20 [ 134.505332][ T6224] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 134.505376][ T6224] ? tcp_free_fastopen_req+0x70/0x70 [ 134.505417][ T6224] tcp_sendmsg+0x2b/0x40 [ 134.516708][ T6224] __sys_sendto+0x46d/0x620 [ 134.516744][ T6224] ? __ia32_sys_getpeername+0x80/0x80 [ 134.516795][ T6224] ? lock_chain_count+0x20/0x20 [ 134.516826][ T6224] __x64_sys_sendto+0xda/0xf0 [ 134.526007][ T6224] do_syscall_64+0x4c/0xa0 [ 134.526039][ T6224] ? clear_bhb_loop+0x30/0x80 [ 134.526065][ T6224] ? clear_bhb_loop+0x30/0x80 [ 134.526089][ T6224] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 134.536544][ T6224] RIP: 0033:0x7fa79f683559 [ 134.536572][ T6224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.536590][ T6224] RSP: 002b:00007fa79d8db028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 134.536615][ T6224] RAX: ffffffffffffffda RBX: 00007fa79f90afa0 RCX: 00007fa79f683559 [ 134.545755][ T6224] RDX: 0000000000000091 RSI: 0000000000000000 RDI: 0000000000000003 [ 134.545772][ T6224] RBP: 00007fa79f71a8b0 R08: 00002000000001c0 R09: 000000000000001c [ 134.545788][ T6224] R10: 0000000024000045 R11: 0000000000000246 R12: 0000000000000000 [ 134.555249][ T6224] R13: 00007fa79f90b038 R14: 00007fa79f90afa0 R15: 00007ffe1dff7ac8 [ 134.555285][ T6224] [ 134.585812][ C1] vkms_vblank_simulate: vblank timer overrun [ 134.735076][ T21] Bluetooth: hci5: command 0xfc11 tx timeout [ 134.744285][ T4188] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 134.905550][ T6231] binder: BINDER_SET_CONTEXT_MGR already set [ 134.952974][ T6231] binder: 6230:6231 ioctl 4018620d 200000002e00 returned -16 [ 135.052810][ T6240] netlink: 'syz.0.616': attribute type 1 has an invalid length. [ 135.201938][ T6240] 8021q: adding VLAN 0 to HW filter on device bond5 [ 135.279085][ T6246] bond4: (slave dummy0): Removing an active aggregator [ 135.337249][ T6246] bond4: (slave dummy0): Releasing backup interface [ 135.442960][ T6253] binder: 6252:6253 ioctl c0306201 0 returned -14 [ 135.905178][ T6270] fuse: Bad value for 'fd' [ 136.128780][ T6279] netlink: 'syz.4.629': attribute type 1 has an invalid length. [ 136.222483][ T6279] 8021q: adding VLAN 0 to HW filter on device bond6 [ 136.364790][ T6281] bond5: (slave dummy0): Removing an active aggregator [ 136.400800][ T6281] bond5: (slave dummy0): Releasing backup interface [ 137.048304][ T6310] fuse: Bad value for 'fd' [ 137.312749][ T6315] binder: 6314:6315 ioctl c0306201 0 returned -14 [ 137.532182][ T6322] netlink: 'syz.0.645': attribute type 1 has an invalid length. [ 137.597472][ T6322] 8021q: adding VLAN 0 to HW filter on device bond6 [ 137.774186][ C1] net_ratelimit: 61 callbacks suppressed [ 138.132398][ T6342] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 138.398379][ T6353] binder: BINDER_SET_CONTEXT_MGR already set [ 138.448470][ T6353] binder: 6352:6353 ioctl 4018620d 200000000780 returned -16 [ 138.532172][ T6359] netlink: 'syz.2.659': attribute type 1 has an invalid length. [ 138.681857][ T6359] 8021q: adding VLAN 0 to HW filter on device bond7 [ 138.783087][ T6364] bond6: (slave dummy0): Releasing active interface [ 139.010677][ T6372] netlink: 'syz.2.663': attribute type 1 has an invalid length. [ 139.171840][ T6372] 8021q: adding VLAN 0 to HW filter on device bond8 [ 139.185136][ T6375] bond8: (slave dummy0): making interface the new active one [ 139.202536][ T6375] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 139.211503][ T6378] netlink: 'syz.2.663': attribute type 10 has an invalid length. [ 139.260466][ T6378] netlink: 40 bytes leftover after parsing attributes in process `syz.2.663'. [ 139.289461][ T6378] device dummy0 entered promiscuous mode [ 139.335633][ T6378] bond8: (slave dummy0): Releasing active interface [ 139.533013][ T6386] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 139.801656][ T6398] netlink: 'syz.3.673': attribute type 1 has an invalid length. [ 140.015464][ T6398] 8021q: adding VLAN 0 to HW filter on device bond4 [ 140.029513][ T6400] device dummy0 left promiscuous mode [ 140.302033][ T6410] binder: BINDER_SET_CONTEXT_MGR already set [ 140.319070][ T6410] binder: 6407:6410 ioctl 4018620d 200000000780 returned -16 [ 140.512094][ T6416] netlink: 'syz.2.677': attribute type 1 has an invalid length. [ 140.633181][ T6416] 8021q: adding VLAN 0 to HW filter on device bond9 [ 140.642292][ T6418] device dummy0 left promiscuous mode [ 140.654997][ T6418] bond9: (slave dummy0): making interface the new active one [ 140.663875][ T6418] bond9: (slave dummy0): Enslaving as an active interface with an up link [ 140.672638][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond9: link becomes ready [ 140.726415][ T6422] netlink: 'syz.2.677': attribute type 10 has an invalid length. [ 140.764360][ T6422] netlink: 40 bytes leftover after parsing attributes in process `syz.2.677'. [ 140.773483][ T6422] device dummy0 entered promiscuous mode [ 140.803638][ T6424] input: syz0 as /devices/virtual/input/input7 [ 140.817515][ T6422] bond9: (slave dummy0): Releasing active interface [ 141.071683][ T6432] FAULT_INJECTION: forcing a failure. [ 141.071683][ T6432] name failslab, interval 1, probability 0, space 0, times 0 [ 141.094234][ T6432] CPU: 0 PID: 6432 Comm: syz.2.682 Not tainted syzkaller #0 [ 141.101594][ T6432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 141.111693][ T6432] Call Trace: [ 141.115012][ T6432] [ 141.117981][ T6432] dump_stack_lvl+0x188/0x250 [ 141.122772][ T6432] ? show_regs_print_info+0x20/0x20 [ 141.128037][ T6432] ? load_image+0x410/0x410 [ 141.132592][ T6432] ? __might_sleep+0xf0/0xf0 [ 141.137229][ T6432] ? __lock_acquire+0x7d40/0x7d40 [ 141.142307][ T6432] should_fail+0x383/0x4b0 [ 141.146768][ T6432] should_failslab+0x5/0x20 [ 141.151314][ T6432] slab_pre_alloc_hook+0x51/0xc0 [ 141.156398][ T6432] ? key_alloc+0x302/0x1030 [ 141.160971][ T6432] kmem_cache_alloc+0x3d/0x280 [ 141.165779][ T6432] ? key_user_lookup+0x1b8/0x450 [ 141.170771][ T6432] key_alloc+0x302/0x1030 [ 141.175157][ T6432] ? clear_nonspinnable+0x60/0x60 [ 141.180260][ T6432] keyring_alloc+0x41/0xa0 [ 141.184723][ T6432] keyctl_get_persistent+0x4a0/0x780 [ 141.190069][ T6432] ? proc_key_users_show+0x310/0x310 [ 141.195398][ T6432] ? verify_lock_unused+0x140/0x140 [ 141.200654][ T6432] ? do_futex+0xdc2/0x12b0 [ 141.205127][ T6432] ? vfs_write+0xaa6/0xd70 [ 141.209585][ T6432] __se_sys_keyctl+0x61e/0xa20 [ 141.214390][ T6432] ? __x64_sys_keyctl+0xc0/0xc0 [ 141.219310][ T6432] ? __context_tracking_exit+0x4c/0x80 [ 141.224813][ T6432] ? __lock_acquire+0x7d40/0x7d40 [ 141.224848][ T6432] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 141.235978][ T6432] ? lock_chain_count+0x20/0x20 [ 141.236014][ T6432] ? lockdep_hardirqs_on+0x94/0x140 [ 141.236041][ T6432] ? __x64_sys_keyctl+0x1c/0xc0 [ 141.246119][ T6432] do_syscall_64+0x4c/0xa0 [ 141.246148][ T6432] ? clear_bhb_loop+0x30/0x80 [ 141.246174][ T6432] ? clear_bhb_loop+0x30/0x80 [ 141.246199][ T6432] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 141.246222][ T6432] RIP: 0033:0x7f92d9fe7559 [ 141.255961][ T6432] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.255988][ T6432] RSP: 002b:00007f92d823f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 141.256014][ T6432] RAX: ffffffffffffffda RBX: 00007f92da26efa0 RCX: 00007f92d9fe7559 [ 141.265407][ T6432] RDX: fffffffffffffffd RSI: ffffffffffffffff RDI: 0000000000000016 [ 141.275784][ T6432] RBP: 00007f92da07e8b0 R08: 0000000000000000 R09: 0000000000000000 [ 141.275807][ T6432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.275822][ T6432] R13: 00007f92da26f038 R14: 00007f92da26efa0 R15: 00007ffc4be1aad8 [ 141.303989][ T6432] [ 141.840918][ T6449] netlink: 'syz.2.686': attribute type 1 has an invalid length. [ 141.984349][ T6454] binder: BINDER_SET_CONTEXT_MGR already set [ 142.006636][ T6454] binder: 6453:6454 ioctl 4018620d 200000000b00 returned -16 [ 142.045648][ T6454] binder: BINDER_SET_CONTEXT_MGR already set [ 142.082305][ T6454] binder: 6453:6454 ioctl 4018620d 200000002e00 returned -16 [ 142.295607][ T6449] 8021q: adding VLAN 0 to HW filter on device bond10 [ 142.303642][ T6452] device dummy0 left promiscuous mode [ 142.593544][ T6467] binder: BINDER_SET_CONTEXT_MGR already set [ 142.604293][ T6467] binder: 6465:6467 ioctl 4018620d 200000000780 returned -16 [ 142.984216][ C1] net_ratelimit: 68 callbacks suppressed [ 142.994204][ T4174] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 143.267454][ T4174] usb 3-1: Using ep0 maxpacket: 32 [ 143.384729][ T4174] usb 3-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 143.428261][ T4174] usb 3-1: config 1 interface 0 has no altsetting 0 [ 143.594596][ T4174] usb 3-1: New USB device found, idVendor=046d, idProduct=c539, bcdDevice= 0.40 [ 143.613956][ T4174] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.644728][ T4174] usb 3-1: Product: syz [ 143.644789][ T4174] usb 3-1: Manufacturer: syz [ 143.644808][ T4174] usb 3-1: SerialNumber: syz [ 144.000017][ T6505] binder: BINDER_SET_CONTEXT_MGR already set [ 144.034735][ T6505] binder: 6504:6505 ioctl 4018620d 200000002e00 returned -16 [ 144.144514][ T4174] usbhid 3-1:1.0: can't add hid device: -71 [ 144.154379][ T4174] usbhid: probe of 3-1:1.0 failed with error -71 [ 144.197856][ T4174] usb 3-1: USB disconnect, device number 2 [ 144.372047][ T6512] netlink: 28 bytes leftover after parsing attributes in process `syz.3.710'. [ 144.636765][ T6522] binder: BINDER_SET_CONTEXT_MGR already set [ 144.643171][ T6522] binder: 6521:6522 ioctl 4018620d 200000000b00 returned -16 [ 144.655155][ T6522] binder: BINDER_SET_CONTEXT_MGR already set [ 144.661280][ T6522] binder: 6521:6522 ioctl 4018620d 200000002e00 returned -16 [ 145.141636][ T6540] fuse: Bad value for 'group_id' [ 145.401876][ T6545] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 145.464324][ T6545] CIFS: Attempting to mount \\127.0.0.1\share [ 145.493240][ T6545] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 145.653671][ T6554] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 145.955801][ T6561] binder: BINDER_SET_CONTEXT_MGR already set [ 145.973489][ T6563] FAULT_INJECTION: forcing a failure. [ 145.973489][ T6563] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 145.988202][ T6563] CPU: 1 PID: 6563 Comm: syz.3.725 Not tainted syzkaller #0 [ 145.996384][ T6563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 146.006653][ T6563] Call Trace: [ 146.006665][ T6563] [ 146.006674][ T6563] dump_stack_lvl+0x188/0x250 [ 146.006704][ T6563] ? show_regs_print_info+0x20/0x20 [ 146.012960][ T6563] ? load_image+0x410/0x410 [ 146.012995][ T6563] should_fail+0x383/0x4b0 [ 146.013020][ T6563] prepare_alloc_pages+0x1e3/0x5b0 [ 146.013049][ T6563] __alloc_pages+0x11b/0x480 [ 146.013072][ T6563] ? zone_statistics+0x170/0x170 [ 146.044816][ T6561] binder: 6558:6561 ioctl 4018620d 200000000b00 returned -16 [ 146.047357][ T6563] ? rcu_lock_acquire+0x30/0x30 [ 146.059748][ T6563] ? alloc_pages+0x452/0x560 [ 146.064434][ T6563] __get_free_pages+0x8/0x30 [ 146.069085][ T6563] __tlb_remove_page_size+0x1f2/0x3f0 [ 146.074541][ T6563] unmap_page_range+0xfcf/0x2410 [ 146.079548][ T6563] unmap_vmas+0x131/0x250 [ 146.084014][ T6563] ? unmap_page_range+0x2410/0x2410 [ 146.089262][ T6563] ? __mutex_lock_common+0x435/0x2400 [ 146.094696][ T6563] ? exit_mm_release+0x16/0x30 [ 146.099512][ T6563] exit_mmap+0x3b9/0x640 [ 146.103806][ T6563] ? vm_brk+0x20/0x20 [ 146.107895][ T6563] ? uprobe_clear_state+0x2f6/0x460 [ 146.113153][ T6563] __mmput+0x115/0x390 [ 146.117264][ T6563] exit_mm+0x632/0x7b0 [ 146.121462][ T6563] ? perf_pmu_migrate_context+0xb70/0xb70 [ 146.127237][ T6563] ? do_exit+0x2110/0x2110 [ 146.131692][ T6563] ? __ia32_sys_timer_delete+0x40/0x40 [ 146.137189][ T6563] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 146.142790][ T6563] ? tty_audit_exit+0x149/0x1f0 [ 146.147703][ T6563] do_exit+0x5b8/0x2110 [ 146.151920][ T6563] ? put_task_struct+0x80/0x80 [ 146.156719][ T6563] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 146.162745][ T6563] ? _raw_spin_lock_irq+0xb7/0xf0 [ 146.167810][ T6563] do_group_exit+0x12c/0x2f0 [ 146.172439][ T6563] ? lockdep_hardirqs_on+0x94/0x140 [ 146.172475][ T6563] get_signal+0x7eb/0x12e0 [ 146.172512][ T6563] arch_do_signal_or_restart+0xe6/0x12a0 [ 146.172548][ T6563] ? futex_exit_release+0x1c0/0x1c0 [ 146.172570][ T6563] ? get_sigframe_size+0x10/0x10 [ 146.172592][ T6563] ? __context_tracking_exit+0x4c/0x80 [ 146.204331][ T6563] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 146.210463][ T6563] ? exit_to_user_mode_loop+0x3b/0x130 [ 146.215969][ T6563] exit_to_user_mode_loop+0x9e/0x130 [ 146.221323][ T6563] exit_to_user_mode_prepare+0xee/0x180 [ 146.226916][ T6563] syscall_exit_to_user_mode+0x16/0x40 [ 146.232556][ T6563] do_syscall_64+0x58/0xa0 [ 146.237022][ T6563] ? clear_bhb_loop+0x30/0x80 [ 146.241741][ T6563] ? clear_bhb_loop+0x30/0x80 [ 146.246481][ T6563] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.252425][ T6563] RIP: 0033:0x7ff343a9d559 [ 146.256968][ T6563] Code: Unable to access opcode bytes at RIP 0x7ff343a9d52f. [ 146.264355][ T6563] RSP: 002b:00007ff341cf50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 146.264383][ T6563] RAX: 0000000000000001 RBX: 00007ff343d24fa8 RCX: 00007ff343a9d559 [ 146.264397][ T6563] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff343d24fac [ 146.264412][ T6563] RBP: 00007ff343d24fa0 R08: 0035b24cb035e87c R09: 0000000000000000 [ 146.264426][ T6563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 146.264439][ T6563] R13: 00007ff343d25038 R14: 00007ffdbf480920 R15: 00007ffdbf480a08 [ 146.264470][ T6563] [ 146.297211][ C1] vkms_vblank_simulate: vblank timer overrun [ 146.323869][ C1] vkms_vblank_simulate: vblank timer overrun [ 146.374239][ T6567] binder: BINDER_SET_CONTEXT_MGR already set [ 146.385261][ T6567] binder: 6564:6567 ioctl 4018620d 200000000b00 returned -16 [ 146.404614][ T6567] binder: BINDER_SET_CONTEXT_MGR already set [ 146.410659][ T6567] binder: 6564:6567 ioctl 4018620d 200000002e00 returned -16 [ 146.424768][ T6545] CIFS: VFS: cifs_mount failed w/return code = -112 [ 146.594647][ T6573] fuse: Bad value for 'group_id' [ 147.548771][ T6593] binder: BINDER_SET_CONTEXT_MGR already set [ 147.584551][ T6593] binder: 6592:6593 ioctl 4018620d 200000000b00 returned -16 [ 147.857606][ T6605] nfs4: Unknown parameter 'a' [ 148.092897][ T6603] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input8 [ 148.174216][ C0] net_ratelimit: 71 callbacks suppressed [ 148.472005][ T6617] fuse: Bad value for 'group_id' [ 148.677620][ T6624] binder: BINDER_SET_CONTEXT_MGR already set [ 148.683673][ T6624] binder: 6623:6624 ioctl 4018620d 200000000b00 returned -16 [ 148.747638][ T6628] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 148.767160][ T6624] binder: BINDER_SET_CONTEXT_MGR already set [ 148.773257][ T6624] binder: 6623:6624 ioctl 4018620d 200000002e00 returned -16 [ 149.954427][ T21] Bluetooth: hci0: command 0x0c1a tx timeout [ 150.212171][ T6665] device dummy0 left promiscuous mode [ 150.348153][ T6660] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input9 [ 150.372432][ T6673] binder_alloc: 6672: binder_alloc_buf, no vma [ 150.573282][ T6675] XFS (loop0): Invalid device [./loop0], error=-16 [ 150.842484][ T6689] netlink: 8 bytes leftover after parsing attributes in process `syz.2.768'. [ 150.888172][ T6689] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.895780][ T6689] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.521721][ T6705] usb usb8: usbfs: process 6705 (syz.1.772) did not claim interface 0 before use [ 151.720121][ T6709] netlink: 'syz.1.773': attribute type 1 has an invalid length. [ 151.763243][ T6710] binder_alloc: 6708: binder_alloc_buf, no vma [ 151.865197][ T6709] 8021q: adding VLAN 0 to HW filter on device bond8 [ 151.880549][ T6709] netlink: 'syz.1.773': attribute type 10 has an invalid length. [ 151.890519][ T6709] netlink: 40 bytes leftover after parsing attributes in process `syz.1.773'. [ 151.900295][ T6709] device dummy0 entered promiscuous mode [ 151.959963][ T6712] device dummy0 left promiscuous mode [ 152.267852][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 152.317661][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 152.360899][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x28d5 instead [ 152.416009][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xc87a instead [ 152.431980][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 152.447095][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 152.458266][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 152.469987][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 152.481810][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 152.508953][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 152.543312][ T6722] jffs2: Further such events for this erase block will not be printed [ 152.575235][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 152.623901][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 152.645508][ T6731] binder: BINDER_SET_CONTEXT_MGR already set [ 152.651604][ T6731] binder: 6730:6731 ioctl 4018620d 200000000780 returned -16 [ 152.668559][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x28d5 instead [ 152.693837][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xc87a instead [ 152.731175][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 152.750938][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 152.783551][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 152.795378][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 152.806405][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 152.817206][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 152.828473][ T6722] jffs2: Further such events for this erase block will not be printed [ 152.837947][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 152.856737][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 152.884574][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x28d5 instead [ 152.914353][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xc87a instead [ 152.933177][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 152.950517][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 152.977615][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x28d5 instead [ 153.000897][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xc87a instead [ 153.031175][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 153.048559][ T6716] usb usb5: usbfs: interface 0 claimed by hub while 'syz.0.776' sets config #0 [ 153.116716][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 153.195436][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x28d5 instead [ 153.222271][ T6749] binder: BINDER_SET_CONTEXT_MGR already set [ 153.227822][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xc87a instead [ 153.252185][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 153.254332][ T6749] binder: 6748:6749 ioctl 4018620d 200000000100 returned -16 [ 153.285965][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 153.299843][ T6749] binder: 6748:6749 ioctl c0306201 0 returned -14 [ 153.305240][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x28d5 instead [ 153.328890][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xc87a instead [ 153.351728][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 153.379748][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 153.430779][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x28d5 instead [ 153.454153][ C0] net_ratelimit: 62 callbacks suppressed [ 153.473426][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xc87a instead [ 153.492432][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 153.512342][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 153.545272][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x28d5 instead [ 153.563742][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xc87a instead [ 153.623650][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 153.648502][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 153.660736][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x28d5 instead [ 153.697119][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xc87a instead [ 153.716556][ T4291] udevd[4291]: inotify_add_watch(7, /dev/loop9, 10) failed: Not a directory [ 153.743294][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 153.784583][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 153.848988][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x28d5 instead [ 153.882263][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xc87a instead [ 153.911643][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 153.935700][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 153.950853][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x28d5 instead [ 153.962712][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xc87a instead [ 153.975576][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 153.987777][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 154.006722][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x28d5 instead [ 154.036273][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xc87a instead [ 154.060906][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 154.082077][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 154.093870][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x28d5 instead [ 154.108222][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xc87a instead [ 154.140138][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 154.151242][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 154.170057][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x28d5 instead [ 154.182031][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xc87a instead [ 154.199432][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 154.218205][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 154.228964][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x28d5 instead [ 154.243378][ T6773] binder: BINDER_SET_CONTEXT_MGR already set [ 154.260956][ T6773] binder: 6772:6773 ioctl 4018620d 2000000003c0 returned -16 [ 154.272797][ T6773] binder: BINDER_SET_CONTEXT_MGR already set [ 154.272908][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xc87a instead [ 154.283391][ T6773] binder: 6772:6773 ioctl 4018620d 2000000005c0 returned -16 [ 154.301276][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 154.327269][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 154.354781][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x28d5 instead [ 154.372275][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xc87a instead [ 154.383535][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 154.394503][ T6777] binder: BINDER_SET_CONTEXT_MGR already set [ 154.400757][ T6777] binder: 6776:6777 ioctl 4018620d 200000000100 returned -16 [ 154.419284][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 154.439135][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x28d5 instead [ 154.450119][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xc87a instead [ 154.464860][ T6777] binder: 6776:6777 ioctl c0306201 0 returned -14 [ 154.490827][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 154.514190][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 154.538253][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x28d5 instead [ 154.556123][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xc87a instead [ 154.573031][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 154.588491][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 154.614582][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x28d5 instead [ 154.640624][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xc87a instead [ 154.688181][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 154.706679][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 154.723826][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x28d5 instead [ 154.740768][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xc87a instead [ 154.774763][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 154.809209][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 154.825294][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x28d5 instead [ 154.848837][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xc87a instead [ 154.868331][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 154.907878][ T6790] binder: BINDER_SET_CONTEXT_MGR already set [ 154.914026][ T6790] binder: 6788:6790 ioctl 4018620d 200000000600 returned -16 [ 154.922267][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 154.943193][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x28d5 instead [ 154.977502][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xc87a instead [ 155.001230][ T6790] binder: BINDER_SET_CONTEXT_MGR already set [ 155.012276][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 155.014390][ T6790] binder: 6788:6790 ioctl 4018620d 200000000780 returned -16 [ 155.057286][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 155.092927][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x28d5 instead [ 155.140143][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xc87a instead [ 155.174055][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 155.201610][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 155.233261][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x28d5 instead [ 155.275887][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xc87a instead [ 155.298501][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 155.332957][ T6802] bridge0: port 3(syz_tun) entered blocking state [ 155.344848][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 155.363065][ T6802] bridge0: port 3(syz_tun) entered disabled state [ 155.386258][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x28d5 instead [ 155.407779][ T6802] device syz_tun entered promiscuous mode [ 155.426602][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xc87a instead [ 155.453438][ T6802] bridge0: port 3(syz_tun) entered blocking state [ 155.460244][ T6802] bridge0: port 3(syz_tun) entered forwarding state [ 155.464760][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 155.496225][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 155.517181][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x28d5 instead [ 155.534315][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xc87a instead [ 155.565582][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 155.578087][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 155.598110][ T6804] device syz_tun left promiscuous mode [ 155.603928][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x28d5 instead [ 155.634828][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xc87a instead [ 155.648264][ T6804] bridge0: port 3(syz_tun) entered disabled state [ 155.666568][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 155.707277][ T6804] device bridge_slave_1 left promiscuous mode [ 155.716274][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 155.724465][ T6804] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.738992][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x28d5 instead [ 155.767198][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xc87a instead [ 155.797451][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 155.808490][ T6804] device bridge_slave_0 left promiscuous mode [ 155.834915][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 155.847903][ T6804] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.863920][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x28d5 instead [ 155.908113][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xc87a instead [ 155.952001][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 155.981689][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 156.014671][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x28d5 instead [ 156.035411][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xc87a instead [ 156.087629][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 156.133987][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 156.162504][ T6814] netlink: 8 bytes leftover after parsing attributes in process `syz.4.812'. [ 156.194218][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x28d5 instead [ 156.217157][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xc87a instead [ 156.287769][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 156.334052][ T6818] binder: 6817:6818 ioctl c0306201 0 returned -14 [ 156.337467][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 156.396972][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x28d5 instead [ 156.441278][ T6722] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xc87a instead [ 156.503185][ T6722] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 156.543485][ T6722] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 157.984274][ T6859] FAULT_INJECTION: forcing a failure. [ 157.984274][ T6859] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 158.031237][ T6859] CPU: 1 PID: 6859 Comm: syz.1.831 Not tainted syzkaller #0 [ 158.038608][ T6859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 158.048735][ T6859] Call Trace: [ 158.052065][ T6859] [ 158.055034][ T6859] dump_stack_lvl+0x188/0x250 [ 158.059762][ T6859] ? verify_lock_unused+0x140/0x140 [ 158.065022][ T6859] ? show_regs_print_info+0x20/0x20 [ 158.070285][ T6859] ? load_image+0x410/0x410 [ 158.074848][ T6859] ? scatterwalk_copychunks+0x218/0x570 [ 158.080441][ T6859] ? memcpy+0x3c/0x60 [ 158.084566][ T6859] should_fail+0x383/0x4b0 [ 158.089030][ T6859] prepare_alloc_pages+0x1e3/0x5b0 [ 158.094211][ T6859] __alloc_pages+0x11b/0x480 [ 158.098853][ T6859] ? zone_statistics+0x170/0x170 [ 158.103939][ T6859] ? __rwlock_init+0x140/0x140 [ 158.108850][ T6859] ? alloc_pages+0x452/0x560 [ 158.113499][ T6859] zbud_zpool_malloc+0x1b5/0x940 [ 158.118583][ T6859] zswap_frontswap_store+0xe1d/0x1530 [ 158.124037][ T6859] ? zswap_frontswap_init+0x100/0x100 [ 158.129482][ T6859] ? __rwlock_init+0x140/0x140 [ 158.134312][ T6859] ? _raw_spin_unlock+0x24/0x40 [ 158.139226][ T6859] ? page_swapcount+0x224/0x300 [ 158.144276][ T6859] __frontswap_store+0x331/0x4a0 [ 158.149911][ T6859] swap_writepage+0x5f/0xa0 [ 158.150084][ T6859] shrink_page_list+0x43a8/0x6de0 [ 158.150147][ T6859] ? reclaim_clean_pages_from_list+0xaf0/0xaf0 [ 158.150184][ T6859] ? verify_lock_unused+0x140/0x140 [ 158.150253][ T6859] reclaim_pages+0x712/0x990 [ 158.150301][ T6859] ? isolate_lru_page+0xbd0/0xbd0 [ 158.150335][ T6859] ? do_raw_spin_unlock+0x11d/0x230 [ 158.187527][ T6859] madvise_cold_or_pageout_pte_range+0x1680/0x1ea0 [ 158.194106][ T6859] ? rcu_lock_release+0x20/0x20 [ 158.199032][ T6859] walk_pgd_range+0xb28/0x1370 [ 158.203891][ T6859] __walk_page_range+0x136/0x590 [ 158.208887][ T6859] ? vmacache_find+0x53c/0x590 [ 158.213693][ T6859] ? vmacache_update+0xa0/0x100 [ 158.218586][ T6859] ? find_vma+0x1df/0x230 [ 158.218615][ T6859] walk_page_range+0x3a3/0x550 [ 158.218637][ T6859] ? local_lock_release+0x97/0x170 [ 158.218661][ T6859] ? page_mapped_in_vma+0x520/0x520 [ 158.238190][ T6859] do_madvise+0x16a6/0x2aa0 [ 158.242760][ T6859] ? mark_lock+0x94/0x320 [ 158.247153][ T6859] ? __lock_acquire+0x13b3/0x7d40 [ 158.252220][ T6859] ? get_nr_vmemmap_pages_cb+0x40/0x40 [ 158.252270][ T6859] ? verify_lock_unused+0x140/0x140 [ 158.252298][ T6859] ? verify_lock_unused+0x140/0x140 [ 158.252367][ T6859] ? __context_tracking_exit+0x4c/0x80 [ 158.252395][ T6859] ? __lock_acquire+0x7d40/0x7d40 [ 158.252432][ T6859] ? lock_chain_count+0x20/0x20 [ 158.252467][ T6859] __x64_sys_madvise+0xa2/0xb0 [ 158.252493][ T6859] do_syscall_64+0x4c/0xa0 [ 158.252515][ T6859] ? clear_bhb_loop+0x30/0x80 [ 158.252539][ T6859] ? clear_bhb_loop+0x30/0x80 [ 158.252565][ T6859] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 158.252591][ T6859] RIP: 0033:0x7f7086ce4559 [ 158.252613][ T6859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.274334][ T6859] RSP: 002b:00007f7084f3c028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 158.274366][ T6859] RAX: ffffffffffffffda RBX: 00007f7086f6bfa0 RCX: 00007f7086ce4559 [ 158.274382][ T6859] RDX: 0000000000000015 RSI: 7fffffffffffffff RDI: 0000200000000000 [ 158.274398][ T6859] RBP: 00007f7086d7b8b0 R08: 0000000000000000 R09: 0000000000000000 [ 158.274412][ T6859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.274426][ T6859] R13: 00007f7086f6c038 R14: 00007f7086f6bfa0 R15: 00007ffeb443db98 [ 158.274459][ T6859] [ 158.741392][ T6879] netlink: 'syz.1.836': attribute type 1 has an invalid length. [ 158.780954][ T6879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.836'. [ 158.828255][ T6887] binder: BINDER_SET_CONTEXT_MGR already set [ 158.831439][ T6879] netlink: 'syz.1.836': attribute type 1 has an invalid length. [ 158.871713][ T6887] binder: 6885:6887 ioctl 4018620d 200000000100 returned -16 [ 158.879317][ T6879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.836'. [ 158.894203][ C1] net_ratelimit: 67 callbacks suppressed [ 158.905440][ T6879] iwpm_send_hello: Unable to send a nlmsg [ 159.453480][ T4259] Bluetooth: hci5: Frame reassembly failed (-84) [ 160.439511][ T6945] binder: BINDER_SET_CONTEXT_MGR already set [ 160.460307][ T6945] binder: 6943:6945 ioctl 4018620d 200000000b00 returned -16 [ 160.617294][ T6952] netlink: 68 bytes leftover after parsing attributes in process `syz.3.855'. [ 160.670903][ T6952] netlink: 16 bytes leftover after parsing attributes in process `syz.3.855'. [ 161.454370][ T23] Bluetooth: hci5: command 0x1003 tx timeout [ 161.466400][ T4186] Bluetooth: hci5: sending frame failed (-49) [ 161.892444][ T6996] binder: BINDER_SET_CONTEXT_MGR already set [ 161.893022][ T6995] FAULT_INJECTION: forcing a failure. [ 161.893022][ T6995] name failslab, interval 1, probability 0, space 0, times 0 [ 161.912769][ T6996] binder: 6994:6996 ioctl 4018620d 200000000b00 returned -16 [ 161.922900][ T6995] CPU: 1 PID: 6995 Comm: syz.4.863 Not tainted syzkaller #0 [ 161.930255][ T6995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 161.940372][ T6995] Call Trace: [ 161.943693][ T6995] [ 161.946669][ T6995] dump_stack_lvl+0x188/0x250 [ 161.951395][ T6995] ? show_regs_print_info+0x20/0x20 [ 161.956639][ T6995] ? load_image+0x410/0x410 [ 161.961195][ T6995] ? __might_sleep+0xf0/0xf0 [ 161.965837][ T6995] ? __lock_acquire+0x7d40/0x7d40 [ 161.971014][ T6995] should_fail+0x383/0x4b0 [ 161.975486][ T6995] should_failslab+0x5/0x20 [ 161.980037][ T6995] slab_pre_alloc_hook+0x51/0xc0 [ 161.985019][ T6995] kmem_cache_alloc_trace+0x47/0x290 [ 161.990346][ T6995] ? __list_lru_init+0x535/0xac0 [ 161.995437][ T6995] __list_lru_init+0x535/0xac0 [ 162.000274][ T6995] alloc_super+0x787/0x970 [ 162.004784][ T6995] ? kill_litter_super+0xa0/0xa0 [ 162.009792][ T6995] sget_fc+0x2d4/0x6f0 [ 162.014034][ T6995] ? kill_litter_super+0xa0/0xa0 [ 162.019024][ T6995] ? proc_reconfigure+0x370/0x370 [ 162.024208][ T6995] get_tree_nodev+0x26/0x160 [ 162.028856][ T6995] vfs_get_tree+0x88/0x270 [ 162.033332][ T6995] do_new_mount+0x247/0xa40 [ 162.037898][ T6995] __se_sys_mount+0x2e3/0x3d0 [ 162.042672][ T6995] ? __x64_sys_mount+0xc0/0xc0 [ 162.047506][ T6995] ? lockdep_hardirqs_on+0x94/0x140 [ 162.052754][ T6995] ? __x64_sys_mount+0x1c/0xc0 [ 162.057584][ T6995] do_syscall_64+0x4c/0xa0 [ 162.062058][ T6995] ? clear_bhb_loop+0x30/0x80 [ 162.066998][ T6995] ? clear_bhb_loop+0x30/0x80 [ 162.071948][ T6995] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 162.078524][ T6995] RIP: 0033:0x7f1eeff7e559 [ 162.083085][ T6995] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.102946][ T6995] RSP: 002b:00007f1eee1d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 162.111525][ T6995] RAX: ffffffffffffffda RBX: 00007f1ef0205fa0 RCX: 00007f1eeff7e559 [ 162.119621][ T6995] RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000000000000000 [ 162.127893][ T6995] RBP: 00007f1ef00158b0 R08: 0000000000000000 R09: 0000000000000000 [ 162.135900][ T6995] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 162.135918][ T6995] R13: 00007f1ef0206038 R14: 00007f1ef0205fa0 R15: 00007fff665ad718 [ 162.135950][ T6995] [ 162.238239][ T7001] binder: BINDER_SET_CONTEXT_MGR already set [ 162.262301][ T7001] binder: 7000:7001 ioctl 4018620d 200000000100 returned -16 [ 162.357317][ T7002] binder: 7000:7002 ioctl c0306201 0 returned -14 [ 163.160769][ T7034] input: syz0 as /devices/virtual/input/input10 [ 163.383393][ T4257] [ 163.385790][ T4257] ====================================================== [ 163.392837][ T4257] WARNING: possible circular locking dependency detected [ 163.397065][ T7040] kcov: kcov_start: t = ffff88802b26bb80, size = 524288, area = ffffc9000ec9a000 [ 163.399976][ T4257] syzkaller #0 Not tainted [ 163.413507][ T4257] ------------------------------------------------------ [ 163.420637][ T4257] kworker/1:5/4257 is trying to acquire lock: [ 163.426740][ T4257] ffff888077ca5028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 163.437836][ T4257] [ 163.437836][ T4257] but task is already holding lock: [ 163.445242][ T4257] ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 [ 163.445948][ T7040] syzkaller0 (uninitialized): bond_netdev_event received NETDEV_POST_INIT [ 163.454345][ T4257] [ 163.454345][ T4257] which lock already depends on the new lock. [ 163.454345][ T4257] [ 163.454354][ T4257] [ 163.454354][ T4257] the existing dependency chain (in reverse order) is: [ 163.454361][ T4257] [ 163.454361][ T4257] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 163.454409][ T4257] __mutex_lock_common+0x1e5/0x2400 [ 163.454433][ T4257] mutex_lock_nested+0x17/0x20 [ 163.454450][ T4257] rfkill_register+0x2f/0x970 [ 163.454467][ T4257] hci_register_dev+0x459/0x980 [ 163.454489][ T4257] vhci_create_device+0x32e/0x5c0 [ 163.454514][ T4257] vhci_write+0x389/0x440 [ 163.468150][ T7040] (null): siw: event 17 [ 163.473454][ T4257] vfs_write+0x748/0xd70 [ 163.473481][ T4257] ksys_write+0x153/0x260 [ 163.473499][ T4257] do_syscall_64+0x4c/0xa0 [ 163.473518][ T4257] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 163.473541][ T4257] [ 163.473541][ T4257] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 163.473572][ T4257] __mutex_lock_common+0x1e5/0x2400 [ 163.473590][ T4257] mutex_lock_nested+0x17/0x20 [ 163.473608][ T4257] vhci_send_frame+0x88/0x100 [ 163.473629][ T4257] hci_send_frame+0x1a9/0x2e0 [ 163.473651][ T4257] hci_tx_work+0x9b5/0x16d0 [ 163.473671][ T4257] process_one_work+0x867/0xff0 [ 163.473693][ T4257] worker_thread+0xad7/0x12a0 [ 163.473712][ T4257] kthread+0x42e/0x520 [ 163.473728][ T4257] ret_from_fork+0x1f/0x30 [ 163.473748][ T4257] [ 163.473748][ T4257] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 163.473779][ T4257] __flush_work+0x116/0x210 [ 163.473797][ T4257] hci_dev_do_open+0xc77/0x12a0 [ 163.498075][ T7040] device: 'syzkaller0': device_add [ 163.502132][ T4257] hci_power_on+0x1a7/0x5f0 [ 163.512121][ T3519] sd 0:0:1:0: cmd ffff888025083528 CDB: 0x2a [ 163.512850][ T4257] process_one_work+0x867/0xff0 [ 163.518686][ T3519] Added buffer head 76 to ffff888022837a00 [ 163.523316][ T4257] worker_thread+0xad7/0x12a0 [ 163.534216][ C0] wireguard: wg2: Handshake for peer 30 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 5) [ 163.537231][ T4257] kthread+0x42e/0x520 [ 163.542583][ T7] chan ffff88802bf8e000 state BT_DISCONN [ 163.548645][ T4257] ret_from_fork+0x1f/0x30 [ 163.548670][ T4257] [ 163.548670][ T4257] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 163.548723][ T4257] __mutex_lock_common+0x1e5/0x2400 [ 163.562081][ T7] chan ffff88802bf8e000 state BT_DISCONN [ 163.562333][ T4257] mutex_lock_nested+0x17/0x20 [ 163.577707][ T7041] kcov: kcov_start: t = ffff88802d4a3b80, size = 524288, area = ffffc900108a0000 [ 163.578636][ T4257] bg_scan_update+0x44/0x3b0 [ 163.585170][ T7] chan ffff88802bf8e000, err 110, state BT_DISCONN [ 163.589176][ T4257] process_one_work+0x867/0xff0 [ 163.589203][ T4257] worker_thread+0xad7/0x12a0 [ 163.596584][ T7] chan ffff88802bf8e000 state BT_DISCONN [ 163.599009][ T4257] kthread+0x42e/0x520 [ 163.603966][ T7] sk ffff88802bf8f000 state 9 [ 163.613439][ T4257] ret_from_fork+0x1f/0x30 [ 163.613463][ T4257] [ 163.613463][ T4257] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 163.613494][ T4257] __lock_acquire+0x38f7/0x7d40 [ 163.613516][ T4257] lock_acquire+0x19f/0x400 [ 163.620997][ T7040] kobject: 'syzkaller0' (ffff88807654c608): kobject_add_internal: parent: 'net', set: 'devices' [ 163.624105][ T4257] __flush_work+0x116/0x210 [ 163.624132][ T4257] __cancel_work_timer+0x3f4/0x560 [ 163.624158][ T4257] hci_request_cancel_all+0xcc/0x300 [ 163.641112][ T7] ffff88814cbe4000 [ 163.645807][ T4257] hci_dev_do_close+0x4e/0x1020 [ 163.645836][ T4257] hci_rfkill_set_block+0x101/0x180 [ 163.645859][ T4257] rfkill_set_block+0x1c1/0x3c0 [ 163.662984][ T7] chan ffff88802bf8e000 orig refcnt 4 [ 163.668554][ T4257] rfkill_epo+0x75/0x170 [ 163.668583][ T4257] rfkill_op_handler+0x76/0x220 [ 163.668602][ T4257] process_one_work+0x867/0xff0 [ 163.668623][ T4257] worker_thread+0xad7/0x12a0 [ 163.676690][ T7040] net syzkaller0: No ACPI support [ 163.678867][ T4257] kthread+0x42e/0x520 [ 163.683863][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 163.691498][ T4257] ret_from_fork+0x1f/0x30 [ 163.697322][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 163.702895][ T4257] [ 163.702895][ T4257] other info that might help us debug this: [ 163.702895][ T4257] [ 163.702904][ T4257] Chain exists of: [ 163.702904][ T4257] [ 163.708829][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 163.717957][ T4257] (work_completion)(&hdev->bg_scan_update) [ 163.726449][ T7] hcon ffff8880797f2000 orig refcnt 1 [ 163.729767][ T4257] --> &data->open_mutex [ 163.744341][ T7] sk ffff88802bf8f000 state BT_CLOSED [ 163.745997][ T4257] --> rfkill_global_mutex [ 163.745997][ T4257] [ 163.746016][ T4257] Possible unsafe locking scenario: [ 163.746016][ T4257] [ 163.746024][ T4257] CPU0 CPU1 [ 163.746030][ T4257] ---- ---- [ 163.750905][ T7] chan ffff88802bf8e000 orig refcnt 3 [ 163.755324][ T4257] lock(rfkill_global_mutex); [ 163.755342][ T4257] lock(&data->open_mutex); [ 163.755357][ T4257] lock(rfkill_global_mutex); [ 163.755372][ T4257] lock( [ 163.766414][ T7040] PM: Adding info for No Bus:syzkaller0 [ 163.770115][ T4257] (work_completion)(&hdev->bg_scan_update)); [ 163.776027][ T7] sk ffff88802bf8f000 [ 163.780534][ T4257] [ 163.780534][ T4257] *** DEADLOCK *** [ 163.780534][ T4257] [ 163.780542][ T4257] 3 locks held by kworker/1:5/4257: [ 163.780554][ T4257] #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 [ 163.780611][ T4257] #1: ffffc9000317fd00 ((rfkill_op_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 [ 163.780661][ T4257] #2: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 [ 163.780714][ T4257] [ 163.780714][ T4257] stack backtrace: [ 163.780721][ T4257] CPU: 1 PID: 4257 Comm: kworker/1:5 Not tainted syzkaller #0 [ 163.780741][ T4257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 163.780756][ T4257] Workqueue: events rfkill_op_handler [ 163.780775][ T4257] Call Trace: [ 163.780783][ T4257] [ 163.780792][ T4257] dump_stack_lvl+0x188/0x250 [ 163.780815][ T4257] ? load_image+0x410/0x410 [ 163.780833][ T4257] ? show_regs_print_info+0x20/0x20 [ 163.780857][ T4257] ? print_circular_bug+0x12b/0x1a0 [ 163.780879][ T4257] check_noncircular+0x2f8/0x400 [ 163.804350][ T7] chan ffff88802bf8e000 orig refcnt 2 [ 163.808059][ T4257] ? look_up_lock_class+0x71/0x110 [ 163.808096][ T4257] ? print_deadlock_bug+0x5d0/0x5d0 [ 163.811924][ T7] chan ffff88802bf8e000 orig refcnt 1 [ 163.817214][ T4257] ? lockdep_lock+0xf1/0x1f0 [ 163.817251][ T4257] ? __lock_acquire+0x12df/0x7d40 [ 163.817274][ T4257] ? mark_lock+0x94/0x320 [ 163.817291][ T4257] ? _find_first_zero_bit+0xd1/0xf0 [ 163.825355][ T7040] kobject: 'syzkaller0' (ffff88807654c608): kobject_uevent_env [ 163.828400][ T4257] __lock_acquire+0x38f7/0x7d40 [ 163.834048][ T7] chan ffff88802bf8e000 [ 163.838564][ T4257] ? console_lock+0x70/0x70 [ 163.856166][ T7] Added buffer head 0 to ffff88801f3cd400 [ 163.859871][ T4257] ? verify_lock_unused+0x140/0x140 [ 163.859905][ T4257] ? prb_read_valid+0x39/0x60 [ 163.874787][ T1111] nf_conntrack: normal packet for ffff888023828f00 [ 163.876925][ T4257] ? verify_lock_unused+0x140/0x140 [ 163.876961][ T4257] ? console_trylock_spinning+0x370/0x370 [ 163.889762][ T7040] kobject: 'syzkaller0' (ffff88807654c608): fill_kobj_path: path = '/devices/virtual/net/syzkaller0' [ 163.894177][ T4257] lock_acquire+0x19f/0x400 [ 163.894207][ T4257] ? __flush_work+0xfa/0x210 [ 163.894230][ T4257] ? __lock_acquire+0x7d40/0x7d40 [ 163.908192][ T7041] kcov: kcov_task_exit: t = ffff88802d4a3b80, kcov->t = ffff88802d4a3b80 [ 163.913075][ T4257] ? read_lock_is_recursive+0x10/0x10 [ 163.920316][ T7040] kobject: 'queues' (ffff8880278c6050): kobject_add_internal: parent: 'syzkaller0', set: '' [ 163.923122][ T4257] ? start_flush_work+0x784/0x830 [ 163.930980][ T7040] kobject: 'queues' (ffff8880278c6050): kobject_uevent_env [ 163.935234][ T4257] __flush_work+0x116/0x210 [ 163.935261][ T4257] ? __flush_work+0xfa/0x210 [ 163.935281][ T4257] ? flush_work+0x20/0x20 [ 163.944408][ T7040] kobject: 'queues' (ffff8880278c6050): kobject_uevent_env: filter function caused the event to drop! [ 163.948137][ T4257] ? try_to_grab_pending+0xfb/0x820 [ 163.953588][ T7040] kobject: 'rx-0' (ffff888056880050): kobject_add_internal: parent: 'queues', set: 'queues' [ 163.958924][ T4257] ? mark_lock+0x94/0x320 [ 163.958948][ T4257] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 163.958974][ T4257] ? lock_chain_count+0x20/0x20 [ 163.958999][ T4257] ? __cancel_work_timer+0x36a/0x560 [ 163.959020][ T4257] __cancel_work_timer+0x3f4/0x560 [ 163.959041][ T4257] ? cancel_work_sync+0x20/0x20 [ 163.959061][ T4257] ? __cancel_work+0x1f9/0x2e0 [ 163.972440][ T7040] kobject: 'rx-0' (ffff888056880050): kobject_uevent_env [ 163.979010][ T4257] ? cancel_work+0x20/0x20 [ 163.979044][ T4257] ? __rwlock_init+0x140/0x140 [ 163.979064][ T4257] hci_request_cancel_all+0xcc/0x300 [ 163.979092][ T4257] hci_dev_do_close+0x4e/0x1020 [ 163.985911][ T7044] kcov: kcov_start: t = ffff88807d91d940, size = 524288, area = ffffc90003ee3000 [ 163.987618][ T4257] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 163.995139][ T7040] kobject: 'rx-0' (ffff888056880050): fill_kobj_path: path = '/devices/virtual/net/syzkaller0/queues/rx-0' [ 163.997683][ T4257] ? _raw_spin_unlock+0x40/0x40 [ 164.010097][ T7040] kobject: 'tx-0' (ffff88805e200018): kobject_add_internal: parent: 'queues', set: 'queues' [ 164.011910][ T4257] hci_rfkill_set_block+0x101/0x180 [ 164.025115][ T7040] kobject: 'tx-0' (ffff88805e200018): kobject_uevent_env [ 164.032507][ T4257] ? rcu_lock_release+0x20/0x20 [ 164.043463][ T7040] kobject: 'tx-0' (ffff88805e200018): fill_kobj_path: path = '/devices/virtual/net/syzkaller0/queues/tx-0' [ 164.048007][ T4257] rfkill_set_block+0x1c1/0x3c0 [ 164.048041][ T4257] rfkill_epo+0x75/0x170 [ 164.048063][ T4257] rfkill_op_handler+0x76/0x220 [ 164.048082][ T4257] process_one_work+0x867/0xff0 [ 164.048126][ T4257] ? worker_detach_from_pool+0x240/0x240 [ 164.057962][ T7040] syzkaller0: Features changed: 0x00002000001558c9 -> 0x00002000000058c1 [ 164.065817][ T4257] ? lockdep_hardirqs_off+0x70/0x100 [ 164.065854][ T4257] ? _raw_spin_lock_irq+0xb7/0xf0 [ 164.065875][ T4257] ? _raw_spin_lock_irqsave+0x100/0x100 [ 164.065898][ T4257] ? wq_worker_running+0x97/0x170 [ 164.073199][ T7040] Registering net sysctl (net ffff888073a69a80): net/ipv4/neigh/syzkaller0 [ 164.074683][ T4257] worker_thread+0xad7/0x12a0 [ 164.074717][ T4257] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 164.074746][ T4257] kthread+0x42e/0x520 [ 164.074764][ T4257] ? rcu_lock_release+0x20/0x20 [ 164.074785][ T4257] ? kthread_blkcg+0xd0/0xd0 [ 164.074803][ T4257] ret_from_fork+0x1f/0x30 [ 164.074831][ T4257] [ 164.086394][ T7040] procname=mcast_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c6354 [ 164.087256][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 164.093143][ T7040] procname=ucast_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c6358 [ 164.097610][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 164.097643][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 164.097664][ C1] sd 0:0:1:0: cmd ffff888025083528 response 0 status 0x0 sense_len 0 [ 164.097689][ C1] No more buffers in queue [ 164.116448][ T7040] procname=app_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c635c [ 164.121937][ C1] nf_conntrack: normal packet for ffff888023828300 [ 164.141786][ T7040] procname=mcast_resolicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c6360 [ 164.143785][ C1] tcp_in_window: START [ 164.172301][ T7040] procname=retrans_time mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff8880278c6364 [ 164.176520][ C1] tcp_in_window: [ 164.176533][ C1] seq=3866735941 ack=2305757226+(0) sack=2305757226+(0) win=24567 end=3866735941 [ 164.176558][ C1] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757226 maxend=2308901610 maxwin=3144576 scale=7 [ 164.176580][ C0] net_ratelimit: 58 callbacks suppressed [ 164.176587][ C1] tcp_in_window: [ 164.176592][ C0] wireguard: wg1: Sending keepalive packet to peer 22 (127.0.0.1:20003) [ 164.176596][ C1] seq=3866735941 ack=2305757226+(0) sack=2305757226+(0) win=24567 end=3866735941 [ 164.176620][ C1] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757226 maxend=2308901610 maxwin=3144576 scale=7 [ 164.176655][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.176672][ C1] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757226 maxend=2308901802 maxwin=3144576 [ 164.176699][ C1] tcp_conntracks: [ 164.176708][ C1] syn=0 ack=1 fin=0 rst=0 old=3 new=3 [ 164.182595][ T1111] nf_conntrack: normal packet for ffff888023829e00 [ 164.188652][ C1] No more buffers in queue [ 164.207996][ T7040] procname=base_reachable_time mode=644 proc_handler=neigh_proc_base_reachable_time data=ffff8880278c6368 [ 164.210426][ C1] eth0: xmit ffff88801eaec500 42:01:0a:80:00:01 [ 164.225246][ T7040] procname=delay_first_probe_time mode=644 proc_handler=neigh_proc_dointvec_jiffies data=ffff8880278c636c [ 164.233214][ C1] Added buffer head 7 to ffff888147d5f000 [ 164.233429][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 164.249662][ T7040] procname=gc_stale_time mode=644 proc_handler=neigh_proc_dointvec_jiffies data=ffff8880278c6370 [ 164.255184][ C1] wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) [ 164.268843][ T7040] procname=unres_qlen_bytes mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c6374 [ 164.272012][ C1] wireguard: wg0: Sending keepalive packet to peer 19 ([::1]:20002/0%0) [ 164.283344][ T7040] procname=proxy_qlen mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff8880278c6378 [ 164.286628][ C1] wireguard: wg0: Sending keepalive packet to peer 7 ([::1]:20002/0%0) [ 164.300238][ T7040] procname=anycast_delay mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff8880278c637c [ 164.302264][ C1] wireguard: wg0: Sending keepalive packet to peer 13 ([::1]:20002/0%0) [ 164.309736][ T7] nf_conntrack: normal packet for ffff8880798e2600 [ 164.312665][ C1] wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) [ 164.320683][ T1111] nf_conntrack: normal packet for ffff8880798e2f00 [ 164.324993][ C1] Sent skb ffff88801eaec500 [ 164.335148][ T4174] nf_conntrack: normal packet for ffff888078730480 [ 164.337725][ C1] No more buffers in queue [ 164.345732][ C0] wireguard: wg2: Receiving keepalive packet from peer 11 ([::1]:20001/0%0) [ 164.349177][ C1] Receiving skb proto 0x0800 len 124 type 0 [ 164.357417][ T7045] kcov: kcov_start: t = ffff888061f63b80, size = 524288, area = ffffc9001049f000 [ 164.359387][ C1] Receiving skb proto 0x0800 len 52 type 0 [ 164.384473][ T7045] udc dummy_udc.1: registering UDC driver [USB Raw Gadget] [ 164.390945][ C1] Receiving skb proto 0x0800 len 52 type 0 [ 164.398559][ C0] wireguard: wg2: Receiving keepalive packet from peer 29 ([::1]:20001/0%0) [ 164.405978][ C1] Receiving skb proto 0x0800 len 316 type 0 [ 164.415108][ T7040] procname=proxy_delay mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff8880278c6380 [ 164.418318][ C1] Receiving skb proto 0x0800 len 316 type 0 [ 164.423823][ T7040] procname=locktime mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff8880278c6384 [ 164.434422][ C1] No more buffers in queue [ 164.434513][ C1] tcp_in_window: START [ 164.454501][ T7045] dummy_hcd dummy_hcd.1: port status 0x00010101 has changes [ 164.459264][ C1] tcp_in_window: [ 164.468287][ T7] usb usb2: usb wakeup-resume [ 164.473608][ C1] seq=2305757226 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757298 [ 164.481839][ T7040] procname=unres_qlen mode=644 proc_handler=neigh_proc_dointvec_unres_qlen data=ffff8880278c6374 [ 164.484264][ C1] tcp_in_window: sender end=2305757226 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.507823][ T7040] procname=retrans_time_ms mode=644 proc_handler=neigh_proc_dointvec_ms_jiffies data=ffff8880278c6364 [ 164.509201][ C1] tcp_in_window: [ 164.513299][ T7040] procname=base_reachable_time_ms mode=644 proc_handler=neigh_proc_base_reachable_time data=ffff8880278c6368 [ 164.518337][ C1] seq=2305757226 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757298 [ 164.518367][ C1] tcp_in_window: sender end=2305757226 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518394][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.518410][ C1] tcp_in_window: res=1 sender end=2305757298 maxend=2308901802 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 164.518437][ C1] tcp_conntracks: [ 164.518445][ C1] syn=0 ack=1 fin=0 rst=0 old=3 new=3 [ 164.518478][ C1] tcp_in_window: START [ 164.518487][ C1] tcp_in_window: [ 164.518494][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518518][ C1] tcp_in_window: sender end=2305757298 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518555][ C1] tcp_in_window: [ 164.518563][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518587][ C1] tcp_in_window: sender end=2305757298 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518615][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.518630][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901802 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 164.518657][ C1] tcp_conntracks: [ 164.518665][ C1] syn=0 ack=1 fin=1 rst=0 old=3 new=4 [ 164.518688][ C1] tcp_in_window: START [ 164.518696][ C1] tcp_in_window: [ 164.518704][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518728][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518756][ C1] tcp_in_window: [ 164.518764][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518788][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518816][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.518831][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901802 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 164.518868][ C1] tcp_conntracks: [ 164.518875][ C1] syn=0 ack=1 fin=1 rst=0 old=4 new=6 [ 164.518898][ C1] tcp_in_window: START [ 164.518907][ C1] tcp_in_window: [ 164.518914][ C1] seq=2305757034 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518937][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.518966][ C1] tcp_in_window: [ 164.518974][ C1] seq=2305757034 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.518998][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.519026][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.519042][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901802 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 164.519069][ C1] tcp_conntracks: [ 164.519077][ C1] syn=0 ack=1 fin=1 rst=0 old=6 new=6 [ 164.519100][ C1] tcp_in_window: START [ 164.519108][ C1] tcp_in_window: [ 164.519117][ C1] seq=2305757034 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.519141][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.519170][ C1] tcp_in_window: [ 164.519178][ C1] seq=2305757034 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 164.541309][ T7] usb usb2: usb auto-resume [ 164.542567][ C1] tcp_in_window: sender end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 164.564486][ T7045] kobject: 'dummy_udc.1' (ffff888025b5c018): kobject_uevent_env [ 164.568559][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 164.584368][ T7] usb usb2: dummy_bus_resume [ 164.588455][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901802 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 164.603109][ T7040] Registering net sysctl (net ffff888073a69a80): net/ipv4/conf/syzkaller0 [ 164.605914][ C1] tcp_conntracks: [ 164.605931][ C1] syn=0 ack=1 fin=1 rst=0 old=6 new=6 [ 164.606372][ C1] nf_conntrack: normal packet for ffff888023828300 [ 164.678872][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 164.679333][ C1] tcp_in_window: START [ 164.688422][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 164.703160][ C1] tcp_in_window: [ 164.708392][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 164.959662][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 165.204850][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 165.556857][ C1] seq=3866735941 ack=2305757298+(0) sack=2305757298+(0) win=24567 end=3866735941 [ 165.567290][ C1] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 [ 165.582117][ C1] tcp_in_window: [ 165.582134][ C1] seq=3866735941 ack=2305757298+(0) sack=2305757298+(0) win=24567 end=3866735941 [ 165.595024][ C1] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901802 maxwin=3144576 scale=7 [ 165.609732][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 165.615055][ C1] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901874 maxwin=3144576 [ 165.628999][ C1] tcp_conntracks: [ 165.629011][ C1] syn=0 ack=1 fin=0 rst=0 old=6 new=7 [ 165.638266][ C1] No more buffers in queue [ 165.642694][ C1] eth0: xmit ffff88802031e280 42:01:0a:80:00:01 [ 165.648971][ C1] Added buffer head 7 to ffff888147d5f000 [ 165.654725][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 165.662799][ T150] sd 0:0:1:0: cmd ffff8880229d2128 CDB: 0x35 [ 165.665346][ C0] wireguard: wg0: Sending keepalive packet to peer 20 ([::1]:20003/0%0) [ 165.669045][ T150] Added buffer head 76 to ffff888022837a00 [ 165.683315][ T4257] hci0: cancelling interleave scan [ 165.683348][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 165.683375][ C1] sd 0:0:1:0: cmd ffff8880229d2128 response 0 status 0x0 sense_len 0 [ 165.683398][ C1] No more buffers in queue [ 165.708842][ T4257] hci0 state 0 -> 0 [ 165.710108][ T7045] kobject: 'dummy_udc.1' (ffff888025b5c018): fill_kobj_path: path = '/devices/platform/dummy_udc.1/udc/dummy_udc.1' [ 165.712693][ T4257] sock ffff8880615de000, index 0, cmd 15, status 15 [ 165.712843][ T4257] channel 2 len 15 [ 165.730275][ T7021] kcov: kcov_task_exit: t = ffff8880229b3b80, kcov->t = ffff8880229b3b80 [ 165.732852][ T4257] channel 3 len 10 [ 165.745674][ T7024] kcov: kcov_task_exit: t = ffff88802abbd940, kcov->t = ffff88802abbd940 [ 165.748674][ T4257] All LE pending actions cleared [ 165.762049][ T4257] hdev hci0 [ 165.765240][ T4257] hcon ffff8880797b2000 reason 22 [ 165.770516][ T4257] hcon ffff8880797b2000 conn ffff88807d2f7800, err 103 [ 165.770851][ T7040] procname=forwarding mode=644 proc_handler=devinet_sysctl_forward data=ffff888029631958 [ 165.777452][ T4257] hci0 hcon ffff8880797b2000 chan ffff888023e9ae00 [ 165.795661][ T7032] MPTCP: msk=ffff88807bdabac0 state=7 [ 165.798619][ T4256] Bluetooth: hci5: command 0x1001 tx timeout [ 165.801181][ T7032] MPTCP: msk=ffff88807bdabac0 [ 165.807343][ T4186] hci5 cmd_cnt 1 cmd queued 1 [ 165.816932][ T4186] hci5 type 1 len 3 [ 165.820467][ T7] hub 2-0:1.0: hub_resume [ 165.820787][ T4186] hci5: type 1 len 3 [ 165.829217][ T4186] Bluetooth: hci5: sending frame failed (-49) [ 165.835950][ T4257] hci0 hcon ffff8880797b2000 handle 201 [ 165.841573][ T4257] hcon ffff8880797b2000 [ 165.845932][ T4257] hci0: conn ffff8880797b2000 [ 165.847100][ T7] dummy_hcd dummy_hcd.1: port status 0x00010101 has changes [ 165.850684][ T4257] device: 'hci0:201': device_unregister [ 165.862848][ T7036] kcov: kcov_task_exit: t = ffff888078ec9dc0, kcov->t = ffff888078ec9dc0 [ 165.863741][ T4257] kernfs runtime_status: removing [ 165.877369][ T4257] kernfs control: removing [ 165.881997][ T4257] kernfs runtime_suspended_time: removing [ 165.887834][ T4257] kernfs runtime_active_time: removing [ 165.893809][ C1] Sent skb ffff88802031e280 [ 165.898409][ C1] No more buffers in queue [ 165.903117][ C1] No more buffers in queue [ 165.905458][ T7032] MPTCP: msk=ffff88807bdabac0 [ 165.906914][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 165.907834][ C1] Receiving skb proto 0x0800 len 124 type 0 [ 165.912285][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 165.920603][ C1] Receiving skb proto 0x0806 len 28 type 1 [ 165.926470][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 26 [ 165.935545][ C1] No more buffers in queue [ 165.944264][ T7] usb usb2-port1: status 0101 change 0001 [ 165.949979][ C1] Added buffer head 3538 to ffff8881476eef00 [ 165.966374][ C1] Added buffer head 3539 to ffff8881476eef00 [ 165.973030][ C1] Added buffer head 3540 to ffff8881476eef00 [ 165.975344][ T7032] kcov: kcov_task_exit: t = ffff88807eeb0000, kcov->t = ffff88807eeb0000 [ 165.979193][ C1] Added buffer head 3541 to ffff8881476eef00 [ 165.991424][ T7040] procname=mc_forwarding mode=444 proc_handler=devinet_conf_proc data=ffff88802963195c [ 165.994269][ C1] Added buffer head 3542 to ffff8881476eef00 [ 166.009105][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 166.010144][ C1] Added buffer head 3543 to ffff8881476eef00 [ 166.018302][ C0] kcov: kcov_start: t = ffff88807afd5940, size = 262144, area = ffffc9000235a000 [ 166.018401][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 166.024409][ C1] Added buffer head 3544 to ffff8881476eef00 [ 166.047901][ C1] Added buffer head 3545 to ffff8881476eef00 [ 166.050686][ T4174] Added buffer head 0 to ffff88801f3cd400 [ 166.054020][ C1] Added buffer head 3546 to ffff8881476eef00 [ 166.054060][ C1] Added buffer head 3547 to ffff8881476eef00 [ 166.065879][ T7040] Not writable by anyone [ 166.071894][ C1] Added buffer head 3548 to ffff8881476eef00 [ 166.071917][ C1] Added buffer head 3549 to ffff8881476eef00 [ 166.088616][ C1] Added buffer head 3550 to ffff8881476eef00 [ 166.094270][ C0] wireguard: wg1: Sending keepalive packet to peer 4 (127.0.0.1:20003) [ 166.094760][ C1] Added buffer head 3551 to ffff8881476eef00 [ 166.104055][ C0] tcp_in_window: START [ 166.109682][ C1] Added buffer head 3552 to ffff8881476eef00 [ 166.113689][ C0] tcp_in_window: [ 166.119706][ C1] Added buffer head 3553 to ffff8881476eef00 [ 166.119703][ C0] seq=1512740496 ack=164936229+(0) sack=164936229+(0) win=512 end=1512740496 [ 166.119730][ C0] tcp_in_window: sender end=1512740497 maxend=1512740498 maxwin=65536 scale=7 receiver end=164936229 maxend=165001765 maxwin=147512 scale=2 [ 166.123370][ C1] Added buffer head 3554 to ffff8881476eef00 [ 166.129378][ C0] tcp_in_window: [ 166.138152][ C1] Added buffer head 3555 to ffff8881476eef00 [ 166.152422][ C0] seq=1512740496 ack=164936229+(0) sack=164936229+(0) win=512 end=1512740496 [ 166.158465][ C1] Added buffer head 3556 to ffff8881476eef00 [ 166.162108][ C0] tcp_in_window: sender end=1512740497 maxend=1512740498 maxwin=65536 scale=7 receiver end=164936229 maxend=165001765 maxwin=147512 scale=2 [ 166.168296][ C1] Added buffer head 3557 to ffff8881476eef00 [ 166.177200][ C0] tcp_in_window: I=1 II=1 III=1 IV=1 [ 166.183191][ C1] Added buffer head 3558 to ffff8881476eef00 [ 166.197708][ C0] tcp_in_window: res=1 sender end=1512740497 maxend=1512740498 maxwin=65536 receiver end=164936229 maxend=165001765 maxwin=147512 [ 166.203959][ C1] Added buffer head 3559 to ffff8881476eef00 [ 166.209288][ C0] tcp_conntracks: [ 166.215297][ C1] Added buffer head 3560 to ffff8881476eef00 [ 166.228680][ C0] syn=0 ack=1 fin=0 rst=0 old=5 new=5 [ 166.234692][ C1] Added buffer head 3561 to ffff8881476eef00 [ 166.248027][ C0] nf_conntrack: normal packet for ffff888078730d80 [ 166.249842][ C1] Added buffer head 3562 to ffff8881476eef00 [ 166.249862][ C1] Added buffer head 3563 to ffff8881476eef00 [ 166.255912][ C0] tcp_in_window: START [ 166.262428][ C1] Added buffer head 3564 to ffff8881476eef00 [ 166.268453][ C0] tcp_in_window: [ 166.274638][ C1] Added buffer head 3565 to ffff8881476eef00 [ 166.278718][ C0] seq=164936229 ack=1512740497+(0) sack=1512740497+(0) win=0 end=164936229 [ 166.284738][ C1] Added buffer head 3566 to ffff8881476eef00 [ 166.288375][ C0] tcp_in_window: sender end=164936229 maxend=165001765 maxwin=147512 scale=2 receiver end=1512740497 maxend=1512740498 maxwin=65536 scale=7 [ 166.294396][ C1] Added buffer head 3567 to ffff8881476eef00 [ 166.303002][ C0] tcp_in_window: [ 166.303014][ C0] seq=164936229 ack=1512740497+(0) sack=1512740497+(0) win=0 end=164936229 [ 166.309034][ C1] Added buffer head 3568 to ffff8881476eef00 [ 166.323309][ C0] tcp_in_window: sender end=164936229 maxend=165001765 maxwin=147512 scale=2 receiver end=1512740497 maxend=1512740498 maxwin=65536 scale=7 [ 166.329431][ C1] Added buffer head 3569 to ffff8881476eef00 [ 166.329446][ C1] Added buffer head 3570 to ffff8881476eef00 [ 166.329459][ C1] Added buffer head 3571 to ffff8881476eef00 [ 166.329508][ C1] tcp_in_window: START [ 166.333144][ C0] tcp_in_window: I=1 II=1 III=1 IV=1 [ 166.342042][ C1] tcp_in_window: [ 166.348077][ C0] tcp_in_window: res=1 sender end=164936229 maxend=165001765 maxwin=147512 receiver end=1512740497 maxend=1512740498 maxwin=65536 [ 166.362343][ C1] seq=2305757226 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 166.368352][ C0] tcp_conntracks: [ 166.374499][ C1] tcp_in_window: sender end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 166.380486][ C0] syn=0 ack=1 fin=0 rst=0 old=5 new=5 [ 166.384623][ C1] tcp_in_window: [ 166.392137][ T7044] kcov: kcov_task_exit: t = ffff88807d91d940, kcov->t = ffff88807d91d940 [ 166.393583][ C1] seq=2305757226 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 166.417534][ T7040] procname=bc_forwarding mode=644 proc_handler=devinet_conf_proc data=ffff8880296319d4 [ 166.419954][ C1] tcp_in_window: sender end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 166.458384][ T7] kcov: kcov_remote_start: handle = 100000000000002, context: task [ 166.461985][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 166.471838][ T7] kcov: kcov_start: t = ffff888017a8bb80, size = 1048576, area = ffffc900148ab000 [ 166.475590][ T4174] nf_conntrack: normal packet for ffff8880798e3200 [ 166.486619][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901874 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 166.486653][ C1] tcp_conntracks: [ 166.486662][ C1] syn=0 ack=1 fin=1 rst=0 old=7 new=7 [ 166.505358][ T7045] raw-gadget.0 gadget: event fetching interrupted [ 166.509583][ C1] No more buffers in queue [ 166.524232][ T7] hub 2-0:1.0: state 7 ports 1 chg 0002 evt 0000 [ 166.529631][ C1] eth0: xmit ffff88805a059140 42:01:0a:80:00:01 [ 166.533775][ T7040] procname=accept_redirects mode=644 proc_handler=devinet_conf_proc data=ffff888029631964 [ 166.538810][ C1] Added buffer head 7 to ffff888147d5f000 [ 166.538867][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 166.539248][ T4257] kernfs autosuspend_delay_ms: removing [ 166.539295][ T4257] kernfs power: removing [ 166.539321][ T4257] kernfs device: removing [ 166.539343][ T4257] kernfs subsystem: removing [ 166.539367][ T4257] kernfs hci0:201: removing [ 166.539401][ T4257] kernfs uevent: removing [ 166.539416][ T4257] PM: Removing info for No Bus:hci0:201 [ 166.539438][ T4257] kobject: 'hci0:201' (ffff8880797b2420): kobject_uevent_env [ 166.539473][ T4257] kobject: 'hci0:201' (ffff8880797b2420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:201' [ 166.539597][ T4257] kernfs hci0:201: removing [ 166.539610][ T4257] kobject: 'hci0:201' (ffff8880797b2420): kobject_cleanup, parent 0000000000000000 [ 166.539630][ T4257] kobject: 'hci0:201' (ffff8880797b2420): calling ktype release [ 166.539674][ T4257] kobject: 'hci0:201': free name [ 166.539692][ T4257] hci0 orig refcnt 10 [ 166.539706][ T4257] hcon ffff8880793e8000 reason 22 [ 166.539721][ T4257] hcon ffff8880793e8000 conn ffff88807d2f7000, err 103 [ 166.539752][ T4257] hci0 hcon ffff8880793e8000 chan ffff888023e9af00 [ 166.540106][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 166.540109][ C1] Sent skb ffff88805a059140 [ 166.540126][ C0] kcov: kcov_start: t = ffff88802b26bb80, size = 262144, area = ffffc9000235a000 [ 166.540135][ C1] No more buffers in queue [ 166.540161][ C0] kcov: kcov_start: t = ffff88802b26bb80, size = 524288, area = ffffc9000ec9a000 [ 166.540182][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 22 [ 166.540243][ C1] No more buffers in queue [ 166.540377][ T150] sd 0:0:1:0: cmd ffff88802507ed28 CDB: 0x2a [ 166.540404][ T150] Added buffer head 76 to ffff888022837a00 [ 166.541953][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 166.554697][ T1111] nf_conntrack: normal packet for ffff888023829380 [ 166.558006][ C1] sd 0:0:1:0: cmd ffff88802507ed28 response 0 status 0x0 sense_len 0 [ 166.594429][ T7045] kcov: kcov_task_exit: t = ffff888061f63b80, kcov->t = ffff888061f63b80 [ 166.597406][ C1] No more buffers in queue [ 166.609370][ T9] sd 0:0:1:0: cmd ffff888025083928 CDB: 0x2a [ 166.611419][ T4257] hci0 hcon ffff8880793e8000 handle 200 [ 166.615457][ T9] Added buffer head 76 to ffff888022837a00 [ 166.621290][ T4257] hcon ffff8880793e8000 [ 166.628725][ T9] sd 0:0:1:0: cmd ffff888025083d28 CDB: 0x2a [ 166.652665][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 166.654036][ T9] Added buffer head 190 to ffff888022837a00 [ 166.827096][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 166.834565][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 166.841623][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 166.848830][ T9] sd 0:0:1:0: cmd ffff888025084128 CDB: 0x2a [ 166.854887][ T9] Added buffer head 71 to ffff888022837a00 [ 166.860790][ T9] sd 0:0:1:0: cmd ffff888025088528 CDB: 0x2a [ 166.866992][ T9] Added buffer head 133 to ffff888022837a00 [ 166.873036][ T9] sd 0:0:1:0: cmd ffff888025084928 CDB: 0x2a [ 166.879107][ T9] Added buffer head 193 to ffff888022837a00 [ 166.885132][ T9] sd 0:0:1:0: cmd ffff888025084d28 CDB: 0x2a [ 166.891197][ T9] Added buffer head 81 to ffff888022837a00 [ 166.897227][ T9] sd 0:0:1:0: cmd ffff888025084528 CDB: 0x2a [ 166.903268][ T9] Added buffer head 30 to ffff888022837a00 [ 166.909105][ C1] No more buffers in queue [ 166.909257][ T9] sd 0:0:1:0: cmd ffff888025086528 CDB: 0x2a [ 166.913615][ C1] Receiving skb proto 0x0800 len 52 type 0 [ 166.919582][ T9] Added buffer head 189 to ffff888022837a00 [ 166.925432][ C1] No more buffers in queue [ 166.931514][ T9] sd 0:0:1:0: cmd ffff888025085d28 CDB: 0x2a [ 166.935798][ C1] tcp_in_window: START [ 166.941713][ T9] Added buffer head 38 to ffff888022837a00 [ 166.945864][ C1] tcp_in_window: [ 166.951598][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 166.951793][ T9] sd 0:0:1:0: cmd ffff888025086128 CDB: 0x2a [ 166.955366][ C1] tcp_in_window: sender end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 166.964511][ T9] Added buffer head 36 to ffff888022837a00 [ 166.970498][ C1] tcp_in_window: [ 166.986994][ T9] sd 0:0:1:0: cmd ffff888025085128 CDB: 0x2a [ 166.992732][ C1] seq=2305757298 ack=3866735941+(0) sack=3866735941+(0) win=24567 end=2305757299 [ 166.996402][ T9] Added buffer head 53 to ffff888022837a00 [ 167.002382][ C1] tcp_in_window: sender end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 receiver end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 [ 167.011860][ T9] sd 0:0:1:0: cmd ffff888025085528 CDB: 0x2a [ 167.017642][ C1] tcp_in_window: I=1 II=1 III=1 IV=1 [ 167.032374][ T9] Added buffer head 45 to ffff888022837a00 [ 167.038677][ C1] tcp_in_window: res=1 sender end=2305757299 maxend=2308901874 maxwin=3144576 receiver end=3866735941 maxend=3869880517 maxwin=3144576 [ 167.044063][ T9] sd 0:0:1:0: cmd ffff888025085928 CDB: 0x2a [ 167.049979][ C1] tcp_conntracks: [ 167.063800][ T9] Added buffer head 197 to ffff888022837a00 [ 167.069853][ C1] syn=0 ack=1 fin=1 rst=0 old=7 new=7 [ 167.073645][ T9] sd 0:0:1:0: cmd ffff888025086928 CDB: 0x2a [ 167.090834][ T9] Added buffer head 200 to ffff888022837a00 [ 167.094320][ T7040] procname=secure_redirects mode=644 proc_handler=devinet_conf_proc data=ffff888029631968 [ 167.096975][ T9] sd 0:0:1:0: cmd ffff888025087d28 CDB: 0x2a [ 167.113093][ T9] Added buffer head 8 to ffff888022837a00 [ 167.117047][ T7040] procname=shared_media mode=644 proc_handler=devinet_conf_proc data=ffff888029631970 [ 167.119080][ T9] sd 0:0:1:0: cmd ffff888025086d28 CDB: 0x2a [ 167.134321][ T7040] procname=rp_filter mode=644 proc_handler=devinet_conf_proc data=ffff888029631974 [ 167.134833][ T9] Added buffer head 122 to ffff888022837a00 [ 167.150223][ T9] sd 0:0:1:0: cmd ffff888025087128 CDB: 0x2a [ 167.150244][ T7040] procname=send_redirects mode=644 proc_handler=devinet_conf_proc data=ffff88802963196c [ 167.156391][ T9] Added buffer head 114 to ffff888022837a00 [ 167.172720][ T9] sd 0:0:1:0: cmd ffff888025087528 CDB: 0x2a [ 167.178779][ T9] Added buffer head 48 to ffff888022837a00 [ 167.184390][ T7040] procname=accept_source_route mode=644 proc_handler=devinet_conf_proc data=ffff888029631978 [ 167.184885][ T9] sd 0:0:1:0: cmd ffff888025087928 CDB: 0x2a [ 167.196292][ T7040] procname=accept_local mode=644 proc_handler=devinet_conf_proc data=ffff8880296319b0 [ 167.201138][ T9] Added buffer head 205 to ffff888022837a00 [ 167.201234][ T9] sd 0:0:1:0: cmd ffff888025088128 CDB: 0x2a [ 167.222869][ T9] Added buffer head 224 to ffff888022837a00 [ 167.224334][ T7040] procname=src_valid_mark mode=644 proc_handler=devinet_conf_proc data=ffff8880296319b4 [ 167.228914][ T9] sd 0:0:1:0: cmd ffff888025088928 CDB: 0x2a [ 167.239838][ T7040] procname=proxy_arp mode=644 proc_handler=devinet_conf_proc data=ffff888029631960 [ 167.244767][ T9] Added buffer head 227 to ffff888022837a00 [ 167.260258][ T9] sd 0:0:1:0: cmd ffff888025088d28 CDB: 0x2a [ 167.264365][ T7040] procname=medium_id mode=644 proc_handler=devinet_conf_proc data=ffff88802963198c [ 167.266309][ T9] Added buffer head 230 to ffff888022837a00 [ 167.281945][ T9] sd 0:0:1:0: cmd ffff888025089128 CDB: 0x2a [ 167.281983][ T7040] procname=bootp_relay mode=644 proc_handler=devinet_conf_proc data=ffff88802963197c [ 167.288002][ T9] Added buffer head 233 to ffff888022837a00 [ 167.303641][ T9] sd 0:0:1:0: cmd ffff888025089528 CDB: 0x2a [ 167.309697][ T9] Added buffer head 236 to ffff888022837a00 [ 167.314378][ T7040] procname=log_martians mode=644 proc_handler=devinet_conf_proc data=ffff888029631980 [ 167.315746][ T9] sd 0:0:1:0: cmd ffff888025089928 CDB: 0x2a [ 167.326600][ T7040] procname=tag mode=644 proc_handler=devinet_conf_proc data=ffff888029631984 [ 167.331453][ T9] Added buffer head 239 to ffff888022837a00 [ 167.331551][ T9] sd 0:0:1:0: cmd ffff888025089d28 CDB: 0x2a [ 167.352521][ T9] Added buffer head 149 to ffff888022837a00 [ 167.354319][ T7040] procname=arp_filter mode=644 proc_handler=devinet_conf_proc data=ffff888029631988 [ 167.358580][ T9] sd 0:0:1:0: cmd ffff88802508a128 CDB: 0x2a [ 167.369458][ T7040] procname=arp_announce mode=644 proc_handler=devinet_conf_proc data=ffff88802963199c [ 167.374369][ T9] Added buffer head 152 to ffff888022837a00 [ 167.390112][ T9] sd 0:0:1:0: cmd ffff88802508a528 CDB: 0x2a [ 167.396166][ T9] Added buffer head 155 to ffff888022837a00 [ 167.402127][ T9] sd 0:0:1:0: cmd ffff88802508a928 CDB: 0x2a [ 167.408270][ T9] Added buffer head 158 to ffff888022837a00 [ 167.414263][ T9] sd 0:0:1:0: cmd ffff88802508ad28 CDB: 0x2a [ 167.415490][ T7040] procname=arp_ignore mode=644 proc_handler=devinet_conf_proc data=ffff8880296319a0 [ 167.420286][ T9] Added buffer head 161 to ffff888022837a00 [ 167.420385][ T9] sd 0:0:1:0: cmd ffff88802508b128 CDB: 0x2a [ 167.438668][ T7045] udc dummy_udc.1: unregistering UDC driver [USB Raw Gadget] [ 167.442117][ T9] Added buffer head 164 to ffff888022837a00 [ 167.442215][ T9] sd 0:0:1:0: cmd ffff88802508b528 CDB: 0x2a [ 167.458320][ T7040] procname=arp_accept mode=644 proc_handler=devinet_conf_proc data=ffff8880296319a8 [ 167.461648][ T9] Added buffer head 167 to ffff888022837a00 [ 167.467172][ T1111] Added buffer head 0 to ffff88801f3cd400 [ 167.471461][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 167.477494][ T7] usb usb2-port1: status 0101, change 0000, 12 Mb/s [ 167.483037][ C1] sd 0:0:1:0: cmd ffff888025083928 response 0 status 0x0 sense_len 0 [ 167.495302][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 167.497141][ C1] sd 0:0:1:0: cmd ffff888025085528 response 0 status 0x0 sense_len 0 [ 167.505390][ C0] kcov: kcov_start: t = ffff88802279d940, size = 262144, area = ffffc9000235a000 [ 167.514149][ C1] sd 0:0:1:0: cmd ffff888025086528 response 0 status 0x0 sense_len 0 [ 167.522841][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 167.531885][ C1] sd 0:0:1:0: cmd ffff888025084928 response 0 status 0x0 sense_len 0 [ 167.556469][ C1] sd 0:0:1:0: cmd ffff888025088d28 response 0 status 0x0 sense_len 0 [ 167.561993][ T1111] nf_conntrack: normal packet for ffff888023828f00 [ 167.564578][ C1] sd 0:0:1:0: cmd ffff888025089928 response 0 status 0x0 sense_len 0 [ 167.564603][ C1] sd 0:0:1:0: cmd ffff88802508b528 response 0 status 0x0 sense_len 0 [ 167.571398][ T4255] nf_conntrack: normal packet for ffff888078730480 [ 167.579194][ C1] sd 0:0:1:0: cmd ffff888025087528 response 0 status 0x0 sense_len 0 [ 167.579219][ C1] sd 0:0:1:0: cmd ffff888025085d28 response 0 status 0x0 sense_len 0 [ 167.588707][ T13] nf_conntrack: normal packet for ffff8880798e2f00 [ 167.593934][ C1] sd 0:0:1:0: cmd ffff888025086928 response 0 status 0x0 sense_len 0 [ 167.603071][ T4662] nf_conntrack: normal packet for ffff8880798e2600 [ 167.610715][ C1] sd 0:0:1:0: cmd ffff888025084128 response 0 status 0x0 sense_len 0 [ 167.610745][ C1] sd 0:0:1:0: cmd ffff888025084528 response 0 status 0x0 sense_len 0 [ 167.610767][ C1] sd 0:0:1:0: cmd ffff888025089128 response 0 status 0x0 sense_len 0 [ 167.630192][ T9] sd 0:0:1:0: cmd ffff88802508b928 CDB: 0x2a [ 167.631887][ C1] sd 0:0:1:0: cmd ffff888025087d28 response 0 status 0x0 sense_len 0 [ 167.670130][ C1] sd 0:0:1:0: cmd ffff888025086d28 response 0 status 0x0 sense_len 0 [ 167.678240][ C1] sd 0:0:1:0: cmd ffff888025087128 response 0 status 0x0 sense_len 0 [ 167.686460][ C1] sd 0:0:1:0: cmd ffff888025088528 response 0 status 0x0 sense_len 0 [ 167.694552][ C1] sd 0:0:1:0: cmd ffff888025087928 response 0 status 0x0 sense_len 0 [ 167.702743][ C1] sd 0:0:1:0: cmd ffff888025084d28 response 0 status 0x0 sense_len 0 [ 167.710837][ C1] sd 0:0:1:0: cmd ffff888025085128 response 0 status 0x0 sense_len 0 [ 167.718938][ C1] sd 0:0:1:0: cmd ffff888025088128 response 0 status 0x0 sense_len 0 [ 167.727010][ C1] sd 0:0:1:0: cmd ffff888025085928 response 0 status 0x0 sense_len 0 [ 167.735186][ C1] sd 0:0:1:0: cmd ffff888025086128 response 0 status 0x0 sense_len 0 [ 167.743275][ C1] sd 0:0:1:0: cmd ffff888025089528 response 0 status 0x0 sense_len 0 [ 167.751363][ C1] sd 0:0:1:0: cmd ffff88802508a528 response 0 status 0x0 sense_len 0 [ 167.759430][ C1] sd 0:0:1:0: cmd ffff888025088928 response 0 status 0x0 sense_len 0 [ 167.767498][ C1] sd 0:0:1:0: cmd ffff88802508a128 response 0 status 0x0 sense_len 0 [ 167.775570][ C1] sd 0:0:1:0: cmd ffff88802508b128 response 0 status 0x0 sense_len 0 [ 167.783844][ C1] sd 0:0:1:0: cmd ffff888025089d28 response 0 status 0x0 sense_len 0 [ 167.792022][ C1] sd 0:0:1:0: cmd ffff88802508ad28 response 0 status 0x0 sense_len 0 [ 167.800090][ C1] sd 0:0:1:0: cmd ffff88802508a928 response 0 status 0x0 sense_len 0 [ 167.808180][ C1] sd 0:0:1:0: cmd ffff888025083d28 response 0 status 0x0 sense_len 0 [ 167.817193][ C1] No more buffers in queue [ 167.821762][ T9] Added buffer head 190 to ffff888022837a00 [ 167.827797][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 167.835245][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 167.842207][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 167.849880][ T9] sd 0:0:1:0: cmd ffff88802508bd28 CDB: 0x2a [ 167.855816][ T4257] hci0: conn ffff8880793e8000 [ 167.856350][ T9] Added buffer head 158 to ffff888022837a00 [ 167.860591][ T4257] device: 'hci0:200': device_unregister [ 167.866554][ T9] sd 0:0:1:0: cmd ffff88802508c128 CDB: 0x2a [ 167.866582][ T9] Added buffer head 161 to ffff888022837a00 [ 167.866635][ T9] sd 0:0:1:0: cmd ffff88802508d928 CDB: 0x2a [ 167.886218][ T4257] kernfs runtime_status: removing [ 167.890344][ T9] Added buffer head 149 to ffff888022837a00 [ 167.890440][ T9] sd 0:0:1:0: cmd ffff88802508dd28 CDB: 0x2a [ 167.904175][ T4186] hcon ffff8880797f2000 state BT_CONNECTED [ 167.907556][ T9] Added buffer head 164 to ffff888022837a00 [ 167.913261][ T4186] hcon ffff8880797f2000 [ 167.919479][ T9] sd 0:0:1:0: cmd ffff88802508e128 CDB: 0x2a [ 167.919516][ T9] Added buffer head 152 to ffff888022837a00 [ 167.919544][ T9] sd 0:0:1:0: cmd ffff88802508e528 CDB: 0x2a [ 167.919564][ T9] Added buffer head 227 to ffff888022837a00 [ 167.924472][ T4186] hci2: opcode 0x0406 plen 3 [ 167.929797][ T9] sd 0:0:1:0: cmd ffff88802508e928 CDB: 0x2a [ 167.942270][ T4186] hci2: skb len 6 [ 167.947936][ T9] Added buffer head 155 to ffff888022837a00 [ 167.953296][ T4186] hci2: length 1 [ 167.958586][ T9] sd 0:0:1:0: cmd ffff888025083528 CDB: 0x2a [ 167.962318][ T4186] hci2 cmd_cnt 1 cmd queued 1 [ 167.968181][ T9] Added buffer head 236 to ffff888022837a00 [ 167.968246][ T9] sd 0:0:1:0: cmd ffff88802508c528 CDB: 0x2a [ 167.972147][ T4186] hci2 type 1 len 6 [ 167.977801][ T9] Added buffer head 36 to ffff888022837a00 [ 167.977839][ T9] sd 0:0:1:0: cmd ffff88802508c928 CDB: 0x2a [ 167.977857][ T9] Added buffer head 14 to ffff888022837a00 [ 167.977880][ T9] sd 0:0:1:0: cmd ffff88802508cd28 CDB: 0x2a [ 167.977899][ T9] Added buffer head 82 to ffff888022837a00 [ 167.977923][ T9] sd 0:0:1:0: cmd ffff88802508d128 CDB: 0x2a [ 167.977942][ T9] Added buffer head 126 to ffff888022837a00 [ 167.977966][ T9] sd 0:0:1:0: cmd ffff88802508d528 CDB: 0x2a [ 167.977985][ T9] Added buffer head 124 to ffff888022837a00 [ 167.978011][ T9] sd 0:0:1:0: cmd ffff88802508ed28 CDB: 0x2a [ 167.978029][ T9] Added buffer head 198 to ffff888022837a00 [ 167.978051][ T9] sd 0:0:1:0: cmd ffff88802508f128 CDB: 0x2a [ 167.978069][ T9] Added buffer head 225 to ffff888022837a00 [ 167.978092][ T9] sd 0:0:1:0: cmd ffff88802508f528 CDB: 0x2a [ 168.000516][ T4257] kernfs control: removing [ 168.004622][ T9] Added buffer head 134 to ffff888022837a00 [ 168.004665][ T9] sd 0:0:1:0: cmd ffff88802508f928 CDB: 0x2a [ 168.004686][ T9] Added buffer head 70 to ffff888022837a00 [ 168.004708][ T9] sd 0:0:1:0: cmd ffff88802508fd28 CDB: 0x2a [ 168.004728][ T9] Added buffer head 118 to ffff888022837a00 [ 168.004753][ T9] sd 0:0:1:0: cmd ffff888025080128 CDB: 0x2a [ 168.004771][ T9] Added buffer head 77 to ffff888022837a00 [ 168.004836][ T9] sd 0:0:1:0: cmd ffff888025080528 CDB: 0x2a [ 168.023532][ T7045] dummy_hcd dummy_hcd.1: port status 0x00010110 has changes [ 168.028798][ T9] Added buffer head 196 to ffff888022837a00 [ 168.034764][ C1] wireguard: wg1: Handshake for peer 28 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 7) [ 168.040814][ T9] sd 0:0:1:0: cmd ffff888025080928 CDB: 0x2a [ 168.058738][ T4259] nf_conntrack: normal packet for ffff888078730780 [ 168.059071][ T9] Added buffer head 205 to ffff888022837a00 [ 168.075374][ T4257] kernfs runtime_suspended_time: removing [ 168.077197][ T9] sd 0:0:1:0: cmd ffff888025080d28 CDB: 0x2a [ 168.106933][ T7040] procname=arp_notify mode=644 proc_handler=devinet_conf_proc data=ffff8880296319ac [ 168.111408][ T9] Added buffer head 208 to ffff888022837a00 [ 168.111505][ T9] sd 0:0:1:0: cmd ffff888025081128 CDB: 0x2a [ 168.121316][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 168.123537][ T9] Added buffer head 211 to ffff888022837a00 [ 168.129349][ C1] kcov: kcov_start: t = ffff88813fe78000, size = 262144, area = ffffc9000235a000 [ 168.135704][ T9] sd 0:0:1:0: cmd ffff888025081528 CDB: 0x2a [ 168.142976][ C1] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 109 [ 168.148833][ T9] Added buffer head 214 to ffff888022837a00 [ 168.160624][ T7045] kobject: 'dummy_udc.1' (ffff888025b5c018): kobject_uevent_env [ 168.166468][ T9] sd 0:0:1:0: cmd ffff888025081928 CDB: 0x2a [ 168.173058][ T4257] kernfs runtime_active_time: removing [ 168.178868][ T9] Added buffer head 217 to ffff888022837a00 [ 168.192935][ T7045] kobject: 'dummy_udc.1' (ffff888025b5c018): fill_kobj_path: path = '/devices/platform/dummy_udc.1/udc/dummy_udc.1' [ 168.200214][ T9] sd 0:0:1:0: cmd ffff888025081d28 CDB: 0x2a [ 168.209793][ T7040] procname=proxy_arp_pvlan mode=644 proc_handler=devinet_conf_proc data=ffff8880296319b8 [ 168.212058][ T9] Added buffer head 220 to ffff888022837a00 [ 168.212134][ T9] sd 0:0:1:0: cmd ffff888025082128 CDB: 0x2a [ 168.229026][ T4257] kernfs autosuspend_delay_ms: removing [ 168.235362][ T9] Added buffer head 223 to ffff888022837a00 [ 168.254387][ T7040] procname=force_igmp_version mode=644 proc_handler=devinet_conf_proc data=ffff888029631998 [ 168.255785][ T9] sd 0:0:1:0: cmd ffff888025082528 CDB: 0x2a [ 168.274199][ T7040] procname=igmpv2_unsolicited_report_interval mode=644 proc_handler=devinet_conf_proc data=ffff8880296319c0 [ 168.274933][ T9] Added buffer head 3 to ffff888022837a00 [ 168.280852][ T7040] procname=igmpv3_unsolicited_report_interval mode=644 proc_handler=devinet_conf_proc data=ffff8880296319c4 [ 168.293375][ T9] sd 0:0:1:0: cmd ffff888025082928 CDB: 0x2a [ 168.299490][ T4257] kernfs power: removing [ 168.309339][ T9] Added buffer head 68 to ffff888022837a00 [ 168.353572][ T4257] kernfs device: removing [ 168.361676][ T9] sd 0:0:1:0: cmd ffff888025082d28 CDB: 0x2a [ 168.374189][ T7040] procname=ignore_routes_with_linkdown mode=644 proc_handler=devinet_conf_proc data=ffff8880296319c8 [ 168.379142][ T9] Added buffer head 50 to ffff888022837a00 [ 168.387437][ T4257] kernfs subsystem: removing [ 168.389781][ T7] dummy_hcd dummy_hcd.1: port status 0x00110100 has changes [ 168.395329][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 168.401956][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 168.405724][ C1] sd 0:0:1:0: cmd ffff888025082d28 response 0 status 0x0 sense_len 0 [ 168.416747][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 168.422571][ C1] sd 0:0:1:0: cmd ffff888025080528 response 0 status 0x0 sense_len 0 [ 168.427639][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 51 [ 168.434976][ C1] sd 0:0:1:0: cmd ffff88802508fd28 response 0 status 0x0 sense_len 0 [ 168.442786][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 168.450514][ C1] sd 0:0:1:0: cmd ffff88802508c928 response 0 status 0x0 sense_len 0 [ 168.458605][ C0] kcov: kcov_start: t = ffff888079a39dc0, size = 262144, area = ffffc9000235a000 [ 168.467731][ C1] sd 0:0:1:0: cmd ffff888025080d28 response 0 status 0x0 sense_len 0 [ 168.475926][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 168.484259][ C1] sd 0:0:1:0: cmd ffff88802508c528 response 0 status 0x0 sense_len 0 [ 168.492569][ T4255] nf_conntrack: normal packet for ffff8880798e2780 [ 168.500494][ C1] sd 0:0:1:0: cmd ffff88802508f928 response 0 status 0x0 sense_len 0 [ 168.500520][ C1] sd 0:0:1:0: cmd ffff888025080128 response 0 status 0x0 sense_len 0 [ 168.508945][ T4662] Added buffer head 0 to ffff88801f3cd400 [ 168.517859][ C1] sd 0:0:1:0: cmd ffff888025081528 response 0 status 0x0 sense_len 0 [ 168.517884][ C1] sd 0:0:1:0: cmd ffff888025081928 response 0 status 0x0 sense_len 0 [ 168.526176][ T7] usb usb2-port1: not reset yet, waiting 60ms [ 168.534737][ C1] sd 0:0:1:0: cmd ffff888025082128 response 0 status 0x0 sense_len 0 [ 168.534763][ C1] sd 0:0:1:0: cmd ffff88802508d128 response 0 status 0x0 sense_len 0 [ 168.550495][ T4171] nf_conntrack: normal packet for ffff888023828300 [ 168.557436][ C1] sd 0:0:1:0: cmd ffff88802508d528 response 0 status 0x0 sense_len 0 [ 168.557469][ C1] sd 0:0:1:0: cmd ffff888025082928 response 0 status 0x0 sense_len 0 [ 168.557492][ C1] sd 0:0:1:0: cmd ffff88802508bd28 response 0 status 0x0 sense_len 0 [ 168.565658][ T4171] tcp_in_window: START [ 168.571291][ C1] sd 0:0:1:0: cmd ffff888025083528 response 0 status 0x0 sense_len 0 [ 168.579601][ T4171] tcp_in_window: [ 168.587589][ C1] sd 0:0:1:0: cmd ffff88802508b928 response 0 status 0x0 sense_len 0 [ 168.587617][ C1] sd 0:0:1:0: cmd ffff88802508e928 response 0 status 0x0 sense_len 0 [ 168.593710][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 168.601962][ C1] sd 0:0:1:0: cmd ffff88802508ed28 response 0 status 0x0 sense_len 0 [ 168.601991][ C1] sd 0:0:1:0: cmd ffff88802508cd28 response 0 status 0x0 sense_len 0 [ 168.610219][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 [ 168.616632][ C1] sd 0:0:1:0: cmd ffff88802508f528 response 0 status 0x0 sense_len 0 [ 168.624766][ T4171] tcp_in_window: [ 168.632802][ C1] sd 0:0:1:0: cmd ffff888025082528 response 0 status 0x0 sense_len 0 [ 168.640959][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 168.645087][ C1] sd 0:0:1:0: cmd ffff88802508c128 response 0 status 0x0 sense_len 0 [ 168.653343][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901874 maxwin=3144576 scale=7 [ 168.657009][ C1] sd 0:0:1:0: cmd ffff888025081128 response 0 status 0x0 sense_len 0 [ 168.657033][ C1] sd 0:0:1:0: cmd ffff888025081d28 response 0 status 0x0 sense_len 0 [ 168.665164][ T4171] tcp_in_window: I=1 II=1 III=1 IV=1 [ 168.673302][ C1] sd 0:0:1:0: cmd ffff88802508dd28 response 0 status 0x0 sense_len 0 [ 168.682838][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 168.690790][ C1] sd 0:0:1:0: cmd ffff888025080928 response 0 status 0x0 sense_len 0 [ 168.699165][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 168.713649][ C1] sd 0:0:1:0: cmd ffff88802508f128 response 0 status 0x0 sense_len 0 [ 168.721728][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 168.725402][ C1] sd 0:0:1:0: cmd ffff88802508e128 response 0 status 0x0 sense_len 0 [ 168.733633][ T4171] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901875 maxwin=3144576 [ 168.743294][ C1] sd 0:0:1:0: cmd ffff88802508e528 response 0 status 0x0 sense_len 0 [ 168.743324][ C1] sd 0:0:1:0: cmd ffff88802508d928 response 0 status 0x0 sense_len 0 [ 168.751614][ T4171] tcp_conntracks: [ 168.766234][ C1] No more buffers in queue [ 168.794062][ T7040] procname=drop_gratuitous_arp mode=644 proc_handler=devinet_conf_proc data=ffff8880296319d0 [ 168.803715][ T4171] syn=0 ack=1 fin=0 rst=0 old=7 new=7 [ 168.806142][ T4662] Added buffer head 0 to ffff88801f3cd400 [ 168.812405][ T7040] procname=disable_xfrm mode=644 proc_handler=ipv4_doint_and_flush data=ffff888029631990 [ 168.824354][ T7] dummy_hcd dummy_hcd.1: port status 0x00110100 has changes [ 168.827663][ T7040] procname=disable_policy mode=644 proc_handler=ipv4_doint_and_flush data=ffff888029631994 [ 168.843686][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 168.856412][ T7040] procname=promote_secondaries mode=644 proc_handler=ipv4_doint_and_flush data=ffff8880296319a4 [ 168.864694][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 168.864816][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 59 [ 168.872841][ T7040] procname=route_localnet mode=644 proc_handler=ipv4_doint_and_flush data=ffff8880296319bc [ 168.878709][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 168.881809][ T7040] procname=drop_unicast_in_l2_multicast mode=644 proc_handler=ipv4_doint_and_flush data=ffff8880296319cc [ 168.892035][ C0] kcov: kcov_start: t = ffff88813fed0000, size = 262144, area = ffffc9000235a000 [ 168.892130][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 168.901383][ T7040] syzkaller0: bond_netdev_event received NETDEV_REGISTER [ 168.905218][ T7] usb usb2-port1: not reset yet, waiting 200ms [ 168.914997][ T7040] net syzkaller0: siw: event 5 [ 168.964705][ T4171] No more buffers in queue [ 168.968548][ T7040] Registering net sysctl (net ffff888073a69a80): net/ipv6/neigh/syzkaller0 [ 168.978126][ T4171] eth0: xmit ffff888072ff8c80 42:01:0a:80:00:01 [ 168.978155][ T4171] Added buffer head 0 to ffff8881476eee00 [ 168.978407][ C0] virtqueue callback for ffff8881476eee00 (ffffffff854980c0) [ 168.990777][ T7040] procname=mcast_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f54 [ 168.998829][ C0] Sent skb ffff888072ff8c80 [ 169.016485][ T4171] nf_conntrack: normal packet for ffff888023828300 [ 169.023051][ C0] No more buffers in queue [ 169.036885][ T7040] procname=ucast_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f58 [ 169.044050][ T4171] tcp_in_window: START [ 169.056895][ T7040] procname=app_solicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f5c [ 169.059434][ T4171] tcp_in_window: [ 169.073628][ T7040] procname=mcast_resolicit mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f60 [ 169.078316][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.084654][ T7040] procname=retrans_time mode=644 proc_handler=ndisc_ifinfo_sysctl_change data=ffff888021a58f64 [ 169.089891][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.100904][ T7040] procname=base_reachable_time mode=644 proc_handler=ndisc_ifinfo_sysctl_change data=ffff888021a58f68 [ 169.105401][ T4171] tcp_in_window: [ 169.105413][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.105437][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.105465][ T4171] tcp_in_window: I=1 II=1 III=1 IV=1 [ 169.105481][ T4171] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901875 maxwin=3144576 [ 169.105507][ T4171] tcp_conntracks: [ 169.105516][ T4171] syn=0 ack=1 fin=0 rst=0 old=7 new=7 [ 169.108244][ T4171] No more buffers in queue [ 169.113080][ T7040] procname=delay_first_probe_time mode=644 proc_handler=neigh_proc_dointvec_jiffies data=ffff888021a58f6c [ 169.120652][ T4171] eth0: xmit ffff888058917c80 42:01:0a:80:00:01 [ 169.120677][ T4171] Added buffer head 0 to ffff8881476eee00 [ 169.120726][ C0] virtqueue callback for ffff8881476eee00 (ffffffff854980c0) [ 169.120765][ C0] Sent skb ffff888058917c80 [ 169.120811][ C0] No more buffers in queue [ 169.126824][ T4171] nf_conntrack: normal packet for ffff888023828300 [ 169.140507][ T7040] procname=gc_stale_time mode=644 proc_handler=neigh_proc_dointvec_jiffies data=ffff888021a58f70 [ 169.158849][ T7] dummy_hcd dummy_hcd.1: port status 0x00110100 has changes [ 169.175602][ T4256] Bluetooth: hci5: command 0x1009 tx timeout [ 169.190359][ T4171] tcp_in_window: START [ 169.197185][ C1] net_ratelimit: 35 callbacks suppressed [ 169.197228][ C1] wireguard: wg1: Receiving keepalive packet from peer 21 ([::1]:20001/0%0) [ 169.212436][ T4171] tcp_in_window: [ 169.212455][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.223575][ T4257] kernfs hci0:200: removing [ 169.232281][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.236135][ T4257] kernfs uevent: removing [ 169.241577][ T4171] tcp_in_window: [ 169.246169][ T146] hci5 cmd_cnt 1 cmd queued 0 [ 169.257520][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.267822][ T4257] PM: Removing info for No Bus:hci0:200 [ 169.269817][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.279761][ T7040] procname=unres_qlen_bytes mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f74 [ 169.281690][ T4171] tcp_in_window: I=1 II=1 III=1 IV=1 [ 169.286177][ T4257] kobject: 'hci0:200' (ffff8880793e8420): kobject_uevent_env [ 169.292684][ T4171] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901875 maxwin=3144576 [ 169.308539][ T7040] procname=proxy_qlen mode=644 proc_handler=neigh_proc_dointvec_zero_intmax data=ffff888021a58f78 [ 169.310812][ T4171] tcp_conntracks: [ 169.319422][ T7040] procname=anycast_delay mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff888021a58f7c [ 169.320922][ T4171] syn=0 ack=1 fin=0 rst=0 old=7 new=7 [ 169.326765][ T4257] kobject: 'hci0:200' (ffff8880793e8420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:200' [ 169.338500][ C0] wireguard: wg2: Handshake for peer 30 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 6) [ 169.346149][ T4257] kernfs hci0:200: removing [ 169.349723][ T7040] procname=proxy_delay mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff888021a58f80 [ 169.352732][ T4257] kobject: 'hci0:200' (ffff8880793e8420): kobject_cleanup, parent 0000000000000000 [ 169.352755][ T4257] kobject: 'hci0:200' (ffff8880793e8420): calling ktype release [ 169.352796][ T4257] kobject: 'hci0:200': free name [ 169.352817][ T4257] hci0 orig refcnt 7 [ 169.367660][ T9] wireguard: wg2: Sending handshake initiation to peer 30 (127.0.0.1:20002) [ 169.381529][ T7040] procname=locktime mode=644 proc_handler=neigh_proc_dointvec_userhz_jiffies data=ffff888021a58f84 [ 169.394322][ T4257] hdev hci0 event 4 [ 169.395740][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 169.576744][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 169.577490][ T4257] hdev 0000000000000000 len 8 [ 169.585941][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 51 [ 169.592257][ T4257] hdev hci0 event 8 [ 169.600160][ C0] wireguard: wg0: Sending keepalive packet to peer 20 ([::1]:20003/0%0) [ 169.603787][ T4257] hci0 orig refcnt 6 [ 169.611361][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 169.615895][ T4257] kobject: 'rfkill5' (ffff8881485fb108): kobject_uevent_env [ 169.623364][ C0] kcov: kcov_start: t = ffff88807d4b9dc0, size = 262144, area = ffffc9000235a000 [ 169.631691][ T4257] kobject: 'rfkill5' (ffff8881485fb108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/rfkill5' [ 169.640066][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 169.659670][ T4257] ffff888026abc000 name hci1 blocked 1 [ 169.665481][ T4257] hci1 ffff888026abc000 [ 169.665656][ T4255] nf_conntrack: normal packet for ffff8880798e3200 [ 169.669688][ T4257] hci1: err 0x13 [ 169.678451][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 169.681304][ T4257] hci1: cancelling interleave scan [ 169.687322][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 169.687339][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 169.693577][ T4257] hci1 state 0 -> 0 [ 169.699560][ T4662] Added buffer head 0 to ffff88801f3cd400 [ 169.707770][ T4257] sock ffff88807af3d000, index 1, cmd 14, status 15 [ 169.710920][ T7] usb usb2-port1: not reset yet, waiting 200ms [ 169.717365][ T4257] channel 2 len 15 [ 169.723544][ T7040] procname=unres_qlen mode=644 proc_handler=neigh_proc_dointvec_unres_qlen data=ffff888021a58f74 [ 169.730570][ T4257] channel 3 len 10 [ 169.734348][ T7040] procname=retrans_time_ms mode=644 proc_handler=ndisc_ifinfo_sysctl_change data=ffff888021a58f64 [ 169.745175][ T4257] All LE pending actions cleared [ 169.751882][ T7040] procname=base_reachable_time_ms mode=644 proc_handler=ndisc_ifinfo_sysctl_change data=ffff888021a58f68 [ 169.760057][ T4171] No more buffers in queue [ 169.764589][ T7040] Registering net sysctl (net ffff888073a69a80): net/ipv6/conf/syzkaller0 [ 169.775581][ T4171] eth0: xmit ffff88805727b780 42:01:0a:80:00:01 [ 169.775609][ T4171] Added buffer head 7 to ffff888147d5f000 [ 169.775675][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 169.780181][ T7040] procname=forwarding mode=644 proc_handler=addrconf_sysctl_forward data=ffff8880789145d8 [ 169.790004][ T4257] hdev hci1 [ 169.795184][ T7040] procname=hop_limit mode=644 proc_handler=proc_dointvec_minmax data=ffff8880789145dc [ 169.801572][ T4257] hcon ffff88801a9b8000 reason 22 [ 169.808543][ T7040] procname=mtu mode=644 proc_handler=addrconf_sysctl_mtu data=ffff8880789145e0 [ 169.820360][ T4171] nf_conntrack: normal packet for ffff888023828300 [ 169.822435][ T7040] procname=accept_ra mode=644 proc_handler=proc_dointvec data=ffff8880789145e4 [ 169.834927][ C1] Sent skb ffff88805727b780 [ 169.837363][ T7040] procname=accept_redirects mode=644 proc_handler=proc_dointvec data=ffff8880789145e8 [ 169.846413][ C1] No more buffers in queue [ 169.850634][ T4171] tcp_in_window: START [ 169.853077][ T7040] procname=autoconf mode=644 proc_handler=proc_dointvec data=ffff8880789145ec [ 169.862261][ T4171] tcp_in_window: [ 169.866804][ T7040] procname=dad_transmits mode=644 proc_handler=proc_dointvec data=ffff8880789145f0 [ 169.876700][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.881505][ T7040] procname=router_solicitations mode=644 proc_handler=proc_dointvec_minmax data=ffff8880789145f4 [ 169.885625][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.894709][ T7040] procname=router_solicitation_interval mode=644 proc_handler=proc_dointvec_jiffies data=ffff8880789145f8 [ 169.898350][ T4171] tcp_in_window: [ 169.907887][ T7040] procname=router_solicitation_max_interval mode=644 proc_handler=proc_dointvec_jiffies data=ffff8880789145fc [ 169.917031][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 169.946155][ T4188] hci5: end: err -110 [ 169.954070][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 169.958027][ T7] dummy_hcd dummy_hcd.1: port status 0x00110100 has changes [ 169.969555][ T4171] tcp_in_window: I=1 II=1 III=1 IV=1 [ 169.979126][ T4188] hdev hci5 event 8 [ 169.982745][ T4171] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901875 maxwin=3144576 [ 169.997753][ T4188] hdev ffff888079474000 [ 170.005035][ T4171] tcp_conntracks: [ 170.010331][ T4188] hdev ffff888079474000 tty ffff888076b2d000 [ 170.014162][ T4171] syn=0 ack=1 fin=0 rst=0 old=7 new=7 [ 170.018483][ T3519] sd 0:0:1:0: cmd ffff88802507ed28 CDB: 0x2a [ 170.028786][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.033022][ T3519] Added buffer head 149 to ffff888022837a00 [ 170.036746][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 170.043359][ T7040] procname=router_solicitation_delay mode=644 proc_handler=proc_dointvec_jiffies data=ffff888078914600 [ 170.048253][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 51 [ 170.054352][ T6914] hci5 ffff888079474000 [ 170.062393][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 170.062418][ C1] sd 0:0:1:0: cmd ffff88802507ed28 response 0 status 0x0 sense_len 0 [ 170.062440][ C1] No more buffers in queue [ 170.062723][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.129787][ C0] kcov: kcov_start: t = ffff888079a39dc0, size = 262144, area = ffffc9000235a000 [ 170.129910][ T4257] hcon ffff88801a9b8000 conn ffff88807d4dc800, err 103 [ 170.138995][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 170.154344][ T7] usb usb2-port1: not reset yet, waiting 200ms [ 170.163821][ T7040] procname=force_mld_version mode=644 proc_handler=proc_dointvec data=ffff888078914604 [ 170.167548][ T4171] No more buffers in queue [ 170.176441][ T6914] hci5: err 0x13 [ 170.178331][ T4171] eth0: xmit ffff88802445e500 42:01:0a:80:00:01 [ 170.181827][ T6914] hci5: cancelling interleave scan [ 170.188093][ T4171] Added buffer head 0 to ffff8881476eee00 [ 170.188174][ C0] virtqueue callback for ffff8881476eee00 (ffffffff854980c0) [ 170.188204][ C0] Sent skb ffff88802445e500 [ 170.202290][ T150] sd 0:0:1:0: cmd ffff8880229d2128 CDB: 0x35 [ 170.206686][ C0] No more buffers in queue [ 170.207118][ T4171] nf_conntrack: normal packet for ffff888023828300 [ 170.211269][ T150] Added buffer head 149 to ffff888022837a00 [ 170.218181][ T4171] tcp_in_window: START [ 170.222899][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 170.229119][ T4171] tcp_in_window: [ 170.234957][ C1] sd 0:0:1:0: cmd ffff8880229d2128 response 0 status 0x0 sense_len 0 [ 170.239138][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 170.247180][ C1] No more buffers in queue [ 170.256875][ T150] sd 0:0:1:0: cmd ffff888025070128 CDB: 0x2a [ 170.259336][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 170.268776][ T150] Added buffer head 149 to ffff888022837a00 [ 170.273110][ T4171] tcp_in_window: [ 170.280341][ C1] virtqueue callback for ffff888022837a00 (ffffffff8506e140) [ 170.294167][ T4171] seq=3866735941 ack=2305757299+(0) sack=2305757299+(0) win=24567 end=3866735941 [ 170.300066][ C1] sd 0:0:1:0: cmd ffff888025070128 response 0 status 0x0 sense_len 0 [ 170.303713][ T4171] tcp_in_window: sender end=3866735941 maxend=3869880517 maxwin=3144576 scale=7 receiver end=2305757299 maxend=2308901875 maxwin=3144576 scale=7 [ 170.311108][ C1] No more buffers in queue [ 170.313450][ T4257] hci1 hcon ffff88801a9b8000 chan ffff888023e9ad00 [ 170.320633][ T4171] tcp_in_window: I=1 II=1 III=1 IV=1 [ 170.329212][ T7040] procname=mldv1_unsolicited_report_interval mode=644 proc_handler=proc_dointvec_ms_jiffies data=ffff888078914608 [ 170.343553][ T4171] tcp_in_window: res=1 sender end=3866735941 maxend=3869880517 maxwin=3144576 receiver end=2305757299 maxend=2308901875 maxwin=3144576 [ 170.343588][ T4171] tcp_conntracks: [ 170.343596][ T4171] syn=0 ack=1 fin=0 rst=0 old=7 new=7 [ 170.351824][ T6914] hdev hci5 event 2 [ 170.361627][ T4254] firmware_class: device_uncache_fw_images [ 170.373114][ T7040] procname=mldv2_unsolicited_report_interval mode=644 proc_handler=proc_dointvec_ms_jiffies data=ffff88807891460c [ 170.387590][ T4256] Bluetooth: hci2: command 0x0406 tx timeout [ 170.404279][ T7] dummy_hcd dummy_hcd.1: port status 0x00110100 has changes [ 170.406451][ C1] wireguard: wg2: Receiving keepalive packet from peer 23 ([::1]:20001/0%0) [ 170.424343][ T7040] procname=use_tempaddr mode=644 proc_handler=proc_dointvec data=ffff888078914610 [ 170.424442][ T7040] procname=temp_valid_lft mode=644 proc_handler=proc_dointvec data=ffff888078914614 [ 170.424472][ T7040] procname=temp_prefered_lft mode=644 proc_handler=proc_dointvec data=ffff888078914618 [ 170.434404][ C1] wireguard: wg1: Receiving keepalive packet from peer 3 ([::1]:20001/0%0) [ 170.442007][ T4188] hci2 cmd_cnt 1 cmd queued 0 [ 170.452603][ T7040] procname=regen_max_retry mode=644 proc_handler=proc_dointvec data=ffff88807891461c [ 170.459947][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.469709][ T6914] hdev 0000000000000000 len 8 [ 170.478105][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 170.478241][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 51 [ 170.490302][ T6914] kernfs runtime_status: removing [ 170.493994][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.502532][ T7040] procname=max_desync_factor mode=644 proc_handler=proc_dointvec data=ffff888078914620 [ 170.505366][ C0] kcov: kcov_start: t = ffff888079a39dc0, size = 262144, area = ffffc9000235a000 [ 170.505475][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 170.516354][ C1] wireguard: wg1: Receiving keepalive packet from peer 9 ([::1]:20001/0%0) [ 170.527893][ T7] usb usb2-port1: not reset yet, waiting 200ms [ 170.529165][ C1] wireguard: wg1: Receiving keepalive packet from peer 15 ([::1]:20001/0%0) [ 170.536509][ T7] dummy_hcd dummy_hcd.1: port status 0x00010100 has changes [ 170.557570][ T6914] kernfs control: removing [ 170.564261][ C0] wireguard: wg1: Receiving keepalive packet from peer 21 ([::1]:20001/0%0) [ 170.573394][ T7040] procname=max_addresses mode=644 proc_handler=proc_dointvec data=ffff888078914624 [ 170.578756][ C0] wireguard: wg1: Receiving keepalive packet from peer 27 ([::1]:20001/0%0) [ 170.601035][ T6914] kernfs runtime_suspended_time: removing [ 170.608510][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.608535][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 170.608570][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 43 [ 170.621539][ T7040] procname=accept_ra_defrtr mode=644 proc_handler=proc_dointvec data=ffff888078914628 [ 170.626990][ C0] wireguard: wg0: Sending keepalive packet to peer 26 ([::1]:20003/0%0) [ 170.634051][ T7040] procname=ra_defrtr_metric mode=644 proc_handler=proc_douintvec_minmax data=ffff88807891462c [ 170.642737][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.652075][ T4171] No more buffers in queue [ 170.660559][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 170.660705][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 170.670830][ T4171] eth0: xmit ffff88805b53ba00 42:01:0a:80:00:01 [ 170.679509][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 170.689960][ T4171] Added buffer head 7 to ffff888147d5f000 [ 170.698200][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 170.698207][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 170.698222][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 170.703286][ C1] Sent skb ffff88805b53ba00 [ 170.720543][ T4662] nf_conntrack: normal packet for ffff888023828f00 [ 170.720752][ T4662] Added buffer head 0 to ffff88801f3cd400 [ 170.727213][ C1] No more buffers in queue [ 170.734944][ T7] dummy_hcd dummy_hcd.1: port status 0x00010100 has changes [ 170.744043][ T6914] kernfs runtime_active_time: removing [ 170.748514][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.805655][ C0] kcov: kcov_start: t = ffff88807d4b9dc0, size = 262144, area = ffffc9000235a000 [ 170.813827][ T7040] procname=accept_ra_min_hop_limit mode=644 proc_handler=proc_dointvec data=ffff888078914630 [ 170.814928][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 59 [ 170.815852][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.834339][ T6914] kernfs autosuspend_delay_ms: removing [ 170.842080][ C0] kcov: kcov_start: t = ffff88807d4b9dc0, size = 262144, area = ffffc9000235a000 [ 170.849794][ T6914] kernfs power: removing [ 170.856892][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 170.862368][ T7040] procname=accept_ra_min_lft mode=644 proc_handler=proc_dointvec data=ffff888078914634 [ 170.875800][ T4255] nf_conntrack: normal packet for ffff8880798e2600 [ 170.883768][ T6914] kernfs device: removing [ 170.886738][ T7] kobject: '2-1' (ffff88807c18b0a8): kobject_cleanup, parent 0000000000000000 [ 170.891250][ T6914] kernfs subsystem: removing [ 170.899678][ T4662] nf_conntrack: normal packet for ffff888078730480 [ 170.905376][ T6914] kernfs rfkill22: removing [ 170.910916][ T7] kobject: '2-1' (ffff88807c18b0a8): calling ktype release [ 170.922526][ T7] kobject: '2-1': free name [ 170.927708][ T6914] kernfs uevent: removing [ 170.929254][ T7] dummy_hcd dummy_hcd.1: port status 0x00010100 has changes [ 170.932087][ T6914] kernfs name: removing [ 170.940259][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.952456][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 170.958726][ T7040] procname=accept_ra_pinfo mode=644 proc_handler=proc_dointvec data=ffff888078914638 [ 170.961876][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 51 [ 170.980111][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 170.988305][ C0] kcov: kcov_start: t = ffff88807d4b9dc0, size = 262144, area = ffffc9000235a000 [ 170.990802][ T6914] kernfs type: removing [ 170.997501][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 171.008608][ T4662] nf_conntrack: normal packet for ffff8880798e2f00 [ 171.011788][ T4257] hci1 hcon ffff88801a9b8000 handle 200 [ 171.016983][ T7] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc900148ab000 621939 [ 171.022496][ T7040] procname=accept_ra_rtr_pref mode=644 proc_handler=proc_dointvec data=ffff888078914640 [ 171.033551][ T7] kcov: kcov_remote_start: handle = 100000000000002, context: task [ 171.047013][ T4257] hcon ffff88801a9b8000 [ 171.049316][ T7] kcov: kcov_start: t = ffff888017a8bb80, size = 1048576, area = ffffc900148ab000 [ 171.049411][ T7] hub 2-0:1.0: state 7 ports 1 chg 0000 evt 0002 [ 171.049475][ T7] dummy_hcd dummy_hcd.1: port status 0x00010100 has changes [ 171.049524][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.049544][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.049612][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 105 [ 171.060123][ T6914] kernfs index: removing [ 171.063683][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.070704][ T7040] procname=router_probe_interval mode=644 proc_handler=proc_dointvec_jiffies data=ffff888078914644 [ 171.076746][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.076854][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 171.086574][ T6914] kernfs persistent: removing [ 171.102780][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.106017][ T4257] hci1: conn ffff88801a9b8000 [ 171.107903][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.116314][ T6914] kernfs state: removing [ 171.127792][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 30 [ 171.138327][ T7040] procname=accept_ra_rt_info_min_plen mode=644 proc_handler=proc_dointvec data=ffff888078914648 [ 171.145343][ T7] usb usb2-port1: status 0100, change 0001, 12 Mb/s [ 171.145759][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.145779][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.145808][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 22 [ 171.162295][ T6914] kernfs soft: removing [ 171.165659][ T4257] device: 'hci1:200': device_unregister [ 171.179811][ T6914] kernfs hard: removing [ 171.189671][ T7040] procname=accept_ra_rt_info_max_plen mode=644 proc_handler=proc_dointvec data=ffff88807891464c [ 171.197950][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.203353][ C1] virtqueue callback for ffff8881476eef00 (ffffffff85497fd0) [ 171.211614][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.220916][ C1] No more buffers in queue [ 171.229199][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 171.233471][ C1] Receiving skb proto 0x0806 len 28 type 1 [ 171.284762][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.291708][ C1] No more buffers in queue [ 171.297482][ C0] kcov: kcov_start: t = ffff88807afd1dc0, size = 262144, area = ffffc9000235a000 [ 171.297582][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 171.306200][ C1] No more buffers in queue [ 171.332408][ C1] eth0: xmit ffff88802a106640 42:01:0a:80:00:01 [ 171.338845][ C1] Added buffer head 7 to ffff888147d5f000 [ 171.344631][ C1] virtqueue callback for ffff888147d5f000 (ffffffff854980c0) [ 171.352200][ T7040] procname=proxy_ndp mode=644 proc_handler=addrconf_sysctl_proxy_ndp data=ffff888078914650 [ 171.352922][ C1] Sent skb ffff88802a106640 [ 171.366638][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.367152][ C1] No more buffers in queue [ 171.375226][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.375317][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 171.380679][ T6914] kernfs hard_block_reasons: removing [ 171.394871][ T7040] procname=accept_source_route mode=644 proc_handler=proc_dointvec data=ffff888078914654 [ 171.415104][ T4257] kernfs runtime_status: removing [ 171.420642][ T6914] PM: Removing info for No Bus:rfkill22 [ 171.420658][ T4257] kernfs control: removing [ 171.427377][ T7040] procname=optimistic_dad mode=644 proc_handler=proc_dointvec data=ffff88807891465c [ 171.433662][ T4257] kernfs runtime_suspended_time: removing [ 171.441262][ T7040] procname=use_optimistic mode=644 proc_handler=proc_dointvec data=ffff888078914660 [ 171.448684][ T6914] kobject: 'rfkill22' (ffff8880619ab108): kobject_uevent_env [ 171.457154][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.472486][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.477381][ T4257] kernfs runtime_active_time: removing [ 171.482254][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 38 [ 171.493411][ T6914] kobject: 'rfkill22' (ffff8880619ab108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5/rfkill22' [ 171.497152][ T7] usb usb2-port1: debounce total 100ms stable 100ms status 0x100 [ 171.511001][ T4257] kernfs autosuspend_delay_ms: removing [ 171.520996][ T4257] kernfs power: removing [ 171.523856][ T7040] procname=mc_forwarding mode=444 proc_handler=proc_dointvec data=ffff888078914664 [ 171.525331][ T4257] kernfs device: removing [ 171.535627][ T7040] Not writable by anyone [ 171.542006][ T6914] kernfs rfkill22: removing [ 171.545055][ T7] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc900148ab000 61530 [ 171.551480][ T4257] kernfs subsystem: removing [ 171.558739][ T7040] procname=disable_ipv6 mode=644 proc_handler=addrconf_sysctl_disable data=ffff888078914668 [ 171.563828][ T4257] kernfs hci1:200: removing [ 171.577318][ T7040] procname=accept_dad mode=644 proc_handler=proc_dointvec data=ffff888078914670 [ 171.580430][ T7] kcov: kcov_remote_start: handle = 100000000000002, context: task [ 171.586978][ T7040] procname=force_tllao mode=644 proc_handler=proc_dointvec data=ffff888078914674 [ 171.594469][ T7] kcov: kcov_start: t = ffff888017a8bb80, size = 1048576, area = ffffc900148ab000 [ 171.599365][ T7] hub 2-0:1.0: state 7 ports 1 chg 0000 evt 0002 [ 171.610648][ T4257] kernfs uevent: removing [ 171.613776][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.619854][ T4257] PM: Removing info for No Bus:hci1:200 [ 171.624048][ C0] kcov: kcov_start: t = ffff88813fea9dc0, size = 262144, area = ffffc9000235a000 [ 171.632328][ T7040] procname=ndisc_notify mode=644 proc_handler=proc_dointvec data=ffff888078914678 [ 171.637841][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 34 [ 171.652822][ T4257] kobject: 'hci1:200' (ffff88801a9b8420): kobject_uevent_env [ 171.658582][ T7] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc900148ab000 29070 [ 171.672147][ T7040] procname=suppress_frag_ndisc mode=644 proc_handler=proc_dointvec data=ffff88807891467c [ 171.677932][ T7] hub 2-0:1.0: hub_suspend [ 171.681155][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 171.681203][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 171.681215][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 171.686731][ T4257] kobject: 'hci1:200' (ffff88801a9b8420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/hci1:200' [ 171.693149][ T4662] Added buffer head 0 to ffff88801f3cd400 [ 171.695910][ C0] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 171.695909][ T7040] procname=accept_ra_from_local mode=644 proc_handler=proc_dointvec data=ffff888078914658 [ 171.695932][ C0] kcov: kcov_start: t = ffff88807d4b9dc0, size = 262144, area = ffffc9000235a000 [ 171.695947][ T7040] procname=accept_ra_mtu mode=644 proc_handler=proc_dointvec data=ffff888078914680 [ 171.695961][ C0] kcov: kcov_move_area: ffffc90012ca7000 1048576 <= ffffc9000235a000 11 [ 171.695975][ T7040] procname=stable_secret mode=600 proc_handler=addrconf_sysctl_stable_secret data=ffff888078914688 [ 171.696005][ T7040] procname=use_oif_addrs_only mode=644 proc_handler=proc_dointvec data=ffff88807891469c [ 171.696029][ T7040] procname=ignore_routes_with_linkdown mode=644 proc_handler=addrconf_sysctl_ignore_routes_with_linkdown data=ffff88807891463c [ 171.696745][ T7040] procname=drop_unicast_in_l2_multicast mode=644 proc_handler=proc_dointvec data=ffff88807891466c [ 171.696772][ T7040] procname=drop_unsolicited_na mode=644 proc_handler=proc_dointvec data=ffff888078914684 [ 171.696798][ T7040] procname=keep_addr_on_down mode=644 proc_handler=proc_dointvec data=ffff8880789146a0 [ 171.696823][ T7040] procname=seg6_enabled mode=644 proc_handler=proc_dointvec data=ffff8880789146a4 [ 171.696848][ T7040] procname=seg6_require_hmac mode=644 proc_handler=proc_dointvec data=ffff8880789146a8 [ 171.696874][ T7040] procname=enhanced_dad mode=644 proc_handler=proc_dointvec data=ffff8880789146ac [ 171.696900][ T7040] procname=addr_gen_mode mode=644 proc_handler=addrconf_sysctl_addr_gen_mode data=ffff8880789146b0 [ 171.696928][ T7040] procname=disable_policy mode=644 proc_handler=addrconf_sysctl_disable_policy data=ffff8880789146b4 [ 171.696957][ T7040] procname=ndisc_tclass mode=644 proc_handler=proc_dointvec_minmax data=ffff8880789146b8 [ 171.696984][ T7040] procname=rpl_seg_enabled mode=644 proc_handler=proc_dointvec_minmax data=ffff8880789146bc [ 171.697012][ T7040] procname=ioam6_enabled mode=644 proc_handler=proc_dou8vec_minmax data=ffff8880789146c8 [ 171.697038][ T7040] procname=ioam6_id mode=644 proc_handler=proc_douintvec_minmax data=ffff8880789146c0 [ 171.709106][ T7] usb usb2: bus auto-suspend, wakeup 1 [ 171.715755][ T4257] kernfs hci1:200: removing [ 171.719970][ T7] usb usb2: dummy_bus_suspend [ 171.736702][ T7040] procname=ioam6_id_wide mode=644 proc_handler=proc_douintvec data=ffff8880789146c4 [ 171.737595][ T7040] Registering net sysctl (net ffff888073a69a80): net/mpls/conf/syzkaller0 [ 171.855201][ T7] nf_conntrack: normal packet for ffff888023829680 [ 171.862981][ T4257] kobject: 'hci1:200' (ffff88801a9b8420): kobject_cleanup, parent 0000000000000000 [ 171.870682][ T7040] procname=input mode=644 proc_handler=mpls_conf_proc data=ffff888022900e00 [ 171.887768][ T4257] kobject: 'hci1:200' (ffff88801a9b8420): calling ktype release [ 171.913981][ T3850] Deleting a9feffff/32 tos=0 t=ffff88807d8e4fb0 [ 171.924291][ T4257] kobject: 'hci1:200': free name [ 171.938505][ T3850] Deleting a9feffff/32 tos=0 t=ffff88807d8e4fb0 [ 171.944268][ T4257] hci1 orig refcnt 7 [ 171.949681][ T3850] Deleting a9feb967/32 tos=0 t=ffff88807d8e4fb0 [ 171.952745][ T4257] hdev hci1 event 4 [ 171.952800][ T4257] hdev 0000000000000000 len 8 [ 171.964523][ T3850] sctp: sctp_addr_wq_mgmt: add new entry for cmd:2, addr:169.254.185.103 in wq:ffffffff974d9858 [ 171.968582][ T4257] hdev hci1 event 8 [ 171.999381][ T7040] kcov: kcov_task_exit: t = ffff88802b26bb80, kcov->t = ffff88802b26bb80 [ 172.012342][ T4257] hci1 orig refcnt 6 [ 172.020257][ T3850] Deleting a9fe0000/16 tos=0 t=ffff88807d8e4fb0 [ 172.024269][ T4257] kobject: 'rfkill6' (ffff8881485e4108): kobject_uevent_env [ 172.090489][ T4257] kobject: 'rfkill6' (ffff8881485e4108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/rfkill6' [ 172.091317][ T7040] syzkaller0 (unregistering): bond_netdev_event received NETDEV_UNREGISTER [ 172.112534][ T4257] ffff888077c90000 name hci2 blocked 1 [ 172.119478][ T4257] hci2 ffff888077c90000 [ 172.123769][ T4257] hci2: err 0x13 [ 172.127778][ T4257] hci2: cancelling interleave scan [ 172.130310][ T7040] net syzkaller0: siw: event 6 [ 172.133165][ T4257] hci2 state 0 -> 0 [ 172.141927][ T4257] All LE pending actions cleared [ 172.147143][ T4257] hdev hci2 [ 172.150367][ T4257] hcon ffff888078d6e000 reason 22 [ 172.155804][ T4257] hcon ffff888078d6e000 conn ffff88801fd2a000, err 103 [ 172.163258][ T4257] hci2 hcon ffff888078d6e000 chan ffff88802b4ea100 [ 172.171945][ T4257] hci2 hcon ffff888078d6e000 handle 201 [ 172.172109][ T7040] kobject: 'rx-0' (ffff888056880050): kobject_cleanup, parent ffff8880278c6050 [ 172.178590][ T4257] hcon ffff888078d6e000 [ 172.192392][ T7040] kobject: 'rx-0' (ffff888056880050): auto cleanup kobject_del [ 172.200211][ T7040] kernfs rps_cpus: removing [ 172.200992][ T4257] hci2: conn ffff888078d6e000 [ 172.204882][ T7040] kernfs rps_flow_cnt: removing [ 172.214685][ T7040] kobject: 'rx-0' (ffff888056880050): auto cleanup 'remove' event [ 172.223056][ T7040] kobject: 'rx-0' (ffff888056880050): kobject_uevent_env [ 172.224393][ T4257] device: 'hci2:201': device_unregister [ 172.231636][ T7040] kobject: 'rx-0' (ffff888056880050): fill_kobj_path: path = '/devices/virtual/net/syzkaller0/queues/rx-0' [ 172.249056][ T7040] kernfs rx-0: removing [ 172.253452][ T7040] kobject: 'rx-0' (ffff888056880050): calling ktype release [ 172.254225][ T4257] kernfs runtime_status: removing [ 172.268020][ T4257] kernfs control: removing [ 172.272511][ T4257] kernfs runtime_suspended_time: removing [ 172.278267][ T7040] kobject: 'rx-0': free name [ 172.284245][ T7040] kernfs limit: removing [ 172.288695][ T7040] kernfs limit_max: removing [ 172.293420][ T7040] kernfs limit_min: removing [ 172.298231][ T7040] kernfs hold_time: removing [ 172.302974][ T7040] kernfs inflight: removing [ 172.307855][ T7040] kernfs byte_queue_limits: removing [ 172.326324][ T4257] kernfs runtime_active_time: removing [ 172.331889][ T4257] kernfs autosuspend_delay_ms: removing [ 172.337791][ T7040] kobject: 'tx-0' (ffff88805e200018): kobject_cleanup, parent ffff8880278c6050 [ 172.347783][ T4257] kernfs power: removing [ 172.352113][ T4257] kernfs device: removing [ 172.356536][ T7040] kobject: 'tx-0' (ffff88805e200018): auto cleanup kobject_del [ 172.364710][ T4257] kernfs subsystem: removing [ 172.369715][ T4257] kernfs hci2:201: removing [ 172.374371][ T7040] kernfs tx_timeout: removing [ 172.379563][ T4257] kernfs uevent: removing [ 172.383946][ T4257] PM: Removing info for No Bus:hci2:201 [ 172.389635][ T7040] kernfs traffic_class: removing [ 172.394843][ T7040] kernfs xps_cpus: removing [ 172.399420][ T7040] kernfs xps_rxqs: removing [ 172.403983][ T7040] kernfs tx_maxrate: removing [ 172.408907][ T4257] kobject: 'hci2:201' (ffff888078d6e420): kobject_uevent_env [ 172.416880][ T4257] kobject: 'hci2:201' (ffff888078d6e420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:201' [ 172.428682][ T7040] kobject: 'tx-0' (ffff88805e200018): auto cleanup 'remove' event [ 172.437888][ T4257] kernfs hci2:201: removing [ 172.442450][ T4257] kobject: 'hci2:201' (ffff888078d6e420): kobject_cleanup, parent 0000000000000000 [ 172.452135][ T7040] kobject: 'tx-0' (ffff88805e200018): kobject_uevent_env [ 172.459410][ T7040] kobject: 'tx-0' (ffff88805e200018): fill_kobj_path: path = '/devices/virtual/net/syzkaller0/queues/tx-0' [ 172.470980][ T4257] kobject: 'hci2:201' (ffff888078d6e420): calling ktype release [ 172.479091][ T7040] kernfs tx-0: removing [ 172.483658][ T7040] kobject: 'tx-0' (ffff88805e200018): calling ktype release [ 172.484380][ C0] sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff974d9858 is addr:169.254.185.103 for cmd:2 at entry:ffff88801b58cb00 [ 172.491297][ T4257] kobject: 'hci2:201': free name [ 172.510120][ T7040] kobject: 'tx-0': free name [ 172.515242][ T4257] hci2 orig refcnt 10 [ 172.519425][ T4257] hcon ffff8880797f2000 reason 22 [ 172.524697][ T7040] kernfs queues: removing [ 172.529723][ T7040] kobject: 'queues' (ffff8880278c6050): kobject_cleanup, parent 0000000000000000 [ 172.539484][ T4257] hcon ffff8880797f2000 conn ffff88801fd29800, err 103 [ 172.546753][ T7040] kobject: 'queues' (ffff8880278c6050): calling ktype release [ 172.554612][ T4257] hci2 hcon ffff8880797f2000 chan ffff88802b4ea000 [ 172.561260][ T7040] kobject: 'queues' (ffff8880278c6050): kset_release [ 172.569200][ T4257] hci2 hcon ffff8880797f2000 handle 200 [ 172.574958][ T4257] hcon ffff8880797f2000 [ 172.578436][ T7040] kobject: 'queues': free name [ 172.587010][ T7040] kernfs runtime_status: removing [ 172.592598][ T7040] kernfs control: removing [ 172.594326][ T4257] hci2: conn ffff8880797f2000 [ 172.599994][ T7040] kernfs runtime_suspended_time: removing [ 172.603533][ T4257] device: 'hci2:200': device_unregister [ 172.612719][ T7040] kernfs runtime_active_time: removing [ 172.619798][ T7040] kernfs autosuspend_delay_ms: removing [ 172.627463][ T4257] kernfs runtime_status: removing [ 172.632618][ T4257] kernfs control: removing [ 172.637447][ T4257] kernfs runtime_suspended_time: removing [ 172.643282][ T4257] kernfs runtime_active_time: removing [ 172.648980][ T7040] kernfs power: removing [ 172.653277][ T7040] kernfs subsystem: removing [ 172.659235][ T4257] kernfs autosuspend_delay_ms: removing [ 172.665314][ T4257] kernfs power: removing [ 172.670230][ T4257] kernfs device: removing [ 172.674697][ T4257] kernfs subsystem: removing [ 172.678209][ C0] virtqueue callback for ffff88801f3cd400 (ffffffff84450960) [ 172.687492][ C0] virtqueue interrupt with no work for ffff88801f3cd300 [ 172.694447][ C0] virtqueue interrupt with no work for ffff88801f3cd200 [ 172.702432][ T7] Added buffer head 0 to ffff88801f3cd400 [ 172.712758][ T7040] kernfs syzkaller0: removing [ 172.718121][ T7040] kernfs uevent: removing [ 172.722767][ T7040] kernfs tun_flags: removing [ 172.729831][ T7040] kernfs owner: removing [ 172.734864][ T7] nf_conntrack: normal packet for ffff8880798e3200 [ 172.742104][ T7040] kernfs group: removing [ 172.749061][ T4257] kernfs hci2:200: removing [ 172.753658][ T7040] kernfs rx_packets: removing [ 172.758542][ T4257] kernfs uevent: removing [ 172.762961][ T4257] PM: Removing info for No Bus:hci2:200 [ 172.769001][ T7040] kernfs tx_packets: removing [ 172.773751][ T7040] kernfs rx_bytes: removing [ 172.778548][ T4257] kobject: 'hci2:200' (ffff8880797f2420): kobject_uevent_env [ 172.786155][ T7040] kernfs tx_bytes: removing [ 172.791241][ T7040] kernfs rx_errors: removing [ 172.796026][ T4257] kobject: 'hci2:200' (ffff8880797f2420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:200' [ 172.801732][ T7040] kernfs tx_errors: removing [ 172.812793][ T7040] kernfs rx_dropped: removing [ 172.817842][ T7040] kernfs tx_dropped: removing [ 172.822588][ T7040] kernfs multicast: removing [ 172.827749][ T4257] kernfs hci2:200: removing [ 172.832366][ T7040] kernfs collisions: removing [ 172.839537][ T7040] kernfs rx_length_errors: removing [ 172.845099][ T7040] kernfs rx_over_errors: removing [ 172.850372][ T7040] kernfs rx_crc_errors: removing [ 172.857892][ T7040] kernfs rx_frame_errors: removing [ 172.863184][ T7040] kernfs rx_fifo_errors: removing [ 172.868660][ T7040] kernfs rx_missed_errors: removing [ 172.868661][ T4257] kobject: 'hci2:200' (ffff8880797f2420): kobject_cleanup, parent 0000000000000000 [ 172.868685][ T4257] kobject: 'hci2:200' (ffff8880797f2420): calling ktype release [ 172.880859][ T7040] kernfs tx_aborted_errors: removing [ 172.898763][ T4257] kobject: 'hci2:200': free name [ 172.903770][ T4257] hci2 orig refcnt 7 [ 172.905118][ T7040] kernfs tx_carrier_errors: removing [ 172.918277][ T7040] kernfs tx_fifo_errors: removing [ 172.922855][ T4257] hdev hci2 event 4 [ 172.928470][ T7040] kernfs tx_heartbeat_errors: removing [ 172.929568][ T4257] hdev 0000000000000000 len 8 [ 172.939804][ T7040] kernfs tx_window_errors: removing [ 172.945473][ T7040] kernfs rx_compressed: removing [ 172.950567][ T7040] kernfs tx_compressed: removing [ 172.955556][ T4257] hdev hci2 event 8 [ 172.955575][ T4257] hci2 orig refcnt 6 [ 172.955590][ T4257] kobject: 'rfkill7' (ffff88814c989108): kobject_uevent_env [ 172.955644][ T4257] kobject: 'rfkill7' (ffff88814c989108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/rfkill7' [ 172.956395][ T4257] ffff88802607c000 name hci3 blocked 1 [ 172.987947][ T4257] hci3 ffff88802607c000 [ 172.987976][ T7040] kernfs rx_nohandler: removing [ 172.991860][ T7040] kernfs statistics: removing [ 172.992861][ T4257] hci3: err 0x13 [ 173.006304][ T4257] hci3: cancelling interleave scan [ 173.011468][ T4257] hci3 state 0 -> 0 [ 173.013396][ T7040] kernfs netdev_group: removing [ 173.015527][ T4257] channel 3 len 10 [ 173.024399][ T7040] kernfs type: removing [ 173.028612][ T7040] kernfs dev_id: removing [ 173.032996][ T7040] kernfs dev_port: removing [ 173.037869][ T4257] All LE pending actions cleared [ 173.042840][ T4257] hdev hci3 [ 173.046236][ T7040] kernfs iflink: removing [ 173.050626][ T7040] kernfs ifindex: removing [ 173.055326][ T4257] hcon ffff88801abce000 reason 22 [ 173.060481][ T4257] hcon ffff88801abce000 conn ffff88802d113800, err 103 [ 173.067708][ T7040] kernfs name_assign_type: removing [ 173.073127][ T4257] hci3 hcon ffff88801abce000 chan ffff88801fc6e400 [ 173.080373][ T7040] kernfs addr_assign_type: removing [ 173.085940][ T7040] kernfs addr_len: removing [ 173.091524][ T4257] hci3 hcon ffff88801abce000 handle 200 [ 173.097677][ T7040] kernfs link_mode: removing [ 173.102402][ T4257] hcon ffff88801abce000 [ 173.106964][ T7040] kernfs address: removing [ 173.111568][ T4257] hci3: conn ffff88801abce000 [ 173.116671][ T7040] kernfs broadcast: removing [ 173.121504][ T4257] device: 'hci3:200': device_unregister [ 173.127364][ T7040] kernfs speed: removing [ 173.131797][ T4257] kernfs runtime_status: removing [ 173.137278][ T7040] kernfs duplex: removing [ 173.141823][ T7040] kernfs dormant: removing [ 173.146590][ T4257] kernfs control: removing [ 173.151384][ T4257] kernfs runtime_suspended_time: removing [ 173.157847][ T7040] kernfs testing: removing [ 173.162433][ T7040] kernfs operstate: removing [ 173.167424][ T4257] kernfs runtime_active_time: removing [ 173.173179][ T4257] kernfs autosuspend_delay_ms: removing [ 173.179273][ T7040] kernfs carrier_changes: removing [ 173.184827][ T7040] kernfs ifalias: removing [ 173.189420][ T4257] kernfs power: removing [ 173.193964][ T4257] kernfs device: removing [ 173.199061][ T7040] kernfs carrier: removing [ 173.203627][ T7040] kernfs mtu: removing [ 173.209185][ T4257] kernfs subsystem: removing [ 173.214385][ T4257] kernfs hci3:200: removing [ 173.219112][ T7040] kernfs flags: removing [ 173.223485][ T7040] kernfs tx_queue_len: removing [ 173.229467][ T4257] kernfs uevent: removing [ 173.233940][ T4257] PM: Removing info for No Bus:hci3:200 [ 173.240699][ T7040] kernfs gro_flush_timeout: removing [ 173.246176][ T7040] kernfs napi_defer_hard_irqs: removing [ 173.251853][ T4257] kobject: 'hci3:200' (ffff88801abce420): kobject_uevent_env [ 173.259613][ T7040] kernfs phys_port_id: removing [ 173.265536][ T4257] kobject: 'hci3:200' (ffff88801abce420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/hci3:200' [ 173.277353][ T7040] kernfs phys_port_name: removing [ 173.282534][ T7040] kernfs phys_switch_id: removing [ 173.287885][ T7040] kernfs proto_down: removing [ 173.292815][ T4257] kernfs hci3:200: removing [ 173.297627][ T4257] kobject: 'hci3:200' (ffff88801abce420): kobject_cleanup, parent 0000000000000000 [ 173.307519][ T7040] kernfs carrier_up_count: removing [ 173.312884][ T7040] kernfs carrier_down_count: removing [ 173.318612][ T4257] kobject: 'hci3:200' (ffff88801abce420): calling ktype release [ 173.326863][ T7040] kernfs threaded: removing [ 173.331548][ T7040] PM: Removing info for No Bus:syzkaller0 [ 173.337612][ T4257] kobject: 'hci3:200': free name [ 173.342715][ T7040] kobject: 'syzkaller0' (ffff88807654c608): kobject_uevent_env [ 173.350723][ T4257] hci3 orig refcnt 7 [ 173.354868][ T4257] hdev hci3 event 4 [ 173.358809][ T7040] kobject: 'syzkaller0' (ffff88807654c608): fill_kobj_path: path = '/devices/virtual/net/syzkaller0' [ 173.370106][ T4257] hdev 0000000000000000 len 8 [ 173.375780][ T4257] hdev hci3 event 8 [ 173.379722][ T4257] hci3 orig refcnt 6 [ 173.383861][ T7040] kernfs syzkaller0: removing [ 173.388902][ T4257] kobject: 'rfkill8' (ffff88801fc11108): kobject_uevent_env [ 173.396539][ T4257] kobject: 'rfkill8' (ffff88801fc11108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/rfkill8' [ 173.408500][ T4257] ffff8880786fc000 name hci4 blocked 1 [ 173.414212][ T4257] hci4 ffff8880786fc000 [ 173.418504][ T4257] hci4: err 0x13 [ 173.422171][ T4257] hci4: cancelling interleave scan [ 173.427722][ T4257] hci4 state 0 -> 0