last executing test programs: 10m24.462603009s ago: executing program 1 (id=109): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x2c020400) r3 = msgget$private(0x0, 0x240) msgsnd(r3, &(0x7f0000000880)={0x2, "ee42821b1c4caaea41c37605858c2e4c333010004b2773d118d62b48c6c10972d002976bf44c1659163f1b1081ce5a07d4d2d11bdd55d6f3e78c5eb10491714b3397fb0217f6c0c7b381dbe591ec8a3a33f0df6b52ad2e14e2299f80d221cb5733ba378bb7b51305e23b03a33bc2a5a1d57177e8849c536d3d45b227f400ad7f690e08448eee45487595ffe7f3cd371a7ad1c75dca24cb4ccc2deff5830aef85429ea7db2c798108c7893d3227e76f043389a61f74e65f9d23da4706383f6af635215d8c6b7a408d1161d0b7b42a177b3c3007e1741f21140a20f2e7310b34ad06707746b818759bf3738f7fe054c0c092e4094e6f2028494683e55e4cac29ce9a19d4279337b8f05ce105a2d8dd3441769673a35f77bffd0bcba53441b12e9482121627f96c61281f180f66fa39003047a09cc037a5969ac0fabd25e9246a419e5cdcb2c5db788d9c1d32f00ce428497b299dadc5959336de73833aff4633bb79d36168db980ce8cdee71e568d68e37023827a81bc4b80aba19c6972807ca8097091b1aa3c501f94ebaabf3a31cc773e651e65c5e0267f201bf46590c35483f01fd13a0e063797ac987d00430629f029b0f7b3d902c2249bd41f3ef366e06115503e64ba466d9b1ce6661817b45313096551dcb3e11bf1775f0777864ddd9960d843bbed0fa0c9b38de88ca7d54d4982895b235452d10ff9edfa3ddddd45a6e4673994cd06e9e62998f9984959dfe45229b688f38a4d2ecc0f6e9d5e27e136eb1727e6e4ce6d15360df07e8f608e35bf325d0751437e9da28b41c1b6ab5f0174165857c125e4a052221589a9e7dc44517fe19026e53e6d1ea03551c06f905178bfe44b9fa707fd5f9547808c72d9267eb89d3ad8f4e6a25bef93737a671485f3a9aa41bf4321ece49d62a4765820f9f526924f8707ab9e886ad6baf841467fa0be154fe531ec91a74dca5d74597707b30e069664d0f775ca36907a225fcbad3bdd39a32f2a4310584c1e52eb2db10db83cdeb6be8f7d316f7808e558129c59a3f9e99acba845935ac74d86b459bf75367d4e106e39c47d9c928d30bd56dda1736d070dfaec636d788db11cac44cd88df8ed930e322f0cc23ce095d1c4ff9333668027d4097832e44d90ae9dfffafa4f9eb953f38e6efadc7353c638f32ab6eacc6a6b888e8ad3dc4db734fc6f2a7682fc4bb3f49d3ba890890880a546c84b5e5fec26ad3a274342b2efa62efa3a3b7baeffa2a430b96d8aa09f89b9baf6c2157901b0cd19f1778a3ece5f3171a6a290ffd65adbc08accdfc807fb136ccfc4adfb2f1ce9d4e8085506b99d7794ad5ee323a98f1a93e655a88df717a41e7852e94e914944fe5af7454b144f7079b433bd0be47bb6f6abaeec1e4a580d367d5ca7e59fe78f30e9f122d1a2743172489dabec25fbf7ae21775af4f3cde4a18ddbf8517b75c2695d161160992c036e74707526b10e010cd10ff3197cca4839ca5e2e91de3837750ce1da299e621117f5302a89844b65e5c890a7d5c508127bd99008d4da7724ed9a0933bafb1d448cc8c3de807e9fb0b69e8971bcf09511d0ca99bdf6969784633b9d411f228d1542450d6ef9c77b5f510c1303389cc588ad0da8eced2c6eee8a020cce6aa8877fc29d52b53a4977c50402cb9f3f5aeacae761bee4f685536d390b90ef0021a29a903015dbac15318a3dbabaf2595bd6a37199c5eae26862898b13bc4ffd0500dfd2b1e03e72223ed992697fb63e824cf6e2c2136e57b0ff6fe81579f8c24892bd8f461caf110a97580ae9d278cf3c52f846da43a88d40234e16783beb379acb137b11090bd9bbe1c3d2e1b9b97b683c51ff28472d48c1e400a53ed694b5feab7d2449a6e2fb7c4a202f4923d85bb7f3e33add906fc9223105ea3efd3c1bad314dae722df8ddb6e05bc03573d25b8e06f3b266dff9aff15e4e77ec75124cceba595ea95891aa89a5cab46ffeda22b5f45115d57874ee219b84d884f16193e63ac482a75d47a5411ffc5c85df802131e07baa78881e20a5d10650d8df1957735759f55ee3ba2faa7af0a9e19b1af881c6e963db8f74c8d3c26bb281fc6ce2ff89d0dead1573e9840c9343f99e5cee86bfbad595c6594023ef58cb09f3be849eb4bd9d85531244b28bbffab5f44200be5bff8d53f418de2df46b41123ed8326db4e6a6a4be67521c5bb7356c21c8e34e3fe98ccefb589d23ffe01dca2705cecad8b60533e65311c477dbac542af5df0d0be2fa80f18b81e30c7a0a206bf47bd0e9662cd7897c94c41adf266199f22fe991d2da8a6b7f7452794ab8d646d46c8892756722dc06abbdf26a1f87e08f8f1716f424bdd7e970e3c01ad6954a287884c60c47450001f93987814d682bc7279cf9b59e13b032221d650d9766b9997b3f766d436d57089dbf5688a4da4a9b09ec8527248e1bd951c62edd2c4623bb3c8597082e7149893c43331478c6853509a78836de879903a05772979550c7080475068158274b01a2b8e9f45a96a932186f689b1f5b6949989820c5cb8aa5f563a259ec30a22fa02d0fb73126fb059834081126806b8ea0cfb4a6e6caf1bb1ecee42d119b6c0c6d7adbfc91499d8065871bc0ba7819a13e03103460f0264ded3d72cb9a29172f0296193b1663dd993b31cdc92f406f8016bdb8123158624cd08cfafc0de4e496443a55164b2c7290c23ca8da929daf4f25c890bd98a8f61b958d3b953a3dcb9fd266ba04ef63f96ea6df6c6801e9d7b5c9242a3f71c04ba5477459e9a827cb0c8de8027825430b381528823228d3236706f9fb0ecd751aed976ac446e3d07d20c662f690e24d2b20457031d6acdea6e638aad8c80b986a27191c436c0bde3cce3f44bf53cf1d74d0e93ae5f1b1fae1456ba674be39cd39b000a66fc95ef9021698f31288c9a666a59d76298bbdc7bf16f774f07b6ab22267e797bed9efd395de7724dc47e9df684eaaa48d9f03a761c54c916a33c79b3d5b05033bd95d3fcb2ce6f08fd02e15e5684eac997158ed1d300e2f8a857c29a2b6cba9e5b36fd3fed6d233196f489d7a2b301fcbe488dbdf3c33683936341553775f8c145ee0c6840260e93f6c69edd2ebfba3981e90bb2f5720b673340f10cfeee976c8d295d972544a8d3f0a66d2593ed530062cc432934b80e0614d31fc8adfa59dbaf79a4ab02a13c3ec662e5556a97cae80b86ba1a86790a923116778985399c9373d1df2dea8df7232591674c3314fb515f80a1e8e6ef05daacdea35d60e4c29b052341f51eae22afcfd621417d5b9ed2b97edec15dc675f22f0b40fca22e1220d32b92e1149523aa704f3303758718f1ff5b8766d987ecf9774dd39a771521fab0ff82af26268047a5e8e5e447074746cd7f8b9a915c47e10549bb9bbdaccf10685a1fb1cbd5d1ee7bbab77"}, 0x97d, 0x0) msgrcv(0x0, &(0x7f0000000000), 0xfffffcef, 0x0, 0x4800) syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="02c8200a00060001000101"], 0xf) 10m22.027720547s ago: executing program 1 (id=112): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x6484c2, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaab0c9420343758864450000280022000000069078ac"], 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 10m21.199450666s ago: executing program 1 (id=117): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYRES16=0x0, @ANYBLOB="010025bd700000000000020000000800", @ANYBLOB="0c009900b4170e"], 0x28}, 0x1, 0x0, 0x0, 0x4c854}, 0x20040880) add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe) mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000000780)=ANY=[@ANYRESDEC=0x0, @ANYBLOB="58e1a192964f91b2b2"]) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[]) 10m17.322918218s ago: executing program 1 (id=123): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r0 = fsopen(&(0x7f0000000140)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) fsmount(r0, 0x0, 0x2c) 10m16.140161616s ago: executing program 1 (id=126): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mprotect(&(0x7f00000f8000/0x3000)=nil, 0x3000, 0x1) futimesat(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000040)={0x0, 0x258cc74d, 0x4000, 0x0, 0x40, "00000000000000000000ffff00"}) r3 = syz_open_pts(r2, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x81, 0x6, 0x40000005, 0x7ff, 0xd, "d206000094f3ffffd51930f9000100"}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000100)=0x6) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 10m12.999652821s ago: executing program 1 (id=137): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) socket(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) close(r3) 10m11.934598356s ago: executing program 32 (id=137): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) socket(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) close(r3) 9m52.205419773s ago: executing program 3 (id=189): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000680)={0x1f, 0x1, @none}, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f0000000000)='ceph\x00', 0x0, &(0x7f00000005c0)="1c000000000000000000", 0xa, 0xfffffffffffffffe) 9m49.782767011s ago: executing program 3 (id=193): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) read(r0, &(0x7f00000002c0)=""/153, 0x99) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000002c0)={0x0, &(0x7f0000000140)=[@nested_amd_set_intercept={0x181, 0x30, {0x0, 0xf05b, 0xfffffffffffffff9}}], 0x30}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f00000000c0)=@arm64={0xda, 0x4, 0xb0, '\x00', 0xfff}) 9m48.12440975s ago: executing program 3 (id=198): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x40850) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x3, 0xff) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') lseek(r3, 0x289e0cb5, 0x0) 9m43.072197479s ago: executing program 3 (id=204): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028006700000a06"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 9m39.775117617s ago: executing program 3 (id=208): socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) connect$l2tp6(r3, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r3, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x17fd147c801ae9af, 0xff14) 9m31.951655623s ago: executing program 3 (id=219): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB], 0xffdd) 9m16.758391832s ago: executing program 33 (id=219): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB], 0xffdd) 9m11.164186705s ago: executing program 5 (id=251): syz_clone(0x89a3c111, 0x0, 0x0, 0x0, 0x0, 0x0) futex(0x0, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x4000000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0xb, 0x0, &(0x7f0000000240)={0x77359400}, &(0x7f0000048000)=0x1, 0x0) 9m9.349016127s ago: executing program 5 (id=252): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x20, 0x16, 0xa01, 0x0, 0x0, {0x3}, [@typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x20}}, 0x8000) 9m6.833486557s ago: executing program 5 (id=266): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000002c0)=0xe) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 9m3.578048144s ago: executing program 5 (id=261): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x18, &(0x7f0000000140)={[{@uni_xlate}, {@shortname_win95}, {@rodir}, {}, {@utf8}, {@rodir}, {@numtail}, {@fat=@nfs_stale_rw}, {@fat=@showexec}, {@shortname_mixed}, {@fat=@check_strict}, {@shortname_winnt}, {@utf8no}, {@iocharset={'iocharset', 0x3d, 'maccroatian'}}, {@fat=@gid}, {@utf8}, {@shortname_mixed}]}, 0x7, 0x2a6, &(0x7f0000000240)="$eJzs3c2KI1UUAOBT+ekkukgWrkSYAl24GqZ9gm5kBLVBULJQF9o4GZBUGOhAIK0YZ+UT+AQ+jxtx6cYHUNw5C7GkUpWYzFR6TDvTPTTft+nDuffU/amia1U3n782Gd97ML3/8Otfo9tNonEUR/EoiUE0YuXbqPXz7/V5AOAF9yjP44+81ClT8+0e7R2VrcZznxwA8Fxsvv+3GrzdAeDG+ujjT94/Pjm5+2GadiMm382GSZR/y/bj+/FlZDGKO9GPvyLytTJ+592Tu9FKC4N4Y7KYDYvKyWc/Vtc//i1iWX8Y/RjU1x+mpY36xWzYjpeq8Y+yGH3wQ/TjlaLml/dWc1/Vv1VTH8ODePP1jfnfjn789EU8iCzuPVb/zWGavp1//+dXnxbZoj5ZzIaddb+qd/Oq7gkAAAAAAAAAAAAAAAAAAAAAADff7XRtsH3+zurg/wvanzwfqLc64Gexcb7PnTRN86Ts/299K15tRes61w4AAAAAAAAAAAAAAAAAAAAviun8fHya9SJiGWSjszKTzSNiO7NHsPqsv6Yp/t7OdCLiMkOUwa19q6JZTS1LiiW347+Xt6OzrHx65+aeqyi2PxudJa247IY/GSTrTK8MohFxNr0V5VhFplcGG5n/PXo3yrEq49PkaTe3W/eQPIMgr3n8mjurDh7P9KoV1HTuXTD6wcuXmnPe39GURER7vZkXX6f9bPfw6v4HAQAAAAAAAAAAAAAAAAAApen8fNxYfvRb0/jwGiYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANdgOj8fny5//3+PYFEV7+qTN4ugFVWmZtiDK14mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN9w/AQAA//8XQlpx") socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x90, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x7c}}, 0x4000840) 9m1.439712925s ago: executing program 5 (id=268): r0 = socket(0x40000000015, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) shmget$private(0x0, 0x3000, 0x100, &(0x7f0000ffc000/0x3000)=nil) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ptrace(0x10, 0x1) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) 8m59.360422064s ago: executing program 5 (id=270): socket$kcm(0x21, 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x2, 0x7}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}]}}}, {0x28, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}]}}}]}]}], {0x14}}, 0xe0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8m44.269008631s ago: executing program 34 (id=270): socket$kcm(0x21, 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x2, 0x7}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}]}}}, {0x28, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}]}}}]}]}], {0x14}}, 0xe0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5m54.655939796s ago: executing program 4 (id=541): r0 = openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x280, 0x100, 0x14}, 0x18) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008804}, 0x4048012) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setrlimit(0xb, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x3, 'wrr\x00', 0x17, 0x81, 0x5}, {@multicast1, 0x4e23, 0x3, 0x1cb, 0x12d5c, 0x12d5c}}, 0x44) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x20000) 5m53.410474815s ago: executing program 4 (id=543): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) add_key$keyring(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0xfffffffffffffffa) socket$inet6(0xa, 0x80002, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'syztnl1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) read$FUSE(r1, &(0x7f0000000200)={0x2020}, 0x2020) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000003500)={&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c8ce789d11d3f1f, &(0x7f0000003400)=""/232, 0xe8}, &(0x7f0000003540)=0x40) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000002340)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @mcast1, 0xa8a9}, 0xffffffffffffffff, 0x2}}, 0x48) bind$bt_l2cap(r1, &(0x7f0000000180)={0x1f, 0x8, @none, 0x2}, 0xe) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x0, @loopback, 0x9}, {0xa, 0x4e23, 0x6, @mcast1, 0x7fffffff}, r4, 0x80d}}, 0x48) write(r0, &(0x7f00000001c0), 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f046}) 5m50.067759515s ago: executing program 4 (id=547): pipe2(&(0x7f0000000000), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}, @NFT_MSG_NEWSETELEM={0x80, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x54, 0x3, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x44, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x1000}]}}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xbc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(r2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$tipc(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) timer_create(0x3, 0x0, &(0x7f0000002300)=0x0) timer_settime(r4, 0x1, 0x0, 0x0) timer_create(0x3, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) timer_delete(0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000240)={@mcast1, 0x40000019, r7}) 5m41.975635516s ago: executing program 4 (id=551): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffdfe) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, &(0x7f0000000480)=""/61, 0x54000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) syz_open_procfs(0x0, &(0x7f0000000100)='gid_map\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x300) recvmmsg(r2, &(0x7f0000002900), 0x0, 0x45833af92e4b39ff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb00000001090224"], 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) setxattr$incfs_size(0x0, 0x0, 0x0, 0x0, 0x1) 5m37.436786554s ago: executing program 4 (id=557): socket$nl_route(0x10, 0x3, 0x0) unlink(&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00') socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffff9c, 0x0, 0x101001, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000100)={0x0, 0x0, 0x0}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000011) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r1 = fsopen(&(0x7f0000000040)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source\x00', &(0x7f00000000c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) unshare(0x26020480) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(r2, &(0x7f0000000180)='cgroup.max.depth\x00', 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) write$binfmt_aout(r2, &(0x7f0000000400)=ANY=[], 0xff2e) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x6, 0x0, 0x0, 0x0, 0xeed, 0x8000}, 0x0, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000000c0)) rt_sigtimedwait(&(0x7f0000000000)={[0x7]}, &(0x7f0000000040), 0x0, 0x8) 5m34.933638873s ago: executing program 4 (id=560): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet(0x2, 0x3, 0x9) r5 = add_key$user(&(0x7f00000001c0), &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000480)="fef0eda8c799a4a0c7cb5b000600", 0xe, 0xfffffffffffffffe) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[], 0x6}, 0x1, 0x0, 0x0, 0x4000001}, 0x44040) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r6, r5}, &(0x7f00000000c0)=""/83, 0x53, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x0, 0x24000004) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'wlan0\x00', 0x0}) readahead(0xffffffffffffffff, 0x6, 0x0) 5m19.783151151s ago: executing program 35 (id=560): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet(0x2, 0x3, 0x9) r5 = add_key$user(&(0x7f00000001c0), &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000480)="fef0eda8c799a4a0c7cb5b000600", 0xe, 0xfffffffffffffffe) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[], 0x6}, 0x1, 0x0, 0x0, 0x4000001}, 0x44040) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r6, r5}, &(0x7f00000000c0)=""/83, 0x53, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x0, 0x24000004) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'wlan0\x00', 0x0}) readahead(0xffffffffffffffff, 0x6, 0x0) 7.879627944s ago: executing program 2 (id=1465): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)) 7.655800179s ago: executing program 7 (id=1466): prlimit64(0x0, 0xe, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)={0x48, r0, 0x801, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "7ee5d52ffd"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}]}]}, 0x48}}, 0x0) 7.259760709s ago: executing program 2 (id=1469): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x10, 0x80000000000000, 0x9, 0xc, 0x1000, 0x7, 0x1002, 0xd, 0xa, 0x81, 0x2, 0x2370, 0x8bd8, 0x0, 0x7, 0x4e22], 0x25000, 0x216156}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.20078s ago: executing program 7 (id=1471): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4c04, 0x6, @dev={0xfe, 0x80, '\x00', 0x35}, 0x22}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001980)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x64}, 0x10}, 0x1c, 0x0}}], 0x40000000000024e, 0x20002040) sendto$inet6(r0, 0x0, 0x0, 0x8000, 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f00000000c0)=0x1, 0xa0832f12714ce08c) 6.043025597s ago: executing program 6 (id=1473): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000008c0), 0x0, 0x0, 0x0, 0x1}}, 0x40) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000240)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r2, 0x1, {0x0, 0x0, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000140)={&(0x7f0000000440)={0x1d, r2, 0x2, {0x0, 0xf0, 0x4}, 0xff}, 0x18, &(0x7f0000000180)={0x0}, 0x4, 0x0, 0x0, 0x24004045}, 0x1) 5.809011683s ago: executing program 2 (id=1475): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x80) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r2, 0x0, 0x1) 5.751850135s ago: executing program 7 (id=1476): r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) shutdown(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) sendto$inet6(r0, &(0x7f00000001c0)="bc", 0x1, 0x4, &(0x7f00000000c0)={0xa, 0x4e20, 0x8, @loopback, 0xfffffffe}, 0x1c) close(r0) 5.587391349s ago: executing program 0 (id=1477): bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0xfeff, 0x0}, 0x20000000) 5.474342281s ago: executing program 7 (id=1478): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/rfkill/rfkill0/state\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/SourceSink.r0/bulk_qlen\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/100, 0x64) 5.407484423s ago: executing program 2 (id=1479): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r1, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e23, 0x180000, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x31}}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="18000000000000002900000036000000cf6e"], 0x30}, 0x34004894) 5.364538914s ago: executing program 8 (id=1480): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = socket(0x1e, 0x5, 0x0) connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="17", 0x1}], 0x1}}], 0x1, 0x4044890) unshare(0x22020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x10, 0x1, 0x1, 0x2, 0x0, 0x7}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0xb1bd, 0x0, 0xfffffffffffffffc, 0x0, 0x1b}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 5.309494485s ago: executing program 6 (id=1481): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000020000000200000004"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r2, 0x0, 0x0}, 0x10) 5.143092179s ago: executing program 0 (id=1482): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42902, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x54, 0x2c, 0xd27, 0x870b525, 0x8000, {0x0, 0x0, 0x0, r2, {0x9, 0xc}, {}, {0xa, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_IPV4_DST={0x5, 0xc, @loopback}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x2204403c}, 0x0) 5.135382799s ago: executing program 2 (id=1483): r0 = openat(0xffffffffffffff9c, 0x0, 0x101, 0x0) writev(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r5, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f0000000080)={0xfffffe01, 0x9, 0xbf3ffe01, 0x8001, 0x2, "202b9809007d0000cd681ec267a000", 0x6, 0xd}) ioctl$TIOCL_PASTESEL(r5, 0x541c, &(0x7f00000002c0)) 5.10824333s ago: executing program 7 (id=1484): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) 4.931732384s ago: executing program 6 (id=1485): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = fsopen(&(0x7f0000000040)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source\x00', &(0x7f00000000c0)='//127.0.0.1/share\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_dev$media(&(0x7f00000003c0), 0x4, 0x404541) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$UHID_CREATE(r2, &(0x7f0000000240)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/2, 0x2}}, 0x11c) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000080)=""/155, 0x9b}, {0x0, 0x4}], 0x2) 3.225004415s ago: executing program 2 (id=1486): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001b40)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000540)=ANY=[@ANYBLOB="4009e4000000bf4b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.192444605s ago: executing program 8 (id=1487): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) ptrace(0x10, r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ptrace$getregset(0x4205, r0, 0x1, &(0x7f0000000080)={0x0}) 3.017439869s ago: executing program 7 (id=1488): syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file0\x00', 0x8c0, &(0x7f0000000080)=ANY=[@ANYBLOB='acl,heartbeat=none,dir_resv_level=00003,coherency=full,coherency=full,localflocks,coherency=full,noacl,\x00'/119], 0x5, 0x4451, &(0x7f0000008900)="$eJzs3T9sVPcdAPDfe3aLTYHalIFKlXpSUVu1lWUz0RqpxhiMDS4VLQxdjrN9gJuzD9nnKAODoyxImSJliDKgRMrmCXnLRJZIGbNkJDNSMmSJFAnlort7Z99758MX4sMBfT4S/t37/be/9373e8PxixOVO0truaW1XGElV164tXY693q5tL5cDHHWp205+6Lr8TlQvYiT2B+cq+cv/ufG6RA+WfziSbVarYaa/rCrsZbX335zb6E1bYpbL95q9Lt7b/vlfyGEE23zqukLIQwkr88l6WSSDoYQjoUQohDCjXtv38zt02wePi6ezT+du781fmp288FW5989CuH90m//dnv5qz/0jX/5l30aHgAAAAAAAAAAAAAAAACAl9z0tavX/z06Fh5FoX8zav++7nSSdvp+bHXf/L73vywAAAAAAAAAAAAAAAAAAAD8TO18/z8XHd/l+/9TSTrRoX31n92N88efOE96Y+ZfV6cujI4l579HbeVnkqyvz/WF4eb56p91Pv/9XKb97ue/t4/zvJrza447FKJ4JHUdxyMjIXyYHPx+Mjocl8prlb/eKq+vLO7bNF5a6fg3Tu9PRSc50D8V/2ec/z+Z6b/35///pu3dVLu+uX9vsVdaOv59Het99Gb0jPj/crve+Uy7FxF/nl86/v31vMHWChONBaAW/3f6977/pzL99yr+x0IIuag211xqBajtYWr5nfYrpKXj/4t6XmrpTP6Qne7/7zLxv5Dp/6DW/43sBxG7Sse/sY4PpGrs3P/D8d73/8VM/wcR/9r8N3z+dyUd/0ONzP5Ulfpfstv1fzrTf6/ifz1O5nksSr0DNqNGfqf/r460dPwH2sp3nv/irvb/lzLtX9TzX3Pc5vNfc/n/c9R4/mN32/HfCk+q1cGO9bq9/2cy7Xq9/k/U939tzpzo5aCvkPT9f7iel947D9V/dop/NRP/2Uz/zxH/jzs/he6o70oGmvHfWU++P9TI/8D+ryvp+P+qkRm31tio/6zv/6K99/+XM/0fxP6vNv+NuLejvirS8T/SsV4t/p938fl/JdOu9/EPYbT5BmjfvrCHdPyPdqxXv/8H9o7/XKZdr+P/p152DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPASmEzSoRDFI6nrOB4ZCeF8cn0yHI7mC4v5+VJ54bW1EKaS/Fw4Ht0ulecLpfzSSnmxmC+USuWFEC4k5SfCQLRWKlfyy4W7F7f7GozuFAurlflioRJCmE7yfxeONvuaX6osF+6GEC5tl/06Lq/evVNYyS8urf5jdHR0NMxsz2E4Kr5RKa5UGqM3SkOY3W47FLVMrl58eXsuR6L/l9dXVwqlev6Vljal8kKh1NJmLil7NwxHldX1lYVCpZgvlW83xztIE0k6NXPtv9eujLWV34wa6eSLnRYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9Kj8b+/F0Lob1zFIYRclLyIkn8pDx8Xz+afzt3fGj81u/lg68ludQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4gR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirs0j9KA0EUB+A3Y6Glx7BadjvbFUW0cEXwBHoMD6NH8RLewSJF2hQhkMxC2D+wTVJ9X/Ngfsy8B/MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWe3zr3l/rJiLF1fYy4vfz7/84fy71+276/sUZZuR0nl66+4e6Kf+eRvltOVq1eZ9u1l8fMVF7P4M9Ge7TwbjP0Ny+zc3X972OlKuIaEt+k3KuqmVvAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADs2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHAsAAAAACPO3jqJvAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FcAAAD//9HQIRk=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x275a, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0xffc9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1a4a438, &(0x7f0000000100)=ANY=[], 0xb, 0x0, &(0x7f0000000100)) 2.615901689s ago: executing program 0 (id=1489): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.967512744s ago: executing program 6 (id=1490): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="001c88a807001000000040"], 0xffe) 1.71447835s ago: executing program 8 (id=1491): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000001c0)={0x0, 0x6}, 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)=ANY=[@ANYRES32=0x0, @ANYBLOB="0080"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000340), 0x8) 1.623839012s ago: executing program 0 (id=1492): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x3, 0x0, 0xa, 0xb5e}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 1.355877858s ago: executing program 8 (id=1493): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='4\x00', 0x1) 1.270777481s ago: executing program 6 (id=1494): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x148}) r2 = fsopen(&(0x7f0000000080)='binfmt_misc\x00', 0x1) mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f0000000380), 0x14c98, &(0x7f0000002780)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) 1.040528396s ago: executing program 8 (id=1495): openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x806, 0x1, 0x4, 0x7}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r0], 0x20}}, 0x0) getsockopt(0xffffffffffffffff, 0xff, 0x1, 0x0, 0x0) 871.88171ms ago: executing program 6 (id=1496): syz_mount_image$nilfs2(&(0x7f000000a000), &(0x7f0000001300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x94, &(0x7f0000000100)=ANY=[], 0x1, 0xdac, &(0x7f0000000440)="$eJzs3UtvXNUdAPBzxx47LxqHmMZN0yQlpbiP2CRYpbsaKV2gSqgSnwClgYYa+ghdgIKUsOi2kRAfoIh9F31mgRSxSsWmVb8AQqrUTYqQaBtVAle2zxmP/57RnXFsj8fz+0l3ztz7P/eec+Zx5859nQSMrMbq48LCTJXS27ffunT/zPh/V6acaeU4u/o4nscWU0rN1nwpTYXlLU6upZ99cv1ye/p5Tqt0MVWpak1Pz95rzXs4pXQjnU130lR67uMTt1764Jml947fPH7pjdm7O9N6AAAYLfd/8O7P//L4968f+99vTy+mydb0sn2+mMeP5O3+xWptPCet/wFVW1q1jRcTId94Hhoh31iHfO3lNEO+8S7lT4TlNrvkm6wpf6xtWqd2wzBb/x9fNeY2jDcac3Nr/8lXfDg2Uc29cnXphWsDqiiw7T49k3fxGQyGkRuWjw56DQSwJh433ORG3LPwYFpLG++t/HtPNzrPD9tgtz//yh+u8t+9aY3D9tmvn6bSrvI9OpLH43GE8TBfv9//srx4PKLZYz27HUcYluML3eo5tsv12Kpu9Y+fi/3qKzktr8PpEG///sT3dFjeY6Cz+/b/GwwjOywPegUE7FnxvLnlrMTjeX0xPlkTP1ATP1gTP1QTP1wTh1H2u1d/nW5V6//z43/6fveHlf1sD+X0C33WJ+6P7Lf8eN5vvx60/Hg+Mexps/859ekv7/w1nv//eTj//1z+LZ3KK4iyvzDuV2+d+x8uDG50yfdwqM5DHfKvPp/emK+aXl9OalvPbKrHzMb5jnbLd2pjvqmQ71DeFjkQ6hu3Tw6F+cr2R1mvltdrPLS3GdoxEepR3pljOT0Q2nOsW7vCjuyJkK+Zh+OhXdOhXY+E+b4Y2lXNbGxX3H9e6nMiTI/HSUq+8LZt+l2K70W8LuPRnL6Z03dy+n5OP+pQ7igqn8du5/+Xz+dMalYvXF268kQeL5/Tu2PNyZXpF3a53sCD6/X6n5m08fqfI63pzUb7euHo+vSqfb0wFaZf7DL9yTxefs9+PHZwdfrc5Z8u/Wi7Gw8j7tprr//k+aWlK7/wxBNPengyKl+ZQa+ZgJ02/+rLP5u/9trr56++/PyLV1688sqFJ777nSefemphfnWrfr592x7YX9Z/9AddEwAAAAAAAAAAAKBn1cHOk3Nad3/bcj15uT49Xh/PcCjvW/k0lPsYlOs/u93XpVy/eWwX6sj2243LiQbdRqCzf7n/7/4e0h6og2HPDsvL7uIP7A2D7v+v3PewpEfO//3YylCy3Xt64/oy3r8QHsRe739O+fur/79W/1c9r/9Cj1lTWyv39/cP/q2t2HSy1/Jj+8t9YKf7K/8PufzSmsdSb+Uv/yaUH29U2qM/hvIPbSr/HxOdyt/U/lNbK/9Pufzyss2ei+V3e/3Xalw1NtYj7jcu9wGM+42LP4f2l3v79f3+b7Gjttu5fBhlw9LPZL+Gpf/Pbspyy3owr55bx+nK/bdjfwf91r/c97v8DjwSll/V/L7p/3O41fX/WT5/8/r/hH3nQ8f/DIaRHZaXlwfa9cmo9ruyVwz69R/0NuSgyx/0619n7X/s5KbzgYvY/2eMx/4/Yzz2/xnjsX+tGI/9f8bXM/b/GeMnwnJj/6AzNfEv1cRP1sS/XBM/VROP/99i/GxN/HRN/ExN/OGa+KM18XM18a/VxB+riT9eE5+tie93X83pqLYfRlnsN9L3H0ZHOf7T7fs/XRMHhlfs1zl+v79eEweGVznPw/cbRlDV+Y4dcX972Y/7Zk7fyen7Of1oxyrIbvhGTr+Z02/l9Ns5PZ/TuZzO51TfkMPtV/88efpWtX6e39EQ7/V80ng9QLxPzIUe6xOPz/V7PuuJHsvZqfK3eDkIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNBorD4uLMxUKb19+61L/57+3g9Xppxp5Ti7+jiexxZTSs2UUpXHx8PybkyupZ99cv1yp7RKF1cfy3h69l5r3sMr86ez6U6aSs99fOLWSx88s/Te8ZvHL70xe3dnWg8AAACj4f8BAAD///ZR5UI=") syz_mount_image$vfat(&(0x7f0000005900), &(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x399483d, 0x0, 0x0, 0x0, &(0x7f00000000c0)) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x70) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 713.571874ms ago: executing program 0 (id=1497): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000700)='\x00'/27, 0x1b) 488.187699ms ago: executing program 8 (id=1498): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000f00)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d", 0x2}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000002500)=[{&(0x7f0000000600)=""/87, 0x57}], 0x1}, 0x0) 0s ago: executing program 0 (id=1499): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x14, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000280)={r2, @in={{0x2, 0x4e24, @empty}}, 0x5}, &(0x7f0000000380)=0x90) kernel console output (not intermixed with test programs): T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 306.331012][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 306.351868][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 306.363447][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 306.390161][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 306.418460][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 306.429278][ T6215] netlink: 12 bytes leftover after parsing attributes in process `syz.4.388'. [ 306.475357][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 306.488043][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 306.500030][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 306.513558][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 306.563899][ T5919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 309.178962][ T6240] tipc: Enabling of bearer rejected, failed to enable media [ 311.210627][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 311.218244][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 311.276753][ T5919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.192641][ T4542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 314.227335][ T4531] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 314.788420][ T4542] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 314.804831][ T4531] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.920172][ T4531] usb 3-1: config 0 has no interfaces? [ 314.995744][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 315.006056][ T4531] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 315.029079][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 315.061895][ T5919] device veth0_vlan entered promiscuous mode [ 315.071869][ T4531] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.090290][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 315.112840][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 315.143890][ T4531] usb 3-1: config 0 descriptor?? [ 315.166116][ T5919] device veth1_vlan entered promiscuous mode [ 315.209279][ T5174] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 315.234969][ T5174] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 315.343610][ T5174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 315.609641][ T5174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 316.448118][ T5919] device veth0_macvtap entered promiscuous mode [ 316.503965][ T5919] device veth1_macvtap entered promiscuous mode [ 316.619317][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 316.905967][ T6315] block device autoloading is deprecated and will be removed. [ 317.095525][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 317.375582][ T4531] usb 3-1: USB disconnect, device number 5 [ 318.495787][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.503930][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.557639][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 318.588034][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 318.618170][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 318.656662][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 318.684308][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 318.697539][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 319.575301][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 319.589258][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 319.608250][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 319.623084][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 319.636054][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 319.648798][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 319.690184][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 319.795671][ T5919] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 320.317891][ T6326] loop2: detected capacity change from 0 to 1024 [ 320.338490][ T5919] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 320.358617][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 320.915861][ T6326] hfsplus: unable to parse mount options [ 320.942116][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 320.968931][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 321.029520][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 321.801324][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 321.844585][ T5919] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.449472][ T5919] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.502275][ T5919] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 323.328982][ T5919] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 323.763141][ T4379] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 323.800107][ T4379] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 323.896679][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 323.963933][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 324.026245][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 324.073495][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 327.558735][ T6365] input: syz0 as /devices/virtual/input/input7 [ 328.957235][ T6375] netlink: 'syz.2.418': attribute type 1 has an invalid length. [ 328.965796][ T6375] netlink: 'syz.2.418': attribute type 2 has an invalid length. [ 330.908437][ T4287] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 330.918956][ T4287] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 330.928832][ T4287] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 330.976802][ T4287] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 330.992911][ T4287] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 331.002227][ T4287] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 331.252442][ T4505] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.451765][ T4505] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.627011][ T4505] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.822945][ T6410] loop7: detected capacity change from 0 to 1024 [ 331.834637][ T4505] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.360373][ T6410] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 333.074065][ T4288] Bluetooth: hci0: command 0x0409 tx timeout [ 333.571834][ T5673] EXT4-fs (loop7): unmounting filesystem. [ 333.624335][ T6391] chnl_net:caif_netlink_parms(): no params data found [ 335.160564][ T4288] Bluetooth: hci0: command 0x041b tx timeout [ 335.475246][ T6454] netlink: 'syz.4.429': attribute type 10 has an invalid length. [ 335.954192][ T6454] team0 (unregistering): Port device team_slave_0 removed [ 336.057610][ T6454] team0 (unregistering): Port device team_slave_1 removed [ 336.175918][ T6457] netlink: 72 bytes leftover after parsing attributes in process `syz.4.429'. [ 336.192794][ T6458] netlink: 4 bytes leftover after parsing attributes in process `syz.4.429'. [ 336.311372][ T6391] bridge0: port 1(bridge_slave_0) entered blocking state [ 336.327338][ T6391] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.347114][ T6391] device bridge_slave_0 entered promiscuous mode [ 336.470534][ T6391] bridge0: port 2(bridge_slave_1) entered blocking state [ 336.489165][ T6391] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.524410][ T6391] device bridge_slave_1 entered promiscuous mode [ 336.896681][ T6391] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 336.979613][ T6482] using random self ethernet address [ 337.017270][ T6482] using random host ethernet address [ 337.029709][ T6391] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 337.233710][ T4288] Bluetooth: hci0: command 0x040f tx timeout [ 337.293119][ T26] audit: type=1800 audit(1787705296.486:75): pid=6486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.433" name="ifname" dev="configfs" ino=44380 res=0 errno=0 [ 338.478478][ T6391] team0: Port device team_slave_0 added [ 339.132658][ T6391] team0: Port device team_slave_1 added [ 339.325722][ T4288] Bluetooth: hci0: command 0x0419 tx timeout [ 340.517020][ C1] llc_process_tmr_ev: timer called on closed connection [ 341.626987][ T6391] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.640360][ T6528] netlink: 8 bytes leftover after parsing attributes in process `syz.4.442'. [ 341.673524][ T6391] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.808550][ T6391] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.922445][ T6391] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.935652][ T6391] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.117707][ T6391] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.752929][ T6391] device hsr_slave_0 entered promiscuous mode [ 342.791944][ T6391] device hsr_slave_1 entered promiscuous mode [ 343.132908][ T6391] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 343.189083][ T6391] Cannot create hsr debugfs directory [ 344.819729][ T4505] device hsr_slave_0 left promiscuous mode [ 344.914939][ T4505] device hsr_slave_1 left promiscuous mode [ 344.940738][ T4505] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 344.959847][ T4505] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 344.978899][ T4505] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 345.032452][ T4505] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 345.102439][ T4505] device bridge_slave_1 left promiscuous mode [ 345.108854][ T4505] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.617739][ T4505] device bridge_slave_0 left promiscuous mode [ 345.670353][ T4505] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.091779][ T4505] device veth1_macvtap left promiscuous mode [ 346.098273][ T4505] device veth0_macvtap left promiscuous mode [ 346.118042][ T4505] device veth1_vlan left promiscuous mode [ 346.129932][ T4505] device veth0_vlan left promiscuous mode [ 348.991770][ T6571] ubi0: attaching mtd0 [ 349.006780][ T6571] ubi0: scanning is finished [ 349.011766][ T6571] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 349.066079][ T6571] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 349.816556][ T4320] hid-generic 0000:0000:0000.0002: item fetching failed at offset 0/2 [ 349.917369][ T4320] hid-generic: probe of 0000:0000:0000.0002 failed with error -22 [ 353.302582][ T4505] team0 (unregistering): Port device team_slave_1 removed [ 353.448301][ T4505] team0 (unregistering): Port device team_slave_0 removed [ 354.120420][ T4505] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 354.406421][ T4505] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 356.021236][ T4505] bond0 (unregistering): Released all slaves [ 357.306545][ T6601] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 357.316424][ T6601] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 357.326130][ T6601] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 357.366433][ T6601] syz.4.458 (6601) used greatest stack depth: 20160 bytes left [ 357.375227][ T26] audit: type=1800 audit(1787705316.472:76): pid=6601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.458" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 357.882895][ T6620] sctp: [Deprecated]: syz.0.460 (pid 6620) Use of int in maxseg socket option. [ 357.882895][ T6620] Use struct sctp_assoc_value instead [ 360.153513][ T6628] fuse: Bad value for 'fd' [ 360.325047][ T26] audit: type=1326 audit(1787705319.491:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6622 comm="syz.4.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdc8e59e0d9 code=0x7fc00000 [ 360.380350][ T26] audit: type=1326 audit(1787705319.541:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6622 comm="syz.4.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fdc8e59e0d9 code=0x7fc00000 [ 360.492847][ T26] audit: type=1326 audit(1787705319.541:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6622 comm="syz.4.462" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdc8e59e0d9 code=0x7fc00000 [ 361.029122][ T6391] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 363.326867][ T6391] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 363.487523][ T6391] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 363.649713][ T6654] netlink: 'syz.7.477': attribute type 1 has an invalid length. [ 363.657661][ T6654] netlink: 'syz.7.477': attribute type 2 has an invalid length. [ 364.410588][ T6391] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 365.382955][ T6391] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.890517][ T4287] Bluetooth: hci5: command 0x0406 tx timeout [ 366.050799][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 366.102486][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 366.145320][ T6391] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.200134][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 366.231301][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 366.290563][ T4379] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.297790][ T4379] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.504055][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 366.530924][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 366.572364][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 366.629034][ T4379] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.636318][ T4379] bridge0: port 2(bridge_slave_1) entered forwarding state [ 366.720963][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 366.766044][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 366.873231][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 366.934296][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 366.974211][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 367.019573][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 367.138132][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 367.272398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 367.340244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 367.488714][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 367.540883][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 367.700246][ T6391] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 368.334173][ T6691] netlink: 8 bytes leftover after parsing attributes in process `syz.0.476'. [ 371.850561][ T6706] netlink: 16 bytes leftover after parsing attributes in process `syz.0.478'. [ 373.996975][ T6714] Mass Storage Function, version: 2009/09/11 [ 374.003376][ T6714] LUN: removable file: (no medium) [ 374.026442][ T6714] LUN: removable file: (no medium) [ 375.056594][ T6391] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 375.138088][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 375.146113][ T4379] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 378.207300][ T6730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.485'. [ 378.228436][ T6754] retu-mfd 0-0001: could not read Retu revision: -5 [ 378.308798][ T6754] retu-mfd: probe of 0-0001 failed with error -5 [ 378.345737][ T6754] i2c i2c-0: new_device: Instantiated device retu at 0x01 [ 378.766624][ T4287] Bluetooth: hci5: unexpected subevent 0x1a length: 30 > 6 [ 378.769023][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 378.783406][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 378.834538][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 378.852768][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 378.872336][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 378.891739][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 378.912733][ T6391] device veth0_vlan entered promiscuous mode [ 378.976195][ T6776] netlink: 8 bytes leftover after parsing attributes in process `syz.4.493'. [ 379.014717][ T6391] device veth1_vlan entered promiscuous mode [ 379.137291][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 379.147921][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 379.191414][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.197848][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.237408][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 379.281075][ T4376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 379.320584][ T6391] device veth0_macvtap entered promiscuous mode [ 379.350307][ T6391] device veth1_macvtap entered promiscuous mode [ 380.476775][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 380.571894][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 380.763687][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.849267][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.901069][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.964807][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.017356][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.127702][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.157027][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.322805][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 381.502457][ T6391] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 381.946774][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 381.967835][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.167443][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 382.214998][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.257954][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 382.296659][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.338085][ T6391] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 382.359138][ T6391] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.371770][ T6391] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 382.567058][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 382.596511][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 382.606212][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 382.619756][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 383.250167][ T6391] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.283265][ T6391] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.370930][ T6391] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.420717][ T6391] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.861504][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.869398][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.013821][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 386.064006][ T4328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.121360][ T4328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.192552][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 388.893401][ T6866] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 388.975612][ T6866] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 389.788968][ T6869] loop7: detected capacity change from 0 to 2048 [ 390.563794][ T6871] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 390.692458][ T6869] syz.7.510: attempt to access beyond end of device [ 390.692458][ T6869] loop7: rw=0, sector=2198922592328, nr_sectors = 2 limit=2048 [ 390.707304][ T6869] NILFS (loop7): I/O error reading meta-data file (ino=6, block-offset=1) [ 391.044436][ T6878] using random self ethernet address [ 391.049927][ T6878] using random host ethernet address [ 391.282656][ T6878] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 391.347090][ T6878] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 391.621658][ T4319] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 393.093456][ T6878] udc dummy_udc.0: failed to start g1: -22 [ 393.099351][ T6878] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 393.160734][ T6878] UDC core: g1: couldn't find an available UDC or it's busy [ 399.153501][ T6932] Bluetooth: MGMT ver 1.22 [ 402.003731][ T6972] loop6: detected capacity change from 0 to 16 [ 402.104550][ T6972] erofs: (device loop6): mounted with root inode @ nid 36. [ 402.194186][ T6978] netlink: 'syz.2.534': attribute type 10 has an invalid length. [ 403.200134][ T6972] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 403.265664][ T6978] team0: Port device dummy0 added [ 403.320508][ T6972] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 403.372111][ T6972] erofs: (device loop6): z_erofs_read_folio: failed to read, err [-117] [ 403.472068][ T6982] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 403.537116][ T6982] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 403.938923][ T6982] erofs: (device loop6): z_erofs_read_folio: failed to read, err [-117] [ 405.432576][ T6996] overlayfs: overlapping lowerdir path [ 406.927659][ T6987] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 406.938124][ T6987] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 406.948131][ T6987] erofs: (device loop6): z_erofs_read_folio: failed to read, err [-117] [ 406.957343][ T6992] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 406.967389][ T6992] erofs: (device loop6): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 65535 [ 406.977444][ T6992] erofs: (device loop6): z_erofs_read_folio: failed to read, err [-117] [ 407.534873][ T7004] loop7: detected capacity change from 0 to 128 [ 407.630367][ T7004] FAT-fs (loop7): Unrecognized mount option "184467440737095516150x000000000000000000000000000000000000" or missing value [ 410.742076][ T26] audit: type=1326 audit(1787705369.907:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7021 comm="syz.6.542" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7fc00000 [ 410.879342][ T26] audit: type=1326 audit(1787705369.907:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7021 comm="syz.6.542" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7f65cf79e0d9 code=0x7fc00000 [ 411.837575][ T26] audit: type=1326 audit(1787705370.977:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7021 comm="syz.6.542" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7fc00000 [ 416.795735][ T7057] comedi comedi3: comedi_config --init_data is deprecated [ 421.420755][ T7082] process 'syz.2.562' launched './file1' with NULL argv: empty string added [ 423.444388][ T7093] netlink: 'syz.6.554': attribute type 10 has an invalid length. [ 424.490009][ T7093] team0: Port device dummy0 added [ 424.841095][ T7104] loop7: detected capacity change from 0 to 256 [ 426.588737][ T7109] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 426.616135][ T7109] CIFS: Attempting to mount \\127.0.0.1\share [ 426.623267][ T7109] CIFS: VFS: No username specified [ 426.740851][ T7113] loop6: detected capacity change from 0 to 512 [ 426.999272][ T7117] loop7: detected capacity change from 0 to 2048 [ 427.291440][ T7117] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 427.635291][ T7120] fuse: Unknown parameter 'fd0x0000000000000007' [ 432.560307][ T7172] netlink: 36 bytes leftover after parsing attributes in process `syz.6.567'. [ 433.364161][ T7177] netlink: 'syz.7.568': attribute type 10 has an invalid length. [ 434.296606][ T7177] team0: Port device dummy0 added [ 437.412005][ T7214] loop7: detected capacity change from 0 to 8 [ 438.974955][ T7218] autofs4:pid:7218:autofs_fill_super: called with bogus options [ 439.826455][ T7220] loop6: detected capacity change from 0 to 2048 [ 440.614579][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.621880][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.242756][ T7231] ubi0: attaching mtd0 [ 441.250527][ T7231] ubi0: scanning is finished [ 441.256216][ T7231] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 441.283708][ T7231] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 442.701096][ T7246] netlink: 36 bytes leftover after parsing attributes in process `syz.0.580'. [ 443.715132][ T7238] xt_CT: You must specify a L4 protocol and not use inversions on it [ 443.799443][ T7249] loop7: detected capacity change from 0 to 512 [ 443.825697][ T7237] loop5: detected capacity change from 0 to 7 [ 443.837111][ T7237] Dev loop5: unable to read RDB block 7 [ 443.843232][ T7237] loop5: unable to read partition table [ 443.849496][ T7237] loop5: partition table beyond EOD, truncated [ 443.855763][ T7237] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 443.906078][ T7249] EXT4-fs warning (device loop7): dx_probe:833: inode #2: comm syz.7.584: Unrecognised inode hash code 255 [ 443.932313][ T7249] EXT4-fs warning (device loop7): dx_probe:966: inode #2: comm syz.7.584: Corrupt directory, running e2fsck is recommended [ 443.974756][ T7237] Dev loop5: unable to read RDB block 7 [ 443.980439][ T7237] loop5: unable to read partition table [ 443.986362][ T7237] loop5: partition table beyond EOD, truncated [ 443.992654][ T7237] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 444.010613][ T7249] EXT4-fs (loop7): Cannot turn on journaled quota: type 1: error -117 [ 444.031868][ T7249] EXT4-fs error (device loop7): ext4_iget_extra_inode:4763: inode #15: comm syz.7.584: corrupted in-inode xattr [ 444.064558][ T7249] EXT4-fs error (device loop7): ext4_orphan_get:1410: comm syz.7.584: couldn't read orphan inode 15 (err -117) [ 444.198213][ T7249] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 444.640064][ T7261] EXT4-fs warning (device loop7): dx_probe:833: inode #2: comm syz.7.584: Unrecognised inode hash code 255 [ 444.652530][ T7261] EXT4-fs warning (device loop7): dx_probe:966: inode #2: comm syz.7.584: Corrupt directory, running e2fsck is recommended [ 444.668162][ T7261] EXT4-fs error (device loop7): ext4_readdir:263: inode #2: block 4: comm syz.7.584: path /42/file0: bad entry in directory: rec_len % 4 != 0 - offset=512, inode=4294967295, rec_len=65535, size=1024 fake=0 [ 445.172434][ T5673] EXT4-fs (loop7): unmounting filesystem. [ 445.995113][ T7267] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 446.004706][ T7267] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 446.014530][ T7267] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 446.052102][ T7267] syz.6.587 (7267) used greatest stack depth: 17312 bytes left [ 446.284273][ T26] audit: type=1800 audit(1787705405.167:83): pid=7267 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.587" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 447.088688][ T7274] Device name cannot be null; rc = [-22] [ 448.732799][ T4288] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 448.762339][ T4288] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 448.782237][ T4288] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 448.803052][ T4288] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 449.441871][ T4288] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 449.454502][ T4288] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 449.727869][ T7289] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 450.453791][ T4505] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.039458][ T4505] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.257546][ T4505] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.493070][ T4288] Bluetooth: hci3: command 0x0409 tx timeout [ 451.589042][ T4505] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.502811][ T7307] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 453.025654][ T7286] chnl_net:caif_netlink_parms(): no params data found [ 453.572271][ T4288] Bluetooth: hci3: command 0x041b tx timeout [ 453.619581][ T7331] xt_connbytes: Forcing CT accounting to be enabled [ 453.626706][ T7331] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 454.051627][ T7321] syz.6.588 (7321): drop_caches: 0 [ 454.369311][ T7286] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.377217][ T7286] bridge0: port 1(bridge_slave_0) entered disabled state [ 454.412291][ T7286] device bridge_slave_0 entered promiscuous mode [ 454.494744][ T7286] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.522709][ T7286] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.582231][ T7286] device bridge_slave_1 entered promiscuous mode [ 454.738249][ T7286] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.764604][ T7286] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 454.932001][ T7286] team0: Port device team_slave_0 added [ 455.030388][ T7286] team0: Port device team_slave_1 added [ 455.141068][ T7286] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 455.152312][ T7286] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 455.257893][ T7286] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 455.327036][ T7286] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 455.352489][ T7286] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 455.493225][ T7286] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 455.652394][ T4288] Bluetooth: hci3: command 0x040f tx timeout [ 455.802536][ T7350] loop6: detected capacity change from 0 to 512 [ 456.256167][ T7350] EXT4-fs warning (device loop6): dx_probe:833: inode #2: comm syz.6.599: Unrecognised inode hash code 255 [ 456.307569][ T7350] EXT4-fs warning (device loop6): dx_probe:966: inode #2: comm syz.6.599: Corrupt directory, running e2fsck is recommended [ 456.514711][ T7360] loop7: detected capacity change from 0 to 32768 [ 456.544749][ T7360] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.600 (7360) [ 456.592161][ T7360] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 456.603065][ T7360] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 456.612265][ T7360] BTRFS info (device loop7): turning on sync discard [ 456.619233][ T7360] BTRFS info (device loop7): using free space tree [ 456.773571][ T7350] EXT4-fs (loop6): Cannot turn on journaled quota: type 1: error -117 [ 456.892544][ T7350] EXT4-fs error (device loop6): ext4_iget_extra_inode:4763: inode #15: comm syz.6.599: corrupted in-inode xattr [ 456.914554][ T7350] EXT4-fs error (device loop6): ext4_orphan_get:1410: comm syz.6.599: couldn't read orphan inode 15 (err -117) [ 456.982839][ T7350] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 457.373687][ T7360] BTRFS info (device loop7): enabling ssd optimizations [ 457.423762][ T7387] EXT4-fs warning (device loop6): dx_probe:833: inode #2: comm syz.6.599: Unrecognised inode hash code 255 [ 457.435376][ T7387] EXT4-fs warning (device loop6): dx_probe:966: inode #2: comm syz.6.599: Corrupt directory, running e2fsck is recommended [ 457.448618][ T7387] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 4: comm syz.6.599: path /22/file0: bad entry in directory: rec_len % 4 != 0 - offset=512, inode=4294967295, rec_len=65535, size=1024 fake=0 [ 457.540418][ T7387] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 64: comm syz.6.599: path /22/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 457.733490][ T4288] Bluetooth: hci3: command 0x0419 tx timeout [ 457.809960][ T7286] device hsr_slave_0 entered promiscuous mode [ 457.862228][ T7359] EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 255: padding at end of block bitmap is not set [ 457.930014][ T26] audit: type=1800 audit(1787705417.097:84): pid=7358 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.600" name="file1" dev="loop7" ino=260 res=0 errno=0 [ 458.013691][ T7286] device hsr_slave_1 entered promiscuous mode [ 458.232449][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 460.078080][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 460.089501][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 460.100380][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 460.109919][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 460.119575][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 460.128569][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 460.137948][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 460.138254][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 460.160249][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 460.709578][ T5673] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 462.044744][ T4505] device hsr_slave_0 left promiscuous mode [ 463.402427][ T4505] device hsr_slave_1 left promiscuous mode [ 463.518925][ T4505] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 463.532498][ T4505] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 463.556591][ T4505] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 464.430540][ T4505] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 464.690370][ T4505] device bridge_slave_1 left promiscuous mode [ 464.698709][ T4505] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.814504][ T4505] device bridge_slave_0 left promiscuous mode [ 464.851399][ T4505] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.100771][ T4505] device veth1_macvtap left promiscuous mode [ 465.119985][ T4505] device veth0_macvtap left promiscuous mode [ 465.130411][ T4505] device veth1_vlan left promiscuous mode [ 465.197161][ T4505] device veth0_vlan left promiscuous mode [ 470.779325][ T7461] loop6: detected capacity change from 0 to 512 [ 470.798277][ T7461] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 471.054299][ T4505] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 471.115313][ T4505] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 471.515699][ T7464] FAT-fs (loop6): error, fat_free_clusters: deleting FAT entry beyond EOF [ 471.796199][ T4505] bond0 (unregistering): Released all slaves [ 473.040835][ T7416] netlink: 'syz.0.612': attribute type 10 has an invalid length. [ 473.114350][ T7416] team0: Port device dummy0 added [ 473.410978][ T7468] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 474.780037][ T7470] loop7: detected capacity change from 0 to 2048 [ 474.865910][ T7286] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 474.879054][ T7470] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 474.947920][ T7286] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 475.570252][ T7286] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 476.247008][ T7286] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 480.542873][ T7286] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.596890][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 480.622839][ T4704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 480.672563][ T7286] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.705025][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 480.836904][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 480.922638][ T4671] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.930023][ T4671] bridge0: port 1(bridge_slave_0) entered forwarding state [ 481.042363][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 481.111052][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 481.192917][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 481.228485][ T4671] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.235751][ T4671] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.322668][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 481.401626][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 481.475008][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 481.569808][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 481.639676][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 481.687645][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 481.789929][ T7286] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 481.833662][ T7286] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 481.862984][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 481.884211][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 481.913437][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 481.990352][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 482.023653][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 482.041065][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 482.075503][ T7513] loop6: detected capacity change from 0 to 512 [ 482.142037][ T7513] EXT4-fs (loop6): Test dummy encryption mode enabled [ 482.295554][ T7513] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 482.641652][ T7513] EXT4-fs (loop6): 1 truncate cleaned up [ 482.762967][ T7513] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 483.476290][ T7529] capability: warning: `syz.6.632' uses deprecated v2 capabilities in a way that may be insecure [ 486.819482][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 486.866426][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 486.888012][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 487.088581][ T7286] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.175336][ T7566] loop8: detected capacity change from 0 to 7 [ 487.729370][ T7566] Dev loop8: unable to read RDB block 7 [ 487.735542][ T7566] loop8: unable to read partition table [ 487.741384][ T7566] loop8: partition table beyond EOD, truncated [ 487.747727][ T7566] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 488.915910][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 488.954703][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 489.016232][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 489.027665][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 489.037048][ T7286] device veth0_vlan entered promiscuous mode [ 489.045001][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 489.053909][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 489.067609][ T7286] device veth1_vlan entered promiscuous mode [ 489.100609][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 489.117267][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 489.129524][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 489.138484][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 489.151054][ T7286] device veth0_macvtap entered promiscuous mode [ 489.166450][ T7286] device veth1_macvtap entered promiscuous mode [ 489.188636][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 489.199867][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.210204][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 489.221395][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.234202][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 489.245022][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.255746][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 489.266654][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.279201][ T7286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 489.288385][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 489.298076][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 489.306820][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 489.319423][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 489.333167][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 489.353165][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.368014][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 489.380370][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.396388][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 489.409218][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.420329][ T7286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 489.431178][ T7286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 489.443366][ T7286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 489.451546][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 489.464562][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 489.478249][ T7286] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.488166][ T7286] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.497972][ T7286] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.507463][ T7286] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.604238][ T4346] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.619280][ T4346] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.628046][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 489.653789][ T6439] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.661685][ T6439] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.670243][ T6439] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 490.030063][ T7596] netlink: 152 bytes leftover after parsing attributes in process `syz.2.646'. [ 490.083377][ T7592] 9pnet_fd: Insufficient options for proto=fd [ 490.785207][ T7602] jffs2: notice: (7602) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 491.719214][ T7606] lo speed is unknown, defaulting to 1000 [ 491.725534][ T7606] lo speed is unknown, defaulting to 1000 [ 491.732025][ T7606] lo speed is unknown, defaulting to 1000 [ 491.742779][ T7606] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 491.760331][ T7606] lo speed is unknown, defaulting to 1000 [ 491.767193][ T7606] lo speed is unknown, defaulting to 1000 [ 491.774027][ T7606] lo speed is unknown, defaulting to 1000 [ 491.780741][ T7606] lo speed is unknown, defaulting to 1000 [ 491.787263][ T7606] lo speed is unknown, defaulting to 1000 [ 494.888360][ T7625] jffs2: notice: (7625) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 498.024942][ T7657] loop7: detected capacity change from 0 to 32768 [ 498.036167][ T7659] netlink: 236 bytes leftover after parsing attributes in process `syz.2.650'. [ 498.349535][ T7652] tmpfs: Unknown parameter 'usrquota' [ 498.364138][ T7657] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz.7.648 (7657) [ 498.411445][ T7657] BTRFS info (device loop7): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 498.422221][ T7657] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm [ 498.430982][ T7657] BTRFS info (device loop7): turning on sync discard [ 498.437801][ T7657] BTRFS info (device loop7): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 498.447947][ T7657] BTRFS info (device loop7): use zstd compression, level 3 [ 498.455249][ T7657] BTRFS info (device loop7): turning on async discard [ 498.462387][ T7657] BTRFS warning (device loop7): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 498.473071][ T7657] BTRFS info (device loop7): trying to use backup root at mount time [ 498.481229][ T7657] BTRFS info (device loop7): enabling auto defrag [ 498.487776][ T7657] BTRFS info (device loop7): using free space tree [ 499.820402][ T4376] BTRFS warning (device loop7): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 499.945729][ T7657] BTRFS error (device loop7): failed to load root extent [ 499.953171][ T7657] BTRFS warning (device loop7): try to load backup roots slot 1 [ 499.968209][ T76] BTRFS warning (device loop7): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 500.032202][ T7657] BTRFS warning (device loop7): couldn't read tree root [ 500.039284][ T7657] BTRFS warning (device loop7): try to load backup roots slot 2 [ 500.048239][ T7657] BTRFS error (device loop7): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7 [ 500.059808][ T7657] BTRFS warning (device loop7): couldn't read tree root [ 500.066872][ T7657] BTRFS warning (device loop7): try to load backup roots slot 3 [ 500.160052][ T7657] BTRFS info (device loop7): enabling ssd optimizations [ 500.175886][ T7657] BTRFS info (device loop7): rebuilding free space tree [ 500.355822][ T7657] BTRFS info (device loop7): checking UUID tree [ 500.613531][ T7706] PKCS7: Unknown OID: [4] 0.0 [ 500.618879][ T7706] PKCS7: Only support pkcs7_signedData type [ 500.675988][ T7706] xt_policy: output policy not valid in PREROUTING and INPUT [ 500.779155][ T7657] BTRFS warning (device loop7): failed to start uuid_rescan task [ 500.787013][ T7657] BTRFS warning (device loop7): failed to check the UUID tree: -4 [ 501.962019][ T7657] BTRFS error (device loop7): open_ctree failed: -4 [ 502.475379][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.482141][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 505.011095][ T7736] tipc: Started in network mode [ 505.016201][ T7736] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 505.026410][ T7736] tipc: Enabling of bearer rejected, failed to enable media [ 507.595077][ T7759] loop8: detected capacity change from 0 to 32768 [ 507.618535][ T7759] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop8 scanned by syz.8.663 (7759) [ 507.651728][ T7759] BTRFS info (device loop8): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 507.662218][ T7759] BTRFS info (device loop8): using crc32c (crc32c-intel) checksum algorithm [ 507.670956][ T7759] BTRFS info (device loop8): turning on sync discard [ 507.677762][ T7759] BTRFS info (device loop8): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 507.687212][ T7759] BTRFS info (device loop8): use zstd compression, level 3 [ 507.694556][ T7759] BTRFS info (device loop8): turning on async discard [ 507.701361][ T7759] BTRFS warning (device loop8): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 507.712145][ T7759] BTRFS info (device loop8): trying to use backup root at mount time [ 507.720272][ T7759] BTRFS info (device loop8): enabling auto defrag [ 507.726840][ T7759] BTRFS info (device loop8): using free space tree [ 508.005676][ T7772] netlink: 68 bytes leftover after parsing attributes in process `syz.0.664'. [ 508.258779][ T5174] BTRFS warning (device loop8): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 508.429837][ T7759] BTRFS error (device loop8): failed to load root extent [ 508.437188][ T7759] BTRFS warning (device loop8): try to load backup roots slot 1 [ 508.445682][ T4346] BTRFS warning (device loop8): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 508.553799][ T7759] BTRFS warning (device loop8): couldn't read tree root [ 508.560978][ T7759] BTRFS warning (device loop8): try to load backup roots slot 2 [ 508.569461][ T7759] BTRFS error (device loop8): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7 [ 508.580990][ T7759] BTRFS warning (device loop8): couldn't read tree root [ 508.588137][ T7759] BTRFS warning (device loop8): try to load backup roots slot 3 [ 508.651375][ T7759] BTRFS info (device loop8): enabling ssd optimizations [ 508.659512][ T7759] BTRFS info (device loop8): rebuilding free space tree [ 508.794751][ T7759] BTRFS info (device loop8): checking UUID tree [ 510.420779][ T4316] hid-generic 0000:0000:0000.0003: item fetching failed at offset 0/2 [ 510.429169][ T126] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 510.673576][ T4316] hid-generic: probe of 0000:0000:0000.0003 failed with error -22 [ 511.488961][ T7286] BTRFS info (device loop8): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 513.292400][ T7814] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 514.235267][ T7839] loop8: detected capacity change from 0 to 1024 [ 516.536218][ T7846] netlink: 72 bytes leftover after parsing attributes in process `syz.0.674'. [ 520.282434][ T7868] Cannot find set identified by id 0 to match [ 523.107021][ T4288] Bluetooth: hci3: unexpected subevent 0x01 length: 11 < 18 [ 523.116083][ T7424] hid-generic 0000:0000:0000.0004: item fetching failed at offset 0/2 [ 523.157491][ T7424] hid-generic: probe of 0000:0000:0000.0004 failed with error -22 [ 523.193313][ T7888] loop8: detected capacity change from 0 to 8 [ 523.213416][ T7888] SQUASHFS error: zlib decompression failed, data probably corrupt [ 523.246201][ T7888] SQUASHFS error: Failed to read block 0x9b: -5 [ 523.272190][ T7888] SQUASHFS error: Unable to read metadata cache entry [99] [ 523.287482][ T7888] SQUASHFS error: Unable to read inode 0x127 [ 524.546174][ T7899] loop8: detected capacity change from 0 to 1024 [ 524.607187][ T7899] hfsplus: unable to parse mount options [ 525.085721][ T7906] loop8: detected capacity change from 0 to 16 [ 525.096964][ T7906] MTD: Attempt to mount non-MTD device "/dev/loop8" [ 525.175064][ T7906] cramfs: root is not a directory [ 527.318289][ T4316] hid-generic 0000:0000:0000.0005: item fetching failed at offset 0/2 [ 527.572328][ T7423] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 529.348650][ T4316] hid-generic: probe of 0000:0000:0000.0005 failed with error -22 [ 529.463948][ T7423] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 529.495613][ T7423] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 529.542230][ T7423] usb 7-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 529.577641][ T7423] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.809501][ T7423] pegasus: probe of 7-1:1.0 failed with error -71 [ 529.863486][ T7423] usb 7-1: USB disconnect, device number 3 [ 532.732715][ T126] hid-generic 0000:0000:0000.0006: item fetching failed at offset 0/2 [ 532.741261][ T126] hid-generic: probe of 0000:0000:0000.0006 failed with error -22 [ 532.827032][ T7977] loop8: detected capacity change from 0 to 512 [ 532.951681][ T7977] EXT4-fs: inline encryption not supported [ 533.043340][ T7977] EXT4-fs (loop8): warning: checktime reached, running e2fsck is recommended [ 533.160347][ T7977] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #15: comm syz.8.712: corrupted inode contents [ 533.256117][ T7977] EXT4-fs (loop8): Remounting filesystem read-only [ 533.304085][ T7977] EXT4-fs error (device loop8): ext4_dirty_inode:6156: inode #15: comm syz.8.712: mark_inode_dirty error [ 533.493850][ T7977] EXT4-fs (loop8): Remounting filesystem read-only [ 533.514540][ T7977] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #15: comm syz.8.712: corrupted inode contents [ 533.923736][ T7977] EXT4-fs (loop8): Remounting filesystem read-only [ 533.966571][ T7977] EXT4-fs error (device loop8): ext4_xattr_delete_inode:2947: inode #15: comm syz.8.712: mark_inode_dirty error [ 534.152844][ T4288] Bluetooth: hci5: unexpected cc 0x1407 length: 11 > 9 [ 534.324628][ T7977] EXT4-fs (loop8): Remounting filesystem read-only [ 534.384827][ T7977] EXT4-fs error (device loop8): ext4_xattr_delete_inode:2950: inode #15: comm syz.8.712: mark inode dirty (error -117) [ 534.433331][ T7991] loop6: detected capacity change from 0 to 1024 [ 534.543022][ T7977] EXT4-fs (loop8): Remounting filesystem read-only [ 534.570219][ T7991] hfsplus: bad catalog file entry [ 535.959396][ T7977] EXT4-fs warning (device loop8): ext4_evict_inode:301: xattr delete (err -117) [ 535.969481][ T7991] hfsplus: failed to load root directory [ 536.012502][ T7977] EXT4-fs (loop8): 1 orphan inode deleted [ 536.029062][ T7977] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 536.281456][ T7286] EXT4-fs (loop8): unmounting filesystem. [ 538.083091][ T8007] loop8: detected capacity change from 0 to 4096 [ 538.133022][ T8007] ntfs3: loop8: Different NTFS' sector size (1024) and media sector size (512) [ 539.068750][ T14] hid-generic 0000:0000:0000.0007: item fetching failed at offset 0/2 [ 539.162763][ T14] hid-generic: probe of 0000:0000:0000.0007 failed with error -22 [ 542.530833][ T5953] hid-generic 0000:0000:0000.0008: item fetching failed at offset 0/2 [ 542.743239][ T5953] hid-generic: probe of 0000:0000:0000.0008 failed with error -22 [ 543.490165][ T4288] Bluetooth: hci0: unexpected event for opcode 0x0c22 [ 544.123555][ T8076] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 544.215989][ T8076] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 544.273957][ T8076] udc dummy_udc.0: failed to start g1: -22 [ 544.290175][ T8076] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 544.348694][ T8076] UDC core: g1: couldn't find an available UDC or it's busy [ 544.538971][ T7423] hid-generic 0000:0000:0000.0009: item fetching failed at offset 0/2 [ 544.561345][ T7423] hid-generic: probe of 0000:0000:0000.0009 failed with error -22 [ 546.552724][ T7149] hid-generic 0000:0000:0000.000A: item fetching failed at offset 0/2 [ 546.678139][ T7149] hid-generic: probe of 0000:0000:0000.000A failed with error -22 [ 547.147310][ T8103] loop7: detected capacity change from 0 to 2048 [ 547.409646][ T8103] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 548.414192][ T5953] hid-generic 0000:0000:0000.000B: item fetching failed at offset 0/2 [ 548.438871][ T5953] hid-generic: probe of 0000:0000:0000.000B failed with error -22 [ 548.620695][ T8124] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 548.645317][ T8124] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 548.679808][ T8124] udc dummy_udc.0: failed to start g1: -22 [ 548.711609][ T8124] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 548.762483][ T8124] UDC core: g1: couldn't find an available UDC or it's busy [ 552.904073][ T7422] hid-generic 0000:0000:0000.000C: item fetching failed at offset 0/2 [ 553.039244][ T7422] hid-generic: probe of 0000:0000:0000.000C failed with error -22 [ 558.479528][ T126] hid-generic 0000:0000:0000.000D: item fetching failed at offset 0/2 [ 558.522641][ T126] hid-generic: probe of 0000:0000:0000.000D failed with error -22 [ 559.122401][ T7149] hid-generic 0000:0000:0000.000E: item fetching failed at offset 0/2 [ 559.164383][ T7149] hid-generic: probe of 0000:0000:0000.000E failed with error -22 [ 562.798784][ T7828] hid-generic 0000:0000:0000.000F: item fetching failed at offset 0/2 [ 562.953527][ T7828] hid-generic: probe of 0000:0000:0000.000F failed with error -22 [ 563.495048][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.501542][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.013185][ T126] hid-generic 0000:0000:0000.0010: item fetching failed at offset 0/2 [ 566.021936][ T126] hid-generic: probe of 0000:0000:0000.0010 failed with error -22 [ 566.205312][ T8266] libceph: resolve '0' (ret=-3): failed [ 566.505354][ T8272] netlink: 152 bytes leftover after parsing attributes in process `syz.0.801'. [ 566.645593][ T8276] siw: device registration error -23 [ 571.561509][ T7423] hid-generic 0000:0000:0000.0011: item fetching failed at offset 0/2 [ 571.589615][ T7423] hid-generic: probe of 0000:0000:0000.0011 failed with error -22 [ 572.657427][ T7423] hid-generic 0000:0000:0000.0012: item fetching failed at offset 0/2 [ 572.686641][ T7423] hid-generic: probe of 0000:0000:0000.0012 failed with error -22 [ 575.277650][ T8344] netlink: 32 bytes leftover after parsing attributes in process `syz.7.809'. [ 577.106073][ T14] hid-generic 0000:0000:0000.0013: item fetching failed at offset 0/2 [ 577.125461][ T14] hid-generic: probe of 0000:0000:0000.0013 failed with error -22 [ 577.252203][ T4288] Bluetooth: hci3: command 0x0406 tx timeout [ 579.898718][ T4316] hid-generic 0000:0000:0000.0014: item fetching failed at offset 0/2 [ 579.929827][ T4316] hid-generic: probe of 0000:0000:0000.0014 failed with error -22 [ 587.014472][ T14] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 587.427728][ T14] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 588.262164][ T14] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 588.283684][ T14] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 588.412397][ T14] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 588.432990][ T7149] hid-generic 0000:0000:0000.0015: item fetching failed at offset 0/2 [ 588.473148][ T7149] hid-generic: probe of 0000:0000:0000.0015 failed with error -22 [ 588.485637][ T14] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 588.526223][ T7149] hid-generic 0000:0000:0000.0016: item fetching failed at offset 0/2 [ 588.542932][ T7149] hid-generic: probe of 0000:0000:0000.0016 failed with error -22 [ 588.583782][ T14] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 590.675539][ T14] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 590.714347][ T14] usb 3-1: Product: syz [ 590.719536][ T14] usb 3-1: Manufacturer: syz [ 590.810929][ T14] usb 3-1: can't set config #1, error -71 [ 591.063857][ T14] usb 3-1: USB disconnect, device number 6 [ 591.988105][ T8427] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 593.561743][ T5953] hid-generic 0000:0000:0000.0017: item fetching failed at offset 0/2 [ 593.624841][ T5953] hid-generic: probe of 0000:0000:0000.0017 failed with error -22 [ 597.715398][ T8476] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 598.905144][ T5953] hid-generic 0000:0000:0000.0018: item fetching failed at offset 0/2 [ 599.652667][ T5953] hid-generic: probe of 0000:0000:0000.0018 failed with error -22 [ 600.089111][ T7828] hid-generic 0000:0000:0000.0019: item fetching failed at offset 0/2 [ 600.102813][ T7828] hid-generic: probe of 0000:0000:0000.0019 failed with error -22 [ 600.242932][ T7828] hid-generic 0000:0000:0000.001A: item fetching failed at offset 0/2 [ 600.254940][ T7828] hid-generic: probe of 0000:0000:0000.001A failed with error -22 [ 600.304719][ T8488] netlink: 'syz.2.844': attribute type 28 has an invalid length. [ 600.318036][ T8488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.844'. [ 600.447811][ T7828] rtc_cmos 00:00: Alarms can be up to one day in the future [ 600.533684][ T7828] rtc_cmos 00:00: Alarms can be up to one day in the future [ 600.590875][ T7828] rtc_cmos 00:00: Alarms can be up to one day in the future [ 600.659035][ T7828] rtc_cmos 00:00: Alarms can be up to one day in the future [ 600.744832][ T7828] rtc rtc0: __rtc_set_alarm: err=-22 [ 600.987418][ T7828] hid-generic 0000:0000:0000.001B: item fetching failed at offset 0/2 [ 601.038457][ T7828] hid-generic: probe of 0000:0000:0000.001B failed with error -22 [ 602.152680][ T27] hid-generic 0000:0000:0000.001C: item fetching failed at offset 0/2 [ 602.409292][ T27] hid-generic: probe of 0000:0000:0000.001C failed with error -22 [ 606.347394][ T5953] hid-generic 0000:0000:0000.001D: item fetching failed at offset 0/2 [ 606.386738][ T5953] hid-generic: probe of 0000:0000:0000.001D failed with error -22 [ 606.859082][ T5953] hid-generic 0000:0000:0000.001E: item fetching failed at offset 0/2 [ 606.901276][ T5953] hid-generic: probe of 0000:0000:0000.001E failed with error -22 [ 607.001749][ T8549] syz.2.865: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 607.084706][ T8549] CPU: 0 PID: 8549 Comm: syz.2.865 Not tainted syzkaller #0 [ 607.092488][ T8549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 607.105510][ T8549] Call Trace: [ 607.109648][ T8549] [ 607.112730][ T8549] dump_stack_lvl+0x188/0x24e [ 607.119022][ T8549] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 607.127286][ T8549] ? show_regs_print_info+0x12/0x12 [ 607.133185][ T8549] ? load_image+0x410/0x410 [ 607.139492][ T8549] ? __rcu_read_unlock+0x78/0xd0 [ 607.146787][ T8549] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 607.155220][ T8549] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 607.165018][ T8549] warn_alloc+0x242/0x330 [ 607.170482][ T8549] ? zone_watermark_ok_safe+0x270/0x270 [ 607.177205][ T8549] __vmalloc_node_range+0x11e/0x1380 [ 607.184635][ T8549] ? __mutex_trylock_common+0x15c/0x260 [ 607.191818][ T8549] ? trace_raw_output_contention_end+0xd0/0xd0 [ 607.200360][ T8549] ? rcu_is_watching+0x11/0xa0 [ 607.206470][ T8549] ? trace_contention_end+0x5f/0x170 [ 607.213691][ T8549] ? __mutex_lock+0x1ab/0xae0 [ 607.218850][ T8549] ? tomoyo_path_number_perm+0x5a4/0x650 [ 607.225404][ T8549] ? free_vm_area+0x50/0x50 [ 607.230442][ T8549] ? dvb_demux_do_ioctl+0x313/0x530 [ 607.236273][ T8549] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 607.241827][ T8549] ? mutex_lock_nested+0x10/0x10 [ 607.247857][ T8549] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 607.254034][ T8549] vmalloc+0x75/0x80 [ 607.258534][ T8549] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 607.264956][ T8549] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 607.272079][ T8549] dvb_demux_do_ioctl+0x450/0x530 [ 607.278789][ T8549] dvb_usercopy+0x191/0x2b0 [ 607.284103][ T8549] ? dvb_dmxdev_buffer_read+0x4a0/0x4a0 [ 607.290508][ T8549] ? dvb_generic_ioctl+0xb0/0xb0 [ 607.296468][ T8549] ? dvb_demux_poll+0x210/0x210 [ 607.301695][ T8549] dvb_demux_ioctl+0x25/0x30 [ 607.307069][ T8549] __se_sys_ioctl+0xfa/0x170 [ 607.312084][ T8549] do_syscall_64+0x4c/0xa0 [ 607.316938][ T8549] ? clear_bhb_loop+0x60/0xb0 [ 607.323112][ T8549] ? clear_bhb_loop+0x60/0xb0 [ 607.328577][ T8549] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 607.337092][ T8549] RIP: 0033:0x7f241f99e0d9 [ 607.343473][ T8549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.365318][ T8549] RSP: 002b:00007f24207b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 607.375650][ T8549] RAX: ffffffffffffffda RBX: 00007f241fc25fa0 RCX: 00007f241f99e0d9 [ 607.387156][ T8549] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000003 [ 607.398258][ T8549] RBP: 00007f241fa35024 R08: 0000000000000000 R09: 0000000000000000 [ 607.407728][ T8549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 607.416552][ T8549] R13: 00007f241fc26038 R14: 00007f241fc25fa0 R15: 00007ffd7a5a9cf8 [ 607.425436][ T8549] [ 608.392320][ T7828] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 608.647150][ T8549] Mem-Info: [ 608.651088][ T8549] active_anon:45128 inactive_anon:0 isolated_anon:0 [ 608.651088][ T8549] active_file:21118 inactive_file:40170 isolated_file:0 [ 608.651088][ T8549] unevictable:768 dirty:186 writeback:0 [ 608.651088][ T8549] slab_reclaimable:22306 slab_unreclaimable:96578 [ 608.651088][ T8549] mapped:32465 shmem:39419 pagetables:795 [ 608.651088][ T8549] sec_pagetables:0 bounce:0 [ 608.651088][ T8549] kernel_misc_reclaimable:0 [ 608.651088][ T8549] free:1279637 free_pcp:5816 free_cma:0 [ 608.713853][ T7828] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 608.732155][ T8549] Node 0 active_anon:180712kB inactive_anon:0kB active_file:84472kB inactive_file:160480kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:129860kB dirty:744kB writeback:0kB shmem:156340kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:12132kB pagetables:3180kB sec_pagetables:0kB all_unreclaimable? no [ 610.385081][ T7] hid-generic 0000:0000:0000.001F: item fetching failed at offset 0/2 [ 610.561163][ T7828] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 610.578492][ T7828] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 610.590884][ T7828] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 610.602117][ T7828] usb 9-1: SerialNumber: syz [ 610.617980][ T7828] usb 9-1: 0:2 : does not exist [ 610.641750][ T8549] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 610.701169][ T8549] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 610.812679][ T7] hid-generic: probe of 0000:0000:0000.001F failed with error -22 [ 610.827323][ T27] usb 9-1: USB disconnect, device number 3 [ 610.973722][ T8549] lowmem_reserve[]: 0 2527 2528 2528 2528 [ 611.018015][ T8549] Node 0 DMA32 free:1144364kB boost:0kB min:34692kB low:43364kB high:52036kB reserved_highatomic:0KB active_anon:225864kB inactive_anon:0kB active_file:84472kB inactive_file:160480kB unevictable:1536kB writepending:832kB present:3129332kB managed:2592908kB mlocked:0kB bounce:0kB free_pcp:18044kB local_pcp:18044kB free_cma:0kB [ 611.103744][ T8563] udevd[8563]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 611.159950][ T8549] lowmem_reserve[]: 0 0 1 1 1 [ 611.200295][ T8549] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1424kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 611.362308][ T8549] lowmem_reserve[]: 0 0 0 0 0 [ 611.452079][ T7] hid-generic 0000:0000:0000.0020: item fetching failed at offset 0/2 [ 612.163651][ T8549] Node 1 Normal free:3905904kB boost:0kB min:55192kB low:68988kB high:82784kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:12832kB local_pcp:10848kB free_cma:0kB [ 612.284149][ T7] hid-generic: probe of 0000:0000:0000.0020 failed with error -22 [ 612.292989][ T8549] lowmem_reserve[]: 0 0 0 0 0 [ 612.298633][ T8549] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 612.355709][ T8549] Node 0 DMA32: 996*4kB (UME) 490*8kB (UME) 395*16kB (UME) 141*32kB (UME) 206*64kB (UME) 242*128kB (UME) 109*256kB (UME) 95*512kB (UME) 50*1024kB (UME) 10*2048kB (UM) 229*4096kB (UM) = 1149104kB [ 612.386033][ T8549] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 612.399344][ T8549] Node 1 Normal: 244*4kB (UME) 60*8kB (UME) 32*16kB (UME) 112*32kB (UME) 41*64kB (UME) 15*128kB (UE) 8*256kB (UM) 3*512kB (UME) 1*1024kB (U) 0*2048kB 950*4096kB (M) = 3905904kB [ 612.442423][ T8549] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 612.473470][ T8549] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 612.524376][ T8549] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 612.564267][ T8549] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 612.629415][ T8549] 103780 total pagecache pages [ 612.682815][ T8549] 0 pages in swap cache [ 612.687170][ T8549] Free swap = 124668kB [ 612.721960][ T8549] Total swap = 124996kB [ 612.727449][ T8549] 2097051 pages RAM [ 612.742087][ T8549] 0 pages HighMem/MovableOnly [ 612.747802][ T8549] 415223 pages reserved [ 612.801470][ T8549] 0 pages cma reserved [ 612.859921][ T7423] hid-generic 0000:0000:0000.0021: item fetching failed at offset 0/2 [ 612.901401][ T7423] hid-generic: probe of 0000:0000:0000.0021 failed with error -22 [ 613.028675][ T8599] netlink: 16 bytes leftover after parsing attributes in process `syz.8.878'. [ 615.498417][ T14] hid-generic 0000:0000:0000.0022: item fetching failed at offset 0/2 [ 616.351301][ T14] hid-generic: probe of 0000:0000:0000.0022 failed with error -22 [ 616.656816][ T8617] netlink: 'syz.8.884': attribute type 2 has an invalid length. [ 616.714188][ T8619] loop7: detected capacity change from 0 to 16 [ 616.763675][ T8619] erofs: (device loop7): mounted with root inode @ nid 36. [ 617.489502][ T8632] loop6: detected capacity change from 0 to 256 [ 617.518153][ T8632] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001034b, chksum : 0x6322ccb6, utbl_chksum : 0xe619d30d) [ 617.561299][ T8632] exFAT-fs (loop6): failed to load alloc-bitmap [ 617.571886][ T8632] exFAT-fs (loop6): failed to recognize exfat type [ 617.634214][ T14] hid-generic 0000:0000:0000.0023: item fetching failed at offset 0/2 [ 617.680743][ T14] hid-generic: probe of 0000:0000:0000.0023 failed with error -22 [ 617.783014][ T8563] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 620.135838][ T7] hid-generic 0000:0000:0000.0024: item fetching failed at offset 0/2 [ 620.167282][ T7] hid-generic: probe of 0000:0000:0000.0024 failed with error -22 [ 620.857533][ T14] hid-generic 0000:0000:0000.0025: item fetching failed at offset 0/2 [ 620.910131][ T14] hid-generic: probe of 0000:0000:0000.0025 failed with error -22 [ 624.478450][ T8683] loop7: detected capacity change from 0 to 256 [ 625.412859][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.428254][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.748550][ T8687] xt_connbytes: Forcing CT accounting to be enabled [ 628.506414][ T8690] Illegal XDP return value 4294967274 on prog (id 44) dev N/A, expect packet loss! [ 629.108589][ T7] hid-generic 0000:0000:0000.0026: item fetching failed at offset 0/2 [ 629.154569][ T7] hid-generic: probe of 0000:0000:0000.0026 failed with error -22 [ 629.568490][ T4316] hid-generic 0000:0000:0000.0027: item fetching failed at offset 0/2 [ 629.609799][ T4316] hid-generic: probe of 0000:0000:0000.0027 failed with error -22 [ 632.536929][ T14] hid-generic 0000:0000:0000.0028: item fetching failed at offset 0/2 [ 632.616575][ T14] hid-generic: probe of 0000:0000:0000.0028 failed with error -22 [ 636.768566][ T7149] hid-generic 0000:0000:0000.0029: item fetching failed at offset 0/2 [ 637.620335][ T7149] hid-generic: probe of 0000:0000:0000.0029 failed with error -22 [ 640.234124][ T14] hid-generic 0000:0000:0000.002A: item fetching failed at offset 0/2 [ 640.319750][ T14] hid-generic: probe of 0000:0000:0000.002A failed with error -22 [ 641.468553][ T126] hid-generic 0000:0000:0000.002B: item fetching failed at offset 0/2 [ 641.521143][ T126] hid-generic: probe of 0000:0000:0000.002B failed with error -22 [ 641.532608][ T8778] netlink: 'syz.2.922': attribute type 12 has an invalid length. [ 644.640000][ T7149] hid-generic 0000:0000:0000.002C: item fetching failed at offset 0/2 [ 645.303665][ T7149] hid-generic: probe of 0000:0000:0000.002C failed with error -22 [ 646.098240][ T126] hid-generic 0000:0000:0000.002D: item fetching failed at offset 0/2 [ 646.172675][ T126] hid-generic: probe of 0000:0000:0000.002D failed with error -22 [ 646.583081][ T126] hid-generic 0000:0000:0000.002E: item fetching failed at offset 0/2 [ 646.649759][ T126] hid-generic: probe of 0000:0000:0000.002E failed with error -22 [ 648.978701][ T8835] jffs2: notice: (8835) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 649.102184][ T126] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 649.241472][ T8850] x_tables: duplicate underflow at hook 3 [ 649.323896][ T126] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 649.377735][ T126] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 649.421816][ T126] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.619180][ T126] snd-usb-audio: probe of 3-1:27.0 failed with error -2 [ 649.662766][ T8563] udevd[8563]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 649.708183][ T4321] usb 3-1: USB disconnect, device number 7 [ 650.321470][ T126] hid-generic 0000:0000:0000.002F: item fetching failed at offset 0/2 [ 651.990167][ T126] hid-generic: probe of 0000:0000:0000.002F failed with error -22 [ 652.307358][ T7] hid-generic 0000:0000:0000.0030: item fetching failed at offset 0/2 [ 652.340626][ T7] hid-generic: probe of 0000:0000:0000.0030 failed with error -22 [ 653.467054][ T8880] loop6: detected capacity change from 0 to 32768 [ 653.660520][ T8880] JBD2: Ignoring recovery information on journal [ 653.929534][ T8880] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 654.290878][ T6391] ocfs2: Unmounting device (7,6) on (node local) [ 654.516334][ T7423] hid-generic 0000:0000:0000.0031: item fetching failed at offset 0/2 [ 654.564619][ T7423] hid-generic: probe of 0000:0000:0000.0031 failed with error -22 [ 656.606468][ T26] audit: type=1326 audit(1787705621.771:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 656.668890][ T7423] hid-generic 0000:0000:0000.0032: item fetching failed at offset 0/2 [ 656.729447][ T7423] hid-generic: probe of 0000:0000:0000.0032 failed with error -22 [ 656.745107][ T26] audit: type=1326 audit(1787705621.781:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 656.928365][ T26] audit: type=1326 audit(1787705621.781:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 656.989444][ T8937] jffs2: notice: (8937) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 657.073688][ T26] audit: type=1326 audit(1787705621.781:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=129 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 657.221052][ T26] audit: type=1326 audit(1787705621.781:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 657.341423][ T26] audit: type=1326 audit(1787705621.781:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 657.512139][ T26] audit: type=1326 audit(1787705621.781:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 657.520168][ T8940] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 657.625527][ T26] audit: type=1326 audit(1787705621.781:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8929 comm="syz.6.973" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f65cf79e0d9 code=0x7ffc0000 [ 658.052386][ T8932] loop6: detected capacity change from 0 to 32768 [ 658.116025][ T8932] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.976 (8932) [ 658.303819][ T8932] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 658.421587][ T8975] netlink: 72 bytes leftover after parsing attributes in process `syz.2.987'. [ 658.456311][ T8932] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 658.632581][ T8932] BTRFS info (device loop6): using free space tree [ 659.159466][ T7] hid-generic 0000:0000:0000.0033: item fetching failed at offset 0/2 [ 659.212932][ T7] hid-generic: probe of 0000:0000:0000.0033 failed with error -22 [ 659.514309][ T8932] BTRFS info (device loop6): enabling ssd optimizations [ 659.830788][ T9006] loop8: detected capacity change from 0 to 256 [ 659.906559][ T9006] FAT-fs (loop8): Directory bread(block 64) failed [ 659.937008][ T9006] FAT-fs (loop8): Directory bread(block 65) failed [ 660.012779][ T9006] FAT-fs (loop8): Directory bread(block 66) failed [ 660.020986][ T9006] FAT-fs (loop8): Directory bread(block 67) failed [ 660.062677][ T6391] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 660.096725][ T9006] FAT-fs (loop8): Directory bread(block 68) failed [ 660.133964][ T9006] FAT-fs (loop8): Directory bread(block 69) failed [ 660.169651][ T9006] FAT-fs (loop8): Directory bread(block 70) failed [ 660.272335][ T9006] FAT-fs (loop8): Directory bread(block 71) failed [ 660.291317][ T9006] FAT-fs (loop8): Directory bread(block 72) failed [ 660.406677][ T9006] FAT-fs (loop8): Directory bread(block 73) failed [ 660.810886][ T9006] syz.8.994: attempt to access beyond end of device [ 660.810886][ T9006] loop8: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 660.852959][ T9006] syz.8.994: attempt to access beyond end of device [ 660.852959][ T9006] loop8: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 660.913108][ T26] audit: type=1800 audit(1787705626.081:93): pid=9006 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.994" name="file0" dev="loop8" ino=1048645 res=0 errno=0 [ 661.481236][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 661.641604][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 661.854137][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 661.903071][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 661.935047][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 661.969707][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 661.988155][ T9022] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 662.359054][ T9036] loop8: detected capacity change from 0 to 512 [ 662.594531][ T9033] jffs2: notice: (9033) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 662.698978][ T9036] EXT4-fs error (device loop8): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 42 vs 41 free clusters [ 662.819394][ T9036] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #16: comm syz.8.1003: corrupted inode contents [ 662.941565][ T9036] EXT4-fs error (device loop8): ext4_dirty_inode:6156: inode #16: comm syz.8.1003: mark_inode_dirty error [ 662.968201][ T7731] hid-generic 0000:0000:0000.0034: item fetching failed at offset 0/2 [ 663.014301][ T7731] hid-generic: probe of 0000:0000:0000.0034 failed with error -22 [ 663.061147][ T9036] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #16: comm syz.8.1003: corrupted inode contents [ 663.173100][ T9036] EXT4-fs error (device loop8): __ext4_ext_dirty:202: inode #16: comm syz.8.1003: mark_inode_dirty error [ 663.261271][ T9036] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #16: comm syz.8.1003: corrupted inode contents [ 663.412628][ T9036] EXT4-fs error (device loop8) in ext4_orphan_del:303: Corrupt filesystem [ 663.511900][ T9036] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #16: comm syz.8.1003: corrupted inode contents [ 663.674682][ T9036] EXT4-fs error (device loop8): ext4_truncate:4325: inode #16: comm syz.8.1003: mark_inode_dirty error [ 663.832704][ T9036] EXT4-fs error (device loop8) in ext4_process_orphan:345: Corrupt filesystem [ 663.926061][ T9036] EXT4-fs (loop8): 1 truncate cleaned up [ 663.945715][ T4379] Quota error (device loop8): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 663.992166][ T4379] EXT4-fs error (device loop8): ext4_release_dquot:6877: comm kworker/u4:9: Failed to release dquot type 1 [ 664.006073][ T9036] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 664.100511][ T9036] ext4 filesystem being mounted at /86/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 664.341116][ T9036] Quota error (device loop8): write_blk: dquota write failed [ 664.473043][ T9036] Quota error (device loop8): qtree_write_dquot: Error -28 occurred while creating quota [ 664.570101][ T9036] EXT4-fs error (device loop8): ext4_acquire_dquot:6841: comm syz.8.1003: Failed to acquire dquot type 1 [ 664.825033][ T7286] EXT4-fs (loop8): unmounting filesystem. [ 664.886635][ T4671] Quota error (device loop8): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 664.942286][ T4671] EXT4-fs error (device loop8): ext4_release_dquot:6877: comm kworker/u4:15: Failed to release dquot type 1 [ 665.088401][ T4321] hid-generic 0000:0000:0000.0035: item fetching failed at offset 0/2 [ 665.149804][ T4321] hid-generic: probe of 0000:0000:0000.0035 failed with error -22 [ 666.991079][ T27] hid-generic 0000:0000:0000.0036: item fetching failed at offset 0/2 [ 667.044491][ T27] hid-generic: probe of 0000:0000:0000.0036 failed with error -22 [ 667.258944][ T7731] hid-generic 0000:0000:0000.0037: item fetching failed at offset 0/2 [ 667.287193][ T7731] hid-generic: probe of 0000:0000:0000.0037 failed with error -22 [ 667.896451][ T9139] tipc: Invalid UDP bearer configuration [ 667.896496][ T9139] tipc: Enabling of bearer rejected, failed to enable media [ 668.220157][ T4321] hid-generic 0000:0000:0000.0038: item fetching failed at offset 0/2 [ 668.272257][ T7731] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 668.394458][ T4321] hid-generic: probe of 0000:0000:0000.0038 failed with error -22 [ 669.132131][ T7731] usb 3-1: Using ep0 maxpacket: 16 [ 669.140425][ T7731] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 669.170072][ T9153] loop7: detected capacity change from 0 to 4096 [ 669.189258][ T7731] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 669.209600][ T9153] EXT4-fs: Ignoring removed mblk_io_submit option [ 669.216637][ T7731] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 669.236154][ T9153] EXT4-fs: Ignoring removed bh option [ 669.258262][ T9153] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 669.275437][ T7731] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 669.292188][ T9153] EXT4-fs (loop7): Test dummy encryption mode enabled [ 669.302924][ T7731] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.327712][ T7731] usb 3-1: config 0 descriptor?? [ 669.356580][ T9153] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 669.521922][ T5673] EXT4-fs (loop7): unmounting filesystem. [ 669.766269][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.817650][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.831332][ T9135] loop8: detected capacity change from 0 to 32768 [ 669.854231][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.874258][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.881661][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.905428][ T9135] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop8 scanned by syz.8.1036 (9135) [ 669.948000][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 669.994267][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.032338][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.060409][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.100893][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.130603][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.169927][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.198448][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.227211][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.245297][ T7731] microsoft 0003:045E:07DA.0039: unknown main item tag 0x0 [ 670.291150][ T7731] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0039/input/input8 [ 670.368711][ T7730] hid-generic 0000:0000:0000.003A: item fetching failed at offset 0/2 [ 670.380080][ T7731] microsoft 0003:045E:07DA.0039: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 670.394690][ T7730] hid-generic: probe of 0000:0000:0000.003A failed with error -22 [ 670.407854][ T7731] usb 3-1: USB disconnect, device number 8 [ 670.432412][ T9135] BTRFS info (device loop8): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 670.478521][ T9135] BTRFS info (device loop8): using sha256 (sha256-avx2) checksum algorithm [ 670.540871][ T9135] BTRFS info (device loop8): force clearing of disk cache [ 670.569043][ T9135] BTRFS info (device loop8): force zlib compression, level 3 [ 670.619091][ T9135] BTRFS info (device loop8): disabling free space tree [ 670.649830][ T9135] BTRFS info (device loop8): max_inline at 0 [ 670.677153][ T9135] BTRFS info (device loop8): enabling free space tree [ 670.710622][ T9135] BTRFS info (device loop8): using free space tree [ 670.906107][ T9186] fido_id[9186]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 671.844133][ T9027] hid-generic 0000:0000:0000.003B: item fetching failed at offset 0/2 [ 671.967130][ T9135] BTRFS error (device loop8): open_ctree failed: -12 [ 672.023242][ T9027] hid-generic: probe of 0000:0000:0000.003B failed with error -22 [ 672.093317][ T9214] loop6: detected capacity change from 0 to 2048 [ 672.165325][ T9214] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024) [ 672.286044][ T9223] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 672.811039][ T9236] netlink: 'syz.6.1063': attribute type 4 has an invalid length. [ 673.361036][ T7828] hid-generic 0000:0000:0000.003C: item fetching failed at offset 0/2 [ 673.507661][ T7828] hid-generic: probe of 0000:0000:0000.003C failed with error -22 [ 674.377382][ T9254] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1068'. [ 674.440298][ T9254] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1068'. [ 675.105291][ T4321] hid-generic 0000:0000:0000.003D: item fetching failed at offset 0/2 [ 675.373943][ T4321] hid-generic: probe of 0000:0000:0000.003D failed with error -22 [ 676.220126][ T9264] sctp: failed to load transform for md5: -2 [ 677.109224][ T7731] hid-generic 0000:0000:0000.003E: item fetching failed at offset 0/2 [ 677.852421][ T7731] hid-generic: probe of 0000:0000:0000.003E failed with error -22 [ 678.197141][ T9270] loop8: detected capacity change from 0 to 40427 [ 678.233122][ T9270] F2FS-fs (loop8): Wrong segment_count / block_count (64 > 16384) [ 678.345603][ T4321] hid-generic 0000:0000:0000.003F: item fetching failed at offset 0/2 [ 678.378417][ T9270] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 678.511736][ T4321] hid-generic: probe of 0000:0000:0000.003F failed with error -22 [ 679.090581][ T9270] F2FS-fs (loop8): Failed to start F2FS issue_checkpoint_thread (-12) [ 679.618041][ T9320] loop6: detected capacity change from 0 to 32768 [ 679.635022][ T9320] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.1087 (9320) [ 679.660160][ T9320] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 679.677160][ T9320] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 679.686877][ T9320] BTRFS info (device loop6): turning on sync discard [ 679.696273][ T9320] BTRFS info (device loop6): using free space tree [ 680.202216][ T9320] BTRFS info (device loop6): enabling ssd optimizations [ 680.335512][ T26] audit: type=1800 audit(1787705645.501:94): pid=9320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1087" name="file1" dev="loop6" ino=260 res=0 errno=0 [ 680.575033][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 680.594710][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 680.652214][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 680.673122][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 680.690481][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 681.324260][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 681.341820][ T9357] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 684.025911][ T6391] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 684.798232][ T8563] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop6 scanned by udevd (8563) [ 685.240418][ T4318] hid-generic 0000:0000:0000.0040: item fetching failed at offset 0/2 [ 685.453920][ T4318] hid-generic: probe of 0000:0000:0000.0040 failed with error -22 [ 686.114429][ T9417] netlink: 'syz.8.1110': attribute type 3 has an invalid length. [ 686.376598][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.384022][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.073646][ T9025] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 687.252716][ T5953] hid-generic 0000:0000:0000.0041: item fetching failed at offset 0/2 [ 687.368001][ T9025] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 687.409133][ T5953] hid-generic: probe of 0000:0000:0000.0041 failed with error -22 [ 687.498021][ T9025] usb 9-1: config 0 interface 0 has no altsetting 0 [ 687.609140][ T9025] usb 9-1: New USB device found, idVendor=06cb, idProduct=73f5, bcdDevice= 0.00 [ 687.791930][ T9025] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.025797][ T9025] usb 9-1: config 0 descriptor?? [ 688.060530][ T9440] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 688.374600][ T9466] program syz.0.1127 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 688.478775][ T4318] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 688.517315][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.548103][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.577476][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.615352][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.650651][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.671043][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.680730][ T4318] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 688.699747][ T4318] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 688.720397][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.727957][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.741213][ T4318] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 688.765830][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.773607][ T4318] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 688.785214][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.792925][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.800560][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.809522][ T4318] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 688.819556][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.827601][ T4318] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 688.837164][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.844608][ T4318] usb 3-1: Product: syz [ 688.850326][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.858435][ T4318] usb 3-1: Manufacturer: syz [ 688.867432][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.877215][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.886745][ T4318] cdc_wdm 3-1:1.0: skipping garbage [ 688.902139][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.909536][ T4318] cdc_wdm 3-1:1.0: skipping garbage [ 688.923049][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.931302][ T4318] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 688.948923][ T4318] cdc_wdm 3-1:1.0: Unknown control protocol [ 688.956783][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.969367][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 688.987717][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.004403][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.019538][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.034861][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.051564][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.057874][ T27] wiimote 0005:057E:0306.0043: hidraw0: BLUETOOTH HID v0.00 Gamepad [syz0] on syz0 [ 689.075765][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.112638][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.126668][ T27] wiimote 0005:057E:0306.0043: New device registered [ 689.133881][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.150355][ T9479] wiimote 0005:057E:0306.0043: Device removed [ 689.158745][ T27] usb 3-1: USB disconnect, device number 9 [ 689.164681][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.164768][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.164792][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.164823][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.251283][ T9025] itetech 0003:06CB:73F5.0042: unknown main item tag 0x0 [ 689.305200][ T9025] itetech 0003:06CB:73F5.0042: hidraw0: USB HID v0.81 Device [HID 06cb:73f5] on usb-dummy_hcd.8-1/input0 [ 689.372583][ T9025] usb 9-1: USB disconnect, device number 4 [ 689.587002][ T4318] hid-generic 0000:0000:0000.0044: item fetching failed at offset 0/2 [ 689.878335][ T4318] hid-generic: probe of 0000:0000:0000.0044 failed with error -22 [ 690.702608][ T9505] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.720521][ T9497] fido_id[9497]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 690.892117][ T4321] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 691.084042][ T4321] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 691.125350][ T4321] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 691.136892][ T9508] fido_id[9508]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 691.173947][ T4321] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 691.215766][ T4321] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 691.248042][ T4321] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 691.308341][ T4321] usb 9-1: Product: syz [ 691.332421][ T4321] usb 9-1: Manufacturer: syz [ 691.337153][ T4321] usb 9-1: SerialNumber: syz [ 691.578695][ T4321] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 691.858637][ T4321] usb 9-1: USB disconnect, device number 5 [ 691.888612][ T4321] usblp0: removed [ 692.350396][ T4321] hid-generic 0000:0000:0000.0045: item fetching failed at offset 0/2 [ 692.559344][ T4321] hid-generic: probe of 0000:0000:0000.0045 failed with error -22 [ 693.542037][ T5953] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 693.752607][ T5953] usb 9-1: Using ep0 maxpacket: 8 [ 693.773337][ T5953] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 693.781714][ T5953] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 693.819340][ T9539] loop6: detected capacity change from 0 to 32768 [ 693.826112][ T5953] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 693.826149][ T5953] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 693.826175][ T5953] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 693.901700][ T9539] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 scanned by syz.6.1151 (9539) [ 693.944206][ T5953] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 693.964090][ T5953] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.003388][ T9539] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 694.035648][ T9539] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 694.076003][ T9539] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 694.126786][ T9539] BTRFS info (device loop6): use zstd compression, level 3 [ 694.158170][ T9547] loop7: detected capacity change from 0 to 40427 [ 694.169226][ T9539] BTRFS info (device loop6): using free space tree [ 694.192105][ T9547] F2FS-fs (loop7): Invalid Fs Meta Ino: node(1) meta(2) root(0) [ 694.210322][ T9547] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 694.260486][ T9547] F2FS-fs (loop7): invalid crc value [ 694.280991][ T5953] usb 9-1: GET_CAPABILITIES returned 0 [ 694.302416][ T5953] usbtmc 9-1:16.0: can't read capabilities [ 694.346374][ T9547] F2FS-fs (loop7): Found nat_bits in checkpoint [ 694.527822][ T9550] usb 9-1: usbtmc_ioctl_clear_out_halt returned -32 [ 694.567464][ T4321] usb 9-1: USB disconnect, device number 6 [ 694.668583][ T9547] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 694.672489][ T9539] BTRFS info (device loop6): enabling ssd optimizations [ 694.680241][ T9547] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 694.843374][ T26] audit: type=1800 audit(1787705660.011:95): pid=9539 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1151" name="file1" dev="loop6" ino=260 res=0 errno=0 [ 694.875822][ T9574] f2fs_ckpt-7:7: attempt to access beyond end of device [ 694.875822][ T9574] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 695.476798][ T6391] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 697.618904][ T9025] hid-generic 0000:0000:0000.0046: item fetching failed at offset 0/2 [ 697.668356][ T9025] hid-generic: probe of 0000:0000:0000.0046 failed with error -22 [ 697.808018][ T9633] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 697.857964][ T9633] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 697.919346][ T9633] udc dummy_udc.0: failed to start g1: -22 [ 697.958519][ T9633] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 698.025093][ T9633] UDC core: g1: couldn't find an available UDC or it's busy [ 699.175294][ T26] audit: type=1800 audit(1787705664.341:96): pid=9669 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.1178" name="power" dev="configfs" ino=56487 res=0 errno=0 [ 699.588281][ T9025] hid-generic 0000:0000:0000.0047: item fetching failed at offset 0/2 [ 699.746490][ T9025] hid-generic: probe of 0000:0000:0000.0047 failed with error -22 [ 700.569627][ T9693] loop8: detected capacity change from 0 to 256 [ 700.624005][ T9693] exFAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 700.686090][ T9693] exFAT-fs (loop8): Medium has reported failures. Some data may be lost. [ 700.777693][ T9693] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0xb94faefa, utbl_chksum : 0xe619d30d) [ 700.817623][ T9697] Format for deleting device is "id" (uint). [ 700.840548][ T9693] exFAT-fs (loop8): failed to load alloc-bitmap [ 700.874998][ T9693] exFAT-fs (loop8): failed to recognize exfat type [ 701.261484][ T5953] kernel write not supported for file /840/attr/prev (pid: 5953 comm: kworker/0:8) [ 701.319524][ T9720] loop8: detected capacity change from 0 to 512 [ 701.467691][ T9720] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 701.504390][ T27] hid-generic 0000:0000:0000.0048: item fetching failed at offset 0/2 [ 701.675548][ T27] hid-generic: probe of 0000:0000:0000.0048 failed with error -22 [ 701.711549][ T9720] ext4 filesystem being mounted at /110/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 702.599160][ T7286] EXT4-fs (loop8): unmounting filesystem. [ 702.876106][ T9747] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 703.288220][ T9754] device gretap0 entered promiscuous mode [ 703.340059][ T9754] device vlan2 entered promiscuous mode [ 704.009219][ T5953] hid-generic 0000:0000:0000.0049: item fetching failed at offset 0/2 [ 704.225317][ T5953] hid-generic: probe of 0000:0000:0000.0049 failed with error -22 [ 705.525967][ T9801] loop6: detected capacity change from 0 to 64 [ 706.388108][ T9823] netlink: 188 bytes leftover after parsing attributes in process `syz.2.1227'. [ 706.441021][ T9823] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1227'. [ 706.515030][ T9823] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1227'. [ 706.643086][ T9830] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 706.692730][ T9830] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 706.735034][ T9830] udc dummy_udc.0: failed to start g1: -22 [ 706.747095][ T9832] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1229'. [ 706.786362][ T9830] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 706.887753][ T9830] UDC core: g1: couldn't find an available UDC or it's busy [ 707.294775][ T9846] loop6: detected capacity change from 0 to 256 [ 708.402930][ T9873] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1243'. [ 709.282308][ T9896] loop6: detected capacity change from 0 to 256 [ 709.404949][ T9896] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x1fe4a43c, utbl_chksum : 0xe619d30d) [ 709.535512][ T9903] program syz.7.1252 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 710.007167][ T9916] loop8: detected capacity change from 0 to 164 [ 710.089224][ T9919] loop6: detected capacity change from 0 to 256 [ 710.158737][ T9916] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 710.174112][ T9919] exFAT-fs (loop6): failed to load upcase table (idx : 0x00011bf5, chksum : 0x5eaa6302, utbl_chksum : 0xe619d30d) [ 710.197248][ T9919] exFAT-fs (loop6): bogus allocation bitmap size(need : 2, cur : 17179869186) [ 710.250967][ T9916] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 710.266469][ T9919] exFAT-fs (loop6): failed to load alloc-bitmap [ 710.280602][ T9919] exFAT-fs (loop6): failed to recognize exfat type [ 710.309586][ T9916] rock: directory entry would overflow storage [ 710.339864][ T9916] rock: sig=0x4f50, size=4, remaining=3 [ 710.368523][ T9916] iso9660: Corrupted directory entry in block 4 of inode 1792 [ 710.630912][ T9928] loop7: detected capacity change from 0 to 256 [ 710.660576][ T9929] loop6: detected capacity change from 0 to 512 [ 710.730690][ T9928] exFAT-fs (loop7): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x241b98d9, utbl_chksum : 0xe619d30d) [ 710.831021][ T9929] EXT4-fs error (device loop6): ext4_orphan_get:1405: inode #15: comm syz.6.1264: casefold flag without casefold feature [ 710.959005][ T9929] EXT4-fs error (device loop6): ext4_orphan_get:1410: comm syz.6.1264: couldn't read orphan inode 15 (err -117) [ 711.025760][ T9929] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 711.067589][ T9929] ext4 filesystem being mounted at /160/éq‰Y’3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 711.313197][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 711.764455][ T9963] loop7: detected capacity change from 0 to 512 [ 711.798405][ T9954] loop8: detected capacity change from 0 to 4096 [ 711.812965][ T9963] EXT4-fs: Ignoring removed i_version option [ 713.401519][ T9963] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 713.497533][ T9963] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 713.548948][ T9954] ntfs3: loop8: Mark volume as dirty due to NTFS errors [ 713.611982][ T9963] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 713.653403][ T9975] loop6: detected capacity change from 0 to 512 [ 713.675746][ T9963] ext4 filesystem being mounted at /190/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 714.084030][ T5673] EXT4-fs (loop7): unmounting filesystem. [ 714.691853][ T9999] loop6: detected capacity change from 0 to 1024 [ 714.785727][ T9999] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 714.833174][ T9999] ext4 filesystem being mounted at /164/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 714.928576][T10009] loop8: detected capacity change from 0 to 128 [ 714.944956][T10009] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 714.954093][T10009] ext4 filesystem being mounted at /133/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 715.054479][T10009] syz.8.1288 (pid 10009) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 715.264354][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 715.407927][ T7286] EXT4-fs (loop8): unmounting filesystem. [ 715.876195][T10030] loop6: detected capacity change from 0 to 128 [ 717.761474][ T7832] hid-generic 0000:0000:0000.004A: item fetching failed at offset 0/2 [ 717.923473][ T7832] hid-generic: probe of 0000:0000:0000.004A failed with error -22 [ 718.630674][T10097] sock: sock_set_timeout: `syz.0.1315' (pid 10097) tries to set negative timeout [ 719.493944][ T5953] hid-generic 0000:0000:0000.004B: item fetching failed at offset 0/2 [ 719.649507][ T5953] hid-generic: probe of 0000:0000:0000.004B failed with error -22 [ 719.930932][T10122] bridge0: port 3(vlan3) entered blocking state [ 720.078738][T10122] bridge0: port 3(vlan3) entered disabled state [ 720.240295][T10122] device vlan3 entered promiscuous mode [ 720.246592][T10122] device macvtap0 entered promiscuous mode [ 720.258085][T10122] bridge0: port 3(vlan3) entered blocking state [ 720.266255][T10122] bridge0: port 3(vlan3) entered forwarding state [ 720.594322][T10138] loop6: detected capacity change from 0 to 512 [ 720.658827][T10138] EXT4-fs error (device loop6): ext4_orphan_get:1405: inode #15: comm syz.6.1330: iget: bad i_size value: 38620345925642 [ 720.692682][T10138] EXT4-fs error (device loop6): ext4_orphan_get:1410: comm syz.6.1330: couldn't read orphan inode 15 (err -117) [ 720.760797][T10138] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 722.671560][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 723.370167][ T9638] hid-generic 0000:0000:0000.004C: item fetching failed at offset 0/2 [ 723.547329][ T9638] hid-generic: probe of 0000:0000:0000.004C failed with error -22 [ 724.492663][ T9638] kernel write not supported for file /cpu/0/msr (pid: 9638 comm: kworker/1:18) [ 725.661717][T10206] loop7: detected capacity change from 0 to 256 [ 726.335738][T10218] loop7: detected capacity change from 0 to 512 [ 726.490800][T10218] EXT4-fs (loop7): Test dummy encryption mode enabled [ 726.539427][T10218] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 727.337259][ T9638] hid-generic 0000:0000:0000.004D: item fetching failed at offset 0/2 [ 727.454719][T10218] EXT4-fs error (device loop7): ext4_orphan_get:1431: comm syz.7.1354: bad orphan inode 131072 [ 727.493704][ T9638] hid-generic: probe of 0000:0000:0000.004D failed with error -22 [ 727.541447][T10218] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 728.275161][T10218] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 728.567147][ T5673] EXT4-fs (loop7): unmounting filesystem. [ 729.005650][T10226] loop8: detected capacity change from 0 to 32768 [ 729.064749][T10226] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop8 scanned by syz.8.1356 (10226) [ 729.146790][T10246] bridge0: port 3(vlan3) entered blocking state [ 729.158076][T10226] BTRFS info (device loop8): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 729.235389][T10226] BTRFS info (device loop8): using crc32c (crc32c-intel) checksum algorithm [ 729.263395][T10246] bridge0: port 3(vlan3) entered disabled state [ 729.290954][T10226] BTRFS info (device loop8): setting nodatasum [ 729.322285][T10246] device vlan3 entered promiscuous mode [ 729.328131][T10246] device macvtap0 entered promiscuous mode [ 729.340382][T10226] BTRFS info (device loop8): force zlib compression, level 3 [ 729.358920][T10250] loop7: detected capacity change from 0 to 1024 [ 729.378119][T10226] BTRFS info (device loop8): turning on sync discard [ 729.387314][T10246] bridge0: port 3(vlan3) entered blocking state [ 729.388428][T10246] bridge0: port 3(vlan3) entered forwarding state [ 729.488975][T10226] BTRFS info (device loop8): turning on flush-on-commit [ 729.576780][T10226] BTRFS info (device loop8): max_inline at 0 [ 729.632935][T10226] BTRFS info (device loop8): turning off discard [ 729.679905][T10226] BTRFS info (device loop8): using free space tree [ 729.866704][T10263] tipc: Started in network mode [ 729.877062][T10263] tipc: Node identity 7f000001, cluster identity 4711 [ 729.887289][T10263] lo: MTU too low for tipc bearer [ 729.897731][T10263] tipc: Enabling of bearer rejected, failed to enable media [ 730.188863][T10226] BTRFS info (device loop8): enabling ssd optimizations [ 730.298239][ T26] audit: type=1800 audit(1787705695.461:97): pid=10226 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1356" name="file1" dev="loop8" ino=260 res=0 errno=0 [ 730.460314][T10289] loop6: detected capacity change from 0 to 1024 [ 731.021891][T10297] hfsplus: inconsistency in B*Tree (9,1,255,1,0) [ 731.141225][T10297] hfsplus: xattr searching failed [ 731.180773][T10299] hfsplus: inconsistency in B*Tree (9,1,255,1,0) [ 731.262362][T10299] hfsplus: xattr search failed [ 731.457312][ T7286] BTRFS info (device loop8): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 731.485684][ T4704] hfsplus: b-tree write err: -5, ino 25 [ 731.503580][ T4704] hfsplus: b-tree write err: -5, ino 4 [ 731.510126][ T4704] hfsplus: b-tree write err: -5, ino 2 [ 731.599691][ T4704] hfsplus: b-tree write err: -5, ino 28 [ 736.061337][T10343] loop6: detected capacity change from 0 to 40427 [ 737.627069][T10384] loop6: detected capacity change from 0 to 256 [ 737.712277][T10384] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 737.767576][T10384] exFAT-fs (loop6): Medium has reported failures. Some data may be lost. [ 737.808598][T10384] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000ff98, chksum : 0xdca9dc68, utbl_chksum : 0xe619d30d) [ 737.838959][T10388] device bridge0 entered promiscuous mode [ 737.979071][T10384] exFAT-fs (loop6): failed to load alloc-bitmap [ 737.996920][T10384] exFAT-fs (loop6): failed to recognize exfat type [ 738.385927][T10408] loop6: detected capacity change from 0 to 256 [ 738.539405][T10408] FAT-fs (loop6): Directory bread(block 64) failed [ 738.573293][T10408] FAT-fs (loop6): Directory bread(block 65) failed [ 738.602893][T10408] FAT-fs (loop6): Directory bread(block 66) failed [ 738.657376][T10408] FAT-fs (loop6): Directory bread(block 67) failed [ 738.690823][T10408] FAT-fs (loop6): Directory bread(block 68) failed [ 738.772623][T10408] FAT-fs (loop6): Directory bread(block 69) failed [ 738.885214][T10408] FAT-fs (loop6): Directory bread(block 70) failed [ 739.044739][T10408] FAT-fs (loop6): Directory bread(block 71) failed [ 739.188130][ T26] audit: type=1800 audit(1787705704.341:98): pid=10413 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1403" name="file" dev="configfs" ino=58305 res=0 errno=0 [ 739.268011][T10408] FAT-fs (loop6): Directory bread(block 72) failed [ 739.439923][T10408] FAT-fs (loop6): Directory bread(block 73) failed [ 740.196311][T10433] vivid-000: disconnect [ 740.330903][T10443] loop6: detected capacity change from 0 to 2048 [ 740.395936][T10439] vivid-000: reconnect [ 740.493920][T10443] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 740.562126][ T5953] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 740.697412][ T6391] EXT4-fs (loop6): unmounting filesystem. [ 740.763564][ T5953] usb 9-1: Using ep0 maxpacket: 8 [ 740.783874][ T5953] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 740.832597][ T5953] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 740.887830][ T5953] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 740.972594][ T5953] usb 9-1: config 0 descriptor?? [ 741.197363][ T5953] iowarrior 9-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 741.429480][T10463] loop7: detected capacity change from 0 to 256 [ 741.458090][ T5953] usb 9-1: USB disconnect, device number 7 [ 741.468805][ C0] iowarrior 9-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 741.503662][T10463] exFAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 741.571031][T10463] exFAT-fs (loop7): Medium has reported failures. Some data may be lost. [ 742.803836][T10463] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 742.891631][T10463] exFAT-fs (loop7): failed to load alloc-bitmap [ 742.972333][T10463] exFAT-fs (loop7): failed to recognize exfat type [ 743.098029][T10463] loop7: detected capacity change from 0 to 512 [ 743.175765][T10463] EXT4-fs: Ignoring removed nobh option [ 743.242247][T10463] ext4: Unknown parameter 'grpquota..' [ 747.817030][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.826619][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.772091][ T7422] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 748.963925][ T7422] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 748.986688][ T7422] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 749.018948][ T7422] usb 3-1: New USB device found, idVendor=1235, idProduct=8210, bcdDevice= 0.40 [ 749.039706][ T7422] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.061170][ T7422] usb 3-1: Product: syz [ 749.073623][ T7422] usb 3-1: Manufacturer: syz [ 749.084358][ T7422] usb 3-1: SerialNumber: syz [ 749.142410][T10520] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1433'. [ 749.343275][T10508] netlink: 'syz.2.1430': attribute type 34 has an invalid length. [ 749.403092][ T7422] usb 3-1: cannot find UAC_HEADER [ 749.498150][ T7422] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 749.538660][ T7422] usb 3-1: USB disconnect, device number 10 [ 749.622388][ T4531] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 749.793144][ T8563] udevd[8563]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 749.822184][ T4531] usb 7-1: Using ep0 maxpacket: 16 [ 749.855782][ T4531] usb 7-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 749.891749][ T4531] usb 7-1: New USB device strings: Mfr=1, Product=6, SerialNumber=3 [ 749.932055][ T4531] usb 7-1: Product: syz [ 749.951887][ T4531] usb 7-1: Manufacturer: syz [ 749.958885][ T4531] usb 7-1: SerialNumber: syz [ 749.975971][ T4531] usb 7-1: config 0 descriptor?? [ 749.997094][ T4531] ums-onetouch 7-1:0.0: USB Mass Storage device detected [ 750.342917][ T4323] usb 7-1: USB disconnect, device number 4 [ 751.103581][T10554] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1442'. [ 751.731699][T10570] rtc_cmos 00:00: Alarms can be up to one day in the future [ 752.279220][T10587] loop8: detected capacity change from 0 to 128 [ 752.389672][T10587] EXT4-fs (loop8): Test dummy encryption mode enabled [ 752.452101][T10587] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 752.485971][T10587] ext4 filesystem being mounted at /159/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 752.629549][ T7] hid-generic 0000:0000:0000.004E: item fetching failed at offset 0/2 [ 752.819161][ T7] hid-generic: probe of 0000:0000:0000.004E failed with error -22 [ 753.529960][T10587] fscrypt (loop8): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 753.603241][T10610] fscrypt (loop8): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 753.617980][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056fa0400: rx timeout, send abort [ 754.043902][ T7286] EXT4-fs (loop8): unmounting filesystem. [ 754.119963][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056fa2800: rx timeout, send abort [ 754.130224][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056fa0400: abort rx timeout. Force session deactivation [ 754.457149][T10600] loop6: detected capacity change from 0 to 32768 [ 754.594139][T10600] JBD2: Ignoring recovery information on journal [ 754.635173][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056fa2800: abort rx timeout. Force session deactivation [ 754.777773][T10600] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 755.354211][ T4531] hid-generic 0000:0000:0000.004F: item fetching failed at offset 0/2 [ 755.659805][ T4531] hid-generic: probe of 0000:0000:0000.004F failed with error -22 [ 756.148344][ T6391] ocfs2: Unmounting device (7,6) on (node local) [ 757.183896][T10696] netlink: 'syz.0.1482': attribute type 12 has an invalid length. [ 759.247511][ T7] hid-generic 0000:0000:0000.0050: item fetching failed at offset 0/2 [ 759.628866][ T7] hid-generic: probe of 0000:0000:0000.0050 failed with error -22 [ 760.955613][T10730] Mass Storage Function, version: 2009/09/11 [ 760.994373][T10730] LUN: removable file: (no medium) [ 761.146096][T10710] loop7: detected capacity change from 0 to 32768 [ 761.242893][T10710] ocfs2: Slot 0 on device (7,7) was already allocated to this node! [ 761.401086][T10710] JBD2: Ignoring recovery information on journal [ 761.560243][T10738] loop6: detected capacity change from 0 to 4096 [ 761.580765][T10710] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 761.697434][T10738] NILFS (loop6): invalid segment: Checksum error in segment payload [ 761.752483][T10744] jffs2: notice: (10744) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 761.763257][T10738] NILFS (loop6): trying rollback from an earlier position [ 761.890554][T10746] (syz.7.1488,10746,1):ocfs2_parse_options:1458 ERROR: Invalid heartbeat mount options [ 761.976399][T10738] NILFS (loop6): recovery complete [ 762.028176][T10753] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 762.392609][ T9026] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 762.417480][T10745] [ 762.419912][T10745] ====================================================== [ 762.431035][T10745] WARNING: possible circular locking dependency detected [ 762.441744][T10745] syzkaller #0 Not tainted [ 762.447865][T10745] ------------------------------------------------------ [ 762.458814][T10745] syz.7.1488/10745 is trying to acquire lock: [ 762.467623][T10745] ffff8880349d22e0 (&oi->ip_alloc_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xb3/0x360 [ 762.482434][T10745] [ 762.482434][T10745] but task is already holding lock: [ 762.491910][T10745] ffff8880349d2378 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa1/0x360 [ 762.508398][T10745] [ 762.508398][T10745] which lock already depends on the new lock. [ 762.508398][T10745] [ 762.521020][T10745] [ 762.521020][T10745] the existing dependency chain (in reverse order) is: [ 762.536520][T10745] [ 762.536520][T10745] -> #3 (&oi->ip_xattr_sem){++++}-{3:3}: [ 762.548232][T10745] down_read+0x42/0x2d0 [ 762.554493][T10745] ocfs2_init_acl+0x307/0x770 [ 762.562160][T10745] ocfs2_mknod+0x18e0/0x2580 [ 762.570447][T10745] ocfs2_create+0x1b6/0x4b0 [ 762.578887][T10745] path_openat+0x11b9/0x2f10 [ 762.587444][T10745] do_filp_open+0x1ee/0x420 [ 762.594400][T10745] do_sys_openat2+0x14b/0x4f0 [ 762.600837][T10745] __x64_sys_openat+0x135/0x160 [ 762.609689][T10745] do_syscall_64+0x4c/0xa0 [ 762.615418][T10745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 762.625279][T10745] [ 762.625279][T10745] -> #2 (&journal->j_trans_barrier){.+.+}-{3:3}: [ 762.642060][T10745] down_read+0x42/0x2d0 [ 762.647641][T10745] ocfs2_start_trans+0x3a4/0x6f0 [ 762.657326][T10745] ocfs2_modify_bh+0xe0/0x4c0 [ 762.664487][T10745] ocfs2_local_read_info+0x1499/0x1820 [ 762.673369][T10745] dquot_load_quota_sb+0x72f/0xa80 [ 762.680503][T10745] dquot_load_quota_inode+0x2d3/0x5c0 [ 762.689114][T10745] ocfs2_enable_quotas+0x1c0/0x4a0 [ 762.695974][T10745] ocfs2_fill_super+0x40fe/0x5010 [ 762.703523][T10745] mount_bdev+0x28a/0x3c0 [ 762.715258][T10745] legacy_get_tree+0xe6/0x180 [ 762.720807][T10745] vfs_get_tree+0x88/0x270 [ 762.728437][T10745] do_new_mount+0x247/0xa40 [ 762.734267][T10745] __se_sys_mount+0x2e3/0x3d0 [ 762.744436][T10745] do_syscall_64+0x4c/0xa0 [ 762.751710][T10745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 762.759344][T10745] [ 762.759344][T10745] -> #1 (sb_internal#2){.+.+}-{0:0}: [ 762.771179][T10745] lock_release+0x347/0x920 [ 762.778097][T10745] up_write+0x29/0x410 [ 762.786237][T10745] ocfs2_free_alloc_context+0x93/0x1a0 [ 762.795168][T10745] ocfs2_write_begin_nolock+0x4504/0x4590 [ 762.804598][T10745] ocfs2_write_begin+0x1b7/0x310 [ 762.810914][T10745] generic_perform_write+0x2fa/0x5c0 [ 762.819768][T10745] __generic_file_write_iter+0x148/0x2a0 [ 762.827639][T10745] ocfs2_file_write_iter+0x1731/0x1fc0 [ 762.833992][T10745] vfs_write+0x482/0x9a0 [ 762.839445][T10745] __x64_sys_pwrite64+0x194/0x220 [ 762.847541][T10745] do_syscall_64+0x4c/0xa0 [ 762.852811][T10745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 762.860816][T10745] [ 762.860816][T10745] -> #0 (&oi->ip_alloc_sem){++++}-{3:3}: [ 762.872386][T10745] __lock_acquire+0x2d18/0x7c40 [ 762.879575][T10745] lock_acquire+0x1bb/0x4a0 [ 762.887121][T10745] down_write+0x36/0x60 [ 762.895379][T10745] ocfs2_try_remove_refcount_tree+0xb3/0x360 [ 762.903340][T10745] ocfs2_truncate_file+0xef5/0x1660 [ 762.910713][T10745] ocfs2_setattr+0x16f8/0x1d90 [ 762.917041][T10745] notify_change+0xca0/0xf90 [ 762.922571][T10745] do_truncate+0x1ac/0x240 [ 762.928506][T10745] path_openat+0x2897/0x2f10 [ 762.936145][T10745] do_filp_open+0x1ee/0x420 [ 762.942036][T10745] do_sys_openat2+0x14b/0x4f0 [ 762.949123][T10745] __x64_sys_openat+0x135/0x160 [ 762.956668][T10745] do_syscall_64+0x4c/0xa0 [ 762.962477][T10745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 762.971000][T10745] [ 762.971000][T10745] other info that might help us debug this: [ 762.971000][T10745] [ 762.983078][T10745] Chain exists of: [ 762.983078][T10745] &oi->ip_alloc_sem --> &journal->j_trans_barrier --> &oi->ip_xattr_sem [ 762.983078][T10745] [ 763.006798][T10745] Possible unsafe locking scenario: [ 763.006798][T10745] [ 763.018951][T10745] CPU0 CPU1 [ 763.027755][T10745] ---- ---- [ 763.035411][T10745] lock(&oi->ip_xattr_sem); [ 763.040681][T10745] lock(&journal->j_trans_barrier); [ 763.051301][T10745] lock(&oi->ip_xattr_sem); [ 763.061128][T10745] lock(&oi->ip_alloc_sem); [ 763.066649][T10745] [ 763.066649][T10745] *** DEADLOCK *** [ 763.066649][T10745] [ 763.076793][T10745] 3 locks held by syz.7.1488/10745: [ 763.083301][T10745] #0: ffff88805a1f0460 (sb_writers#15){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 763.094562][T10745] #1: ffff8880349d2648 (&sb->s_type->i_mutex_key#22){+.+.}-{3:3}, at: do_truncate+0x198/0x240 [ 763.108868][T10745] #2: ffff8880349d2378 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa1/0x360 [ 763.122692][T10745] [ 763.122692][T10745] stack backtrace: [ 763.129938][T10745] CPU: 0 PID: 10745 Comm: syz.7.1488 Not tainted syzkaller #0 [ 763.139737][T10745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 763.153363][T10745] Call Trace: [ 763.157101][T10745] [ 763.160757][T10745] dump_stack_lvl+0x188/0x24e [ 763.166994][T10745] ? load_image+0x410/0x410 [ 763.173345][T10745] ? show_regs_print_info+0x12/0x12 [ 763.179462][T10745] ? print_circular_bug+0x12b/0x1a0 [ 763.186353][T10745] check_noncircular+0x296/0x330 [ 763.194418][T10745] ? add_chain_block+0x9b0/0x9b0 [ 763.201564][T10745] ? lockdep_lock+0xf1/0x1f0 [ 763.211707][T10745] ? lockdep_unlock+0x142/0x2e0 [ 763.220024][T10745] ? _find_first_zero_bit+0xd2/0x100 [ 763.226699][T10745] __lock_acquire+0x2d18/0x7c40 [ 763.233905][T10745] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 763.244270][T10745] ? verify_lock_unused+0x140/0x140 [ 763.252215][T10745] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 763.259405][T10745] ? lockdep_hardirqs_on+0x94/0x140 [ 763.266162][T10745] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 763.274687][T10745] lock_acquire+0x1bb/0x4a0 [ 763.281799][T10745] ? ocfs2_try_remove_refcount_tree+0xb3/0x360 [ 763.290725][T10745] ? __might_sleep+0xd0/0xd0 [ 763.297141][T10745] ? read_lock_is_recursive+0x10/0x10 [ 763.303464][T10745] ? rwsem_write_trylock+0x135/0x1c0 [ 763.312474][T10745] ? clear_nonspinnable+0x60/0x60 [ 763.319727][T10745] ? ocfs2_truncate_file+0xe14/0x1660 [ 763.329877][T10745] down_write+0x36/0x60 [ 763.334443][T10745] ? ocfs2_try_remove_refcount_tree+0xb3/0x360 [ 763.345469][T10745] ocfs2_try_remove_refcount_tree+0xb3/0x360 [ 763.357020][T10745] ? ocfs2_remove_refcount_tree+0xe40/0xe40 [ 763.368084][T10745] ? up_write+0x1b6/0x410 [ 763.373024][T10745] ocfs2_truncate_file+0xef5/0x1660 [ 763.379543][T10745] ? ocfs2_simple_size_update+0x4a0/0x4a0 [ 763.388752][T10745] ? preempt_schedule+0xbc/0xd0 [ 763.396196][T10745] ? preempt_schedule_common+0xa5/0xd0 [ 763.403070][T10745] ? preempt_schedule+0xbc/0xd0 [ 763.408879][T10745] ? schedule_preempt_disabled+0x20/0x20 [ 763.416091][T10745] ? __lock_acquire+0x7c40/0x7c40 [ 763.422705][T10745] ? do_raw_spin_lock+0x128/0x2f0 [ 763.428925][T10745] ? __rwlock_init+0x140/0x140 [ 763.434652][T10745] ? preempt_schedule_thunk+0x16/0x18 [ 763.441287][T10745] ? _raw_spin_unlock+0x36/0x40 [ 763.448083][T10745] ? jbd2_journal_begin_ordered_truncate+0xb0/0x150 [ 763.457912][T10745] ocfs2_setattr+0x16f8/0x1d90 [ 763.463733][T10745] ? ocfs2_extend_allocation+0x1940/0x1940 [ 763.471951][T10745] ? ktime_get_coarse_real_ts64+0x2b/0x120 [ 763.479361][T10745] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 763.487898][T10745] ? mark_lock+0x94/0x320 [ 763.492980][T10745] ? ktime_get_coarse_real_ts64+0x106/0x120 [ 763.500255][T10745] ? current_time+0x19b/0x2c0 [ 763.506581][T10745] ? lockdep_hardirqs_on+0x94/0x140 [ 763.513361][T10745] ? atime_needs_update+0x770/0x770 [ 763.521522][T10745] ? security_inode_setattr+0xd8/0x140 [ 763.528181][T10745] ? try_break_deleg+0x79/0x120 [ 763.533838][T10745] ? ocfs2_extend_allocation+0x1940/0x1940 [ 763.541751][T10745] notify_change+0xca0/0xf90 [ 763.548609][T10745] do_truncate+0x1ac/0x240 [ 763.554076][T10745] ? put_page_bootmem+0x2b0/0x2b0 [ 763.560881][T10745] ? ima_bprm_check+0x200/0x200 [ 763.569233][T10745] ? bpf_lsm_path_truncate+0x5/0x10 [ 763.575744][T10745] path_openat+0x2897/0x2f10 [ 763.582356][T10745] ? verify_lock_unused+0x140/0x140 [ 763.588838][T10745] ? do_filp_open+0x420/0x420 [ 763.595464][T10745] do_filp_open+0x1ee/0x420 [ 763.603901][T10745] ? vfs_tmpfile+0x470/0x470 [ 763.610790][T10745] ? _raw_spin_unlock+0x24/0x40 [ 763.616227][T10745] ? alloc_fd+0x590/0x640 [ 763.621279][T10745] do_sys_openat2+0x14b/0x4f0 [ 763.626996][T10745] ? do_sys_open+0xe0/0xe0 [ 763.632901][T10745] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 763.642125][T10745] ? rcu_is_watching+0x11/0xa0 [ 763.648195][T10745] ? lock_chain_count+0x20/0x20 [ 763.653905][T10745] __x64_sys_openat+0x135/0x160 [ 763.664509][T10745] do_syscall_64+0x4c/0xa0 [ 763.670048][T10745] ? clear_bhb_loop+0x60/0xb0 [ 763.676978][T10745] ? clear_bhb_loop+0x60/0xb0 [ 763.683973][T10745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 763.692634][T10745] RIP: 0033:0x7f218b79e0d9 [ 763.700125][T10745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 763.726484][T10745] RSP: 002b:00007f218c702028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 763.736994][T10745] RAX: ffffffffffffffda RBX: 00007f218ba26090 RCX: 00007f218b79e0d9 [ 763.746619][T10745] RDX: 000000000000275a RSI: 0000200000000040 RDI: ffffffffffffff9c [ 763.756491][T10745] RBP: 00007f218b835024 R08: 0000000000000000 R09: 0000000000000000 [ 763.768701][T10745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 763.778972][T10745] R13: 00007f218ba26128 R14: 00007f218ba26090 R15: 00007ffc7732aae8 [ 763.790685][T10745] [ 763.980694][ T5673] ocfs2: Unmounting device (7,7) on (node local) [ 764.026015][ T9026] usb 3-1: Using ep0 maxpacket: 32 [ 764.041155][ T9026] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 764.086796][ T9026] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 764.118692][ T9026] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 764.151231][ T9026] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.176097][ T9026] usb 3-1: config 0 descriptor?? [ 764.605734][ T9026] ft260 0003:0403:6030.0051: unknown main item tag 0x0 [ 764.622305][ T9026] ft260 0003:0403:6030.0051: unknown main item tag 0x0 [ 764.635805][ T9026] ft260 0003:0403:6030.0051: hidraw0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 764.816442][ T9026] ft260 0003:0403:6030.0051: chip code: 0000 0000 [ 765.428566][ T9026] ft260 0003:0403:6030.0051: failed to reset I2C controller: -71 [ 765.453010][ T9026] usb 3-1: USB disconnect, device number 11 [ 765.549432][T10799] fido_id[10799]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory