last executing test programs: 3m32.213746448s ago: executing program 2 (id=22): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="520003000100b8", 0x7) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e20, @local}}}, &(0x7f0000000140)=0x84) r2 = socket$nl_rdma(0x10, 0x3, 0x14) recvmsg(r2, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x120) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[], 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x4040800) 3m31.21129849s ago: executing program 2 (id=24): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) socket$igmp(0x2, 0x3, 0x2) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0xffffffffffffffff) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000340), 0x10106, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) socket(0x1e, 0x80004, 0x0) bind$tipc(r4, &(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000003c0)={0x43, 0x0, 0x3, 0x3}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x1d, 0x80802, 0x6) mount$9p_fd(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x84, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x400000000000003, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f041}) syz_open_dev$vim2m(&(0x7f0000000080), 0x7fffffffffffffff, 0x2) sendmsg$tipc(r4, &(0x7f0000000400)={&(0x7f0000000480), 0x10, 0x0}, 0x0) 3m28.974933398s ago: executing program 2 (id=25): prlimit64(0x0, 0xe, &(0x7f00000004c0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000580)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000680), 0x651, 0x0) recvmmsg(r1, &(0x7f00000006c0), 0x4000087, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000c00), 0x80c42, 0x0) read(r3, &(0x7f0000000c40)=""/148, 0xffffff96) 3m26.486810402s ago: executing program 2 (id=30): syz_mount_image$ext4(&(0x7f0000001340)='ext4\x00', &(0x7f00000013c0)='./sys\x00', 0x210000, &(0x7f0000001400)={[{@dax_never}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@lazytime}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f00000014c0)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f0000001a40)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000001a80)='./file0\x00', &(0x7f0000001ac0), 0x8, &(0x7f0000001b00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000001b40), &(0x7f0000001b80)='./file0\x00', 0x8820, &(0x7f0000001bc0)=ANY=[], 0x1, 0x0, 0x0) symlinkat(&(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000fc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3m24.34959542s ago: executing program 2 (id=37): r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000300)=[{{&(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000002900)=[{&(0x7f0000002980)="281effe935fdca24ffffff556ea6e500"/26, 0x20}], 0x1, &(0x7f00000029c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x37}, @empty}}}], 0x20}}, {{&(0x7f0000002a00)={0x2, 0x4e22, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000002a40)=[@ip_ttl={{0x18, 0x0, 0x2, 0xedd}}], 0x18}}], 0x2, 0x4800) 3m20.284350174s ago: executing program 2 (id=48): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x383, @dev={0xfe, 0x80, '\x00', 0x3c}, 0x4}]}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000380)={r2, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000440)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000006c0)={r3, 0x2}, &(0x7f0000000700)=0x8) 3m20.002067172s ago: executing program 32 (id=48): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x383, @dev={0xfe, 0x80, '\x00', 0x3c}, 0x4}]}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000380)={r2, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000440)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000006c0)={r3, 0x2}, &(0x7f0000000700)=0x8) 2m47.872099016s ago: executing program 5 (id=49): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000048c0)=@delchain={0x58c, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {0xb, 0x10}}, [@filter_kind_options=@f_bpf={{0x8}, {0x560, 0x2, [@TCA_BPF_ACT={0x55c, 0x1, [@m_mirred={0x558, 0xd, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x73, 0x10, 0x20000000, 0x8, 0xa8a}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8001, 0x0, 0x8, 0x2, 0x3}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x81, 0x1, 0x3, 0x100, 0x100}, 0x1}}]}, {0x4c9, 0x6, "54aa6579cf06a9e3ba2d57a0b3b58a5530eee176cab36463f36b167af47eaffcc5614168a068fcc4247c79c80796c574b4c2af8fdde088a7c88150f55d6194c6e715d3ba099779d80777b6c2ab8ffc343de4bf6ac9bf3141c933c502312f1d4289e195942ddc770951e9bcfdcea336c0bf0474b100872803fa14af615af6da6b063b01c50e9b21ca269b37702a2bce63fba39790cd2e6ae9de2e0206a3a406a8de8f9d43417fc1e6c6771acd645f2349e72126b899f4b2cdc57f230af5679ffd82fc07c607550881f253b3710c5898f406071830211caaa7b71a20bb9fe0385bf1c91e505e3f4a21227bc62630ee99db144595ad6fc3291ae966d1e2128f1e6b2f2726d3f3dfa41850be2b91ac77c5662e1e06ba8b0e121b1008a343e92b708444c195f8d7f46cc4cf73f6d164cabc61bc7ac9ddb5530feacc09aa773720b9e4a533ed55c556b0b76add10945963618aa76433793e7a39ef3f931eb6fc30d04e6737841828e1771c547a6acf68bcf85652f4aac8aa4e7abe5eaddd2ae75756d2f18c4ad6fef07be7489eda7c55a53bd694c68bb54e282e065ca5d9cea36dcd0e0c9dca08fbbaf0d62123f74ae45ef71e47b74e8070fd637cb968ae9804da49bb42f657abc1f73e5a77acde27e0f5320610c098f9f82b5ae6a0812efbd91f2dd0ab6035645aa8da106c7d6b7e81d74eb6b6a1d5840d7811d7759c1badfdf04e55178153ee55ce3f91f94a826e35b114aab35c4eeeb4041893f4d55fe8168bb3d40350fb1ad952b2f6249eb1d26801bcaa623bbb04f5e1cbbd0cbb9ac12a8ad4cd7cf08125b67c9c1a72efab3c73fe9270687b7f10f3a594a4b789e03dd7ffb3b6350dde0280e85df41d9634d26c8686013d49ae4fcb8c456b876af55f4d18b9bdb8935c4b30a7129e3bd776e4c1accc0a95a11b27b786984368989438deea6b22eb6881944dc700357d1367845d9fa20bf2cc0893c72c080bca4dfbb90ae725297a01a08000dd4c7b5ce707b46675657c3c3a9b08bfb7a85732e9fb386f270d381dbb6039421286a79419f58181d8f15927a782297342f00393c492b83f6f830e2388802c4653e41703ce5ed84e8f6a800d213a36763d39ede3079b04101c5577d6d5ae97a7bb225543bc860be7a7476c41ae7fbadc1b811c3783fa6a11445950b2a05cae74808c19433f02ee39d3e1cbafc366e813129df0e8e097858144d1bdcc926ac2978e4e72f097bee562e21b8db59c66e1d43cc7691193036efcc0da1dfedc0bcac2d2418643385114de7e3c592a0a7976388271129f4092dfa7e54fae057a91713e82f6e17d673e0221782ded9c3f7413871ee1bf0e87b73fc99cca64b52eed094277e430743f484f3475b68ee57258f375aba6f6cad6a6656243a04dd4920d8c94098ea748aed043d64aa363dd5891f4ffcdc8d4cfc21f52265ba695c6f4b58ec63e4aecbd849bb4db37b9686c1aa7c8e495d35514674b1740fc276e5a56dd7c2ccee9fbe5216213b0ee43356d08dcbf5740b41a819da2278d16a3218b6e7e2a1a1180dbc5129466e77cc3db280157124f4a0599915516788a5580dfbcfe187d696601f2bf287190d003b2076ee13d1d1ee67c0277082bb2bac2cb311868716932cf57a0bcc489280cae92421fbb866e067ed636670ef65ecf793f66e4fed7f666baa7288f3b5a04cf5222c3ac98ebf9ecbd92e987110cf58c02b604ec4ff6aa20"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x58c}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000540)={0x0, 0xe8}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) syz_genetlink_get_family_id$tipc2(&(0x7f00000008c0), r0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 2m47.73802963s ago: executing program 5 (id=126): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x200001, &(0x7f0000000200), 0x2, 0xb80, &(0x7f0000000240)="$eJzs3M1rVFcbAPDn3nwYNb6JL/LyWkoNtGChOBrFSl2py9ZFof0DDHEiIdcPkhRMcBHbhXRVC910UWgXpX9AoetstNBV6aaVFrqXShHdp9zJnWQwM0mqMx4/fj84c8/HZM7z5JK555C5E8BLa6x8yCP2R8S5LGKk6s8jYrBRG4pYWn3eg/vXJh/evzaZxcrKB39nkVV9zdfKquPuqjEUEb+cyeK/n2ycd25hcWaiKOqzVfvw/MUrh+cWFg9NX5y4UL9QvzR+YvzY8RPHjr99pGu5vrv35tmvxk/t+f7Mrauv3fj9yyxOxXA11ppHt4zFWKxUWvv7I2Ki25Ml0lflk7X0Zf0JAwIAYFN5yxrufzESfbG+eBuJW78mDQ4AAADoipW+WPsfFQAAAPCiyuz/AQAA4AXX/BzAg/vXJpsl7ScSnq57pyNitF3+/bHUOA7FQETsepBF622t2eqPPbGxiNj30+iPZYke3Ye8maXrEfH/dvlnjfxHG3dxb8w/j4hu3Jk99kj7ecr/VBfmT50/AC+n5dOrF7KN1798bf0Tba5//W2uXY8j9fWv8/pvPf++Duu/97c5R/3Ap593Gmtd/xXfvnq7nL88PlFS/8K96xGv9Hde/5T5Zx3yP7fNOQb++PmHTmNl/mW+zfK081/5JuJg2/3P+jfaZJt/P9HhqemiXj22nePG7e/2dZq/9fyXpZy/uRd4Gsrzv6tD/lud/yvbnGP5r4N/dhrbOv/87mD2YaM2WPVcnZifnx2PGMzObuw/unkszec0X6PM/83XN//7b5d/+Z6wVP0eyr3A9epYtj9+ZM5D773zxuPn31tl/ucf8/zf3OYcX382e7fTWOr8AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+5BExHFleW6vnea0WsTsi9sWuvLg8N//W1OWPLp0vxyJGYyCfmi7qRyJiZLWdle3xRn29ffSR9rGI2BsRX4zsbLRrk5eL86mTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYM3uiBiOLK9FRB4RD0fyvFZLHRUAAADQdaOpAwAAAAB6zv4fAAAAXnz2/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPTY3gPLd7KIWDq5s1FKg9XYQNLIgF7LUwcAJNOXOgAgmf7UAQDJ2OMD2RbjQx1HdnQ9FgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACeXQf3L9/JImLp5M5GKQ1WYwNJIwN6LU8dAJBMX+oAgGT6UwcAJGOPD2RbjA91HNnR9VgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHYNN0qW1yIib9TzvFaL2BMRozGQTU0X9SMR8Z+I+G1kYEfZHk8dNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF03t7A4M1EU9VkVFRWVtUrqdyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFKYW1icmSiK+uxc6kgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA1OYWFmcmiqI+28NK6hwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEjnnwAAAP///JMJmQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000dc0)='.\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x41009432, 0x0) 2m46.324201004s ago: executing program 5 (id=131): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f0000000340)={[{@init_itable}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x88}}, {@resuid}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@lazytime}, {@usrquota}, {@data_err_abort}, {@data_err_abort}]}, 0x1, 0x5d8, &(0x7f0000001200)="$eJzs3c9vVEUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aAAleTIwXY0w8eRD/CyVy5aQnD148GRKihqOJa952H3Tbty0tbV/lfT7JdufN7MvMY/l2ZqczbwOorMHsRy1id0RMp4j+dGXpCwbnn+7+/cnJ7JGiXn/jzxSpmZe/NDWf+7IfnRE9EfHzTyl2dSytd2bu0tnxqanJi83j4dlz08Mzc5f2nzk3fnry9OT50ZdGjxw+dPjIyIE1Xdflgrzj197/sP+zsbe/++afNPL9b2MpjsarzRcuvI71MhiDjX+TtLSo78h6V1aSjvm3Oha+xamzxAaxKvn71xURT0V/dMT9N68/Pn2t1MYBG6qeIupARSXxDxWVjwPyz/aLPwfXShmVAJvhzrH5CYCl8d85PzcYPY25ge13Uyyc1kkRsbaZuVY7IuLWzbFrp26OXYsNmocDil25GhFPF8V/asT/QPTEQCP+ay3xn40LTjSfs/zX11j/4qli8Q+bZz7+e5aN/2gT/+8siP9311j/4P3ke70t8d+71ksCAAAAAACAyrpxLCJeLPr7f+3e+p8oWP/TFxFH16H+wUXHS//+X7u9DtUABe4ci3ilcP1vLV/9O9DRTD3WWA/QlU6dmZo8EBGPR8S+6NqWHY8sU8f+z3d93a5ssLn+L39k9d9qrgVstuN257bWcybGZ8cf9rqBiDtXI54pXP+b7vX/qaD/z34fTD9gHbuev36iXdnK8Q9slPq3EXsL+//7d61Iy9+fY7gxHhjORwVLPfvxFz+0q3+t8e8WE/Dwsv5/+/LxP5AW3q9nZvV1HJzrrLcrW+v4vzu92bjlTHcz76Px2dmLIxHd6XhHltuSP7r6NsOjKI+HPF6y+N/33PLzf0Xj/96IWHSnsEh/te4pzj35b9/v7dpj/A/lyeJ/YlX9/+oTo9cHfmxX/4P1/4caff2+Zo75P5j3VR6m3a35BeHYWVS02e0FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEdBLSJ2RKoN3UvXakNDEX0R8URsr01dmJl94dSFD85PZGWN7/+v5d/02z9/nPLv/x9YcDy66PhgROyMiC87ehvHQycvTE2UffEAAAAAAAAAAAAAAAAAAACwRfS12f+f+aOj7NYBG66z7AYApSmI/1/KaAew+fT/UF3iH6pL/EN1iX+oLvEP1SX+obrEP1SX+AcAAAAAgEfKzj03fk0RceXl3sYj090s6yq1ZcBGq5XdAKA0bvED1WXpD1SXz/hAWqG8p+1JK525nOmTD3EyAAAAAAAAAAAAAFTO3t32/0NV2f8P1WX/P1RXvv9/T8ntADafz/hArLCTv3D//4pnAQAAAAAAAAAAAADraWbu0tnxqanJixJvbY1mbGaiXq9fzv4XbJX2/M8T+VL4rdKeRYl8r9+DnVXe7yQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDVfwEAAP//tsck3w==") syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e040a0404"], 0x7) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_buf(r0, 0x6, 0x21, &(0x7f00000009c0)="adbcc72ca6d732549f13db1a0206c4583a651644a810e3241e5547ad229e6b5c", 0x20) getsockopt$inet6_tcp_buf(r0, 0x6, 0x21, 0x0, &(0x7f0000000a00)) mount(0x0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000180)={0xf0f017, 0x3}) 2m45.363200462s ago: executing program 5 (id=144): capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000007c0)={0x200000, 0x200000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/dummy0/carrier\x00', 0x8001, 0x0) write(r0, &(0x7f0000000180)='1', 0x1) syz_clone(0x1b4a100, 0x0, 0x0, 0x0, 0x0, 0x0) 2m45.198664198s ago: executing program 5 (id=147): syz_emit_ethernet(0x2a, &(0x7f0000000440)={@link_local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x2, 0x0, 0xfe, 0x11, 0x0, @local, @multicast1}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 2m29.917239875s ago: executing program 33 (id=147): syz_emit_ethernet(0x2a, &(0x7f0000000440)={@link_local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x2, 0x0, 0xfe, 0x11, 0x0, @local, @multicast1}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 13.271585858s ago: executing program 0 (id=853): socket(0x10, 0x80002, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251ef60a84c9f4d4930f0000004509c5bb0000000000001da2b2ae3ae74cc4e8c3c811", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 11.500352918s ago: executing program 0 (id=856): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x3000000, &(0x7f00000000c0)={[{@grpid}]}, 0x1, 0x521, &(0x7f00000001c0)="$eJzs3d9rZFcdAPDvvcmkyW5qpiqyFmyLrewW3ZmksRpF2gqiTwW1vq8xmYSQSSZkJnUTiqb4BwgiKvgH+CL44KMg/RNEWNB3UVFEd/VR98qdudH8mEnGZJJZJ58PnMw598f5nnPJ3Lk/DvcGcG29EBFvRMRYRLwcETPF9LRIsd9J+XKPHr6zlKcksuytvyaRFNMO6srL4xFxs1htMiK++qWIbyQn4zZ399YX6/XadlGutja2qs3dvbtrG4urtdXa5vz83M8j4tWF2axwoX6WI+K1L/zxB9/9yRdf++Unvvm7e3++8628WZ/7UKfdEbF0oQA9dOoutbfFgXwbbV9GsCHJ+1MaG3YrAADoR36M//6I+Gj7+H8mxtpHcwAAAMAoyV6fjn8mERkAAAAwstKImI4krRRjAaYjTSuVzhjeD8aNtN5otj6+0tjZXM7nRZSjlK6s1WuzxVjhcpSSvDxXjLE9KL9yrDwfEc9ExPdnptrlylKjvjzsix8AAABwTdx8/uj5/z9m0nYeAAAAGDHlngUAAABgVDjlBwAAgNHn/B8AAABG2pfffDNP2cF7vJff3t1Zb7x9d7nWXK9s7CxVlhrbW5XVRmO1/cy+jbPqqzcaW5+MzZ371Vat2ao2d/fubTR2Nlv31o68AhsAAAC4Qs88/95vk4jY/+xUO0XxHECAI/4w7AYAgzQ27AYAQzM+7AYAQ1M6cwl7CBh1yRnzTw7e6VwrjF9dTnsAAIDBu/3hk/f/J4p5Z18bAP6fGesDANfP0bt7U0NrB3D1SucdAXhr0C0BhuV9nY+nes3v+fCOPu7/d64xZNm5GgYAAAzMdDslaaU4Tp+ONK1UIp6Ox1k5SsnKWr02W5wf/Gam9FRenmuvmZw5ZhgAAAAAAAAAAAAAAAAAAAAAAAAA6MiyJDIAAABgpEWkf0raT/OPuD3z0vTRqwPH3vr147d+eH+x1dqei5hI/jaTT5qIiNaPiumvZF4JAAAAAMM1lf/pnKcXn3PDbhIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo+bRw3eWDtJVxv3L5yOi3C3+eEy2PyejFBE3/p7E+KH1kogYG0D8/Xcj4la3+Ek8zrKsXLSiW/ypS45fbm+a7vHTiLg5gPhwnb2X73/e6Pb9S+OF9mf37994kS6q9/4v/c/+b6zH/ufpY+Venn3ws2rP+O9GPDveff9zED/pxD8SIi+82Gcfv/61vb2uMw5V2S3+4VjV1sZWtbm7d3dtY3G1tlrbnJ+f+9TCpxdeXZitrqzVa8XfrmG+95FfPD6t/zd6xC8f7f+J7f9SX73P4l8P7j/8QKdQ6hb/zovdf39v9YifFr99Hyvy+fzbB/n9Tv6w53766+dO6/9yj/5PntH/O331Pz7z8le+8/uuc05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERet5/WBtudJyMTZy0w+IU29jEz27c7/48XqueDqJzLZRVYfjwE0Y+LE93QszlthErGf19XnPyQAADBi/nvQf9odJAAAAAAAAAAAAAAAAAAAAOAynfOxZJMR0ffCx2PuD6erAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACn+ncAAAD//+8b0g8=") openat(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0x0, 0x1a1) socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000780)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'syz_tun\x00', 0x1}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000800), 0x12) listen(r1, 0x5) write$tun(0xffffffffffffffff, &(0x7f0000000840)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(0xffffffffffffffff, &(0x7f0000000880)=ANY=[@ANYBLOB="00000805001001", @ANYRES32], 0xa) 9.90697028s ago: executing program 0 (id=863): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x204001, &(0x7f0000000180), 0x1, 0xbb0, &(0x7f0000002000)="$eJzs3M1vVFUbAPDn3k6/aF9a3rx5FWJiE4MajUOhBBNW4NqoiSxcUtspaTp82NbENiwK7tWFMS5IDH+CiXvZuDJxgQvFv4AYiSG6ARZj7nyUkekMpczMhfL7JWfuOXNm7vM8c2HuucncBvDMmsoe0oj9EXE6iZioP59GxFC1NxKxUXvd3dsX57KWRKXy/p9JJBFx5/bFuca+kvp2rD4YiYjrbyXx309b466srS/Nlsul5fr40OrZC4dW1tbfWDw7e6Z0pnTu6MybR2eOzcx0sdabFz78+oWf33n58tXPpt/9au+PSZyI8fpccx3dMhVTm59JZrC+LUTEbLeD5WSgXk9znUkhx4QAAOgobVrD/T8mYiDuL94m4odfck0OAAAA6IrKQEQFAAAA2OUS1/8AAACwyzV+B3Dn9sW5Rsv3Fwn9detkREzW6m/c31ybKcRGdTtSvW93z19JNN/WmtTe9timskjf/VTKWvToPuRONi5FxPNbHf+kWv9k9S7u1vrTiJjuQvypB8ZPU/0nuhA/7/oBeDZdO1k7kbWe/9LN9U9scf4rbHHu2om8z3+N9d/dlvXf/foH2qz/3ttmjAP3Xrvebq55/ffB57/NZ/Gz7WMV9QhuXYo4UNiq/mSz/qRN/ae3GWNs7uaVdnNZ/Vm9jdbv+itXIw5WV3Ot9Tcknf4+0aGFxXJpuva4xf7XjnWO33z8s5bFb1wL9EN2/PfEzo7/hW3GmHzuj/3t5h5ef/r7UHKq2huqP/PJ7Orq8uGIoeTt1uePdM6l8ZrGPrL6X32p8///rerPvhM26p9D9q/nUn2bjS8/EHPs4JFvd15/b2X1z+/w+H+xzRjffH/lo3ZzedcPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNMhjYjxSNLiZj9Ni8WIsYj4X+xJy+dXVl9fOP/xuflsLmIyBtOFxXJpOiImauMkGx+u9u+PjzwwnomIfRHx5cRodVycO1+ez7t4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANo1FxHgkaTEi0oj4eyJNi8W8swIAAAC6bjLvBAAAAICec/0PAAAAu1/L9X/hX6ORfuYCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADArrTvxWs3kojYOD5abZmh+txgrpkBvZbu+J2VSlcTAfpuIO8EgNwUmvqVinM6PEtc4wPJQ+ZH2s4Mdz0XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ5cr+y/diOJiI3jo9WWGarPDeaaGdBrad4JALkZ6DSZ9C8PoP8KeScA5MY1PlBb6t+r1LTOj7R95/AjRGm/FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACeDuPVlqTFiEir/TQtFiP+ExGTMZgsLJZL0xGxNyJ+nRgczsaH804aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACArltZW1+aLZdLyzo77dw7FfEEpKHzZHVGo+chhntZRd7fTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5GFlbX1ptlwuLa/knQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQt5W19aXZcrm03MNO3jUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCffwIAAP//ZLcP0g==") mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002bc0)={0x8, 0x8b}, 0x0) r0 = getpid() openat$vimc1(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000002c40)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002c80)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000002cc0)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) recvmmsg(r1, &(0x7f0000002d80), 0x10106, 0x2, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfecc) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) mount(0x0, &(0x7f0000002e40)='.\x00', 0x0, 0x2390024, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x280440e, &(0x7f0000000440)={[{@debug}, {@test_dummy_encryption_v1}, {@quota}, {@user_xattr}, {@noinit_itable}, {@norecovery}, {@minixdf}, {@nodioread_nolock}, {@errors_remount}, {@nodelalloc}, {@usrquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8}}]}, 0x1, 0xbdb, &(0x7f0000001000)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2440, 0x0) 8.548674689s ago: executing program 4 (id=868): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20000010) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000380)=0x100000001, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000003c0), 0x3) writev(0xffffffffffffffff, &(0x7f0000000400)=[{0x0}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000004c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000500)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000580)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000640), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x2d64, 0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x2, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0}, 0x20) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000800)={0x43, 0x0, 0x3, 0x3}, 0x10) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0x6, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="6a0afaff270f0000bfa200000000000007020000f0ffffffb70300000a000000b7040000ffffffffb70500000000000085000000550000001500020000000000bf01000000000000850000008b00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4f, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="2e00000010008188e6b62aa73f72cc9f0ba1f848340000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) 7.233284723s ago: executing program 4 (id=873): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x3000000, &(0x7f00000000c0)={[{@grpid}]}, 0x1, 0x521, &(0x7f00000001c0)="$eJzs3d9rZFcdAPDvvcmkyW5qpiqyFmyLrewW3ZmksRpF2gqiTwW1vq8xmYSQSSZkJnUTiqb4BwgiKvgH+CL44KMg/RNEWNB3UVFEd/VR98qdudH8mEnGZJJZJ58PnMw598f5nnPJ3Lk/DvcGcG29EBFvRMRYRLwcETPF9LRIsd9J+XKPHr6zlKcksuytvyaRFNMO6srL4xFxs1htMiK++qWIbyQn4zZ399YX6/XadlGutja2qs3dvbtrG4urtdXa5vz83M8j4tWF2axwoX6WI+K1L/zxB9/9yRdf++Unvvm7e3++8628WZ/7UKfdEbF0oQA9dOoutbfFgXwbbV9GsCHJ+1MaG3YrAADoR36M//6I+Gj7+H8mxtpHcwAAAMAoyV6fjn8mERkAAAAwstKImI4krRRjAaYjTSuVzhjeD8aNtN5otj6+0tjZXM7nRZSjlK6s1WuzxVjhcpSSvDxXjLE9KL9yrDwfEc9ExPdnptrlylKjvjzsix8AAABwTdx8/uj5/z9m0nYeAAAAGDHlngUAAABgVDjlBwAAgNHn/B8AAABG2pfffDNP2cF7vJff3t1Zb7x9d7nWXK9s7CxVlhrbW5XVRmO1/cy+jbPqqzcaW5+MzZ371Vat2ao2d/fubTR2Nlv31o68AhsAAAC4Qs88/95vk4jY/+xUO0XxHECAI/4w7AYAgzQ27AYAQzM+7AYAQ1M6cwl7CBh1yRnzTw7e6VwrjF9dTnsAAIDBu/3hk/f/J4p5Z18bAP6fGesDANfP0bt7U0NrB3D1SucdAXhr0C0BhuV9nY+nes3v+fCOPu7/d64xZNm5GgYAAAzMdDslaaU4Tp+ONK1UIp6Ox1k5SsnKWr02W5wf/Gam9FRenmuvmZw5ZhgAAAAAAAAAAAAAAAAAAAAAAAAA6MiyJDIAAABgpEWkf0raT/OPuD3z0vTRqwPH3vr147d+eH+x1dqei5hI/jaTT5qIiNaPiumvZF4JAAAAAMM1lf/pnKcXn3PDbhIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo+bRw3eWDtJVxv3L5yOi3C3+eEy2PyejFBE3/p7E+KH1kogYG0D8/Xcj4la3+Ek8zrKsXLSiW/ypS45fbm+a7vHTiLg5gPhwnb2X73/e6Pb9S+OF9mf37994kS6q9/4v/c/+b6zH/ufpY+Venn3ws2rP+O9GPDveff9zED/pxD8SIi+82Gcfv/61vb2uMw5V2S3+4VjV1sZWtbm7d3dtY3G1tlrbnJ+f+9TCpxdeXZitrqzVa8XfrmG+95FfPD6t/zd6xC8f7f+J7f9SX73P4l8P7j/8QKdQ6hb/zovdf39v9YifFr99Hyvy+fzbB/n9Tv6w53766+dO6/9yj/5PntH/O331Pz7z8le+8/uuc05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERet5/WBtudJyMTZy0w+IU29jEz27c7/48XqueDqJzLZRVYfjwE0Y+LE93QszlthErGf19XnPyQAADBi/nvQf9odJAAAAAAAAAAAAAAAAAAAAOAynfOxZJMR0ffCx2PuD6erAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACn+ncAAAD//+8b0g8=") openat(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0x0, 0x1a1) socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000780)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'syz_tun\x00', 0x1}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000800), 0x12) listen(r1, 0x5) write$tun(0xffffffffffffffff, &(0x7f0000000840)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(0xffffffffffffffff, &(0x7f0000000880)=ANY=[@ANYBLOB="00000805001001", @ANYRES32], 0xa) 5.439204566s ago: executing program 1 (id=876): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x7}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x8040) 5.139581836s ago: executing program 0 (id=877): setns(0xc9, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(r0, 0x8b0f, &(0x7f0000000100)={'wlan1\x00', @random="01000300ffff"}) 5.044687436s ago: executing program 0 (id=878): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) socket$igmp(0x2, 0x3, 0x2) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0xffffffffffffffff) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000340), 0x10106, 0x2, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) socket(0x1e, 0x80004, 0x0) bind$tipc(r3, &(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f00000003c0)={0x43, 0x0, 0x3, 0x3}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x1d, 0x80802, 0x6) mount$9p_fd(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x84, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x400000000000003, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f041}) syz_open_dev$vim2m(&(0x7f0000000080), 0x7fffffffffffffff, 0x2) sendmsg$tipc(r3, &(0x7f0000000400)={&(0x7f0000000480), 0x10, 0x0}, 0x0) 5.044279566s ago: executing program 1 (id=879): ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file0\x00'}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="210000000000000aba8f00000000002900000000040200", @ANYRES32=r0, @ANYBLOB="02384d0400"/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="01000000030000000400"/28], 0x50) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d93452a92954b4337000000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb0000000000", 0xd8}], 0x1}, 0x4000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x4, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="660a00000000000061117b0000000000850000001e00000095"], &(0x7f0000000380)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r1}, 0x38) openat(r0, &(0x7f00000003c0)='./file0\x00', 0x2, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000004c0)=@filter={'filter\x00', 0xe, 0x4, 0x398, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x1, 0xa, 0x10, 0x10, 0x10, 0x2710, 0xea60}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./proc\x00', &(0x7f0000000a80)='proc\x00', 0x1000004, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./proc/net/ip6t_hashlimit/lo\x00', 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000b00)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 4.974974323s ago: executing program 3 (id=880): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) socket$igmp(0x2, 0x3, 0x2) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0xffffffffffffffff) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000340), 0x10106, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) socket(0x1e, 0x80004, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000003c0)={0x43, 0x0, 0x3, 0x3}, 0x10) socket(0x1d, 0x80802, 0x6) mount$9p_fd(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x84, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x400000000000003, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f041}) syz_open_dev$vim2m(&(0x7f0000000080), 0x7fffffffffffffff, 0x2) sendmsg$tipc(r4, &(0x7f0000000400)={&(0x7f0000000480), 0x10, 0x0}, 0x0) 4.922164479s ago: executing program 4 (id=881): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000100)={'/dev/md', @num=0x0}, 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000140)={0x10000000, 0x0, 0x0, 0x0, 0x4, 0x803, 0x0, 0x4, 0x0, 0x0, 0x0, 0x21}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000013a00)={0x16, {0x1, 0x0}, 0xfffffffd, 0x20c}) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) 4.126882819s ago: executing program 1 (id=882): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./bus\x00', 0x14552, &(0x7f0000000100)=ANY=[], 0x7b, 0x11ff, &(0x7f0000001980)="$eJzs3E+LHEUYB+B315iNG/ePGqMJiIVe9NJk9+BFL4tsQDKgJFkhEYSO26vDtDPD9LAwIkZPXv0cIojgTRBvetmL30DwthePEcSWndEko5PDSEiH5Xku80LVb6jqphuq6erD1774sLNXZXv5MBYXFmKxH5FupUixGP/4NF5+9cefnrty7fqlrVZr+3JKF7eubrySUlp9/vt3Pv7qhR+Gp9/+dvW7pThYf/fwt81fD84enDv88+oH7Sq1q9TtDVOebvR6w/xGWaTddtXJUnqrLPKqSO1uVQym2vfKXr8/Snl3d2W5PyiqKuXdUeoUozTspeFglPL383Y3ZVmWVpaD+Z24Xe18eauu64i6fjRORl3X9WOxHKfj8ViJ1ViL9Xginoyn4kw8HWfjmXg2vvnl69FRAgAAAAAAAAAAAAAAAAAAALh/5t3/f27cq+lRAwAAAAAAAAAAAAAAAAAAwPFy5dr1S1ut1vbllE5FlJ/v7+zvTH4n7Vt70Y4yirgQa/FHjHf/T0zqi2+0ti+ksfX4rLz5d/7m/s4j0/mN8ecEZuY3Jvk0nV+K5bvzm7EWZ2bnN2fmT8VLL96Vz2Itfn4velHGbhxl7+Q/2Ujp9Tdb/8qfH/cDAACA4yBLt81cv2fZvdon+TmeD0ytr4+y5080OnUiohp91MnLshgoHvriZLPD+L2u6+YPQkPFva+UpYj43/+8EBEPxwT/UzR9Z+JBuHPSmx4JAAAAAAAAAAAA83gQrxM2PUcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+YgeOBQAAAACE+Vun0bEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwVAAD//+pd0x0=") r0 = openat(0xffffffffffffff9c, &(0x7f0000002b80)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000002cc0)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000002d00)="c7", 0x1) sendfile(r1, r0, 0x0, 0x2fffe) write$tun(r1, &(0x7f0000002d40)={@void, @void, @x25={0x1, 0x3, 0x27, "3464f71442760e89b7c8798746f0303a4b235ce63f7741dd32344bbdd5666c107ec96e96644b0bcd723a6e87c1b9fdf23b50c12189898cfdea1a8245f24a52a7231d19d5df9c5ed938fde337846a9e280d1643b9aa9ef2cde39c46326dc2f6e48db778483b1a0c5cbc841ae024b4e7ccbffdec4f056120e96d6fffcfe406fd8890c9102b67e1ae3ba08f2aa7c12be4b3fd84dff0c693b022a2fedb93b865358780ca7be93671cb7f9cd659f7648499e45f1c9f93772453e18f94f2d16ecac1805be794e2bf9cf6eefb79f0d6ca3f6ca1544cf67aeeec69f775d4cd7065b3436879addd1eeba38d67cebb5170e6c6d4d1b5e40a64d980cfc93efae61f6af48f7440074f573e538dde306920efaa581f4547c8f5fb9b19f96c412117c321cd2a03e919df49302b9d04ad5d17ba265dd11bcf058104eded4ed7572c37d1813dfbecbd7df5b4f0143b0ed98fa40a7151a336ed1580d91d68b297b9c18be7fd6a52ae8c105d119a7182ee8b6d723ad6db821a2a8a8910011effbafd594725fc759df6dc52377641f434d1c0b1053ae0dfb7789e8be776146a170c57dffe8f52af4c087a1a6837ba58091ef3e12442e46a0ea31773b43a7e481e526f76516488b5002931142dd6305281ba9f8efff94f16caef05f1ee1925bff7c4ae57e498c65410ccee472dc56196c125ef2e874cefbc55b6d41cf4119d2b1ef3ef7b6ea6c1"}}, 0x200) 4.12663684s ago: executing program 6 (id=883): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20000010) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000380)=0x100000001, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000003c0), 0x3) writev(0xffffffffffffffff, &(0x7f0000000400)=[{0x0}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000004c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000500)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000580)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000640), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x2d64, 0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x2, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0}, 0x20) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000800)={0x43, 0x0, 0x3, 0x3}, 0x10) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0x6, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0}, 0x20) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="2e00000010008188e6b62aa73f72cc9f0ba1f848340000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) 3.896342893s ago: executing program 3 (id=884): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000180), 0x651, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x10106, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000001280)=""/4090, &(0x7f0000002280)=0xffa) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323900080003400000000720000480060001000002000005000200110000000c000300080001000000001e14000000110001"], 0xcd0}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001240)={0x1c, 0x15, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}]}, 0x1c}}, 0x10) 1.753248331s ago: executing program 6 (id=885): inotify_add_watch(0xffffffffffffffff, 0x0, 0x400008bf) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8b}, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000001800)="75bf28b757496bd20e81e32fdf5d97c07a511d3a8ea67b60a82f7b803eef6844f89fb449ea36b94cf28f96631630a74b8526b6699676ea8807f29512f7e3ea9470f00373b2e525b7af6810f3877e4428359633b6fa3e7b4af18cde1da834821d7c0f8acf11101f4c9e70ee30c47c2184c9bdb96ceeafbb940aa4de39d2ab8c469330e8a79fe7e7b5d464ce56f005213f5b844833549a7f817657f0304f926a3a376784103bdd028a3cfe3ab0edcb4137c7c6491c4d15a4fbb8bf710bdb88d1be2fb208288f3bf771c6b43c95caeeba0e5d4b126d3f3d3480ad8d8af5aefdf4caf8e1527f68c85233", 0xe8, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff08"], 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f0000000280)=@xdp, 0x80, &(0x7f0000001780)}, 0x0) 1.620136425s ago: executing program 4 (id=886): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x1a, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2d, 0xa000, {0x0, 0x0, 0x0, r3, {0x4, 0x10}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}]}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x10) 1.439783403s ago: executing program 6 (id=887): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_mr_cache\x00') pread64(r0, &(0x7f0000000080)=""/253, 0xfd, 0x0) 1.396304287s ago: executing program 3 (id=888): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000880)='devtmpfs\x00', 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x987a3a9f32358a4c) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRES8], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 1.331679224s ago: executing program 6 (id=889): mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/node/node0/cpulist\x00', 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000180)="290000002000190f00003fffffffda0602000000ffe80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) 1.301189047s ago: executing program 3 (id=890): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x7}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x8040) 1.300445807s ago: executing program 1 (id=900): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000001300020000000900010073797a300000000058000000120a01040000000000000000020000000900010073797a30000000000900020073797a30130000000800030000000004240004800c00010000000000000000010c0002"], 0xbc}, 0x1, 0x0, 0x0, 0x40000811}, 0x0) 1.294127078s ago: executing program 4 (id=891): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x3000000, &(0x7f00000000c0)={[{@grpid}]}, 0x1, 0x521, &(0x7f00000001c0)="$eJzs3d9rZFcdAPDvvcmkyW5qpiqyFmyLrewW3ZmksRpF2gqiTwW1vq8xmYSQSSZkJnUTiqb4BwgiKvgH+CL44KMg/RNEWNB3UVFEd/VR98qdudH8mEnGZJJZJ58PnMw598f5nnPJ3Lk/DvcGcG29EBFvRMRYRLwcETPF9LRIsd9J+XKPHr6zlKcksuytvyaRFNMO6srL4xFxs1htMiK++qWIbyQn4zZ399YX6/XadlGutja2qs3dvbtrG4urtdXa5vz83M8j4tWF2axwoX6WI+K1L/zxB9/9yRdf++Unvvm7e3++8628WZ/7UKfdEbF0oQA9dOoutbfFgXwbbV9GsCHJ+1MaG3YrAADoR36M//6I+Gj7+H8mxtpHcwAAAMAoyV6fjn8mERkAAAAwstKImI4krRRjAaYjTSuVzhjeD8aNtN5otj6+0tjZXM7nRZSjlK6s1WuzxVjhcpSSvDxXjLE9KL9yrDwfEc9ExPdnptrlylKjvjzsix8AAABwTdx8/uj5/z9m0nYeAAAAGDHlngUAAABgVDjlBwAAgNHn/B8AAABG2pfffDNP2cF7vJff3t1Zb7x9d7nWXK9s7CxVlhrbW5XVRmO1/cy+jbPqqzcaW5+MzZ371Vat2ao2d/fubTR2Nlv31o68AhsAAAC4Qs88/95vk4jY/+xUO0XxHECAI/4w7AYAgzQ27AYAQzM+7AYAQ1M6cwl7CBh1yRnzTw7e6VwrjF9dTnsAAIDBu/3hk/f/J4p5Z18bAP6fGesDANfP0bt7U0NrB3D1SucdAXhr0C0BhuV9nY+nes3v+fCOPu7/d64xZNm5GgYAAAzMdDslaaU4Tp+ONK1UIp6Ox1k5SsnKWr02W5wf/Gam9FRenmuvmZw5ZhgAAAAAAAAAAAAAAAAAAAAAAAAA6MiyJDIAAABgpEWkf0raT/OPuD3z0vTRqwPH3vr147d+eH+x1dqei5hI/jaTT5qIiNaPiumvZF4JAAAAAMM1lf/pnKcXn3PDbhIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo+bRw3eWDtJVxv3L5yOi3C3+eEy2PyejFBE3/p7E+KH1kogYG0D8/Xcj4la3+Ek8zrKsXLSiW/ypS45fbm+a7vHTiLg5gPhwnb2X73/e6Pb9S+OF9mf37994kS6q9/4v/c/+b6zH/ufpY+Venn3ws2rP+O9GPDveff9zED/pxD8SIi+82Gcfv/61vb2uMw5V2S3+4VjV1sZWtbm7d3dtY3G1tlrbnJ+f+9TCpxdeXZitrqzVa8XfrmG+95FfPD6t/zd6xC8f7f+J7f9SX73P4l8P7j/8QKdQ6hb/zovdf39v9YifFr99Hyvy+fzbB/n9Tv6w53766+dO6/9yj/5PntH/O331Pz7z8le+8/uuc05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERet5/WBtudJyMTZy0w+IU29jEz27c7/48XqueDqJzLZRVYfjwE0Y+LE93QszlthErGf19XnPyQAADBi/nvQf9odJAAAAAAAAAAAAAAAAAAAAOAynfOxZJMR0ffCx2PuD6erAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACn+ncAAAD//+8b0g8=") openat(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0x0, 0x1a1) socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000780)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'syz_tun\x00', 0x1}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000800), 0x12) listen(r1, 0x5) write$tun(0xffffffffffffffff, &(0x7f0000000840)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(0xffffffffffffffff, &(0x7f0000000880)=ANY=[@ANYBLOB="00000805001001", @ANYRES32], 0xa) 1.195707058s ago: executing program 6 (id=892): ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file0\x00'}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="210000000000000aba8f00000000002900000000040200", @ANYRES32=r0, @ANYBLOB="02384d0400"/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="01000000030000000400"/28], 0x50) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d93452a92954b4337000000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb0000000000", 0xd8}], 0x1}, 0x4000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x4, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="660a00000000000061117b0000000000850000001e00000095"], &(0x7f0000000380)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r1}, 0x38) openat(r0, &(0x7f00000003c0)='./file0\x00', 0x2, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./proc\x00', &(0x7f0000000a80)='proc\x00', 0x1000004, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./proc/net/ip6t_hashlimit/lo\x00', 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 1.195215888s ago: executing program 3 (id=893): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000000)={[{@discard}, {@data_err_ignore}, {@init_itable}, {@nodelalloc}, {@abort}]}, 0xfe, 0x55b, &(0x7f0000000980)="$eJzs3c9vFFUcAPDvbFt+FaUkhKgH04SDGGRLW39g4gGPRokkesdNOzSkW5Z0t4RWEuEgFy+GmBgjifEP8O6R+A/4V5AoCTGk0YOXNbOdhaXdH6UsdGU/n2TgvXmzvHkz8328t283G8DQmsz+KES8GhHfJhGHWspGIy+c3Dhu/cG1uWxLol7/7K8kknxf8/gk/3s8z7wSEb99HXGisLXe6uraYqlcTpfz/FRt6fJUdXXt5MWl0kK6kF6amZ09/c7szPvvvbv1xXt31tY3z/3zw6d3Pjr9zbH173+5d/hWEmfiYF7W2o6ncL01MxmT+TUZizObDpzuQ2WDJNntE2BHRvI4H4usDzgUI3nUAy++ryKiDgypRPzDkGqOA5pz+67z4PqLN8u7/+HGBGhr+5ON90ZiX2NudGA9eWxmlF2JiT7Un9Xx65+3b2Vb9O99CICert+IiFOjo4/1fy9HS/+3c6e2cczmOvR/8PzcycY/b+1tM/4pPBz/RJvxz3ib2N2J3vFfuNeHajrKxn8ftB3/Ply0mhjJcy81xnxjyYWL5TTr27Ju8niM7c3y3dZzTq/frXcqax3/ZVtWf3MsmJ/HvdFN613zpVrpadrc6v6NiNd6jH+TNvc/ux7ntlnH0fT2653Kerf/2ar/HPFG2/v/aK6TdF+fnGo8D1PNp2Krv28e/b1T/bvd/uz+H+je/omkdb22+uR1/LTv37RT2WSSL5o+4fO/J/m8kd6T77taqtWWpyP2JJ9s3T/z6LXNfPP4rP3Hj7WP/27P//6I+GKb7b955GbHQwfh/s8/0f3vkKgnHYvufvzlj53q317/93YjdTzfs53+r8uZPpZ4mmsHAAAAAAAAg6YQEQcjKRQfpguFYnHj8x1H4kChXKnWTlyorFyaj8Z3ZSdirNBc6R5v+TzEdP552GZ+ZlN+NiIOR8R3I/sb+eJcpTy/240HAAAAAAAAAAAAAAAAAACAATHe4fv/mT9GdvvsgGfOT37D8OoZ//34pSdgIPn/H4aX+IfhJf5heIl/GF7iH4aX+IfhJf5heIl/AAAAAAAAAAAAAAAAAAAAAAAAAAAA6KtzZ89mW339wbW5LD9/ZXVlsXLl5HxaXSwurcwV5yrLl4sLlcpCOS3OVZZ6/XvlSuXy9EysXJ2qpUltqrq6dn6psnKpdv7iUmkhPZ+OPZdWAQAAAAAAAAAAAAAAAAAAwP9LdXVtsVQup8sSEjtKjA7GaUj0ObHbPRMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPPJfAAAA//9j0zaD") syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x1004000, &(0x7f0000000280)={[{@journal_async_commit}, {@data_err_ignore}, {@init_itable}, {@norecovery}, {@nolazytime}], [{@permit_directio}]}, 0x1, 0x582, &(0x7f00000003c0)="$eJzs3c9rG8ceAPDvynZ+Oe/FD0J47x2KoYempJFjuz9S6CE9ljY00N5TYSvGWLaCJYfYDTSBNpdeSiiU0kBp7733GPoP9K8ItIFQUpNSelFZeZXIsmQ7ihKJ6vOBlWd2R5qdXX3HM9oVCmBoTaYPuYj/RcQXScSxpm2jkW2c3Cq3+eDaXLokUat98FsSSbauUT7J/o5nmf9GxE+fRZzK7ay3sr6xVCiViqtZfqq6fHmqsr5xenG5sFBcKK7MzM6efW125s03Xt/55IPdtfXlC398/f6dd85+/uLmVz/8WbuVxLk4mm1rbsdTuN6cmYzJ7JiMxbmWgtM9qGyQJP3eAboyksX5WKR9wLEYyaK+WZfhBgy4TyKiBgypRPzDkGqMAxpz+13nwbV/3izv/ttbE6Cd7U+2PhuJQ/W50ZHNZNvMKD0SEz2oP63jx19v30qX6N3nEAB7un4jIs6Mjm7r//4dTf1f987so0xrHfo/eH7upOOfVw62Gf/kHo1/os34Z7xN7HZj7/jP3etBNR2l47+32o5/H120mhjJcv+qj/nGkkuLpWLat6Xd5MkYO3hpcWzXOs5u3q112tY8/kuXtP7GWDDbj3ujLR/Azxeqhe5bvN39GxH/32P8m7Q5/+nxuLDPOk4Ub7/Qadve7X+2at9FvNT2/D+e6yS7X5+cqr8f0scOF0oe3jzxc6f6+93+9Pwf2b39E0nz9drKk9fx7aG/ip22TSbZRdMnfP8fSD6spw9k664WqtXV6YgDyXs71888fm4j3yiftr/x8p36v3bv/8MR8dE+23/z+M2ORQfh/M83uq99nf8OiVrScdPddz/+plP9++v/Xq2nTmZr9tP/7bKn2xLdHjcAAAAAAAAYRLmIOBpJLv8oncvl81v3dxyPI7lSuVI9dam8tjIf9e/KTsRYrnH/w3jT/RDT2f2wjfxMS342Iv4TEV+OHK7n83Pl0ny/Gw8AAAAAAAAAAAAAAAAAAAADYjz7/n+0fP8/9ctIn3cOePZ2/uQ3MCz2jP9e/NITMJD8/4fhJf5heIl/GF7iH4aX+IfhJf5heIl/GF7iHwAAAAAAAAAAAAAAAAAAAAAAAAAAAHrqwvnz6VLbfHBtLs3PX1lfWypfOT1frCzll9fm8nPl1cv5hXJ5oVTMz5WXW58/1pIvlcuXp2di7epUtZhUpyrrGxeXy2sr1YuLy4WF4sVia3kAAAAAAAAAAAAAAAAAAAAgorK+sVQolYqrzyWx8vD51TU0id/v9HU3Rp/ydb7/NKLvx7A3iYfnB2I3epPod88EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI/9HQAA//9K3TA2") unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) 1.104214857s ago: executing program 1 (id=894): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x11, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYBLOB="0000000000000000b70500000000000085000000a800000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5534f000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340), 0x2000, 0x0) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24000048) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000500)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000580), 0x651, 0x0) recvmmsg(r3, &(0x7f00000005c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000600)=0x6) r5 = fsopen(&(0x7f0000000640)='tracefs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000680)='gid', &(0x7f00000006c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\x00\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc0) r6 = inotify_init1(0x800) mprotect(&(0x7f0000758000/0x1000)=nil, 0x1000, 0x2) inotify_add_watch(r6, &(0x7f0000000580)='./file0\x00', 0x460005b4) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r7, 0x40086602, &(0x7f00000003c0)) 344.156845ms ago: executing program 6 (id=895): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20000010) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000380)=0x100000001, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000003c0), 0x3) writev(0xffffffffffffffff, &(0x7f0000000400)=[{0x0}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000004c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000500)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000580)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000640), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x2d64, 0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x2, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0}, 0x20) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000800)={0x43, 0x0, 0x3, 0x3}, 0x10) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0x6, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0}, 0x20) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="2e00000010008188e6b62aa73f72cc9f0ba1f848340000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) 260.348603ms ago: executing program 1 (id=896): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000480)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b92a, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff2}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_RTT={0x8, 0x7, 0x8}, @TCA_CAKE_TARGET={0x8, 0x8, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c080) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000580)={'syzkaller0\x00', @multicast}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x141100, 0x0) close(r9) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000000140)={'syzkaller0\x00', @random="2b0100004ec6"}) 114.521638ms ago: executing program 3 (id=897): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, 0x0, 0x0, 0x20000850) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000004c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000005c0), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000600), 0x10106, 0x2, 0x0) bind$802154_dgram(r1, &(0x7f0000000680)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r1, &(0x7f00000006c0)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0103}}}, 0x14) sendmmsg(r1, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) 64.334373ms ago: executing program 4 (id=898): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000980)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000a00), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000a40), 0x10106, 0x2, 0x0) 0s ago: executing program 0 (id=899): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f00000002c0)={0x1, 0x7ff, 0x0, 0x10000000, 0x2, "fbe20c8a515d59d2476aa3068d94a8009b1b10", 0xde37, 0x4005}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x2) ioctl$TIOCGPTPEER(r0, 0x5441, 0x7fff) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000200)=0x11) read$FUSE(r1, &(0x7f0000000080)={0x2020}, 0xfffffe39) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1b) kernel console output (not intermixed with test programs): terfaces? [ 140.634337][ T5165] EXT4-fs error (device loop0): ext4_orphan_get:1436: comm syz.0.196: bad orphan inode 131083 [ 140.786801][ T4266] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 140.786893][ T5165] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,jqfmt=vfsv0,usrquota,,errors=continue. Quota mode: writeback. [ 140.795894][ T4266] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.795919][ T4266] usb 5-1: Product: syz [ 140.795935][ T4266] usb 5-1: Manufacturer: syz [ 140.795950][ T4266] usb 5-1: SerialNumber: syz [ 140.834398][ T4266] usb 5-1: config 0 descriptor?? [ 140.857401][ T5165] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 141.830543][ T5193] FAULT_INJECTION: forcing a failure. [ 141.830543][ T5193] name failslab, interval 1, probability 0, space 0, times 0 [ 141.865609][ T5193] CPU: 0 PID: 5193 Comm: syz.1.204 Not tainted syzkaller #0 [ 141.872957][ T5193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 141.883219][ T5193] Call Trace: [ 141.886524][ T5193] [ 141.889479][ T5193] dump_stack_lvl+0x188/0x250 [ 141.894200][ T5193] ? show_regs_print_info+0x20/0x20 [ 141.899450][ T5193] ? load_image+0x410/0x410 [ 141.903999][ T5193] ? __might_sleep+0xf0/0xf0 [ 141.908637][ T5193] ? __lock_acquire+0x7d40/0x7d40 [ 141.913702][ T5193] should_fail+0x383/0x4b0 [ 141.918162][ T5193] should_failslab+0x5/0x20 [ 141.922698][ T5193] slab_pre_alloc_hook+0x51/0xc0 [ 141.927680][ T5193] ? key_alloc+0x346/0x1030 [ 141.932222][ T5193] __kmalloc_track_caller+0x69/0x330 [ 141.937544][ T5193] ? key_alloc+0x346/0x1030 [ 141.942108][ T5193] kmemdup+0x22/0x50 [ 141.946043][ T5193] key_alloc+0x346/0x1030 [ 141.950426][ T5193] key_create_or_update+0x8a9/0xa50 [ 141.955671][ T5193] ? key_type_put+0x20/0x20 [ 141.960230][ T5193] ? __might_fault+0xb3/0x110 [ 141.964956][ T5193] __se_sys_add_key+0x34b/0x410 [ 141.969841][ T5193] ? __x64_sys_add_key+0xc0/0xc0 [ 141.974832][ T5193] ? lockdep_hardirqs_on+0x94/0x140 [ 141.980072][ T5193] ? __x64_sys_add_key+0x1c/0xc0 [ 141.985045][ T5193] do_syscall_64+0x4c/0xa0 [ 141.989493][ T5193] ? clear_bhb_loop+0x30/0x80 [ 141.994203][ T5193] ? clear_bhb_loop+0x30/0x80 [ 141.998925][ T5193] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 142.004855][ T5193] RIP: 0033:0x7f8719c89b19 [ 142.009312][ T5193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.028976][ T5193] RSP: 002b:00007f8717ee0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 142.037439][ T5193] RAX: ffffffffffffffda RBX: 00007f8719f0ffa0 RCX: 00007f8719c89b19 [ 142.045440][ T5193] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000000180 [ 142.053436][ T5193] RBP: 00007f8719d21b70 R08: fffffffffffffffe R09: 0000000000000000 [ 142.061435][ T5193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.069450][ T5193] R13: 00007f8719f10038 R14: 00007f8719f0ffa0 R15: 00007ffcf4030448 [ 142.077469][ T5193] [ 142.136734][ T1350] usb 5-1: USB disconnect, device number 2 [ 142.517729][ T5209] device bond0 entered promiscuous mode [ 142.523639][ T5209] device bond_slave_0 entered promiscuous mode [ 142.530874][ T5209] device bond_slave_1 entered promiscuous mode [ 142.558190][ T5209] device batadv0 entered promiscuous mode [ 142.574509][ T5209] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 142.593514][ T5209] device bond0 left promiscuous mode [ 142.599043][ T5209] device bond_slave_0 left promiscuous mode [ 142.606493][ T5209] device bond_slave_1 left promiscuous mode [ 142.630218][ T5209] device batadv0 left promiscuous mode [ 142.786700][ T3577] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 143.176531][ T3577] usb 1-1: Using ep0 maxpacket: 16 [ 143.297378][ T3577] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 143.311593][ T3577] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.324735][ T3577] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.335857][ T3577] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 143.350356][ T3577] usb 1-1: config 0 interface 0 has no altsetting 0 [ 143.357767][ T3577] usb 1-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 143.367158][ T3577] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.386555][ T3577] usb 1-1: config 0 descriptor?? [ 143.412956][ T5214] rxe_eth0 speed is unknown, defaulting to 1000 [ 143.687879][ T5214] chnl_net:caif_netlink_parms(): no params data found [ 143.748872][ T5214] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.756072][ T5214] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.764722][ T5214] device bridge_slave_0 entered promiscuous mode [ 143.773419][ T5214] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.780999][ T5214] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.792389][ T5214] device bridge_slave_1 entered promiscuous mode [ 143.825759][ T5214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 143.848034][ T5214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 143.912244][ T3577] logitech-djreceiver 0003:046D:C53A.0003: hiddev0,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.0-1/input0 [ 143.940515][ T5214] team0: Port device team_slave_0 added [ 143.949121][ T5214] team0: Port device team_slave_1 added [ 143.977970][ T5214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 143.984950][ T5214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 144.026435][ T5214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 144.041590][ T5214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 144.048829][ T5214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 144.089127][ T1350] usb 1-1: USB disconnect, device number 2 [ 144.096670][ T5214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 144.155751][ T4389] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.184009][ T5214] device hsr_slave_0 entered promiscuous mode [ 144.192047][ T5214] device hsr_slave_1 entered promiscuous mode [ 144.209458][ T4389] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.251857][ T5221] fido_id[5221]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 144.310802][ T4389] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.356189][ T4389] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.484972][ T5214] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 144.500671][ T5214] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 144.545046][ T5214] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 144.556081][ T5214] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 144.705737][ T5232] loop0: detected capacity change from 0 to 256 [ 144.978676][ T5239] vivid-001: disconnect [ 145.407366][ T4266] Bluetooth: hci2: command 0x0409 tx timeout [ 145.617933][ T5239] vivid-001: reconnect [ 145.683177][ T4266] lg-g15 0003:046D:0A07.0004: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 145.703268][ T5214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.825178][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.838835][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.903869][ T5246] fido_id[5246]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 145.922685][ T5214] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.974738][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 145.998030][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 146.029538][ T4380] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.036699][ T4380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.078502][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 146.124208][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 146.153817][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 146.162709][ T4380] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.169875][ T4380] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.235494][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.316067][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.502324][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.613486][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.751663][ T5278] device bond0 entered promiscuous mode [ 146.757440][ T5278] device bond_slave_0 entered promiscuous mode [ 146.764441][ T5278] device bond_slave_1 entered promiscuous mode [ 146.782307][ T5278] device batadv0 entered promiscuous mode [ 146.800650][ T5278] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 146.815506][ T5278] device bond0 left promiscuous mode [ 146.820996][ T5278] device bond_slave_0 left promiscuous mode [ 146.827669][ T5278] device bond_slave_1 left promiscuous mode [ 146.841697][ T5278] device batadv0 left promiscuous mode [ 147.020980][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 147.083969][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 147.217820][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 147.654443][ T5291] vivid-001: disconnect [ 147.660625][ T4266] Bluetooth: hci2: command 0x041b tx timeout [ 147.899844][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 148.152720][ T5291] vivid-001: reconnect [ 148.198518][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 148.328355][ T5296] fuse: Unknown parameter 'permit_directio' [ 148.401375][ T5214] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 148.537907][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 148.841596][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 149.484040][ T5322] loop9: detected capacity change from 0 to 7 [ 149.539601][ T5322] Dev loop9: unable to read RDB block 7 [ 149.545588][ T5322] loop9: unable to read partition table [ 149.551974][ T5322] loop9: partition table beyond EOD, truncated [ 149.558546][ T5322] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 149.806541][ T23] Bluetooth: hci2: command 0x040f tx timeout [ 150.392920][ T5336] loop1: detected capacity change from 0 to 512 [ 150.550542][ T5336] EXT4-fs error (device loop1): ext4_orphan_get:1436: comm syz.1.239: bad orphan inode 15 [ 150.586746][ T5336] ext4_test_bit(bit=14, block=5) = 0 [ 150.662239][ T5336] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,lazytime,journal_dev=0x0000000000000003,min_batch_time=0x000000000000004a,nobarrier,journal_ioprio=0x0000000000000003,nolazytime,noload,,errors=continue. Quota mode: none. [ 150.943426][ T5354] device bond0 entered promiscuous mode [ 150.949264][ T5354] device bond_slave_0 entered promiscuous mode [ 150.955695][ T5354] device bond_slave_1 entered promiscuous mode [ 151.143237][ T5355] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 7987 vs 220 free clusters [ 152.542567][ T5357] vivid-001: disconnect [ 152.565304][ T5354] device batadv0 entered promiscuous mode [ 152.623699][ T3577] Bluetooth: hci2: command 0x0419 tx timeout [ 152.655763][ T5354] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 152.710625][ T5357] vivid-001: reconnect [ 152.720222][ T5354] device bond0 left promiscuous mode [ 152.725557][ T5354] device bond_slave_0 left promiscuous mode [ 152.731678][ T5354] device bond_slave_1 left promiscuous mode [ 152.831406][ T5354] device batadv0 left promiscuous mode [ 153.610289][ T5366] loop4: detected capacity change from 0 to 2048 [ 153.741896][ T4702] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 153.770493][ T4702] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 153.808540][ T5214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 153.960868][ T5366] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 154.155568][ T4702] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 154.203099][ T4702] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 154.235051][ T4702] EXT4-fs (loop4): This should not happen!! Data will be lost [ 154.235051][ T4702] [ 154.279410][ T4702] EXT4-fs (loop4): Total free blocks count 0 [ 154.306244][ T4702] EXT4-fs (loop4): Free/Dirty block details [ 154.306254][ T4389] device hsr_slave_0 left promiscuous mode [ 154.326978][ T4702] EXT4-fs (loop4): free_blocks=66060288 [ 154.346092][ T4702] EXT4-fs (loop4): dirty_blocks=32 [ 154.359046][ T4389] device hsr_slave_1 left promiscuous mode [ 154.371713][ T4702] EXT4-fs (loop4): Block reservation details [ 154.386152][ T4389] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 154.400843][ T4702] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 154.414952][ T4389] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 154.428703][ T4702] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 159 with max blocks 1 with error 28 [ 154.454009][ T4389] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 154.471638][ T4702] EXT4-fs (loop4): This should not happen!! Data will be lost [ 154.471638][ T4702] [ 154.489804][ T4389] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 154.507964][ T4389] device bridge_slave_1 left promiscuous mode [ 154.515886][ T4389] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.547319][ T4389] device bridge_slave_0 left promiscuous mode [ 154.581967][ T4389] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.600946][ T5391] loop0: detected capacity change from 0 to 512 [ 154.733275][ T4389] device veth1_macvtap left promiscuous mode [ 154.742596][ T5391] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 154.800726][ T4389] device veth0_macvtap left promiscuous mode [ 154.979120][ T4389] device veth1_vlan left promiscuous mode [ 155.123439][ T4389] device veth0_vlan left promiscuous mode [ 155.632689][ T5405] loop3: detected capacity change from 0 to 512 [ 155.705305][ T5405] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 155.766540][ T5405] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.255: bg 0: block 104: invalid block bitmap [ 155.845258][ T5405] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 155.855042][ T5405] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.255: invalid indirect mapped block 1 (level 1) [ 155.870165][ T5405] EXT4-fs (loop3): 1 truncate cleaned up [ 155.875942][ T5405] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 156.220400][ T5414] vivid-001: disconnect [ 156.883230][ T5414] vivid-001: reconnect [ 156.950296][ T5418] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 157.035957][ T4389] team0 (unregistering): Port device team_slave_1 removed [ 157.055945][ T4389] team0 (unregistering): Port device team_slave_0 removed [ 157.070684][ T4389] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 157.085807][ T4389] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 157.165430][ T4389] bond0 (unregistering): Released all slaves [ 157.582401][ T5437] loop0: detected capacity change from 0 to 2048 [ 157.822154][ T5437] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 158.594536][ T5214] device veth0_vlan entered promiscuous mode [ 158.726078][ T5214] device veth1_vlan entered promiscuous mode [ 158.739378][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 158.749203][ T4382] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 158.779255][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 158.953363][ T4382] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 159.013582][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 159.229957][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 159.275796][ T4382] EXT4-fs (loop0): This should not happen!! Data will be lost [ 159.275796][ T4382] [ 159.481255][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 159.502399][ T4382] EXT4-fs (loop0): Total free blocks count 0 [ 159.535645][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 159.543941][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 159.551922][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 159.578295][ T4382] EXT4-fs (loop0): Free/Dirty block details [ 159.584258][ T4382] EXT4-fs (loop0): free_blocks=66060288 [ 159.774925][ T5214] device veth0_macvtap entered promiscuous mode [ 159.789025][ T4382] EXT4-fs (loop0): dirty_blocks=32 [ 159.800495][ T5214] device veth1_macvtap entered promiscuous mode [ 159.810635][ T4382] EXT4-fs (loop0): Block reservation details [ 160.821741][ T5469] vivid-001: disconnect [ 160.858990][ T4701] Bluetooth: hci3: command 0x0406 tx timeout [ 161.058522][ T5469] vivid-001: reconnect [ 161.091092][ T4382] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 161.126604][ T4382] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 159 with max blocks 1 with error 28 [ 161.143708][ T5472] loop4: detected capacity change from 0 to 256 [ 161.201269][ T4382] EXT4-fs (loop0): This should not happen!! Data will be lost [ 161.201269][ T4382] [ 161.274077][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 161.327746][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 161.348731][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 161.377369][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 161.446017][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.495303][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.551853][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.577333][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.607329][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.624125][ T5485] Zero length message leads to an empty skb [ 161.636367][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.666429][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 161.686377][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.709754][ T5214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 161.755082][ T4382] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 161.779370][ T4382] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 161.838070][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.889558][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.904046][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 161.916224][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 161.926498][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 162.765024][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.783708][ T5500] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 162.806583][ T5214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 162.818950][ T5214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.833834][ T5214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 162.873219][ T5502] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 162.906422][ T5501] netlink: 'syz.3.279': attribute type 11 has an invalid length. [ 162.927494][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 162.947564][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 162.974668][ T5214] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.999871][ T5214] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.025882][ T5214] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.087970][ T5511] loop0: detected capacity change from 0 to 512 [ 163.122837][ T5214] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.463581][ T5511] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 163.987761][ T4380] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 164.002530][ T4380] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 164.084028][ T26] audit: type=1326 audit(1794116491.126:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 164.278464][ T26] audit: type=1326 audit(1794116491.166:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 164.359406][ T26] audit: type=1326 audit(1794116491.166:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 164.384084][ T1253] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 164.391475][ T26] audit: type=1326 audit(1794116491.166:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 164.544285][ T5535] vivid-001: disconnect [ 165.297453][ T5535] vivid-001: reconnect [ 165.410606][ T4380] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.445272][ T4380] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.473690][ T4380] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 165.558346][ T26] audit: type=1326 audit(1794116491.166:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 165.642929][ T26] audit: type=1326 audit(1794116491.176:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 165.697903][ T5544] loop3: detected capacity change from 0 to 8 [ 165.726054][ T26] audit: type=1326 audit(1794116491.176:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 165.769358][ T26] audit: type=1326 audit(1794116491.176:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 165.856810][ T5553] loop9: detected capacity change from 0 to 7 [ 165.883850][ T5553] Dev loop9: unable to read RDB block 7 [ 165.889767][ T5553] loop9: unable to read partition table [ 165.896309][ T5553] loop9: partition table beyond EOD, truncated [ 165.902764][ T5553] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 166.364031][ T5556] vivid-001: disconnect [ 166.443076][ T26] audit: type=1326 audit(1794116491.176:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 166.478342][ T26] audit: type=1326 audit(1794116491.176:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5521 comm="syz.1.284" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8719c89b19 code=0x7ffc0000 [ 166.589429][ T5544] SQUASHFS error: Unable to read directory block [631:72] [ 166.612691][ T5556] vivid-001: reconnect [ 166.661253][ T5544] SQUASHFS error: Unable to read directory block [631:72] [ 166.677939][ T5549] nvmet: transport type 0 not supported [ 166.737990][ T5565] syz.4.294 uses obsolete (PF_INET,SOCK_PACKET) [ 166.963476][ T5575] loop3: detected capacity change from 0 to 512 [ 167.164660][ T5575] EXT4-fs (loop3): Ignoring removed nobh option [ 167.236291][ T5575] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 167.990442][ T5575] EXT4-fs (loop3): Remounting filesystem read-only [ 168.056943][ T5575] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.296: invalid indirect mapped block 4278190080 (level 0) [ 168.142153][ T5575] EXT4-fs (loop3): Remounting filesystem read-only [ 168.161830][ T5575] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.296: invalid indirect mapped block 1 (level 1) [ 168.363832][ T5575] EXT4-fs (loop3): Remounting filesystem read-only [ 168.378777][ T5575] EXT4-fs (loop3): 1 truncate cleaned up [ 168.384468][ T5575] EXT4-fs (loop3): mounted filesystem without journal. Opts: abort,errors=continue,inode_readahead_blks=0x0000000000000040,errors=remount-ro,jqfmt=vfsv1,resgid=0x0000000000000000,nolazytime,nobh,auto_da_alloc=0x0000000000000006,data=journal,init_itable=0x0000000000000005,. Quota mode: none. [ 168.424543][ T5595] team0: Device xfrm0 is of different type [ 168.949387][ T5575] EXT4-fs error (device loop3): ext4_remount:6062: comm syz.3.296: Abort forced by user [ 168.979813][ T5575] EXT4-fs (loop3): Remounting filesystem read-only [ 169.010658][ T5575] EXT4-fs (loop3): re-mounted. Opts: (null). Quota mode: none. [ 169.153717][ T5605] netlink: 'syz.4.304': attribute type 11 has an invalid length. [ 169.217476][ T5607] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 169.945795][ T5616] FAULT_INJECTION: forcing a failure. [ 169.945795][ T5616] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 169.960378][ T5616] CPU: 1 PID: 5616 Comm: syz.1.308 Not tainted syzkaller #0 [ 169.967701][ T5616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 169.977783][ T5616] Call Trace: [ 169.981098][ T5616] [ 169.984053][ T5616] dump_stack_lvl+0x188/0x250 [ 169.988762][ T5616] ? verify_lock_unused+0x140/0x140 [ 169.994005][ T5616] ? show_regs_print_info+0x20/0x20 [ 169.999321][ T5616] ? load_image+0x410/0x410 [ 170.003862][ T5616] ? mark_lock+0x94/0x320 [ 170.008216][ T5616] should_fail+0x383/0x4b0 [ 170.012678][ T5616] prepare_alloc_pages+0x1e3/0x5b0 [ 170.017827][ T5616] __alloc_pages+0x11b/0x480 [ 170.022451][ T5616] ? zone_statistics+0x170/0x170 [ 170.027434][ T5616] ? rcu_lock_acquire+0x30/0x30 [ 170.032311][ T5616] ? alloc_pages+0x452/0x560 [ 170.036932][ T5616] __get_free_pages+0x8/0x30 [ 170.041548][ T5616] __tlb_remove_page_size+0x1f2/0x3f0 [ 170.046952][ T5616] unmap_page_range+0xfcf/0x2410 [ 170.051958][ T5616] unmap_vmas+0x131/0x250 [ 170.056327][ T5616] ? unmap_page_range+0x2410/0x2410 [ 170.061674][ T5616] ? __mutex_lock_common+0x435/0x2400 [ 170.067094][ T5616] ? exit_mm_release+0x16/0x30 [ 170.071897][ T5616] exit_mmap+0x3b9/0x640 [ 170.076199][ T5616] ? vm_brk+0x20/0x20 [ 170.080335][ T5616] ? uprobe_clear_state+0x2f6/0x460 [ 170.085574][ T5616] __mmput+0x115/0x390 [ 170.089676][ T5616] exit_mm+0x632/0x7b0 [ 170.093778][ T5616] ? perf_pmu_migrate_context+0xb70/0xb70 [ 170.100101][ T5616] ? do_exit+0x2100/0x2100 [ 170.104546][ T5616] ? __ia32_sys_timer_delete+0x40/0x40 [ 170.110035][ T5616] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 170.115552][ T5616] ? tty_audit_exit+0x149/0x1f0 [ 170.120438][ T5616] do_exit+0x5b8/0x2100 [ 170.124721][ T5616] ? put_task_struct+0x80/0x80 [ 170.129511][ T5616] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 170.135529][ T5616] ? cgroup_freezing+0x264/0x310 [ 170.140501][ T5616] do_group_exit+0x12c/0x2f0 [ 170.145118][ T5616] ? lockdep_hardirqs_on+0x94/0x140 [ 170.150352][ T5616] get_signal+0x7eb/0x12e0 [ 170.154816][ T5616] arch_do_signal_or_restart+0xe6/0x12a0 [ 170.160485][ T5616] ? media_device_ioctl+0x3f3/0x490 [ 170.165728][ T5616] ? futex_exit_release+0x1c0/0x1c0 [ 170.170957][ T5616] ? get_sigframe_size+0x10/0x10 [ 170.175949][ T5616] ? __context_tracking_exit+0x4c/0x80 [ 170.181455][ T5616] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 170.187477][ T5616] ? exit_to_user_mode_loop+0x3b/0x130 [ 170.192977][ T5616] exit_to_user_mode_loop+0x9e/0x130 [ 170.198302][ T5616] exit_to_user_mode_prepare+0xee/0x180 [ 170.203883][ T5616] syscall_exit_to_user_mode+0x16/0x40 [ 170.209369][ T5616] do_syscall_64+0x58/0xa0 [ 170.213898][ T5616] ? clear_bhb_loop+0x30/0x80 [ 170.218604][ T5616] ? clear_bhb_loop+0x30/0x80 [ 170.223318][ T5616] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 170.229327][ T5616] RIP: 0033:0x7f8719c89b19 [ 170.233769][ T5616] Code: Unable to access opcode bytes at RIP 0x7f8719c89aef. [ 170.241148][ T5616] RSP: 002b:00007f8717ee00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 170.249587][ T5616] RAX: fffffffffffffe00 RBX: 00007f8719f0ffa8 RCX: 00007f8719c89b19 [ 170.257593][ T5616] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8719f0ffa8 [ 170.265592][ T5616] RBP: 00007f8719f0ffa0 R08: 0000000000000000 R09: 0000000000000000 [ 170.273764][ T5616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.281755][ T5616] R13: 00007f8719f10038 R14: 00007ffcf4030360 R15: 00007ffcf4030448 [ 170.289785][ T5616] [ 170.755469][ T5639] device-mapper: table: 248:1: multipath: invalid number of paths [ 170.849861][ T5631] FAULT_INJECTION: forcing a failure. [ 170.849861][ T5631] name failslab, interval 1, probability 0, space 0, times 0 [ 170.953107][ T5639] device-mapper: ioctl: error adding target to table [ 171.494175][ T5631] CPU: 1 PID: 5631 Comm: syz.1.314 Not tainted syzkaller #0 [ 171.501538][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 171.511619][ T5631] Call Trace: [ 171.514918][ T5631] [ 171.517905][ T5631] dump_stack_lvl+0x188/0x250 [ 171.522622][ T5631] ? show_regs_print_info+0x20/0x20 [ 171.527866][ T5631] ? load_image+0x410/0x410 [ 171.532397][ T5631] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 171.538066][ T5631] should_fail+0x383/0x4b0 [ 171.542518][ T5631] should_failslab+0x5/0x20 [ 171.547058][ T5631] slab_pre_alloc_hook+0x51/0xc0 [ 171.552023][ T5631] ? key_alloc+0x346/0x1030 [ 171.556562][ T5631] __kmalloc_track_caller+0x69/0x330 [ 171.561871][ T5631] ? key_alloc+0x346/0x1030 [ 171.566438][ T5631] kmemdup+0x22/0x50 [ 171.570363][ T5631] key_alloc+0x346/0x1030 [ 171.574731][ T5631] keyring_alloc+0x41/0xa0 [ 171.579180][ T5631] lookup_user_key+0x44b/0x1160 [ 171.584074][ T5631] ? lookup_user_key_possessed+0x40/0x40 [ 171.589739][ T5631] ? search_process_keyrings_rcu+0x360/0x360 [ 171.595771][ T5631] ? should_fail_usercopy+0x5/0x20 [ 171.600918][ T5631] ? _copy_from_user+0x111/0x170 [ 171.605884][ T5631] __se_sys_add_key+0x311/0x410 [ 171.610754][ T5631] ? __x64_sys_add_key+0xc0/0xc0 [ 171.615718][ T5631] ? __x64_sys_add_key+0x1c/0xc0 [ 171.620682][ T5631] do_syscall_64+0x4c/0xa0 [ 171.625131][ T5631] ? clear_bhb_loop+0x30/0x80 [ 171.629835][ T5631] ? clear_bhb_loop+0x30/0x80 [ 171.634539][ T5631] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 171.640461][ T5631] RIP: 0033:0x7f8719c89b19 [ 171.644899][ T5631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.664536][ T5631] RSP: 002b:00007f8717ee0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 171.673026][ T5631] RAX: ffffffffffffffda RBX: 00007f8719f0ffa0 RCX: 00007f8719c89b19 [ 171.681044][ T5631] RDX: 0000200000000540 RSI: 0000000000000000 RDI: 0000200000000140 [ 171.689050][ T5631] RBP: 00007f8719d21b70 R08: ffffffffffffffff R09: 0000000000000000 [ 171.697071][ T5631] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 171.705082][ T5631] R13: 00007f8719f10038 R14: 00007f8719f0ffa0 R15: 00007ffcf4030448 [ 171.713107][ T5631] [ 171.716239][ C1] vkms_vblank_simulate: vblank timer overrun [ 172.095861][ T5659] vivid-001: disconnect [ 172.743942][ T5659] vivid-001: reconnect [ 172.905736][ T5664] netlink: 'syz.6.322': attribute type 11 has an invalid length. [ 172.958342][ T5669] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 173.438515][ T5685] loop3: detected capacity change from 0 to 2048 [ 174.081717][ T5691] loop1: detected capacity change from 0 to 512 [ 174.118761][ T5685] EXT4-fs (loop3): mounted filesystem without journal. Opts: abort,block_validity,grpid,,errors=continue. Quota mode: writeback. [ 174.208370][ T4268] Bluetooth: hci1: command 0x0406 tx timeout [ 174.227124][ T5685] ext4 filesystem being mounted at /71/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 174.248775][ T5691] EXT4-fs (loop1): Ignoring removed nobh option [ 174.298374][ T5691] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 174.355659][ T5685] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 174.427714][ T5685] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 174.576510][ T5691] EXT4-fs (loop1): Remounting filesystem read-only [ 174.616224][ T5691] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.331: invalid indirect mapped block 4278190080 (level 0) [ 174.656618][ T5691] EXT4-fs (loop1): Remounting filesystem read-only [ 174.664966][ T5691] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.331: invalid indirect mapped block 1 (level 1) [ 174.712668][ T5716] vivid-001: disconnect [ 175.011734][ T5691] EXT4-fs (loop1): Remounting filesystem read-only [ 175.296443][ T5716] vivid-001: reconnect [ 175.346441][ T5691] EXT4-fs (loop1): 1 truncate cleaned up [ 175.410652][ T5720] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 175.450203][ T5691] EXT4-fs (loop1): mounted filesystem without journal. Opts: abort,errors=continue,inode_readahead_blks=0x0000000000000040,errors=remount-ro,jqfmt=vfsv1,resgid=0x0000000000000000,nolazytime,nobh,auto_da_alloc=0x0000000000000006,data=journal,init_itable=0x0000000000000005,. Quota mode: none. [ 175.709942][ T5691] EXT4-fs error (device loop1): ext4_remount:6062: comm syz.1.331: Abort forced by user [ 175.756164][ T5691] EXT4-fs (loop1): Remounting filesystem read-only [ 175.785620][ T5691] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: none. [ 176.198486][ T5760] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 176.222837][ T5755] team0: Device xfrm0 is of different type [ 176.271250][ T5764] loop4: detected capacity change from 0 to 512 [ 176.311213][ T5754] netlink: 'syz.1.347': attribute type 11 has an invalid length. [ 176.463103][ T5764] EXT4-fs (loop4): 1 orphan inode deleted [ 176.465735][ T5774] FAULT_INJECTION: forcing a failure. [ 176.465735][ T5774] name failslab, interval 1, probability 0, space 0, times 0 [ 176.482050][ T5774] CPU: 0 PID: 5774 Comm: syz.3.353 Not tainted syzkaller #0 [ 176.489378][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 176.499481][ T5774] Call Trace: [ 176.502791][ T5774] [ 176.505749][ T5774] dump_stack_lvl+0x188/0x250 [ 176.510468][ T5774] ? show_regs_print_info+0x20/0x20 [ 176.515727][ T5774] ? load_image+0x410/0x410 [ 176.520289][ T5774] ? __lock_acquire+0x7d40/0x7d40 [ 176.525360][ T5774] should_fail+0x383/0x4b0 [ 176.529819][ T5774] should_failslab+0x5/0x20 [ 176.534377][ T5774] slab_pre_alloc_hook+0x51/0xc0 [ 176.538585][ T5764] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 176.539352][ T5774] kmem_cache_alloc_trace+0x47/0x290 [ 176.556103][ T5774] ? x509_cert_parse+0xfa/0x7a0 [ 176.561004][ T5774] x509_cert_parse+0xfa/0x7a0 [ 176.565740][ T5774] x509_key_preparse+0x60/0x5d0 [ 176.570655][ T5774] ? down_read+0x1aa/0x2e0 [ 176.575124][ T5774] asymmetric_key_preparse+0xa5/0x140 [ 176.580797][ T5774] key_create_or_update+0x405/0xa50 [ 176.586048][ T5774] ? key_type_put+0x20/0x20 [ 176.590614][ T5774] ? __might_fault+0xb3/0x110 [ 176.595337][ T5774] __se_sys_add_key+0x34b/0x410 [ 176.600261][ T5774] ? __x64_sys_add_key+0xc0/0xc0 [ 176.605242][ T5774] ? lockdep_hardirqs_on+0x94/0x140 [ 176.610563][ T5774] ? __x64_sys_add_key+0x1c/0xc0 [ 176.615545][ T5774] do_syscall_64+0x4c/0xa0 [ 176.619076][ T5764] ext4 filesystem being mounted at /97/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 176.619993][ T5774] ? clear_bhb_loop+0x30/0x80 [ 176.620022][ T5774] ? clear_bhb_loop+0x30/0x80 [ 176.639735][ T5774] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 176.645677][ T5774] RIP: 0033:0x7fc5891d8b19 [ 176.650136][ T5774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.669779][ T5774] RSP: 002b:00007fc58742f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 176.678235][ T5774] RAX: ffffffffffffffda RBX: 00007fc58945efa0 RCX: 00007fc5891d8b19 [ 176.686252][ T5774] RDX: 0000200000000540 RSI: 0000000000000000 RDI: 0000200000000140 [ 176.694267][ T5774] RBP: 00007fc589270b70 R08: ffffffffffffffff R09: 0000000000000000 [ 176.702272][ T5774] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 176.710294][ T5774] R13: 00007fc58945f038 R14: 00007fc58945efa0 R15: 00007ffcbe837f58 [ 176.718402][ T5774] [ 176.791358][ T5764] X25: unknown 09 in state 3 [ 176.953280][ T5785] loop0: detected capacity change from 0 to 128 [ 176.991425][ T5785] EXT4-fs (loop0): mounted filesystem without journal. Opts: init_itable,max_dir_size_kb=0x0000000000000002,,errors=continue. Quota mode: none. [ 177.048269][ T5785] ext4 filesystem being mounted at /84/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 177.224343][ T5795] FAULT_INJECTION: forcing a failure. [ 177.224343][ T5795] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 177.237770][ T5795] CPU: 0 PID: 5795 Comm: syz.3.362 Not tainted syzkaller #0 [ 177.245089][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 177.255183][ T5795] Call Trace: [ 177.258512][ T5795] [ 177.261470][ T5795] dump_stack_lvl+0x188/0x250 [ 177.266189][ T5795] ? show_regs_print_info+0x20/0x20 [ 177.271428][ T5795] ? load_image+0x410/0x410 [ 177.275996][ T5795] should_fail+0x383/0x4b0 [ 177.280446][ T5795] prepare_alloc_pages+0x1e3/0x5b0 [ 177.285606][ T5795] __alloc_pages+0x11b/0x480 [ 177.290240][ T5795] ? zone_statistics+0x170/0x170 [ 177.295215][ T5795] ? rcu_lock_acquire+0x30/0x30 [ 177.300103][ T5795] ? alloc_pages+0x452/0x560 [ 177.304729][ T5795] __get_free_pages+0x8/0x30 [ 177.309353][ T5795] __tlb_remove_page_size+0x1f2/0x3f0 [ 177.314762][ T5795] unmap_page_range+0xfcf/0x2410 [ 177.319762][ T5795] unmap_vmas+0x131/0x250 [ 177.324153][ T5795] ? unmap_page_range+0x2410/0x2410 [ 177.329389][ T5795] ? __mutex_lock_common+0x435/0x2400 [ 177.334796][ T5795] ? exit_mm_release+0x16/0x30 [ 177.339606][ T5795] exit_mmap+0x3b9/0x640 [ 177.343885][ T5795] ? vm_brk+0x20/0x20 [ 177.347908][ T5795] ? uprobe_clear_state+0x2f6/0x460 [ 177.353146][ T5795] __mmput+0x115/0x390 [ 177.357251][ T5795] exit_mm+0x632/0x7b0 [ 177.361348][ T5795] ? perf_pmu_migrate_context+0xb70/0xb70 [ 177.367107][ T5795] ? do_exit+0x2100/0x2100 [ 177.371549][ T5795] ? __ia32_sys_timer_delete+0x40/0x40 [ 177.377040][ T5795] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 177.382537][ T5795] ? tty_audit_exit+0x149/0x1f0 [ 177.387422][ T5795] do_exit+0x5b8/0x2100 [ 177.391620][ T5795] ? put_task_struct+0x80/0x80 [ 177.396421][ T5795] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 177.402443][ T5795] ? cgroup_freezing+0x264/0x310 [ 177.407421][ T5795] do_group_exit+0x12c/0x2f0 [ 177.412053][ T5795] ? lockdep_hardirqs_on+0x94/0x140 [ 177.417276][ T5795] get_signal+0x7eb/0x12e0 [ 177.421742][ T5795] arch_do_signal_or_restart+0xe6/0x12a0 [ 177.427426][ T5795] ? futex_exit_release+0x1c0/0x1c0 [ 177.432660][ T5795] ? get_sigframe_size+0x10/0x10 [ 177.437637][ T5795] ? __context_tracking_exit+0x4c/0x80 [ 177.443143][ T5795] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 177.449161][ T5795] ? exit_to_user_mode_loop+0x3b/0x130 [ 177.454657][ T5795] exit_to_user_mode_loop+0x9e/0x130 [ 177.459978][ T5795] exit_to_user_mode_prepare+0xee/0x180 [ 177.465552][ T5795] syscall_exit_to_user_mode+0x16/0x40 [ 177.471042][ T5795] do_syscall_64+0x58/0xa0 [ 177.475491][ T5795] ? clear_bhb_loop+0x30/0x80 [ 177.480196][ T5795] ? clear_bhb_loop+0x30/0x80 [ 177.484923][ T5795] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 177.490859][ T5795] RIP: 0033:0x7fc5891d8b19 [ 177.495441][ T5795] Code: Unable to access opcode bytes at RIP 0x7fc5891d8aef. [ 177.502837][ T5795] RSP: 002b:00007fc58742f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 177.511281][ T5795] RAX: 0000000000000001 RBX: 00007fc58945efa8 RCX: 00007fc5891d8b19 [ 177.519279][ T5795] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc58945efac [ 177.527283][ T5795] RBP: 00007fc58945efa0 R08: 0009baf007fe18c6 R09: 0000000000000000 [ 177.535289][ T5795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 177.543289][ T5795] R13: 00007fc58945f038 R14: 00007ffcbe837e70 R15: 00007ffcbe837f58 [ 177.551664][ T5795] [ 178.326853][ T5825] FAULT_INJECTION: forcing a failure. [ 178.326853][ T5825] name failslab, interval 1, probability 0, space 0, times 0 [ 178.362762][ T5825] CPU: 0 PID: 5825 Comm: syz.4.370 Not tainted syzkaller #0 [ 178.370116][ T5825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 178.380202][ T5825] Call Trace: [ 178.383511][ T5825] [ 178.386468][ T5825] dump_stack_lvl+0x188/0x250 [ 178.391184][ T5825] ? show_regs_print_info+0x20/0x20 [ 178.396418][ T5825] ? load_image+0x410/0x410 [ 178.400960][ T5825] ? __lock_acquire+0x7d40/0x7d40 [ 178.406041][ T5825] should_fail+0x383/0x4b0 [ 178.410496][ T5825] should_failslab+0x5/0x20 [ 178.415048][ T5825] slab_pre_alloc_hook+0x51/0xc0 [ 178.420018][ T5825] ? key_alloc+0x346/0x1030 [ 178.424549][ T5825] __kmalloc_track_caller+0x69/0x330 [ 178.429893][ T5825] ? key_alloc+0x346/0x1030 [ 178.434453][ T5825] kmemdup+0x22/0x50 [ 178.438389][ T5825] key_alloc+0x346/0x1030 [ 178.442795][ T5825] keyring_alloc+0x41/0xa0 [ 178.447284][ T5825] lookup_user_key+0x44b/0x1160 [ 178.452183][ T5825] ? lookup_user_key_possessed+0x40/0x40 [ 178.457853][ T5825] ? search_process_keyrings_rcu+0x360/0x360 [ 178.463880][ T5825] ? __might_fault+0xb3/0x110 [ 178.468598][ T5825] ? _copy_from_user+0x111/0x170 [ 178.473572][ T5825] __se_sys_add_key+0x311/0x410 [ 178.478465][ T5825] ? __x64_sys_add_key+0xc0/0xc0 [ 178.483451][ T5825] ? lockdep_hardirqs_on+0x94/0x140 [ 178.488683][ T5825] ? __x64_sys_add_key+0x1c/0xc0 [ 178.493660][ T5825] do_syscall_64+0x4c/0xa0 [ 178.498110][ T5825] ? clear_bhb_loop+0x30/0x80 [ 178.502821][ T5825] ? clear_bhb_loop+0x30/0x80 [ 178.507534][ T5825] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 178.513474][ T5825] RIP: 0033:0x7fe0d3f59b19 [ 178.517925][ T5825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.537565][ T5825] RSP: 002b:00007fe0d21b0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 178.546016][ T5825] RAX: ffffffffffffffda RBX: 00007fe0d41dffa0 RCX: 00007fe0d3f59b19 [ 178.554029][ T5825] RDX: 0000200000000540 RSI: 0000000000000000 RDI: 0000200000000140 [ 178.562025][ T5825] RBP: 00007fe0d3ff1b70 R08: ffffffffffffffff R09: 0000000000000000 [ 178.570023][ T5825] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 178.578026][ T5825] R13: 00007fe0d41e0038 R14: 00007fe0d41dffa0 R15: 00007ffcfbc29018 [ 178.586049][ T5825] [ 178.609563][ T5827] loop3: detected capacity change from 0 to 512 [ 178.717115][ T5827] EXT4-fs (loop3): 1 orphan inode deleted [ 178.722916][ T5827] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 178.750785][ T5827] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 178.768127][ T5836] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 178.793215][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 178.793232][ T26] audit: type=1326 audit(1794116505.836:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 178.910250][ T5827] X25: unknown 09 in state 3 [ 178.935588][ T26] audit: type=1326 audit(1794116505.906:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.047668][ T26] audit: type=1326 audit(1794116505.906:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.143071][ T26] audit: type=1326 audit(1794116505.906:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.205683][ T5853] nvmet: Invalid value 'f' for adrfam [ 179.309920][ T26] audit: type=1326 audit(1794116505.906:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.397663][ T26] audit: type=1326 audit(1794116505.916:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.433648][ T5853] nvmet: transport type 0 not supported [ 179.474087][ T26] audit: type=1326 audit(1794116505.916:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5835 comm="syz.4.371" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0d3f59b19 code=0x7ffc0000 [ 179.832781][ T5881] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 180.164058][ T5901] netlink: 12 bytes leftover after parsing attributes in process `syz.4.390'. [ 180.256620][ T5901] FAULT_INJECTION: forcing a failure. [ 180.256620][ T5901] name failslab, interval 1, probability 0, space 0, times 0 [ 180.307506][ T5901] CPU: 1 PID: 5901 Comm: syz.4.390 Not tainted syzkaller #0 [ 180.314860][ T5901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 180.324947][ T5901] Call Trace: [ 180.328254][ T5901] [ 180.331207][ T5901] dump_stack_lvl+0x188/0x250 [ 180.335924][ T5901] ? show_regs_print_info+0x20/0x20 [ 180.341166][ T5901] ? load_image+0x410/0x410 [ 180.345714][ T5901] ? __lock_acquire+0x7d40/0x7d40 [ 180.350773][ T5901] ? rcu_lock_acquire+0x30/0x30 [ 180.355674][ T5901] should_fail+0x383/0x4b0 [ 180.360163][ T5901] should_failslab+0x5/0x20 [ 180.364783][ T5901] slab_pre_alloc_hook+0x51/0xc0 [ 180.369753][ T5901] ? security_file_alloc+0x30/0x110 [ 180.374982][ T5901] kmem_cache_alloc+0x3d/0x280 [ 180.379783][ T5901] ? rcu_is_watching+0x11/0xa0 [ 180.384586][ T5901] security_file_alloc+0x30/0x110 [ 180.389658][ T5901] __alloc_file+0xc2/0x240 [ 180.394286][ T5901] alloc_empty_file+0x90/0x180 [ 180.399087][ T5901] path_openat+0x11c/0x2fb0 [ 180.403624][ T5901] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 180.409557][ T5901] ? _raw_spin_unlock+0x40/0x40 [ 180.414441][ T5901] ? stack_trace_save+0xa6/0xf0 [ 180.419331][ T5901] ? stack_depot_save+0x41b/0x460 [ 180.424405][ T5901] ? __kasan_slab_alloc+0xa9/0xc0 [ 180.429469][ T5901] ? __kasan_slab_alloc+0x92/0xc0 [ 180.434527][ T5901] ? slab_post_alloc_hook+0x4c/0x380 [ 180.439843][ T5901] ? kmem_cache_alloc+0x15d/0x280 [ 180.444899][ T5901] ? do_coredump+0x1bb2/0x2a40 [ 180.449694][ T5901] ? get_signal+0x531/0x12e0 [ 180.454315][ T5901] ? arch_do_signal_or_restart+0xe6/0x12a0 [ 180.460164][ T5901] ? do_filp_open+0x400/0x400 [ 180.464871][ T5901] ? do_syscall_64+0x58/0xa0 [ 180.469500][ T5901] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 180.475645][ T5901] do_filp_open+0x1df/0x400 [ 180.480241][ T5901] ? vfs_tmpfile+0x300/0x300 [ 180.484905][ T5901] ? getname_kernel+0x56/0x2e0 [ 180.489699][ T5901] ? getname_kernel+0x142/0x2e0 [ 180.494579][ T5901] ? memcpy+0x3c/0x60 [ 180.498590][ T5901] ? build_open_flags+0x459/0x5c0 [ 180.503653][ T5901] filp_open+0x17c/0x1e0 [ 180.507929][ T5901] ? file_open_name+0x1b0/0x1b0 [ 180.512810][ T5901] ? getname_kernel+0x142/0x2e0 [ 180.517695][ T5901] ? memcpy+0x3c/0x60 [ 180.521710][ T5901] ? getname_kernel+0x1fc/0x2e0 [ 180.526590][ T5901] do_coredump+0x1bb2/0x2a40 [ 180.531238][ T5901] ? nfs_stat_to_errno+0x170/0x170 [ 180.536409][ T5901] ? lock_chain_count+0x20/0x20 [ 180.541306][ T5901] ? _raw_spin_unlock_irq+0x1f/0x40 [ 180.546536][ T5901] ? lockdep_hardirqs_on+0x94/0x140 [ 180.551766][ T5901] get_signal+0x531/0x12e0 [ 180.556239][ T5901] arch_do_signal_or_restart+0xe6/0x12a0 [ 180.561912][ T5901] ? send_signal+0x77e/0x8e0 [ 180.566791][ T5901] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 180.572817][ T5901] ? lockdep_hardirqs_on+0x94/0x140 [ 180.578060][ T5901] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 180.584007][ T5901] ? _raw_spin_unlock+0x40/0x40 [ 180.588911][ T5901] ? get_sigframe_size+0x10/0x10 [ 180.593897][ T5901] ? __context_tracking_exit+0x4c/0x80 [ 180.599421][ T5901] ? exit_to_user_mode_loop+0x3b/0x130 [ 180.604921][ T5901] exit_to_user_mode_loop+0x9e/0x130 [ 180.610241][ T5901] exit_to_user_mode_prepare+0xee/0x180 [ 180.615856][ T5901] syscall_exit_to_user_mode+0x16/0x40 [ 180.621364][ T5901] do_syscall_64+0x58/0xa0 [ 180.625822][ T5901] ? clear_bhb_loop+0x30/0x80 [ 180.630530][ T5901] ? clear_bhb_loop+0x30/0x80 [ 180.635249][ T5901] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 180.641179][ T5901] RIP: 0033:0x7fe0d3f59b19 [ 180.645631][ T5901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.665272][ T5901] RSP: 002b:00007fe0d21b00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 180.673731][ T5901] RAX: 00000000000000ca RBX: 00007fe0d41dffa8 RCX: 00007fe0d3f59b19 [ 180.681869][ T5901] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe0d41dffac [ 180.689892][ T5901] RBP: 00007fe0d41dffa0 R08: 000aec1d3fe5cc5a R09: 0000000000000000 [ 180.697907][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.705916][ T5901] R13: 00007fe0d41e0038 R14: 00007ffcfbc28f30 R15: 00007ffcfbc29018 [ 180.713938][ T5901] [ 182.273019][ T5939] loop6: detected capacity change from 0 to 4096 [ 182.448901][ T5939] EXT4-fs (loop6): Ignoring removed orlov option [ 182.761824][ T5939] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,max_dir_size_kb=0x000000004f2040d2,auto_da_alloc,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 183.653532][ T5963] loop3: detected capacity change from 0 to 2048 [ 183.663888][ T5967] loop1: detected capacity change from 0 to 8 [ 183.746485][ T5962] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 183.753983][ T5962] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 183.806787][ T5967] unable to read inode lookup table [ 183.831236][ T5962] vhci_hcd vhci_hcd.0: Device attached [ 183.874577][ T5963] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 183.978846][ T5964] vhci_hcd: connection closed [ 183.986410][ T4389] vhci_hcd: stop threads [ 183.996273][ T4389] vhci_hcd: release socket [ 184.060063][ T4389] vhci_hcd: disconnect device [ 184.239451][ T4266] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 184.247910][ T4266] usb 35-1: enqueue for inactive port 0 [ 184.326715][ T4266] vhci_hcd: vhci_device speed not set [ 185.172616][ T5989] loop1: detected capacity change from 0 to 2048 [ 185.233749][ T5989] EXT4-fs (loop1): mounted filesystem without journal. Opts: abort,block_validity,grpid,,errors=continue. Quota mode: writeback. [ 185.402802][ T5989] ext4 filesystem being mounted at /73/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 186.511983][ T6003] loop4: detected capacity change from 0 to 8192 [ 186.597887][ T6017] overlayfs: unrecognized mount option "/" or missing value [ 187.557284][ T6025] loop3: detected capacity change from 0 to 1024 [ 187.619202][ T6025] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 187.795031][ T6025] EXT4-fs (loop3): mounted filesystem without journal. Opts: noauto_da_alloc,max_dir_size_kb=0x0000000000000001,mblk_io_submit,norecovery,discard,lazytime,journal_dev=0x0000000000000001,usrquota,noauto_da_alloc,grpjquota=,nobarrier,,errors=continue. Quota mode: writeback. [ 188.065358][ T6038] vivid-001: disconnect [ 188.974603][ T6038] vivid-001: reconnect [ 189.307588][ T6042] netlink: 'syz.1.424': attribute type 11 has an invalid length. [ 189.350655][ T6044] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 189.383703][ T6045] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 189.599250][ T6053] loop6: detected capacity change from 0 to 2048 [ 189.953300][ T6053] EXT4-fs (loop6): mounted filesystem without journal. Opts: abort,block_validity,grpid,,errors=continue. Quota mode: writeback. [ 190.244315][ T6053] ext4 filesystem being mounted at /32/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 190.604772][ T6064] Cannot find set identified by id 0 to match [ 190.643341][ T6053] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 190.698098][ T6053] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 190.900904][ T6085] loop0: detected capacity change from 0 to 256 [ 190.943494][ T6085] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 191.111498][ T6095] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 191.148421][ T6095] FAT-fs (loop0): Filesystem has been set read-only [ 191.176425][ T7] Bluetooth: hci4: command 0x0406 tx timeout [ 191.182908][ T7] Bluetooth: hci1: command 0x0406 tx timeout [ 191.587263][ T6099] rxe_eth0 speed is unknown, defaulting to 1000 [ 192.714448][ T6099] loop1: detected capacity change from 0 to 1024 [ 194.005543][ T6101] vivid-001: disconnect [ 194.111453][ T6099] EXT4-fs (loop1): Ignoring removed oldalloc option [ 194.118522][ T6099] EXT4-fs (loop1): Ignoring removed oldalloc option [ 194.125161][ T6099] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 194.202943][ T6101] vivid-001: reconnect [ 194.233085][ T6099] EXT4-fs warning (device loop1): ext4_multi_mount_protect:403: Unable to create kmmpd thread for loop1. [ 194.266939][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.273352][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.356591][ T26] audit: type=1800 audit(1794116521.336:30): pid=6085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.435" name="file1" dev="loop0" ino=1048649 res=0 errno=0 [ 194.564999][ T6107] loop3: detected capacity change from 0 to 512 [ 194.777341][ T6122] Cannot find set identified by id 0 to match [ 194.812272][ T6127] netlink: 'syz.1.442': attribute type 11 has an invalid length. [ 194.888535][ T6132] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 194.914969][ T6107] EXT4-fs (loop3): 1 orphan inode deleted [ 194.955645][ T6107] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 195.062805][ T6107] ext4 filesystem being mounted at /93/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 195.195413][ T6139] vivid-001: disconnect [ 195.832927][ T6139] vivid-001: reconnect [ 196.510761][ T6170] vivid-001: disconnect [ 197.399257][ T6170] vivid-001: reconnect [ 197.419043][ T4271] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 197.756400][ T4271] usb 7-1: Using ep0 maxpacket: 16 [ 198.027769][ T4271] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.045337][ T4271] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 198.176410][ T6203] vivid-001: disconnect [ 198.227792][ T4271] usb 7-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 198.336042][ T4271] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.600653][ T4271] usb 7-1: Product: syz [ 198.800633][ T6203] vivid-001: reconnect [ 198.821404][ T6202] loop4: detected capacity change from 0 to 512 [ 198.848421][ T4271] usb 7-1: Manufacturer: syz [ 198.853129][ T4271] usb 7-1: SerialNumber: syz [ 199.056014][ T6202] EXT4-fs (loop4): 1 orphan inode deleted [ 199.056048][ T6202] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 199.056156][ T6202] ext4 filesystem being mounted at /127/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 199.236599][ T4271] usb 7-1: USB disconnect, device number 2 [ 199.349036][ T6216] vivid-001: disconnect [ 199.963290][ T6216] vivid-001: reconnect [ 200.070803][ T6219] FAULT_INJECTION: forcing a failure. [ 200.070803][ T6219] name fail_futex, interval 1, probability 0, space 0, times 1 [ 200.070842][ T6219] CPU: 1 PID: 6219 Comm: syz.0.463 Not tainted syzkaller #0 [ 200.070868][ T6219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 200.070882][ T6219] Call Trace: [ 200.070890][ T6219] [ 200.070900][ T6219] dump_stack_lvl+0x188/0x250 [ 200.070936][ T6219] ? show_regs_print_info+0x20/0x20 [ 200.070964][ T6219] ? load_image+0x410/0x410 [ 200.070996][ T6219] ? get_user_pages_fast_only+0x40/0x40 [ 200.071031][ T6219] should_fail+0x383/0x4b0 [ 200.071062][ T6219] get_futex_key+0xbd2/0x1200 [ 200.071106][ T6219] ? futex_wait_restart+0x250/0x250 [ 200.071141][ T6219] futex_wait_requeue_pi+0x333/0xb50 [ 200.071192][ T6219] ? futex_unlock_pi+0xc00/0xc00 [ 200.071216][ T6219] ? futex_wait_queue_me+0x438/0x440 [ 200.071248][ T6219] ? mark_lock+0x94/0x320 [ 200.071301][ T6219] ? verify_lock_unused+0x140/0x140 [ 200.071328][ T6219] ? verify_lock_unused+0x140/0x140 [ 200.071397][ T6219] do_futex+0xe0c/0x12b0 [ 200.071427][ T6219] ? vfs_write+0xaa6/0xd70 [ 200.071467][ T6219] ? futex_exit_release+0x1c0/0x1c0 [ 200.071497][ T6219] ? __context_tracking_exit+0x4c/0x80 [ 200.071530][ T6219] __se_sys_futex+0x389/0x420 [ 200.071556][ T6219] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 200.071586][ T6219] ? __x64_sys_futex+0xf0/0xf0 [ 200.071618][ T6219] ? __x64_sys_futex+0x1d/0xf0 [ 200.071647][ T6219] do_syscall_64+0x4c/0xa0 [ 200.071668][ T6219] ? clear_bhb_loop+0x30/0x80 [ 200.071691][ T6219] ? clear_bhb_loop+0x30/0x80 [ 200.071717][ T6219] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 200.071742][ T6219] RIP: 0033:0x7f33d4fc5b19 [ 200.071763][ T6219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.071783][ T6219] RSP: 002b:00007f33d321c028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 200.071808][ T6219] RAX: ffffffffffffffda RBX: 00007f33d524bfa0 RCX: 00007f33d4fc5b19 [ 200.071826][ T6219] RDX: 0000000000000001 RSI: 000000000000000b RDI: 0000000000000000 [ 200.071841][ T6219] RBP: 00007f33d505db70 R08: 0000200000000140 R09: 0000000000000403 [ 200.071858][ T6219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 200.071873][ T6219] R13: 00007f33d524c038 R14: 00007f33d524bfa0 R15: 00007ffe79e79738 [ 200.071905][ T6219] [ 200.300894][ T6231] netlink: 'syz.4.465': attribute type 11 has an invalid length. [ 200.353128][ T6235] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 200.555564][ T6240] FAULT_INJECTION: forcing a failure. [ 200.555564][ T6240] name failslab, interval 1, probability 0, space 0, times 0 [ 200.555653][ T6240] CPU: 1 PID: 6240 Comm: syz.0.470 Not tainted syzkaller #0 [ 200.555679][ T6240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 200.555694][ T6240] Call Trace: [ 200.555702][ T6240] [ 200.555712][ T6240] dump_stack_lvl+0x188/0x250 [ 200.555750][ T6240] ? show_regs_print_info+0x20/0x20 [ 200.555778][ T6240] ? load_image+0x410/0x410 [ 200.555809][ T6240] ? __might_sleep+0xf0/0xf0 [ 200.555834][ T6240] ? __lock_acquire+0x7d40/0x7d40 [ 200.555868][ T6240] should_fail+0x383/0x4b0 [ 200.555898][ T6240] should_failslab+0x5/0x20 [ 200.555920][ T6240] slab_pre_alloc_hook+0x51/0xc0 [ 200.555944][ T6240] __kmalloc+0x6b/0x340 [ 200.555964][ T6240] ? tomoyo_encode+0x28a/0x550 [ 200.555996][ T6240] tomoyo_encode+0x28a/0x550 [ 200.556027][ T6240] tomoyo_realpath_from_path+0x5a2/0x5e0 [ 200.556066][ T6240] tomoyo_path_number_perm+0x251/0x6b0 [ 200.556094][ T6240] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 200.556128][ T6240] ? do_futex+0xdc2/0x12b0 [ 200.556205][ T6240] security_file_ioctl+0x6c/0xa0 [ 200.556235][ T6240] __se_sys_ioctl+0x48/0x170 [ 200.556260][ T6240] do_syscall_64+0x4c/0xa0 [ 200.556279][ T6240] ? clear_bhb_loop+0x30/0x80 [ 200.556306][ T6240] ? clear_bhb_loop+0x30/0x80 [ 200.556338][ T6240] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 200.556363][ T6240] RIP: 0033:0x7f33d4fc5b19 [ 200.556385][ T6240] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.556405][ T6240] RSP: 002b:00007f33d321c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 200.556433][ T6240] RAX: ffffffffffffffda RBX: 00007f33d524bfa0 RCX: 00007f33d4fc5b19 [ 200.556451][ T6240] RDX: 0000000000000000 RSI: 00000000400454ca RDI: 0000000000000006 [ 200.556467][ T6240] RBP: 00007f33d505db70 R08: 0000000000000000 R09: 0000000000000000 [ 200.556482][ T6240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 200.556496][ T6240] R13: 00007f33d524c038 R14: 00007f33d524bfa0 R15: 00007ffe79e79738 [ 200.556529][ T6240] [ 200.563951][ T6240] ERROR: Out of memory at tomoyo_realpath_from_path. [ 201.054664][ T6256] loop9: detected capacity change from 0 to 7 [ 201.125480][ T6256] Dev loop9: unable to read RDB block 7 [ 201.125612][ T6256] loop9: unable to read partition table [ 201.126387][ T6256] loop9: partition table beyond EOD, truncated [ 201.126420][ T6256] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 202.022714][ T6262] loop6: detected capacity change from 0 to 512 [ 202.135279][ T6262] EXT4-fs (loop6): 1 orphan inode deleted [ 202.135350][ T6262] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 202.135457][ T6262] ext4 filesystem being mounted at /44/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 202.434642][ T6272] vivid-001: disconnect [ 203.065948][ T6272] vivid-001: reconnect [ 203.576491][ T7] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 203.826400][ T7] usb 5-1: Using ep0 maxpacket: 16 [ 203.986500][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 203.986531][ T7] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 204.161427][ T7] usb 5-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 204.161465][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.161490][ T7] usb 5-1: Product: syz [ 204.161508][ T7] usb 5-1: Manufacturer: syz [ 204.161525][ T7] usb 5-1: SerialNumber: syz [ 204.483824][ T7] usb 5-1: USB disconnect, device number 3 [ 205.801393][ T6317] vivid-001: disconnect [ 205.962647][ T6317] vivid-001: reconnect [ 206.243711][ T6321] loop3: detected capacity change from 0 to 512 [ 206.443604][ T6321] EXT4-fs (loop3): 1 orphan inode deleted [ 206.450593][ T6321] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 206.476608][ T6321] ext4 filesystem being mounted at /99/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 206.938833][ T6360] vivid-001: disconnect [ 207.578252][ T6351] vivid-001: reconnect [ 208.022153][ T6371] loop6: detected capacity change from 0 to 512 [ 208.163542][ T6371] EXT4-fs (loop6): 1 orphan inode deleted [ 208.212929][ T6371] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 208.322092][ T6371] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 208.632681][ T6385] device syzkaller0 entered promiscuous mode [ 208.786777][ T13] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 209.036486][ T13] usb 4-1: Using ep0 maxpacket: 16 [ 209.181895][ T6413] vivid-001: disconnect [ 209.247456][ T6324] block2mtd: error: cannot open device /dev/l [ 209.823597][ T6398] vivid-001: reconnect [ 209.943795][ T6416] loop1: detected capacity change from 0 to 512 [ 210.007228][ T13] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 210.017708][ T13] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 210.071784][ T6416] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 210.105293][ T6416] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 210.121999][ T6422] loop0: detected capacity change from 0 to 512 [ 210.136085][ T6416] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 210.216835][ T13] usb 4-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 210.225931][ T13] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.255844][ T13] usb 4-1: Product: syz [ 210.260477][ T13] usb 4-1: Manufacturer: syz [ 210.265215][ T13] usb 4-1: SerialNumber: syz [ 210.292511][ T6416] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.516: Allocating blocks 41-42 which overlap fs metadata [ 210.358179][ T6422] EXT4-fs (loop0): 1 orphan inode deleted [ 210.363989][ T6422] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 210.424555][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 210.437012][ T6416] Quota error (device loop1): write_blk: dquota write failed [ 210.445635][ T6422] ext4 filesystem being mounted at /97/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 210.486474][ T6416] Quota error (device loop1): find_free_dqentry: Can't write quota data block 5 [ 210.576901][ T6416] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.516: Allocating blocks 41-42 which overlap fs metadata [ 210.620822][ T13] usb 4-1: USB disconnect, device number 2 [ 210.650107][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 210.670020][ T6416] Quota error (device loop1): write_blk: dquota write failed [ 210.692661][ T6416] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 210.725814][ T6438] tipc: Started in network mode [ 210.738381][ T6416] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.516: Failed to acquire dquot type 1 [ 210.756506][ T6438] tipc: Node identity 827653ac15da, cluster identity 4711 [ 210.765085][ T6438] tipc: Enabled bearer , priority 0 [ 210.788274][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 210.794967][ T6416] EXT4-fs error (device loop1): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 210.851602][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 210.859043][ T6437] tipc: Resetting bearer [ 210.885861][ T6416] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.516: corrupted inode contents [ 210.947631][ T6437] tipc: Disabling bearer [ 210.965963][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 210.985976][ T6416] EXT4-fs error (device loop1): ext4_dirty_inode:6087: inode #12: comm syz.1.516: mark_inode_dirty error [ 211.012104][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 211.023353][ T6416] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.516: corrupted inode contents [ 211.068209][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 211.157428][ T6416] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #12: comm syz.1.516: mark_inode_dirty error [ 211.206848][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 211.255182][ T6416] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.516: corrupted inode contents [ 211.269319][ T6453] loop0: detected capacity change from 0 to 512 [ 211.324593][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 211.336912][ T6416] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 211.512426][ T6456] rxe_eth0 speed is unknown, defaulting to 1000 [ 212.668228][ T6456] loop6: detected capacity change from 0 to 1024 [ 212.754669][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 213.120049][ T6416] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.516: corrupted inode contents [ 214.106853][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 214.113680][ T6416] EXT4-fs error (device loop1): ext4_truncate:4286: inode #12: comm syz.1.516: mark_inode_dirty error [ 214.246269][ T6460] vivid-001: disconnect [ 214.384168][ T6454] vivid-001: reconnect [ 214.735035][ T6453] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,errors=remount-ro,. Quota mode: writeback. [ 214.937565][ T6453] ext4 filesystem being mounted at /98/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 214.959688][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 215.007680][ T6416] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 215.098205][ T6416] EXT4-fs (loop1): Remounting filesystem read-only [ 215.162188][ T6416] EXT4-fs (loop1): 1 truncate cleaned up [ 215.203130][ T6416] EXT4-fs (loop1): mounted filesystem without journal. Opts: delalloc,noblock_validity,jqfmt=vfsold,nodelalloc,errors=remount-ro,nomblk_io_submit,nojournal_checksum,user_xattr,resgid=0x00000000000000002. Quota mode: writeback. [ 215.329328][ T6469] FAULT_INJECTION: forcing a failure. [ 215.329328][ T6469] name failslab, interval 1, probability 0, space 0, times 0 [ 215.386433][ T6469] CPU: 1 PID: 6469 Comm: syz.4.534 Not tainted syzkaller #0 [ 215.393856][ T6469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 215.403979][ T6469] Call Trace: [ 215.407305][ T6469] [ 215.410283][ T6469] dump_stack_lvl+0x188/0x250 [ 215.415111][ T6469] ? show_regs_print_info+0x20/0x20 [ 215.420354][ T6469] ? load_image+0x410/0x410 [ 215.424921][ T6469] ? __might_sleep+0xf0/0xf0 [ 215.429687][ T6469] ? __lock_acquire+0x7d40/0x7d40 [ 215.434797][ T6469] should_fail+0x383/0x4b0 [ 215.439463][ T6469] should_failslab+0x5/0x20 [ 215.444035][ T6469] slab_pre_alloc_hook+0x51/0xc0 [ 215.449118][ T6469] ? __kernfs_new_node+0xe3/0x6b0 [ 215.454299][ T6469] kmem_cache_alloc+0x3d/0x280 [ 215.459133][ T6469] __kernfs_new_node+0xe3/0x6b0 [ 215.464258][ T6469] ? __lock_acquire+0x7d40/0x7d40 [ 215.469344][ T6469] ? kernfs_new_node+0x250/0x250 [ 215.474350][ T6469] ? kernfs_activate+0x1eb/0x210 [ 215.479553][ T6469] kernfs_new_node+0x148/0x250 [ 215.482285][ T6474] vivid-001: disconnect [ 215.484643][ T6469] __kernfs_create_file+0x47/0x2e0 [ 215.494234][ T6469] sysfs_add_file_mode_ns+0x2d2/0x390 [ 215.499825][ T6469] internal_create_group+0x492/0xd00 [ 215.505201][ T6469] ? sysfs_create_group+0x20/0x20 [ 215.510560][ T6469] ? kernfs_add_one+0x564/0x6c0 [ 215.515656][ T6469] sysfs_create_groups+0x55/0x120 [ 215.520932][ T6469] device_add_attrs+0x82/0x690 [ 215.525867][ T6469] device_add+0x677/0x1050 [ 215.530560][ T6469] netdev_register_kobject+0x184/0x320 [ 215.536350][ T6469] register_netdevice+0x10e8/0x1720 [ 215.542062][ T6469] ? netif_stacked_transfer_operstate+0x200/0x200 [ 215.548704][ T6469] ? lockdep_softirqs_off+0x430/0x430 [ 215.554595][ T6469] slcan_open+0x6f0/0x9a0 [ 215.559421][ T6469] ? rcu_lock_release+0x20/0x20 [ 215.564352][ T6469] ? up_write+0x1b6/0x410 [ 215.568918][ T6469] tty_set_ldisc+0x358/0x660 [ 215.573563][ T6469] tty_ioctl+0xa8b/0xc30 [ 215.577881][ T6469] ? tty_get_icount+0xa0/0xa0 [ 215.582622][ T6469] __se_sys_ioctl+0xfa/0x170 [ 215.587363][ T6469] do_syscall_64+0x4c/0xa0 [ 215.592049][ T6469] ? clear_bhb_loop+0x30/0x80 [ 215.597018][ T6469] ? clear_bhb_loop+0x30/0x80 [ 215.601759][ T6469] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 215.607910][ T6469] RIP: 0033:0x7fe0d3f59b19 [ 215.612730][ T6469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 215.632675][ T6469] RSP: 002b:00007fe0d21b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 215.641244][ T6469] RAX: ffffffffffffffda RBX: 00007fe0d41dffa0 RCX: 00007fe0d3f59b19 [ 215.649269][ T6469] RDX: 0000200000000940 RSI: 0000000000005423 RDI: 0000000000000004 [ 215.650490][ C0] vkms_vblank_simulate: vblank timer overrun [ 215.657283][ T6469] RBP: 00007fe0d3ff1b70 R08: 0000000000000000 R09: 0000000000000000 [ 215.671467][ T6469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 215.679711][ T6469] R13: 00007fe0d41e0038 R14: 00007fe0d41dffa0 R15: 00007ffcfbc29018 [ 215.687950][ T6469] [ 216.077802][ T6474] vivid-001: reconnect [ 217.176638][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unknown main item tag 0x0 [ 217.185051][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unknown main item tag 0x0 [ 217.234743][ T6491] loop1: detected capacity change from 0 to 512 [ 217.255649][ T6492] loop3: detected capacity change from 0 to 1024 [ 217.266618][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unknown main item tag 0x0 [ 217.275154][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unknown main item tag 0x0 [ 217.291938][ T6492] EXT4-fs (loop3): Ignoring removed bh option [ 217.294095][ T6494] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 217.302137][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unknown main item tag 0x0 [ 217.307049][ T6494] device-mapper: raid: Choosing default region size of 4MiB [ 217.366778][ T6494] md/raid1:mdX: active with 1 out of 1 mirrors [ 217.380602][ T1111] logitech-hidpp-device 0005:046D:B012.0005: unbalanced collection at end of report description [ 217.396244][ T1111] logitech-hidpp-device 0005:046D:B012.0005: hidpp_probe:parse failed [ 217.405084][ T1111] logitech-hidpp-device: probe of 0005:046D:B012.0005 failed with error -22 [ 217.417471][ T6492] EXT4-fs (loop3): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,jqfmt=vfsv1,abort,debug_want_extra_isize=0x0000000000000008,lazytime,errors=remount-ro,stripe=0x0000000000000007,bh,auto_da_alloc,. Quota mode: none. [ 217.447477][ T6491] EXT4-fs (loop1): 1 orphan inode deleted [ 217.493337][ T6505] loop6: detected capacity change from 0 to 512 [ 217.502076][ T6491] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 217.514146][ T6491] ext4 filesystem being mounted at /94/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 217.577820][ T6494] device-mapper: ioctl: device has been removed from the dev hash table. [ 217.798036][ T6505] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 217.811765][ T6505] ext4 filesystem being mounted at /72/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 217.914028][ T6514] vivid-001: disconnect [ 218.525838][ T6514] vivid-001: reconnect [ 218.752622][ T6521] loop4: detected capacity change from 0 to 512 [ 218.824422][ T6521] EXT4-fs (loop4): Mount option "dioread_nolock" incompatible with ext3 [ 219.065191][ T6533] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4190] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6533] [ 219.436965][ T4270] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 219.847464][ T4270] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.890991][ T4270] usb 5-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 219.992814][ T4270] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 254 [ 220.049094][ T6535] tipc: Started in network mode [ 220.062179][ T6535] tipc: Node identity b2c6ec36afc3, cluster identity 4711 [ 220.076770][ T6535] tipc: Enabled bearer , priority 0 [ 220.107265][ T4270] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 220.136944][ T4270] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 220.145101][ T4270] usb 5-1: SerialNumber: syz [ 220.150657][ T6529] tipc: Resetting bearer [ 220.202614][ T6549] loop0: detected capacity change from 0 to 512 [ 220.210676][ T4270] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 220.227466][ T4270] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 220.240900][ T4270] cdc_acm: probe of 5-1:1.0 failed with error -22 [ 220.288839][ T6529] tipc: Disabling bearer [ 220.301712][ T6549] EXT4-fs (loop0): Test dummy encryption mode enabled [ 220.311043][ T6549] EXT4-fs (loop0): Ignoring removed oldalloc option [ 220.391033][ T6549] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,grpjquota=,test_dummy_encryption=v1,noload,noload,oldalloc,grpid,,errors=continue. Quota mode: writeback. [ 220.488162][ T4195] logitech-hidpp-device 0005:046D:B012.0006: unknown main item tag 0x0 [ 220.974380][ T6561] loop6: detected capacity change from 0 to 512 [ 221.220200][ T4195] logitech-hidpp-device 0005:046D:B012.0006: unbalanced collection at end of report description [ 221.234137][ T4195] logitech-hidpp-device 0005:046D:B012.0006: hidpp_probe:parse failed [ 221.242580][ T4195] logitech-hidpp-device: probe of 0005:046D:B012.0006 failed with error -22 [ 221.358459][ T6561] EXT4-fs (loop6): 1 orphan inode deleted [ 221.393940][ T6561] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 221.406049][ T6561] ext4 filesystem being mounted at /75/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 221.512394][ T6576] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 221.646906][ T6576] device-mapper: raid: Choosing default region size of 4MiB [ 221.681990][ T6580] loop0: detected capacity change from 0 to 512 [ 221.724769][ T6580] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 221.755313][ T4266] usb 5-1: USB disconnect, device number 4 [ 221.827811][ T6587] vivid-001: disconnect [ 222.200184][ T6580] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802e01c, mo2=0002] [ 222.409695][ T6587] vivid-001: reconnect [ 222.466934][ T6580] System zones: 1-12 [ 222.472040][ T6580] EXT4-fs (loop0): orphan cleanup on readonly fs [ 222.490161][ T6576] md/raid1:mdX: active with 1 out of 1 mirrors [ 222.582356][ T6580] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #11: comm syz.0.555: attempt to clear invalid blocks 1024 len 1 [ 222.603529][ T6580] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.555: bg 0: block 361: padding at end of block bitmap is not set [ 222.668656][ T6580] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 222.770608][ T6596] netlink: 8 bytes leftover after parsing attributes in process `syz.6.559'. [ 222.795676][ T6580] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.555: invalid indirect mapped block 1811939328 (level 0) [ 222.818998][ T6580] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.555: invalid indirect mapped block 2 (level 2) [ 222.863688][ T6580] EXT4-fs (loop0): 1 truncate cleaned up [ 222.869801][ T6580] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,,errors=continue. Quota mode: none. [ 222.950529][ T6604] loop1: detected capacity change from 0 to 1024 [ 224.139605][ T6615] netlink: 144 bytes leftover after parsing attributes in process `syz.3.568'. [ 224.319782][ T4266] logitech-hidpp-device 0005:046D:B012.0007: unknown main item tag 0x0 [ 224.359634][ T4266] logitech-hidpp-device 0005:046D:B012.0007: unbalanced collection at end of report description [ 224.405099][ T6604] EXT4-fs (loop1): Ignoring removed bh option [ 224.472182][ T6627] loop4: detected capacity change from 0 to 512 [ 224.489092][ T4266] logitech-hidpp-device 0005:046D:B012.0007: hidpp_probe:parse failed [ 224.514785][ T4266] logitech-hidpp-device: probe of 0005:046D:B012.0007 failed with error -22 [ 224.534184][ T6604] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,jqfmt=vfsv1,abort,debug_want_extra_isize=0x0000000000000008,lazytime,errors=remount-ro,stripe=0x0000000000000007,bh,auto_da_alloc,. Quota mode: none. [ 224.556793][ C1] vkms_vblank_simulate: vblank timer overrun [ 224.658470][ T6627] EXT4-fs (loop4): 1 orphan inode deleted [ 224.664274][ T6627] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 224.696064][ T6627] ext4 filesystem being mounted at /155/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 225.013157][ T6651] vivid-001: disconnect [ 225.646721][ T6651] vivid-001: reconnect [ 225.808280][ T6656] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 225.815984][ T6656] device-mapper: raid: Choosing default region size of 4MiB [ 226.078325][ T6668] loop4: detected capacity change from 0 to 512 [ 226.125851][ T6656] md/raid1:mdX: active with 1 out of 1 mirrors [ 226.514487][ T6668] EXT4-fs (loop4): mounted filesystem without journal. Opts: block_validity,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 226.531530][ T6677] IPVS: sync thread started: state = MASTER, mcast_ifn = bond_slave_0, syncid = 1, id = 0 [ 226.798407][ T6676] loop3: detected capacity change from 0 to 512 [ 226.835592][ T6668] ext4 filesystem being mounted at /157/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 226.969755][ T6676] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 227.054215][ T1350] logitech-hidpp-device 0005:046D:B012.0008: unknown main item tag 0x0 [ 227.064519][ T6676] ext4 filesystem being mounted at /111/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 227.093769][ T1350] logitech-hidpp-device 0005:046D:B012.0008: unbalanced collection at end of report description [ 227.109001][ T6683] netlink: 144 bytes leftover after parsing attributes in process `syz.1.580'. [ 227.132328][ T1350] logitech-hidpp-device 0005:046D:B012.0008: hidpp_probe:parse failed [ 227.162543][ T1350] logitech-hidpp-device: probe of 0005:046D:B012.0008 failed with error -22 [ 227.466642][ T6695] tipc: Started in network mode [ 227.471597][ T6695] tipc: Node identity 0a5e0c7accb7, cluster identity 4711 [ 227.683775][ T6695] tipc: Enabled bearer , priority 0 [ 227.956346][ T6700] vivid-001: disconnect [ 228.319816][ T6700] vivid-001: reconnect [ 228.440977][ T6699] loop6: detected capacity change from 0 to 512 [ 228.458124][ T6694] tipc: Resetting bearer [ 228.600532][ T6694] tipc: Disabling bearer [ 228.698320][ T6699] EXT4-fs (loop6): 1 orphan inode deleted [ 228.704274][ T6699] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 228.766979][ T26] audit: type=1326 audit(1794116555.816:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6713 comm="syz.4.586" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe0d3f59b19 code=0x0 [ 228.796460][ T6699] ext4 filesystem being mounted at /82/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 228.833658][ T6716] loop4: detected capacity change from 0 to 256 [ 228.921435][ T6715] loop0: detected capacity change from 0 to 1024 [ 229.076917][ T6715] EXT4-fs (loop0): Ignoring removed bh option [ 229.234699][ T6715] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,jqfmt=vfsv1,abort,debug_want_extra_isize=0x0000000000000008,lazytime,errors=remount-ro,stripe=0x0000000000000007,bh,auto_da_alloc,. Quota mode: none. [ 230.301267][ T6740] loop1: detected capacity change from 0 to 512 [ 230.503959][ T6740] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 230.623120][ T6740] ext4 filesystem being mounted at /105/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 230.715448][ T6757] netlink: 144 bytes leftover after parsing attributes in process `syz.6.596'. [ 231.183628][ T6776] vivid-001: disconnect [ 231.479354][ T6774] loop0: detected capacity change from 0 to 512 [ 231.821580][ T6776] vivid-001: reconnect [ 232.060380][ T6774] EXT4-fs (loop0): 1 orphan inode deleted [ 232.077458][ T6774] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 232.151662][ T6774] ext4 filesystem being mounted at /111/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 232.242533][ T6804] loop6: detected capacity change from 0 to 1024 [ 232.340646][ T6804] EXT4-fs (loop6): Ignoring removed bh option [ 232.615928][ T6804] EXT4-fs (loop6): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,jqfmt=vfsv1,abort,debug_want_extra_isize=0x0000000000000008,lazytime,errors=remount-ro,stripe=0x0000000000000007,bh,auto_da_alloc,. Quota mode: none. [ 233.372377][ T6831] loop9: detected capacity change from 0 to 7 [ 233.384110][ T6831] Dev loop9: unable to read RDB block 7 [ 233.389837][ T6831] loop9: unable to read partition table [ 233.395698][ T6831] loop9: partition table beyond EOD, truncated [ 233.402071][ T6831] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 233.499533][ T6833] vivid-001: disconnect [ 234.107882][ T6833] vivid-001: reconnect [ 234.239437][ T5210] logitech-hidpp-device 0005:046D:B012.0009: unknown main item tag 0x0 [ 234.295880][ T5210] logitech-hidpp-device 0005:046D:B012.0009: unbalanced collection at end of report description [ 234.308445][ T6839] netlink: 'syz.1.629': attribute type 11 has an invalid length. [ 234.341449][ T5210] logitech-hidpp-device 0005:046D:B012.0009: hidpp_probe:parse failed [ 234.354361][ T5210] logitech-hidpp-device: probe of 0005:046D:B012.0009 failed with error -22 [ 234.368384][ T6843] IPVS: sync thread started: state = MASTER, mcast_ifn = bond_slave_0, syncid = 1, id = 0 [ 234.385260][ T6845] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 234.493709][ T6839] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 234.812392][ T6857] loop3: detected capacity change from 0 to 512 [ 235.713042][ T6857] EXT4-fs (loop3): 1 orphan inode deleted [ 235.759667][ T6857] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 235.828538][ T6857] ext4 filesystem being mounted at /122/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 237.027601][ T6884] vivid-001: disconnect [ 237.062087][ T6886] loop9: detected capacity change from 0 to 7 [ 237.227434][ T6884] vivid-001: reconnect [ 237.232190][ T6886] Dev loop9: unable to read RDB block 7 [ 237.237856][ T6886] loop9: unable to read partition table [ 237.243677][ T6886] loop9: partition table beyond EOD, truncated [ 237.249975][ T6886] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 237.600672][ T6882] device syzkaller1 entered promiscuous mode [ 237.861545][ T6909] overlayfs: failed to clone upperpath [ 238.083662][ T6918] loop3: detected capacity change from 0 to 512 [ 239.055515][ T6918] EXT4-fs (loop3): 1 orphan inode deleted [ 239.065961][ T6943] loop9: detected capacity change from 0 to 7 [ 239.090387][ T6943] Dev loop9: unable to read RDB block 7 [ 239.097261][ T6943] loop9: unable to read partition table [ 239.103112][ T6943] loop9: partition table beyond EOD, truncated [ 239.108555][ T6482] logitech-hidpp-device 0005:046D:B012.000A: Device not connected [ 239.109727][ T6943] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 239.133380][ T6918] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 239.200998][ T6946] vivid-001: disconnect [ 239.390749][ T6918] ext4 filesystem being mounted at /125/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 239.848935][ T6946] vivid-001: reconnect [ 240.031160][ T6951] loop4: detected capacity change from 0 to 512 [ 240.068580][ T6954] loop1: detected capacity change from 0 to 1024 [ 240.084829][ T6951] EXT4-fs (loop4): Test dummy encryption mode enabled [ 240.133666][ T6951] EXT4-fs (loop4): can't mount with commit=7, fs mounted w/o journal [ 240.145552][ T6954] EXT4-fs (loop1): Ignoring removed oldalloc option [ 240.178347][ T6954] EXT4-fs (loop1): Ignoring removed orlov option [ 240.385630][ T6954] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobarrier,oldalloc,orlov,dioread_lock,,errors=continue. Quota mode: none. [ 240.407056][ T6954] ext4 filesystem being mounted at /113/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 240.623172][ T1270] EXT4-fs error (device loop1): ext4_map_blocks:741: inode #15: comm kworker/u4:5: lblock 0 mapped to illegal pblock 0 (length 1) [ 241.027327][ T1270] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 241.050622][ T6973] loop3: detected capacity change from 0 to 512 [ 241.125292][ T1270] EXT4-fs (loop1): This should not happen!! Data will be lost [ 241.125292][ T1270] [ 242.302151][ T6983] netlink: 'syz.6.657': attribute type 4 has an invalid length. [ 242.373004][ T6985] loop0: detected capacity change from 0 to 1024 [ 242.473685][ T6988] FAULT_INJECTION: forcing a failure. [ 242.473685][ T6988] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 242.595277][ T6988] CPU: 0 PID: 6988 Comm: syz.1.654 Not tainted syzkaller #0 [ 242.602750][ T6988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 242.612857][ T6988] Call Trace: [ 242.616171][ T6988] [ 242.619161][ T6988] dump_stack_lvl+0x188/0x250 [ 242.623900][ T6988] ? show_regs_print_info+0x20/0x20 [ 242.629170][ T6988] ? load_image+0x410/0x410 [ 242.633729][ T6988] ? __lock_acquire+0x7d40/0x7d40 [ 242.638811][ T6988] should_fail+0x383/0x4b0 [ 242.643284][ T6988] prepare_alloc_pages+0x1e3/0x5b0 [ 242.648469][ T6988] __alloc_pages+0x11b/0x480 [ 242.653115][ T6988] ? zone_statistics+0x170/0x170 [ 242.658118][ T6988] ? rcu_lock_release+0x5/0x20 [ 242.662938][ T6988] kmalloc_large_node+0x7d/0x1a0 [ 242.667940][ T6988] __kmalloc_node+0x21e/0x3a0 [ 242.672678][ T6988] kvmalloc_node+0x84/0x130 [ 242.677244][ T6988] nf_tables_newrule+0x1151/0x27a0 [ 242.682424][ T6988] ? nf_tables_delchain+0xf00/0xf00 [ 242.687676][ T6988] ? __lock_acquire+0x7d40/0x7d40 [ 242.692767][ T6988] ? nf_tables_newtable+0xce0/0x1680 [ 242.697331][ T6995] loop9: detected capacity change from 0 to 7 [ 242.698115][ T6988] ? __nla_parse+0x3c/0x50 [ 242.708750][ T6988] nfnetlink_rcv+0x1117/0x2450 [ 242.713590][ T6988] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 242.719230][ T6988] ? rcu_lock_release+0x5/0x20 [ 242.722862][ T6995] Dev loop9: unable to read RDB block 7 [ 242.724041][ T6988] ? __lock_acquire+0x7d40/0x7d40 [ 242.729939][ T6995] loop9: unable to read partition table [ 242.734662][ T6988] netlink_unicast+0x804/0x9e0 [ 242.740946][ T6995] loop9: partition table beyond EOD, truncated [ 242.745080][ T6988] netlink_sendmsg+0x8ba/0xbe0 [ 242.753247][ T6995] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 242.756044][ T6988] ? netlink_getsockopt+0x570/0x570 [ 242.774028][ T6988] ? aa_sock_msg_perm+0x94/0x150 [ 242.779023][ T6988] ? apparmor_socket_sendmsg+0x88/0x230 [ 242.784619][ T6988] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 242.789960][ T6988] ? security_socket_sendmsg+0x7c/0xa0 [ 242.795473][ T6988] ? netlink_getsockopt+0x570/0x570 [ 242.800738][ T6988] ____sys_sendmsg+0x5be/0x8f0 [ 242.805565][ T6988] ? __sys_sendmsg_sock+0x30/0x30 [ 242.810650][ T6988] ? import_iovec+0x6f/0xa0 [ 242.815235][ T6988] ___sys_sendmsg+0x236/0x2e0 [ 242.820086][ T6988] ? __sys_sendmsg+0x290/0x290 [ 242.824955][ T6988] __se_sys_sendmsg+0x1b7/0x2a0 [ 242.829870][ T6988] ? __x64_sys_sendmsg+0x80/0x80 [ 242.834860][ T6988] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 242.840912][ T6988] ? lockdep_hardirqs_on+0x94/0x140 [ 242.846164][ T6988] do_syscall_64+0x4c/0xa0 [ 242.850626][ T6988] ? clear_bhb_loop+0x30/0x80 [ 242.855359][ T6988] ? clear_bhb_loop+0x30/0x80 [ 242.860087][ T6988] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 242.866031][ T6988] RIP: 0033:0x7f8719c89b19 [ 242.870509][ T6988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.890295][ T6988] RSP: 002b:00007f8717ee0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 242.898767][ T6988] RAX: ffffffffffffffda RBX: 00007f8719f0ffa0 RCX: 00007f8719c89b19 [ 242.906788][ T6988] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 242.914806][ T6988] RBP: 00007f8719d21b70 R08: 0000000000000000 R09: 0000000000000000 [ 242.923360][ T6988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.931377][ T6988] R13: 00007f8719f10038 R14: 00007f8719f0ffa0 R15: 00007ffcf4030448 [ 242.939413][ T6988] [ 242.979840][ T6985] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,,errors=continue. Quota mode: none. [ 243.000520][ T6985] ext4 filesystem being mounted at /124/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 243.481980][ T4271] logitech-hidpp-device 0005:046D:B012.000B: Device not connected [ 243.566255][ T7009] vivid-001: disconnect [ 244.190422][ T7009] vivid-001: reconnect [ 244.611648][ T7024] vivid-001: disconnect [ 245.258043][ T7010] vivid-001: reconnect [ 245.291293][ T7026] loop0: detected capacity change from 0 to 512 [ 245.532202][ T7034] FAULT_INJECTION: forcing a failure. [ 245.532202][ T7034] name fail_futex, interval 1, probability 0, space 0, times 0 [ 245.935769][ T7034] CPU: 0 PID: 7034 Comm: syz.6.670 Not tainted syzkaller #0 [ 245.943156][ T7034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 245.953255][ T7034] Call Trace: [ 245.956576][ T7034] [ 245.959547][ T7034] dump_stack_lvl+0x188/0x250 [ 245.964282][ T7034] ? stack_trace_snprint+0xe0/0xe0 [ 245.969433][ T7034] ? show_regs_print_info+0x20/0x20 [ 245.974687][ T7034] ? load_image+0x410/0x410 [ 245.979235][ T7034] ? __kasan_slab_alloc+0xa9/0xc0 [ 245.984414][ T7034] ? slab_post_alloc_hook+0x4c/0x380 [ 245.989755][ T7034] ? kmem_cache_alloc+0x15d/0x280 [ 245.994815][ T7034] ? security_file_alloc+0x30/0x110 [ 246.000049][ T7034] ? __alloc_file+0xc2/0x240 [ 246.004681][ T7034] ? alloc_empty_file+0x90/0x180 [ 246.009659][ T7034] ? alloc_file+0x5c/0x510 [ 246.014119][ T7034] should_fail+0x383/0x4b0 [ 246.018739][ T7034] get_futex_key+0x1a0/0x1200 [ 246.023521][ T7034] ? __lock_acquire+0x13b3/0x7d40 [ 246.028598][ T7034] ? futex_wait_restart+0x250/0x250 [ 246.033869][ T7034] futex_wake+0x101/0x540 [ 246.038262][ T7034] ? futex_wait+0x680/0x680 [ 246.042935][ T7034] ? verify_lock_unused+0x140/0x140 [ 246.048195][ T7034] ? verify_lock_unused+0x140/0x140 [ 246.053452][ T7034] do_futex+0xd83/0x12b0 [ 246.057879][ T7034] ? __raw_spin_lock_init+0x41/0x100 [ 246.063244][ T7034] ? futex_exit_release+0x1c0/0x1c0 [ 246.068498][ T7034] ? __context_tracking_exit+0x4c/0x80 [ 246.074027][ T7034] __se_sys_futex+0x389/0x420 [ 246.078759][ T7034] ? __x64_sys_futex+0xf0/0xf0 [ 246.083579][ T7034] ? __x64_sys_futex+0x1d/0xf0 [ 246.088404][ T7034] do_syscall_64+0x4c/0xa0 [ 246.092886][ T7034] ? clear_bhb_loop+0x30/0x80 [ 246.097608][ T7034] ? clear_bhb_loop+0x30/0x80 [ 246.102325][ T7034] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 246.108259][ T7034] RIP: 0033:0x7fc77e38bb19 [ 246.112713][ T7034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 246.132364][ T7034] RSP: 002b:00007fc77c5e20e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 246.140829][ T7034] RAX: ffffffffffffffda RBX: 00007fc77e611fa8 RCX: 00007fc77e38bb19 [ 246.148845][ T7034] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc77e611fac [ 246.156856][ T7034] RBP: 00007fc77e611fa0 R08: 001ccdc4f8b4cce6 R09: 0000000000000000 [ 246.164863][ T7034] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 246.173336][ T7034] R13: 00007fc77e612038 R14: 00007fffe18645a0 R15: 00007fffe1864688 [ 246.181626][ T7034] [ 246.327816][ T7045] netlink: 'syz.3.672': attribute type 11 has an invalid length. [ 246.380269][ T7026] EXT4-fs (loop0): 1 orphan inode deleted [ 246.397744][ T7051] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 246.406698][ T7026] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 246.418675][ T7026] ext4 filesystem being mounted at /125/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 246.491996][ T1111] logitech-hidpp-device 0005:046D:B012.000C: Device not connected [ 246.518731][ T7051] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 247.541381][ T7064] loop1: detected capacity change from 0 to 1024 [ 247.637963][ T7068] vivid-001: disconnect [ 247.678651][ T7064] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpjquota=,,errors=continue. Quota mode: writeback. [ 247.783304][ T7068] vivid-001: reconnect [ 247.845946][ T7076] block device autoloading is deprecated and will be removed. [ 247.927222][ T7076] md: invalid raid superblock magic on ram12 [ 248.000025][ T7076] md: ram12 does not have a valid v0.0 superblock, not importing! [ 248.057584][ T7076] md: md_import_device returned -22 [ 248.816525][ T7093] vivid-001: disconnect [ 249.106406][ T7088] Can't find ip_set type ha [ 249.144126][ T7077] vivid-001: reconnect [ 249.522153][ T4195] logitech-hidpp-device 0005:046D:B012.000D: Device not connected [ 249.617659][ T7109] loop0: detected capacity change from 0 to 512 [ 250.565336][ T7124] netlink: 'syz.4.695': attribute type 11 has an invalid length. [ 250.697471][ T7131] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 250.719993][ T7109] EXT4-fs (loop0): 1 orphan inode deleted [ 250.726036][ T7109] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 250.739500][ T7109] ext4 filesystem being mounted at /128/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 250.751740][ T7128] vivid-001: disconnect [ 250.829262][ T7124] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 250.897741][ T7128] vivid-001: reconnect [ 251.128836][ T7149] loop9: detected capacity change from 0 to 7 [ 251.141597][ T7149] Dev loop9: unable to read RDB block 7 [ 251.147988][ T7149] loop9: unable to read partition table [ 251.153805][ T7149] loop9: partition table beyond EOD, truncated [ 251.160144][ T7149] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 251.530144][ T7153] vivid-001: disconnect [ 252.104274][ T7145] vivid-001: reconnect [ 252.171660][ T7156] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(0.0.0), cmd(11) [ 252.387359][ T7162] loop0: detected capacity change from 0 to 512 [ 252.415705][ T7164] capability: warning: `syz.6.706' uses deprecated v2 capabilities in a way that may be insecure [ 252.469389][ T7162] EXT4-fs (loop0): Test dummy encryption mode enabled [ 252.481176][ T7162] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 252.527442][ T7162] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #16: comm syz.0.705: invalid indirect mapped block 4294967295 (level 0) [ 252.762502][ T7176] loop6: detected capacity change from 0 to 512 [ 252.789423][ T7177] vivid-001: disconnect [ 252.801380][ T7162] EXT4-fs (loop0): Remounting filesystem read-only [ 252.822427][ T7162] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #16: comm syz.0.705: invalid indirect mapped block 4294967295 (level 1) [ 252.919782][ T7179] netlink: 'syz.4.711': attribute type 10 has an invalid length. [ 252.947006][ T7179] team0: Port device virt_wifi0 added [ 253.017200][ T1111] Bluetooth: hci5: command 0x1003 tx timeout [ 253.082344][ T7162] EXT4-fs (loop0): Remounting filesystem read-only [ 253.111440][ T4206] Bluetooth: hci5: sending frame failed (-49) [ 253.168511][ T7162] EXT4-fs (loop0): 1 orphan inode deleted [ 253.289678][ T7176] EXT4-fs (loop6): 1 orphan inode deleted [ 253.336095][ T7162] EXT4-fs (loop0): 1 truncate cleaned up [ 253.521243][ T7177] vivid-001: reconnect [ 253.574326][ T7176] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 253.587996][ T7176] ext4 filesystem being mounted at /113/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 253.636094][ T7162] EXT4-fs (loop0): mounted filesystem without journal. Opts: errors=remount-ro,lazytime,block_validity,test_dummy_encryption,block_validity,quota,jqfmt=vfsv0,. Quota mode: writeback. [ 253.874301][ T7184] netlink: 'syz.4.713': attribute type 11 has an invalid length. [ 253.888594][ T7188] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 254.141859][ T7189] fscrypt (loop0): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 254.204149][ T7188] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 254.437281][ T7200] loop3: detected capacity change from 0 to 512 [ 254.502779][ T7200] EXT4-fs (loop3): Ignoring removed nobh option [ 254.617099][ T7200] fscrypt (loop3, inode 2): Error -61 getting encryption context [ 254.645801][ T7200] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -61 [ 254.665232][ T7200] EXT4-fs error (device loop3): ext4_orphan_get:1410: inode #13: comm syz.3.717: inode has both inline data and extents flags [ 254.701481][ T7200] EXT4-fs error (device loop3): ext4_orphan_get:1415: comm syz.3.717: couldn't read orphan inode 13 (err -117) [ 254.775346][ T7209] vivid-001: disconnect [ 254.869592][ T7200] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,nouid32,nobh,stripe=0x000000000000ffff,block_validity,grpjquota=",errors=continue. Quota mode: writeback. [ 255.424978][ T7201] vivid-001: reconnect [ 255.456048][ T7200] fscrypt (loop3, inode 2): Error -61 getting encryption context [ 255.570463][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.576917][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.600707][ T1111] Bluetooth: hci5: command 0x1001 tx timeout [ 255.607372][ T4206] Bluetooth: hci5: sending frame failed (-49) [ 255.702094][ T7221] loop4: detected capacity change from 0 to 512 [ 256.000048][ T7231] vivid-001: disconnect [ 256.630263][ T7231] vivid-001: reconnect [ 256.725412][ T7221] EXT4-fs (loop4): 1 orphan inode deleted [ 256.726621][ T5210] logitech-hidpp-device 0005:046D:B012.000E: Device not connected [ 256.741302][ T7221] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 256.759702][ T7221] ext4 filesystem being mounted at /184/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 256.895004][ T7243] netlink: 'syz.6.731': attribute type 11 has an invalid length. [ 256.922252][ T7247] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 256.994102][ T7247] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 257.079238][ T7248] vivid-001: disconnect [ 257.142791][ T7255] netdevsim netdevsim3: Direct firmware load for / failed with error -2 [ 257.160814][ T7255] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 257.822732][ T7248] vivid-001: reconnect [ 258.211136][ T1111] Bluetooth: hci5: command 0x1009 tx timeout [ 258.377337][ T4271] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 258.427838][ T4271] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 258.449377][ T7274] loop3: detected capacity change from 0 to 2048 [ 258.591727][ T7284] fido_id[7284]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 258.622474][ T1111] logitech-hidpp-device 0005:046D:B012.0010: Device not connected [ 258.761371][ T7296] overlayfs: missing 'lowerdir' [ 258.774364][ T7298] loop3: detected capacity change from 0 to 512 [ 258.974871][ T26] audit: type=1326 audit(1794116586.016:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.006208][ T26] audit: type=1326 audit(1794116586.016:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.014128][ T7298] EXT4-fs (loop3): 1 orphan inode deleted [ 259.040519][ T7308] vivid-001: disconnect [ 259.042323][ T26] audit: type=1326 audit(1794116586.016:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.073490][ T26] audit: type=1326 audit(1794116586.016:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.097809][ T26] audit: type=1326 audit(1794116586.016:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.123349][ T26] audit: type=1326 audit(1794116586.016:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.148461][ T7298] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 259.170051][ T7298] ext4 filesystem being mounted at /152/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 259.191801][ T26] audit: type=1326 audit(1794116586.016:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.271244][ T26] audit: type=1326 audit(1794116586.016:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.325485][ T26] audit: type=1326 audit(1794116586.016:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.370994][ T26] audit: type=1326 audit(1794116586.016:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7288 comm="syz.0.743" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f33d4fc5b19 code=0x7fc00000 [ 259.422846][ T7315] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 259.442775][ T7315] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 259.457884][ T7313] netlink: 'syz.6.751': attribute type 11 has an invalid length. [ 259.829725][ T7308] vivid-001: reconnect [ 259.848129][ T7322] vivid-001: disconnect [ 260.275042][ T7311] vivid-001: reconnect [ 260.350727][ T7327] loop4: detected capacity change from 0 to 512 [ 260.410712][ T7327] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 260.569019][ T7327] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000000000,norecovery,dioread_nolock,resgid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 260.595231][ T7327] ext4 filesystem being mounted at /191/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 260.823160][ T7339] x_tables: ip_tables: ah match: only valid for protocol 51 [ 261.602238][ T7349] netlink: 'syz.6.758': attribute type 10 has an invalid length. [ 261.693215][ T7349] team0: Port device virt_wifi0 added [ 261.941693][ T7357] loop3: detected capacity change from 0 to 512 [ 262.055637][ T7361] loop1: detected capacity change from 0 to 512 [ 262.315836][ T7361] EXT4-fs (loop1): Invalid want_extra_isize 8 [ 262.709797][ T7364] vivid-001: disconnect [ 262.762264][ T7357] EXT4-fs (loop3): 1 orphan inode deleted [ 262.796513][ T7357] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 262.810602][ T7357] ext4 filesystem being mounted at /156/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 262.862426][ T7364] vivid-001: reconnect [ 262.895793][ T7368] loop0: detected capacity change from 0 to 512 [ 263.027246][ T7368] EXT4-fs (loop0): filesystem is read-only [ 263.073261][ T7375] loop4: detected capacity change from 0 to 1024 [ 263.206766][ T7368] loop0: detected capacity change from 0 to 4096 [ 263.253541][ T7368] EXT4-fs (loop0): Test dummy encryption mode enabled [ 263.270184][ T7375] EXT4-fs (loop4): DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 263.293443][ T7385] netlink: 'syz.3.770': attribute type 11 has an invalid length. [ 263.323455][ T7368] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,bsddf,quota,test_dummy_encryption,lazytime,nodelalloc,minixdf,nogrpid,,errors=continue. Quota mode: writeback. [ 263.347206][ T7388] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 263.515400][ T7385] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 264.151920][ T7414] loop6: detected capacity change from 0 to 512 [ 264.293137][ T6482] logitech-hidpp-device 0005:046D:B012.0011: Device not connected [ 264.339596][ T7414] EXT4-fs (loop6): Invalid want_extra_isize 8 [ 264.366662][ T7422] loop3: detected capacity change from 0 to 512 [ 264.482990][ T7429] vivid-001: disconnect [ 264.812361][ T7422] EXT4-fs (loop3): 1 orphan inode deleted [ 264.828867][ T7422] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 264.840680][ T7422] ext4 filesystem being mounted at /158/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.862894][ T7441] FAULT_INJECTION: forcing a failure. [ 264.862894][ T7441] name failslab, interval 1, probability 0, space 0, times 0 [ 264.899433][ T7441] CPU: 0 PID: 7441 Comm: syz.0.786 Not tainted syzkaller #0 [ 264.906818][ T7441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 264.916924][ T7441] Call Trace: [ 264.920245][ T7441] [ 264.923218][ T7441] dump_stack_lvl+0x188/0x250 [ 264.927964][ T7441] ? show_regs_print_info+0x20/0x20 [ 264.933215][ T7441] ? load_image+0x410/0x410 [ 264.937765][ T7441] ? __might_sleep+0xf0/0xf0 [ 264.942441][ T7441] ? __lock_acquire+0x7d40/0x7d40 [ 264.947534][ T7441] should_fail+0x383/0x4b0 [ 264.952011][ T7441] should_failslab+0x5/0x20 [ 264.956649][ T7441] slab_pre_alloc_hook+0x51/0xc0 [ 264.961737][ T7441] ? __d_alloc+0x27/0x6d0 [ 264.966166][ T7441] kmem_cache_alloc+0x3d/0x280 [ 264.970996][ T7441] __d_alloc+0x27/0x6d0 [ 264.975214][ T7441] d_alloc_parallel+0x7b/0x1320 [ 264.980133][ T7441] ? __init_waitqueue_head+0xa4/0x140 [ 264.985581][ T7441] __lookup_slow+0x134/0x410 [ 264.990260][ T7441] ? lookup_one_len+0x2d0/0x2d0 [ 264.995185][ T7441] ? down_read+0x1aa/0x2e0 [ 264.999658][ T7441] lookup_slow+0x53/0x70 [ 265.003946][ T7441] walk_component+0x314/0x460 [ 265.008676][ T7441] link_path_walk+0x688/0xde0 [ 265.013428][ T7441] ? handle_lookup_down+0x130/0x130 [ 265.018696][ T7441] path_openat+0x28e/0x2fb0 [ 265.023279][ T7441] ? __kasan_slab_alloc+0xa9/0xc0 [ 265.028370][ T7441] ? do_filp_open+0x400/0x400 [ 265.033126][ T7441] do_filp_open+0x1df/0x400 [ 265.037698][ T7441] ? vfs_tmpfile+0x300/0x300 [ 265.042369][ T7441] ? noop_direct_IO+0x10/0x10 [ 265.047237][ T7441] ? _raw_spin_unlock+0x24/0x40 [ 265.052147][ T7441] ? alloc_fd+0x59e/0x650 [ 265.056534][ T7441] do_sys_openat2+0x14b/0x500 [ 265.061269][ T7441] ? __lock_acquire+0x7d40/0x7d40 [ 265.066346][ T7441] ? do_sys_open+0xe0/0xe0 [ 265.070815][ T7441] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 265.076855][ T7441] ? lock_chain_count+0x20/0x20 [ 265.081776][ T7441] __x64_sys_openat+0x135/0x160 [ 265.086869][ T7441] do_syscall_64+0x4c/0xa0 [ 265.091364][ T7441] ? clear_bhb_loop+0x30/0x80 [ 265.096111][ T7441] ? clear_bhb_loop+0x30/0x80 [ 265.100855][ T7441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 265.106799][ T7441] RIP: 0033:0x7f33d4f8634e [ 265.111295][ T7441] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 265.130954][ T7441] RSP: 002b:00007f33d321bf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 265.139419][ T7441] RAX: ffffffffffffffda RBX: 00007f33d321c6c0 RCX: 00007f33d4f8634e [ 265.147487][ T7441] RDX: 0000000000000000 RSI: 00007f33d505d29e RDI: ffffffffffffff9c [ 265.155518][ T7441] RBP: 00007f33d505db70 R08: 0000000000000000 R09: 0000000000000000 [ 265.163539][ T7441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.171555][ T7441] R13: 00007f33d524c038 R14: 00007f33d524bfa0 R15: 00007ffe79e79738 [ 265.179590][ T7441] [ 265.187313][ T7429] vivid-001: reconnect [ 265.298314][ T7449] netlink: 'syz.6.788': attribute type 10 has an invalid length. [ 265.474697][ T7459] netlink: 'syz.1.791': attribute type 11 has an invalid length. [ 265.484345][ T6482] logitech-hidpp-device 0005:046D:B012.0012: Device not connected [ 265.552947][ T7465] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 265.571636][ T7464] loop3: detected capacity change from 0 to 128 [ 265.611979][ T7465] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 265.633806][ T7464] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 265.648040][ T7464] ext4 filesystem being mounted at /159/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 265.838691][ T7476] loop4: detected capacity change from 0 to 8 [ 266.032210][ T7476] unable to read id index table [ 266.756468][ T7491] loop4: detected capacity change from 0 to 512 [ 266.844399][ T7491] EXT4-fs (loop4): Invalid want_extra_isize 8 [ 266.970992][ T7493] loop3: detected capacity change from 0 to 512 [ 267.013739][ T7498] vivid-001: disconnect [ 267.536056][ T7498] vivid-001: reconnect [ 267.778233][ T7493] EXT4-fs (loop3): 1 orphan inode deleted [ 267.929595][ T7493] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 268.060387][ T7493] ext4 filesystem being mounted at /161/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 268.085882][ T4270] Bluetooth: hci2: command 0x0406 tx timeout [ 268.092760][ T4271] logitech-hidpp-device 0005:046D:B012.0013: Device not connected [ 268.796250][ T7529] netlink: 'syz.1.810': attribute type 11 has an invalid length. [ 269.059522][ T7533] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 269.154870][ T7529] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 269.579385][ T7542] vivid-001: disconnect [ 269.584932][ T7542] vivid-001: reconnect [ 270.978074][ T7556] netlink: 256 bytes leftover after parsing attributes in process `syz.4.820'. [ 271.125521][ T7564] netlink: 'syz.3.817': attribute type 10 has an invalid length. [ 271.154804][ T7564] team0: Port device virt_wifi0 added [ 271.914665][ T7558] device-mapper: table: 248:0: writecache: Origin data device lookup failed [ 271.947076][ T7558] device-mapper: ioctl: error adding target to table [ 271.992880][ T7575] loop1: detected capacity change from 0 to 512 [ 272.910969][ T7575] EXT4-fs (loop1): 1 orphan inode deleted [ 272.961377][ T7575] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 273.177308][ T7590] vivid-001: disconnect [ 273.182992][ T7590] vivid-001: reconnect [ 273.307823][ T7575] ext4 filesystem being mounted at /137/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.881264][ T7599] loop6: detected capacity change from 0 to 256 [ 276.945120][ T7631] loop1: detected capacity change from 0 to 512 [ 276.996470][ T7628] vivid-001: disconnect [ 277.002039][ T7628] vivid-001: reconnect [ 277.111871][ T7631] EXT4-fs (loop1): 1 orphan inode deleted [ 277.146636][ T7631] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 277.198641][ T7625] loop4: detected capacity change from 0 to 8192 [ 277.208156][ T7631] ext4 filesystem being mounted at /141/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 277.326229][ T26] kauditd_printk_skb: 53 callbacks suppressed [ 277.326248][ T26] audit: type=1804 audit(1794116604.366:95): pid=7625 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.838" name="/newroot/212/bus/bus" dev="loop4" ino=1048653 res=1 errno=0 [ 278.680010][ T7659] loop4: detected capacity change from 0 to 1024 [ 279.869983][ T7669] vivid-001: disconnect [ 280.049729][ T7669] vivid-001: reconnect [ 280.103434][ T7667] netlink: 'syz.0.853': attribute type 29 has an invalid length. [ 280.127240][ T7667] netlink: 'syz.0.853': attribute type 29 has an invalid length. [ 280.484711][ T7676] loop1: detected capacity change from 0 to 2048 [ 280.612525][ T7659] EXT4-fs (loop4): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,nodelalloc,abort,,errors=continue. Quota mode: none. [ 280.651562][ T7684] Unsupported ieee802154 address type: 0 [ 280.663133][ T7686] ip_tables: iptables: counters copy to user failed while replacing table [ 280.691783][ T7676] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodelalloc,,errors=continue. Quota mode: none. [ 282.331274][ T7704] loop1: detected capacity change from 0 to 256 [ 282.382452][ T7700] loop6: detected capacity change from 0 to 8192 [ 282.383485][ T7706] netlink: 'syz.4.864': attribute type 11 has an invalid length. [ 282.435933][ T26] audit: type=1804 audit(1794116609.476:96): pid=7700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.860" name="/newroot/149/bus/bus" dev="loop6" ino=1048654 res=1 errno=0 [ 282.466936][ T7709] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 282.522079][ T7709] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 282.599738][ T7712] vivid-001: disconnect [ 283.359636][ T7712] vivid-001: reconnect [ 283.834818][ T7723] vivid-001: disconnect [ 284.244711][ T7713] vivid-001: reconnect [ 284.810478][ T7728] loop1: detected capacity change from 0 to 512 [ 284.926790][ T7728] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 284.958636][ T7728] System zones: 1-12 [ 285.003141][ T7735] loop4: detected capacity change from 0 to 512 [ 285.013771][ T7728] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #12: comm syz.1.870: missing EA_INODE flag [ 285.065292][ T7728] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.870: error while reading EA inode 12 err=-117 [ 285.078435][ T7728] EXT4-fs (loop1): 1 orphan inode deleted [ 285.084273][ T7728] EXT4-fs (loop1): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 286.036242][ T7742] fscrypt (loop1, inode 15): Direct key flag not allowed with different contents and filenames modes [ 286.220406][ T7735] EXT4-fs (loop4): 1 orphan inode deleted [ 286.236811][ T7735] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 286.620711][ T7735] ext4 filesystem being mounted at /216/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 286.798699][ T7746] loop6: detected capacity change from 0 to 1024 [ 286.857838][ T7746] EXT4-fs (loop6): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,nodelalloc,abort,,errors=continue. Quota mode: none. [ 287.096225][ T7761] vivid-001: disconnect [ 287.212732][ T7766] netlink: 'syz.1.879': attribute type 11 has an invalid length. [ 287.233107][ T7761] vivid-001: reconnect [ 287.746958][ T7765] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 287.843074][ T7765] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 288.203892][ T7779] loop1: detected capacity change from 0 to 8192 [ 289.667701][ T7784] netlink: 'syz.6.883': attribute type 10 has an invalid length. [ 290.097291][ T7780] md/raid:md4: invalid chunk size 0 [ 290.102586][ T7780] md: pers->run() failed ... [ 290.386488][ T26] audit: type=1804 audit(1794116617.406:97): pid=7779 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.882" name="/newroot/149/bus/bus" dev="loop1" ino=1048656 res=1 errno=0 [ 290.804703][ T7801] netlink: 8 bytes leftover after parsing attributes in process `syz.1.900'. [ 290.894573][ T7799] loop4: detected capacity change from 0 to 512 [ 290.931746][ T7807] netlink: 'syz.6.892': attribute type 11 has an invalid length. [ 291.041092][ T7806] loop3: detected capacity change from 0 to 1024 [ 291.174092][ T7807] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 291.559083][ T7806] EXT4-fs (loop3): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,nodelalloc,abort,,errors=continue. Quota mode: none. [ 291.578453][ T7799] EXT4-fs (loop4): 1 orphan inode deleted [ 291.584258][ T7799] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,,errors=continue. Quota mode: writeback. [ 291.669772][ T7799] ext4 filesystem being mounted at /219/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 292.026523][ T7826] device syzkaller0 entered promiscuous mode [ 292.065352][ T7826] tipc: Started in network mode [ 292.082295][ T7826] tipc: Node identity d2851bc5e1e4, cluster identity 4711 [ 292.176251][ T7826] tipc: Enabled bearer , priority 0 [ 292.254877][ T7829] netlink: 'syz.6.895': attribute type 10 has an invalid length. [ 292.306844][ C0] [ 292.310252][ C0] ============================= [ 292.315171][ C0] WARNING: suspicious RCU usage [ 292.320126][ C0] syzkaller #0 Not tainted [ 292.324570][ C0] ----------------------------- [ 292.329465][ C0] net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage! [ 292.337940][ C0] [ 292.337940][ C0] other info that might help us debug this: [ 292.337940][ C0] [ 292.348226][ C0] [ 292.348226][ C0] rcu_scheduler_active = 2, debug_locks = 1 [ 292.356353][ C0] 6 locks held by syz.6.895/7823: [ 292.361421][ C0] #0: ffffc90000007bc0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 [ 292.370566][ C0] #1: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 [ 292.379972][ C0] #2: ffffffff8d11f000 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 [ 292.389632][ C0] #3: ffff88807b8ae108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 [ 292.399297][ C0] #4: ffff88807b8ae148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: tipc_l2_send_msg+0x2eb/0x3a0 [ 292.411679][ C0] #5: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 [ 292.421080][ C0] [ 292.421080][ C0] stack backtrace: [ 292.427024][ C0] CPU: 0 PID: 7823 Comm: syz.6.895 Not tainted syzkaller #0 [ 292.434339][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 292.444426][ C0] Call Trace: [ 292.447739][ C0] [ 292.450620][ C0] dump_stack_lvl+0x188/0x250 [ 292.455347][ C0] ? show_regs_print_info+0x20/0x20 [ 292.460600][ C0] ? lockdep_rcu_suspicious+0x110/0x180 [ 292.466191][ C0] qdisc_lookup+0xa6/0x640 [ 292.470649][ C0] qdisc_tree_reduce_backlog+0x188/0x480 [ 292.476325][ C0] cake_dequeue+0x1ddf/0x4a50 [ 292.481112][ C0] ? cake_enqueue+0x8270/0x8270 [ 292.486021][ C0] netem_dequeue+0x12d3/0x1410 [ 292.490848][ C0] ? netem_enqueue+0x37f0/0x37f0 [ 292.495834][ C0] __qdisc_run+0x22f/0x14b0 [ 292.500385][ C0] ? qdisc_purge_queue+0x3d0/0x3d0 [ 292.505582][ C0] __dev_queue_xmit+0xdce/0x2e50 [ 292.510703][ C0] ? call_timer_fn+0x17b/0x540 [ 292.515508][ C0] ? __run_timers+0x56c/0x810 [ 292.520240][ C0] ? dev_queue_xmit+0x20/0x20 [ 292.524968][ C0] ? mark_lock+0x94/0x320 [ 292.529331][ C0] ? eth_header+0x117/0x200 [ 292.534016][ C0] ? memcpy+0x3c/0x60 [ 292.538066][ C0] ? eth_header+0x117/0x200 [ 292.542634][ C0] ? llc_sysctl_exit+0x60/0x60 [ 292.547438][ C0] tipc_l2_send_msg+0x2eb/0x3a0 [ 292.552334][ C0] tipc_bearer_xmit_skb+0x292/0x3c0 [ 292.557573][ C0] ? tipc_bearer_min_mtu+0x190/0x190 [ 292.562918][ C0] tipc_disc_timeout+0x5e1/0x740 [ 292.567902][ C0] ? tipc_disc_create+0x910/0x910 [ 292.572984][ C0] ? tipc_disc_create+0x910/0x910 [ 292.578047][ C0] call_timer_fn+0x17b/0x540 [ 292.582686][ C0] ? tipc_disc_create+0x910/0x910 [ 292.587768][ C0] ? __run_timers+0x810/0x810 [ 292.592496][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 292.597732][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 292.602969][ C0] ? tipc_disc_create+0x910/0x910 [ 292.608037][ C0] __run_timers+0x56c/0x810 [ 292.612599][ C0] ? detach_timer+0x2b0/0x2b0 [ 292.617311][ C0] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 292.623342][ C0] ? sched_clock_cpu+0x15/0x3c0 [ 292.628227][ C0] ? seqcount_lockdep_reader_access+0x177/0x1d0 [ 292.634522][ C0] run_timer_softirq+0x63/0xf0 [ 292.639323][ C0] handle_softirqs+0x336/0x830 [ 292.644129][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 292.649061][ C0] ? do_softirq+0x210/0x210 [ 292.653610][ C0] ? hrtimer_interrupt+0x6a2/0x8b0 [ 292.658770][ C0] __irq_exit_rcu+0x13b/0x230 [ 292.663490][ C0] ? irq_exit_rcu+0x20/0x20 [ 292.668047][ C0] irq_exit_rcu+0x5/0x20 [ 292.672358][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 292.678033][ C0] [ 292.680999][ C0] [ 292.683987][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 292.690008][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x41/0x60 [ 292.696206][ C0] Code: ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 34 16 00 00 00 74 2c 8b 91 10 16 00 00 83 fa 02 75 21 48 8b 91 18 16 00 00 48 8b 32 <48> 8d 7e 01 8b 89 14 16 00 00 48 39 cf 73 08 48 89 44 f2 08 48 89 [ 292.715853][ C0] RSP: 0000:ffffc9000529f6b8 EFLAGS: 00000246 [ 292.721984][ C0] RAX: ffffffff87fb255e RBX: ffffffff8d11efa0 RCX: ffff88802382bb80 [ 292.729994][ C0] RDX: ffffc90016061000 RSI: 0000000000066e82 RDI: 0000000000066e82 [ 292.738018][ C0] RBP: ffffc9000529f770 R08: ffff88802382bb87 R09: 1ffff11004705770 [ 292.746023][ C0] R10: dffffc0000000000 R11: ffffed1004705771 R12: 0000000000000000 [ 292.754028][ C0] R13: 0000000000000001 R14: dffffc0000000000 R15: ffff88807cd71800 [ 292.762052][ C0] ? rcu_lock_acquire+0xe/0x30 [ 292.766869][ C0] rcu_lock_acquire+0xe/0x30 [ 292.771498][ C0] sk_filter_trim_cap+0x14e/0x7d0 [ 292.776557][ C0] ? init_wait_entry+0xd0/0xd0 [ 292.781364][ C0] ? __rwlock_init+0x140/0x140 [ 292.786161][ C0] ? unix_dgram_sendmsg+0xe4d/0x19c0 [ 292.791503][ C0] unix_dgram_sendmsg+0xbcd/0x19c0 [ 292.796683][ C0] ? unix_dgram_poll+0x680/0x680 [ 292.801650][ C0] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 292.808113][ C0] ? apparmor_socket_sendmsg+0x88/0x230 [ 292.813700][ C0] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 292.819019][ C0] ? security_socket_sendmsg+0x7c/0xa0 [ 292.824513][ C0] ? unix_dgram_poll+0x680/0x680 [ 292.829486][ C0] ____sys_sendmsg+0x5be/0x8f0 [ 292.834301][ C0] ? __sys_sendmsg_sock+0x30/0x30 [ 292.839369][ C0] ? rcu_is_watching+0x11/0xa0 [ 292.844168][ C0] ? import_iovec+0x6f/0xa0 [ 292.848723][ C0] ___sys_sendmsg+0x236/0x2e0 [ 292.853458][ C0] ? __sys_sendmsg+0x290/0x290 [ 292.858305][ C0] ? __might_fault+0xb3/0x110 [ 292.863022][ C0] __sys_sendmmsg+0x2ba/0x500 [ 292.867772][ C0] ? __ia32_sys_sendmsg+0x80/0x80 [ 292.872863][ C0] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 292.878888][ C0] ? lock_chain_count+0x20/0x20 [ 292.883785][ C0] __x64_sys_sendmmsg+0x9c/0xb0 [ 292.888678][ C0] do_syscall_64+0x4c/0xa0 [ 292.893133][ C0] ? clear_bhb_loop+0x30/0x80 [ 292.897844][ C0] ? clear_bhb_loop+0x30/0x80 [ 292.902562][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 292.908488][ C0] RIP: 0033:0x7fc77e38bb19 [ 292.912942][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.932672][ C0] RSP: 002b:00007fc77c5e2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 292.941133][ C0] RAX: ffffffffffffffda RBX: 00007fc77e611fa0 RCX: 00007fc77e38bb19 [ 292.949147][ C0] RDX: 0000000000000651 RSI: 0000200000000600 RDI: 0000000000000005 [ 292.957158][ C0] RBP: 00007fc77e423b70 R08: 0000000000000000 R09: 0000000000000000 [ 292.965177][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 292.973315][ C0] R13: 00007fc77e612038 R14: 00007fc77e611fa0 R15: 00007fffe1864688 [ 292.982052][ C0] [ 293.160065][ T7824] tipc: Resetting bearer [ 293.192351][ T7824] tipc: Disabling bearer