last executing test programs: 12.085807064s ago: executing program 1 (id=328): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x30, r0, 0xffffd000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x15f) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) setns(0xc9, 0x0) mount(0x0, 0x0, &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x3}}, './dev\x00'}) open$dir(0x0, 0x4003, 0xb0) ioctl(r1, 0xc138fd03, &(0x7f0000000000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000074") 10.572221172s ago: executing program 0 (id=332): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100002, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x8, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x4, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14, 0x80000) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 10.19134085s ago: executing program 3 (id=333): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r10 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x44, 0x2c, 0xd27, 0x60bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) r12 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffff, 0xfff2}}}, 0x24}}, 0x44840) 9.908546865s ago: executing program 3 (id=334): openat$dma_heap(0xffffffffffffff9c, 0x0, 0x42300, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$igmp(0x2, 0x3, 0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x24000000) 9.899486397s ago: executing program 2 (id=342): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, 0x0, 0x809d) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$sg(0x0, 0xe6, 0x2602) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@local, @in6=@private2}}, {{@in6=@private2}, 0x0, @in6=@private0}}, &(0x7f0000000280)=0xe8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff0100"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) 8.839508542s ago: executing program 1 (id=335): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r0 = socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf9477000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$SETVAL(0x0, 0x0, 0x10, 0x0) eventfd2(0x2, 0x801) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r5, 0x40}, 0x8) 8.704610553s ago: executing program 3 (id=336): r0 = fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) inotify_add_watch(0xffffffffffffffff, 0x0, 0x60000526) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e) socket$inet(0x2, 0x3, 0x401) getdents(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) readv(r2, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/114, 0x72}], 0x1) syz_clone3(&(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 7.706149993s ago: executing program 0 (id=337): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xbfd}, 0x2a, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 7.563304556s ago: executing program 0 (id=338): setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) syz_emit_ethernet(0x7e, &(0x7f00000001c0)=ANY=[], 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000240), 0x35c, 0x0) 7.563049366s ago: executing program 3 (id=339): socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x40086607, 0x0) 7.528276114s ago: executing program 1 (id=340): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6}]}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000140)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef21161fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccf43f1ff0e916b6c691bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a870000000000000000", 0xfc) 7.383384857s ago: executing program 2 (id=341): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) socket$inet6(0xa, 0x3, 0x87) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000080)=0x1, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000002780)={0x8, {"48460b90fc8d13c46cfa284b0d231880597a2b39cb9380733e0a376e788eeeb7bba73615e185c551deef5c6ddc004384d9ecd8a3cbbbca3b5905cc01f6922feb6391c83aa6076d337510366dc8955d56f0fb8702dd28533e3eba654d674b7b8a22b6a38659a0eb9b68c2e819ae859b5d3dd8350dd5aa70218579d1b3496dd530d9a5f38c59df35967484fc2cef0b7b9849345358c3ca8ae743c5179353386a0ad062af2102806696e28be893b106415f1f78ec7a85db02bf6595f2f08ab65a271ae5eb38e5bbdeba21c3fcf9014e83a35909ec6d45f418c051304a5347b1952e3886dd7a8402e4af8348931c8fabf9de24dbfbf8545e9607461d6fda4f211b70baa1482264b7dc3915183449eb676588acd5609e613d990de7f561e235b3b812df99f90cebfe9c06bc7d3a373347e6c39d32fa6df4143d1418f7d0a24f0bec544502373248626d1c1176b09b7fb9667815c3652cbc2bd6210157f9241c17bbb10d616622568a3044d5a6c7e88728524c2a33616bf42d60de72e857735739f8a4674831e9d35779218d55ad2d8cbfb208584b43f8fa37c73987677a339ed9b509e43ad04797cd8290c932563040ba41f7ffec99d61bfb8f6016e393a792356697071ce876df23dc8fe35f3f61914d3d281133a01e761b2163665ac2503bc703d30331f63834f506f09a432e7d22e048e61bad7a664958d448d46f157f031566f025ef699f550c992190940189d1dc1ea28e24c399f12e1283a2e14ee6d4c7c7ff1a86e35cf2ff443f5f7182260671f3df8d2764daf92b6eff68d1419f179d727fd836fa9809071a3868233a85fb24e533c40d038d01917e66e51eee5ec2642cafbf215362b9d0ef431b29a206473497142b389b32b5d6fe6f4e0d153f7675e00df4614943f0ba7e3ecdcf5534749abdd19040ecfca49e93d3265957a4c0bbaa159a2185ea00676a3d49bed542c8fb2fa6046c3cae6feb0bc14b2f80be7cbb4564ada373f3770697f723fffd422c2e93a3703d29bd214f446208b51289ce667e16ce05bffafdacb195e76287b15cb65f4d07568aba02bfdd4ab5b2d681b68deb1849cbcf7de6afefb7d3bc03c786447485691169ef7a57ccffb682848c3f2b033988795ca854d0e933469eda5034586a200807f329500bbf9670a9c4c9d79b9f2c666aa2e9dddedaf148fcedd14a117b975bd32e4ef6a00f6155d8fe89a71795a0d50c2f6845ddca947f1967dac527edd88420bfb4a052ddd6397c0bd8ba004777ae2544873152dcbaed894549875c387e40efce3e572ece97369e71a54061ee02d3c773345f12baa449d7f4d75d2634bfd8004d4215d7896c9542e3f15a84ac3c086b8e9338a02fe167121707e6ce0870970f0f6821d7e50ae07a73547c25d2fbeca126fd149a70d2b8b6e39f48806fd76211fdba31c5e539fd6296258a12bf4488d89d2287854fa67d0ce3173cf784eb05e3a1ea787610059a676395fceddc7ba15188491257e6af5ef6e315d97d54156c2898d2c37533508e08ee1517372b6d52ff3f281f57fb5ada9e27e6aa1f82badae0d1eb41b126ae615d7cf1e6b101a187c472845b90c19ff55661cf66c5b923c498a6209758616c75ceff3ca18c26075e687cb2b3e4923c47bba3124aaee0d49f13ff3eb29f51458b2e285de6f9dc10b43a87d845726637bb71236dca2595b310d75574c5de78a0c33735b73b8ad6f3e12c620612041ba49637492b25f299d875a49d446937107eef7d528e7cc7dcfdd1e052ff229f16b2d935afe8ee39f6633bd89ecb9ba76e972b0f5aa35bf29509f8e7fbfe229c032ef7d2a45f20bab8c4b0c5860d0d93469ad5fdca5fd3815b328f79d719f1106d330498aa90c48f904cb8ca0faa9856b9ef647180b27c5894231a2c23967f750b1bb315b94bcc768433c4ddba42e7fca2b10db020dd739538cb85a95db79a3068fa6b642502355a366bb2f0b4ecdb278f78227ae2a1fb6aff429d2041faf1808ba70b501e34950bad2f0e5291ccbd737b02e50c847aadeadb463f41fcdc1c8c91994279ff736e629137e4e3897e7854d3bb10b9fbcb845fc66ac03f3f9a529072f8b92b11fadf28625a14a1e00259f0db5421a210032b6d6a47fdba2bcf9746f1fd0734c6d9ebb5451deca01faa2df1374d504bdaef49dd3cca2aaf0dfddd564cb76e20e6b8ca8fb26e09462a10d5ab089871dbc4ffe4cdf7c12f3f58bfad3d75aeaded04b12edbf1f3419ee1f8f1d61a4dad78ec27b6968a7ceedfc72444092872a54810c832ec2ff63418e7545b64ae087d493a445d8cba0d0b61ff41c737a31fbdf0c75cd4f8813eae2794d62daa360361cffa21f011d6d7bc3b39c643c2d7ed6e068fbc1e4f7f6c6b36f3056f24d01ab0fa65356bc179002f4e7ab024b8cd55a10cf32e9a2fa5b527112d3e8e423bf2f7be6ae624700318fc5667e40e3af4c912718861913e838a036660d6f2b3fde8c6b967b3870630c1c3905394e7ec2c220fc4b45bb10b42095afcf8de6fe98c7d2c3091add3c8c6f9587478641c9328f2be74b9a415de904ca18023d2db56f60fefa4d82242a083939a6b4c3c15f04f9fd0ba06eaf27da56c66cd84c2f6bdbc652bff7c81780bd9c3d4939d03980889f3835d60db60acf9c6558caa63ccb3a1548100eb6bbbc8f527dd301609f05f93a6db22a95bfe15506bd2916e0dd50dd2791d884f9add2f2b10b7854185e69bdd3b9c0c60beb0805e8fa2cbe5d21dfdb23c5eeeb80c14b3739a988ecc727a7a3f84306a4532acf0f43edde99062adc669da06c1e967c4d3fb2b5e85c8c76ff73ca6561cc1a0415bdbb609b042430c9db21743f51383cb908121ab456051577e5b0938e4edfdbf34363f13545d100862ee122f943f61458c52814b57d9146a0082cef62ca4001064ffaadce1f2f1b9ef4f39abba403e04db49508ce11a76634e4eb03a019eb74aa5fb97347b6da62cf0447141e1be32575cc5a226919c1b08e8bac499f2d86736be28c663f33ecbf4cf56d93f5e4ca9b89d772475628a88ba186a0f7567b8b5fa6d37ff6e0841ebb4f9f704819f218d28f5d780aa2a511c4b4bbb7f6722397e76cf226caf997e325c01e98bb3883316553bfd4c6f6aef2adc466f58846eb7ebf844a9a8b27fe328d72983bdcd6baea2be67fd009fdc2b589a51e627cbcd1ebe604511a953f25bf672a5fb9e76503eb1b2173297f143778606e38a211dd3b132d34bfcec579e4acf7528990b039e1a59bf3835658d8e0581c9d5b8901f22c3d991eb42799278956856a6f27a8c6112c970137dfc0044c6002badb861ab341bd17c87664db6ecb80d2a6136156aa2b425be7b66be288710549259135435f63c703e99661f9f1e6f0b049465e7f42ba0ab2ffdb7803adc575a5f1dc1144ef803618849ea19a4983566deb1285ab34e8afb567e01d26bba4456dc0499c8bf888a130acd613d4e2fec47d907b0e77fe3a3b2895092f7004d9c163be5f56de8136394c34f0152d919cebbdd7d9bf0586fda72b4ee6c87d8c889d4876ad05fdf77c6acb80fd3d0920ee901666cca03af1b68fcee8b56c92f9478429250e197abd60eee3210a7d563d6169483b820e910d6dfc6e547e5957b2311c54ab5acc97648d0c64ab377124f1ef0b24832b0be52098a88ac8c16a0fe5b40045f934c49974e0153244bca86ad4387d29dddc4fc57beb8e762fea81192163d108c856a6ffa58a0735af4ba7a13859818b7816b42e9745882fc901bb1777833da0c87635b13992bb0102fa794612dcd104aae566dce8e36073cd29976fabf0f98b52d62635b5205d4a05116354ed96171472175daa97dbbe170cf7087cfea4af52f94cb4ada574bda70b216f6ea3e1890e691bf34cb35bd1c323a7376b564a288d4488d10581125d4dfecedda8f1ab43ece7e6f52ff0105efa28f907dfae32b354c22ec3226e999dfcb11f80562adc7d4437cdc941fdfed64292f5c163f5201f2daf210a457c7c2d80b8eef98155e4be8efce727a3424eb8f2e48b416ef7b778a032f5a7b8c70c7eacebe3669935a52b2aa5a31c39ad5ffb36a57e2bbca25c98db628ffe2cf09f08c325fea00b0dde6b33825916d0d14b15fac905a4708180761ee6f118b65ad4ee96d3e09ae290ce08980ff01f0bc25629bc38d2ca8d9282ef9be031001a1ea60b38fa2205063b3cd39faec43cc060f78c34f06103ebd5f2ef3ca5a75aad1e5edf97ad6ef0fa63ef64e8a957bc0757a037ad7283251d2419978aea8a60d2dce9646651c53180feacb8139fca2415ee20c7b53e1be5995d371904267462eda89150fbc03ccdeace72b043cfd0a6b15ca9c232f5e08f953fec402b939e9c5a88373b0b32b8236300d0ede6f76e36914313977c67715c8619e32d253bf2d52f2fad1a39f01184625d97dddf7ce330996f46cb676248765fe0b9de5038bf1dc9aa9c431c3122c4692e0b94d46d6110fb8aed0d6d318f46623c1a23168e5ef07b6dedbfc1323a2aa66f8cb50949e2d6394ef35fa7684df08096a11401dcd48983ebe7887e68d14d9ec60faccd783ff67c059d1c2b138b4b266a0c359be645b3d25a683d3b8098023c45677e574369d5f1f2968ea8995886788d91903d5edf08e59a12a13aa7fbd947fa052e3260415749c64d5d319ff934ed81e8380af9b60fd9364b7accd69160d32f644b8b1b842f0ac956a86df2d8b9bc9f7dd5b990847e4c360a40dd54554f2376b8faa93786db4fa669fa6eb27a1389ad296e226fd863c7a3a061963b451a5e215dc0051c3112d54f7e973332f7f132a500eca00e30059f330d438c76e2ae913c6e0e161df2011bb870dee6120286b9893d2943f577b69d67b86db64c2b00ac46faa91ffdb5f232ca26e0a44c73a9225de83ce7fee1ab9d35cda03b9acee73635c1cbb9a4f90e26e3e71e3dec949defeb6eeb1f4d665ce70b1e503229c38648f4d54fc7f50d16852d6052f631251883ccbb7665585c1020c6d13d5299343b27369639902d7deadb4bc3ceea1d62796bcad9a11e63706b75ffc176576394ff602a5577d6cf268660d0c2807b3dda7d46c60e90f12276213d69a8fe55ccf3d32dabf4667f015c8bd5fc6db7c3608972734d1e33d523a869b8290ad05c33f40b0236653cfdfc93ee51f87b65afa210de67853a61f6798f2ecb66a06a677000d2cfa55554ac70a4f16238f530396cf677de8d7c8991a4aa4c9952f38c019e4575879a672420a23c1909b10f24d527a8a11a9f741fe502d2e511efd460d0b5c0e606ba2bb7a9db2f8b1ae401250284012ec7e00411f468c2b2b8b327034f50a0fdcbfb803358705e51e7d4087b91b17025c26327ebde16e5788472ed3185206bcb881071b4b0583e956f24168895a099c4d1c85aa80674a701c6b2d44237cb5b014f7b7797195e69fc61130bfc99d2aecb697c5ff16e2c7308d0c90e0e01133016b2ae3465e45b086823c3e84187ae436c60bf4c31b55e1a4225e8ad985fbf39d16c887b40a4268af22ff5864c704568e18cea6e6036b3fc6d24ad73384c3112f40ddbd0b57d7aa889e8221f0e6d4039bd623d8b0ee530eee1277c89c2949ebc19fe977815c1288fe9e3035d624e8ba1cf12a0f89994091603bcaa12a5501a4206d2686f793c1625a83480871793d8a6f38b17a6cbb5e9e0bece18279d9be532925b25ee2a2ff679ee7b29820d1551d76a870924d438c036fbc99041cec7bcc21c7cbd0c47d994192832ab53817df8d98e29604d69b3a1f3cbdb3cc452136487cffa9394044cff82dde5add1022edc694af", 0x1000}}, 0x1006) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000180)={0xffffffffffff249f}, &(0x7f0000000880)) mount(0x0, 0x0, 0x0, 0x0, 0x0) migrate_pages(0x0, 0x200, &(0x7f0000000000)=0xffffffff7fffffff, &(0x7f00000000c0)=0x3) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd28, 0x0, {{@in6=@loopback, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x0, 0x3c}, 0x2, @in=@loopback, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x0) 6.084229577s ago: executing program 1 (id=343): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000300)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 5.836187734s ago: executing program 3 (id=344): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x45, &(0x7f0000000200), 0x4) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r4, 0x40383d0c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) write$vhost_msg_v2(r5, &(0x7f0000000dc0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x1, 0x3}}, 0x48) 5.76895429s ago: executing program 0 (id=345): socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4) rt_sigpending(0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0xc, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x30004800}, 0x4004) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file1\x00', 0x200800c, &(0x7f0000000680)=ANY=[@ANYRES8=0x0, @ANYRESOCT, @ANYBLOB="571b320da28b242950a68c6808e7157439556e641f44e846a86fbe3d90cb1601de7ed78a94bd9eabd5a1fd0422326a7c598914c4f3e67e7003aca397013b9497b5cc666e28f0e34a6e8c3a748f8194a02c475b33a0ae49b4737267e85e18c72da28a10079d568edc050c44c82fde99e3423d6ff12450d996eb3560389e82019e", @ANYRES32=0x0, @ANYRES16], 0x1, 0x24b, &(0x7f0000000740)="$eJzsmb9rFEEUx78z++vW06CNhY2FARXxLrfXpAkSQbASIfFXpcGsojlzcreCORAJNjbaWQg2Fv4DFgFTpbDzH4hooYKg4BUWNmlW3szs3t7t5e6y2Pk+xea7b97MvPnu7ityYBjmv+Xb1z9fnp2dXYQA9mManon/sAAhtJaZ/M8vH5x6MXfu1dtPb96vTj3aTOKW+UtT4jgzQQClEfvbALbmLTxOd0pn78T4iGlzswhJ+ifpS5A4aeJXIFAx+gYkLhsdQuCa0Xczukn5lcqtO42wcrPZWCYxQ5caXQK61E2qk9TXXRdYNsE4tiAy9bfXOitLjUbYygjbjA0ZKiRSY4fgwEV3XqpasTWlKiQXrz59sk4h440P7Z+iBomaWa8OgQUTn4WXeKMtyZz/iJ2cnxwYPH/+tDvvVC4NjDtkSYu53//ELBIutDh0um9IjnhmfSJxe3DoYC4yWkhly8A6TuJfe61DatIFrWKvjhL2Lu+i6Llxxpizty3KNP3CpKd47gMo+Ex1Yd6QCp1cZK+n0MLSsw53Nz/kc77nZ3l9jsVi/BZi8venNGnxyYdY/JPx0VmRhRwbU9j2hu4f8WuB4+j1DzvTP6rRvfvVtmPuboerQVD3ymnHC2eqqh3lG1/aD33Vn/Zl1neGt0q40sXDpShq1fTVFS58RFErUPdB5rNZ2Gj+um6mRTgP4FhvWzdd0cqX5eocqXJJncgnobxLhQzDMAzDMAzDMAzDMAzDMKM4CqH+C0psH1A//SjifoKLKvo3AAD//0VRPH4=") llistxattr(0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20008814) 3.545607702s ago: executing program 0 (id=346): openat$dma_heap(0xffffffffffffff9c, 0x0, 0x42300, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$igmp(0x2, 0x3, 0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x24000000) 3.545123862s ago: executing program 1 (id=347): syz_usb_connect(0x6, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) setns(0xc9, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000005c0)={'broute\x00', 0x6000000, 0x4, 0x0, [0x0, 0x400004, 0x9, 0x8, 0x377, 0x8], 0x0, 0x0, 0x0}, &(0x7f0000000580)=0x78) 3.544694602s ago: executing program 2 (id=348): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xbfd}, 0x2a, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 3.544528542s ago: executing program 3 (id=349): openat$random(0xffffffffffffff9c, 0x0, 0x8000, 0x0) syz_open_dev$usbfs(0x0, 0xb, 0x101301) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, 0x0) unshare(0x60000600) 1.467872251s ago: executing program 2 (id=350): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000540)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x5, 0xffff}, {}, {0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x9200}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0xc010) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x2, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) 717.789185ms ago: executing program 0 (id=351): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6}]}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000140)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef21161fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccf43f1ff0e916b6c691bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a870000000000000000", 0xfc) 430.613281ms ago: executing program 2 (id=352): setns(0xc9, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='10000', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000caf000/0x1000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x3, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1608000004"], 0x50) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) io_uring_enter(r5, 0x4095, 0x7721, 0x16, 0x0, 0x0) 208.214872ms ago: executing program 1 (id=353): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000009f440000000000006b0a00fe0000000073130000000000009c000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a920099c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3ba18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62c49d15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_group_source_req(r3, 0x29, 0x3c, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0xfe, 0xc8, 0x9}}}, 0x7) 0s ago: executing program 2 (id=354): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setpriority(0x1, 0xffffffffffffffff, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) creat(&(0x7f0000000080)='./bus\x00', 0x0) r3 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_int(r3, 0x29, 0x43, 0x0, 0x0) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x400, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp1250 1 [ 83.876581][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.887658][ T5782] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.895460][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.903129][ T5788] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.911137][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.920102][ T5788] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.927412][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.935537][ T5791] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.943916][ T5791] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.945014][ T5782] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.957542][ T5792] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.965841][ T5792] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.973707][ T5792] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 83.981494][ T5792] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 83.989586][ T5792] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 83.997416][ T5792] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 84.021801][ T5792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.025688][ T5788] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.037600][ T5792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.044784][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.055642][ T5086] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.063987][ T5086] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 84.071993][ T5086] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.622429][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 84.635453][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 84.722669][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 84.750564][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 84.820515][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.829469][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.837168][ T5776] bridge_slave_0: entered allmulticast mode [ 84.844512][ T5776] bridge_slave_0: entered promiscuous mode [ 84.906898][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.917283][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.924823][ T5776] bridge_slave_1: entered allmulticast mode [ 84.932934][ T5776] bridge_slave_1: entered promiscuous mode [ 84.987144][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.995014][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.002625][ T5777] bridge_slave_0: entered allmulticast mode [ 85.010208][ T5777] bridge_slave_0: entered promiscuous mode [ 85.045355][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.052901][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.060327][ T5777] bridge_slave_1: entered allmulticast mode [ 85.067816][ T5777] bridge_slave_1: entered promiscuous mode [ 85.087994][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.102436][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.155880][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.163184][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.170849][ T5775] bridge_slave_0: entered allmulticast mode [ 85.177945][ T5775] bridge_slave_0: entered promiscuous mode [ 85.187833][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.195154][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.202651][ T5775] bridge_slave_1: entered allmulticast mode [ 85.210431][ T5775] bridge_slave_1: entered promiscuous mode [ 85.228000][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.235633][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.244766][ T5774] bridge_slave_0: entered allmulticast mode [ 85.252205][ T5774] bridge_slave_0: entered promiscuous mode [ 85.276516][ T5776] team0: Port device team_slave_0 added [ 85.296138][ T5776] team0: Port device team_slave_1 added [ 85.305030][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.314991][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.325477][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.332874][ T5774] bridge_slave_1: entered allmulticast mode [ 85.341166][ T5774] bridge_slave_1: entered promiscuous mode [ 85.364320][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.385739][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.420509][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.492517][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.499710][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.526158][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.541215][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.555190][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.567587][ T5777] team0: Port device team_slave_0 added [ 85.577097][ T5775] team0: Port device team_slave_0 added [ 85.587469][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.594802][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.621296][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.654049][ T5777] team0: Port device team_slave_1 added [ 85.662479][ T5775] team0: Port device team_slave_1 added [ 85.749128][ T5774] team0: Port device team_slave_0 added [ 85.762442][ T5776] hsr_slave_0: entered promiscuous mode [ 85.769940][ T5776] hsr_slave_1: entered promiscuous mode [ 85.786720][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.794220][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.820831][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.833953][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.841245][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.867281][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.880741][ T5774] team0: Port device team_slave_1 added [ 85.896022][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.903385][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.932558][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.997231][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.004520][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.030973][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.043526][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.050712][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.077229][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.090958][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.097943][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.111654][ T5086] Bluetooth: hci2: command tx timeout [ 86.124535][ T5788] Bluetooth: hci3: command tx timeout [ 86.131341][ T5783] Bluetooth: hci1: command tx timeout [ 86.135417][ T5780] Bluetooth: hci0: command tx timeout [ 86.150247][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.201659][ T5775] hsr_slave_0: entered promiscuous mode [ 86.208493][ T5775] hsr_slave_1: entered promiscuous mode [ 86.215817][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.223984][ T5775] Cannot create hsr debugfs directory [ 86.340057][ T5777] hsr_slave_0: entered promiscuous mode [ 86.346670][ T5777] hsr_slave_1: entered promiscuous mode [ 86.353878][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.361716][ T5777] Cannot create hsr debugfs directory [ 86.447200][ T5774] hsr_slave_0: entered promiscuous mode [ 86.453817][ T5774] hsr_slave_1: entered promiscuous mode [ 86.460923][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.468608][ T5774] Cannot create hsr debugfs directory [ 86.781646][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.799178][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.826056][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.838378][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.915448][ T5776] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.946615][ T5776] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.959315][ T5776] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.976665][ T5776] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.102889][ T5777] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.136358][ T5777] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.173256][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.180506][ T5777] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.225054][ T5777] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.341826][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.355329][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.390973][ T2985] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.398378][ T2985] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.422997][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.438331][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.468130][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.485977][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.531718][ T2985] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.539026][ T2985] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.592521][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.707575][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.714816][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.766051][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.773359][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.022102][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.097764][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.123449][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.157720][ T1079] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.164950][ T1079] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.206453][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.214251][ T5780] Bluetooth: hci2: command tx timeout [ 88.214276][ T5788] Bluetooth: hci0: command tx timeout [ 88.221267][ T5780] Bluetooth: hci1: command tx timeout [ 88.225617][ T5788] Bluetooth: hci3: command tx timeout [ 88.254004][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.283317][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.290574][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.312252][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.319492][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.376781][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.384030][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.500933][ T5775] veth0_vlan: entered promiscuous mode [ 88.511093][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.566710][ T5775] veth1_vlan: entered promiscuous mode [ 88.717213][ T5775] veth0_macvtap: entered promiscuous mode [ 88.757805][ T5775] veth1_macvtap: entered promiscuous mode [ 88.835919][ T5776] veth0_vlan: entered promiscuous mode [ 88.856136][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.876093][ T5776] veth1_vlan: entered promiscuous mode [ 88.895881][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.947686][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.963793][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.975456][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.995637][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.074319][ T5776] veth0_macvtap: entered promiscuous mode [ 89.102666][ T5776] veth1_macvtap: entered promiscuous mode [ 89.188443][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.199825][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.212884][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.225449][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.237075][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.249611][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.291937][ T5776] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.305594][ T5776] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.316999][ T5776] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.326189][ T5776] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.364895][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.384145][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.399878][ T2952] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.414777][ T2952] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.526552][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.551769][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.567020][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.609466][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.684893][ T5774] veth0_vlan: entered promiscuous mode [ 89.707374][ T5777] veth0_vlan: entered promiscuous mode [ 89.708226][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.723664][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.752101][ T5777] veth1_vlan: entered promiscuous mode [ 89.806940][ T5774] veth1_vlan: entered promiscuous mode [ 89.977263][ T5777] veth0_macvtap: entered promiscuous mode [ 89.997053][ T5848] FAULT_INJECTION: forcing a failure. [ 89.997053][ T5848] name failslab, interval 1, probability 0, space 0, times 1 [ 90.013114][ T5777] veth1_macvtap: entered promiscuous mode [ 90.020223][ T5848] CPU: 0 PID: 5848 Comm: syz.3.4 Not tainted syzkaller #0 [ 90.027403][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.037613][ T5848] Call Trace: [ 90.040934][ T5848] [ 90.043906][ T5848] dump_stack_lvl+0x18c/0x250 [ 90.048662][ T5848] ? show_regs_print_info+0x20/0x20 [ 90.053924][ T5848] ? load_image+0x420/0x420 [ 90.058495][ T5848] ? __might_sleep+0xe0/0xe0 [ 90.063145][ T5848] ? __lock_acquire+0x7d80/0x7d80 [ 90.068208][ T5848] should_fail_ex+0x394/0x4c0 [ 90.073373][ T5848] should_failslab+0x9/0x20 [ 90.077919][ T5848] slab_pre_alloc_hook+0x59/0x300 [ 90.083021][ T5848] ? rcu_is_watching+0x15/0xb0 [ 90.087822][ T5848] ? mempool_create+0x5e/0xc0 [ 90.092548][ T5848] ? ceph_msgpool_init+0x180/0x180 [ 90.097688][ T5848] __kmem_cache_alloc_node+0x53/0x250 [ 90.103104][ T5848] ? mempool_create+0x5e/0xc0 [ 90.107817][ T5848] ? ceph_msgpool_init+0x180/0x180 [ 90.112959][ T5848] kmalloc_node_trace+0x26/0xe0 [ 90.117853][ T5848] ? msgpool_alloc+0x1b0/0x1b0 [ 90.122680][ T5848] ? ceph_msgpool_init+0x180/0x180 [ 90.127821][ T5848] mempool_create+0x5e/0xc0 [ 90.132455][ T5848] ceph_msgpool_init+0xa7/0x180 [ 90.137433][ T5848] ceph_osdc_init+0x54f/0x8c0 [ 90.142166][ T5848] ceph_create_client+0x246/0x300 [ 90.147239][ T5848] ceph_get_tree+0x1ca/0x1800 [ 90.151967][ T5848] ? bpf_lsm_capable+0x9/0x10 [ 90.156673][ T5848] ? security_capable+0x89/0xb0 [ 90.161563][ T5848] vfs_get_tree+0x8c/0x280 [ 90.166014][ T5848] vfs_cmd_create+0xe3/0x230 [ 90.170666][ T5848] __se_sys_fsconfig+0x70a/0x850 [ 90.175672][ T5848] ? __x64_sys_fsconfig+0xc0/0xc0 [ 90.180745][ T5848] ? lockdep_hardirqs_on+0x98/0x150 [ 90.185973][ T5848] ? __x64_sys_fsconfig+0x20/0xc0 [ 90.191041][ T5848] do_syscall_64+0x55/0xb0 [ 90.195504][ T5848] ? clear_bhb_loop+0x40/0x90 [ 90.200225][ T5848] ? clear_bhb_loop+0x40/0x90 [ 90.204941][ T5848] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 90.210885][ T5848] RIP: 0033:0x7fa82f19e159 [ 90.215340][ T5848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.234979][ T5848] RSP: 002b:00007fa82d3f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 90.243782][ T5848] RAX: ffffffffffffffda RBX: 00007fa82f425fa0 RCX: 00007fa82f19e159 [ 90.251787][ T5848] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 90.259794][ T5848] RBP: 00007fa82f23506b R08: 0000000000000000 R09: 0000000000000000 [ 90.267799][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.275810][ T5848] R13: 00007fa82f426038 R14: 00007fa82f425fa0 R15: 00007ffdf9dc4618 [ 90.283831][ T5848] [ 90.289610][ T5086] Bluetooth: hci0: command tx timeout [ 90.295299][ T5086] Bluetooth: hci2: command tx timeout [ 90.300955][ T5780] Bluetooth: hci3: command tx timeout [ 90.306586][ T5788] Bluetooth: hci1: command tx timeout [ 90.321647][ T5774] veth0_macvtap: entered promiscuous mode [ 90.332250][ T5774] veth1_macvtap: entered promiscuous mode [ 90.389075][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.419704][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.435254][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.447751][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.464026][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.484283][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.495843][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.510064][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.524835][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.550981][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.582889][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.592316][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.614454][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.625857][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.642741][ T5852] syz_tun: entered allmulticast mode [ 90.682745][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.695486][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.708218][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.719093][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.731841][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.742877][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.757786][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.802442][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.818040][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.829429][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.840401][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.850705][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.861846][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.873784][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.882291][ T5854] syzkaller0: entered promiscuous mode [ 90.887968][ T5854] syzkaller0: entered allmulticast mode [ 90.915692][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.926486][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.937729][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.947332][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.008927][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.033567][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.113387][ T1079] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.121974][ T1079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.207289][ T2941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.232727][ T2941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.327418][ T5849] syz_tun: left allmulticast mode [ 91.413288][ T2985] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.444442][ T2985] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.535047][ T5861] syz.1.2[5861]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 91.706963][ T5861] loop1: detected capacity change from 0 to 2048 [ 91.773529][ T5861] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 92.349999][ T5788] Bluetooth: hci1: command tx timeout [ 92.355492][ T5788] Bluetooth: hci2: command tx timeout [ 92.361282][ T5788] Bluetooth: hci3: command tx timeout [ 92.366750][ T5788] Bluetooth: hci0: command tx timeout [ 92.440602][ T27] cfg80211: failed to load regulatory.db [ 92.649707][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 95.725802][ T5872] syzkaller0: entered promiscuous mode [ 95.873845][ T5872] syzkaller0: entered allmulticast mode [ 95.968489][ T5880] loop3: detected capacity change from 0 to 164 [ 95.995286][ T5880] ======================================================= [ 95.995286][ T5880] WARNING: The mand mount option has been deprecated and [ 95.995286][ T5880] and is ignored by this kernel. Remove the mand [ 95.995286][ T5880] option from the mount to silence this warning. [ 95.995286][ T5880] ======================================================= [ 97.114496][ T5888] rock: directory entry would overflow storage [ 97.121201][ T5888] rock: sig=0x4f50, size=4, remaining=3 [ 97.126943][ T5888] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 100.504015][ T5907] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.564550][ T5916] loop0: detected capacity change from 0 to 64 [ 102.769791][ T5786] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 103.288121][ T5786] usb 4-1: config 0 has an invalid interface number: 6 but max is 0 [ 103.308530][ T5786] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 103.330023][ T5786] usb 4-1: config 0 has no interface number 0 [ 103.336326][ T5786] usb 4-1: config 0 interface 6 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 103.368492][ T5786] usb 4-1: config 0 interface 6 altsetting 0 endpoint 0x82 has invalid maxpacket 65054, setting to 64 [ 103.431669][ T5786] usb 4-1: New USB device found, idVendor=10cf, idProduct=8061, bcdDevice=b7.12 [ 103.448961][ T5786] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.471130][ T5786] usb 4-1: Product: syz [ 103.489086][ T5786] usb 4-1: Manufacturer: syz [ 103.499620][ T5786] usb 4-1: SerialNumber: syz [ 103.520535][ T5929] syzkaller0: entered promiscuous mode [ 103.542468][ T5786] usb 4-1: config 0 descriptor?? [ 103.549016][ T5929] syzkaller0: entered allmulticast mode [ 103.568324][ T5921] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 103.599167][ T5921] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 103.609596][ T5929] tipc: Started in network mode [ 103.614771][ T5929] tipc: Node identity 569b20fbbcfa, cluster identity 4711 [ 104.759806][ T5786] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8061 (VM140)'. [ 104.762037][ T5929] tipc: Enabled bearer , priority 0 [ 104.831668][ T5919] wg2: entered allmulticast mode [ 104.880985][ T5921] Zero length message leads to an empty skb [ 104.911694][ T5929] tipc: Resetting bearer [ 104.973819][ T5786] usb 4-1: USB disconnect, device number 2 [ 105.032606][ T5928] tipc: Resetting bearer [ 105.111291][ T5928] tipc: Disabling bearer [ 105.704642][ T5938] Console: switching to colour VGA+ 80x25 [ 107.489042][ T5942] vlan0: entered allmulticast mode [ 107.530245][ T5942] bond0: entered allmulticast mode [ 109.383490][ T5952] xt_policy: too many policy elements [ 109.714589][ T5957] syz.1.30 (5957) used greatest stack depth: 20456 bytes left [ 111.125459][ T5974] syz.3.34 uses obsolete (PF_INET,SOCK_PACKET) [ 111.269001][ T5976] syzkaller0: entered promiscuous mode [ 111.274574][ T5976] syzkaller0: entered allmulticast mode [ 111.320657][ T5974] loop3: detected capacity change from 0 to 1024 [ 111.366320][ T5976] tipc: Enabled bearer , priority 0 [ 111.377072][ T5974] EXT4-fs: Ignoring removed bh option [ 111.475106][ T5976] tipc: Resetting bearer [ 112.697386][ T5974] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.746402][ T5971] tipc: Resetting bearer [ 112.911926][ T5974] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 112.962267][ T5971] tipc: Disabling bearer [ 112.979070][ T5992] Bluetooth: MGMT ver 1.22 [ 112.995069][ T5992] Bluetooth: hci0: invalid length 0, exp 2 for type 15 [ 113.002512][ T5824] tipc: Node number set to 3932233979 [ 114.388727][ C0] sched: RT throttling activated [ 115.689722][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 116.099106][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 116.457180][ T28] audit: type=1800 audit(1790318313.300:2): pid=6008 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.41" name="idProduct" dev="configfs" ino=7117 res=0 errno=0 [ 116.487774][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.514441][ T28] audit: type=1800 audit(1790318313.320:3): pid=6008 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.41" name="max_speed" dev="configfs" ino=7118 res=0 errno=0 [ 116.588045][ T6014] warning: `syz.2.44' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 118.249560][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 120.107138][ T6024] loop2: detected capacity change from 0 to 32768 [ 120.186441][ T6024] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.46 (6024) [ 120.248611][ T6024] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 120.381350][ T6024] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 120.426760][ T6024] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 120.503722][ T6024] BTRFS info (device loop2): use zstd compression, level 3 [ 120.551455][ T6024] BTRFS info (device loop2): using free space tree [ 121.532310][ T6024] BTRFS info (device loop2): enabling ssd optimizations [ 121.596800][ T6024] BTRFS info (device loop2): auto enabling async discard [ 122.721556][ T5820] IPVS: starting estimator thread 0... [ 122.839045][ T6075] IPVS: using max 17 ests per chain, 40800 per kthread [ 123.043699][ T5777] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 123.124697][ T6082] xt_CONNSECMARK: invalid mode: 0 [ 124.355129][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.362423][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.369310][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.376137][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.383003][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.389865][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.396705][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.403575][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.410451][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.417267][ T6091] tc action pedit offset must be on 32 bit boundaries [ 124.424389][ T6091] 0: reclassify loop, rule prio 0, protocol 800 [ 124.583618][ T6098] syz.0.56: attempt to access beyond end of device [ 124.583618][ T6098] nbd0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 124.713188][ T28] audit: type=1326 audit(1790318321.530:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 124.894062][ T6098] syz.0.56: attempt to access beyond end of device [ 124.894062][ T6098] nbd0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 125.318891][ T28] audit: type=1326 audit(1790318321.530:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.348947][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 125.370069][ T28] audit: type=1326 audit(1790318321.530:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.402990][ T28] audit: type=1326 audit(1790318321.530:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.429107][ T6098] syz.0.56: attempt to access beyond end of device [ 125.429107][ T6098] nbd0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 125.468608][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 125.479783][ T28] audit: type=1326 audit(1790318321.540:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.479838][ T28] audit: type=1326 audit(1790318321.540:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.479886][ T28] audit: type=1326 audit(1790318321.550:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.479941][ T28] audit: type=1326 audit(1790318321.550:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.480038][ T28] audit: type=1326 audit(1790318321.550:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 125.614123][ T6098] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 125.638585][ T6098] UDF-fs: Scanning with blocksize 512 failed [ 125.660724][ T6098] syz.0.56: attempt to access beyond end of device [ 125.660724][ T6098] nbd0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 125.688996][ T5824] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 125.699317][ T6098] syz.0.56: attempt to access beyond end of device [ 125.699317][ T6098] nbd0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 125.730711][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 125.784758][ T6098] syz.0.56: attempt to access beyond end of device [ 125.784758][ T6098] nbd0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 125.976739][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 126.150227][ T6098] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 126.374275][ T6098] UDF-fs: Scanning with blocksize 1024 failed [ 126.417327][ T6098] syz.0.56: attempt to access beyond end of device [ 126.417327][ T6098] nbd0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 126.489093][ T28] audit: type=1326 audit(1790318321.550:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6092 comm="syz.1.55" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fdb99e159 code=0x7ffc0000 [ 126.530377][ T6098] syz.0.56: attempt to access beyond end of device [ 126.530377][ T6098] nbd0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 126.602749][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 127.136174][ T6098] syz.0.56: attempt to access beyond end of device [ 127.136174][ T6098] nbd0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 127.406045][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 127.422356][ T6098] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 127.648494][ T6098] UDF-fs: Scanning with blocksize 2048 failed [ 127.685612][ T6098] syz.0.56: attempt to access beyond end of device [ 127.685612][ T6098] nbd0: rw=0, sector=64, nr_sectors = 8 limit=0 [ 127.886187][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 127.897106][ T6098] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 127.909424][ T5824] usb 3-1: Using ep0 maxpacket: 32 [ 127.914790][ T6098] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 127.923526][ T6098] UDF-fs: Scanning with blocksize 4096 failed [ 127.930248][ T6098] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 127.941162][ T5824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.968945][ T5824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.991299][ T5824] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 128.026178][ T5824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.138830][ T5824] usb 3-1: config 0 descriptor?? [ 128.310409][ T5824] hub 3-1:0.0: USB hub found [ 128.899082][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 129.258744][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 129.298748][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 129.428749][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 129.468758][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 130.648752][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 131.670691][ T5824] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 131.766989][ T5824] usbhid 3-1:0.0: can't add hid device: -71 [ 131.786778][ T5824] usbhid: probe of 3-1:0.0 failed with error -71 [ 131.875030][ T5824] usb 3-1: USB disconnect, device number 2 [ 131.921197][ T6129] syzkaller0: entered promiscuous mode [ 131.927291][ T6129] syzkaller0: entered allmulticast mode [ 131.977127][ T6129] tipc: Enabled bearer , priority 0 [ 132.023840][ T6129] tipc: Resetting bearer [ 132.069768][ T6127] tipc: Resetting bearer [ 132.136011][ T6136] loop2: detected capacity change from 0 to 512 [ 132.153923][ T6127] tipc: Disabling bearer [ 134.127594][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.134646][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.036190][ T5824] Process accounting resumed [ 139.329371][ T5824] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 139.584805][ T6168] Console: switching to colour frame buffer device 128x48 [ 139.598630][ T5824] usb 4-1: Using ep0 maxpacket: 32 [ 139.725260][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 139.833351][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 139.874801][ T5824] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 139.918766][ T5824] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.977443][ T5824] usb 4-1: config 0 descriptor?? [ 140.029452][ T5824] hub 4-1:0.0: USB hub found [ 142.778921][ T5824] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 142.853807][ T5824] usbhid 4-1:0.0: can't add hid device: -71 [ 142.868926][ T5824] usbhid: probe of 4-1:0.0 failed with error -71 [ 142.940228][ T5824] usb 4-1: USB disconnect, device number 3 [ 145.237491][ T6197] loop1: detected capacity change from 0 to 512 [ 146.912516][ T6211] netlink: 'syz.3.81': attribute type 3 has an invalid length. [ 153.184107][ T6244] netlink: 'syz.3.91': attribute type 3 has an invalid length. [ 154.471050][ T6247] netlink: 48 bytes leftover after parsing attributes in process `syz.3.92'. [ 162.230927][ T6282] Console: switching to colour VGA+ 80x25 [ 170.662904][ T6317] Console: switching to colour frame buffer device 128x48 [ 171.001958][ T6319] loop2: detected capacity change from 0 to 2048 [ 171.061002][ T6319] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 171.824898][ T6325] Console: switching to colour VGA+ 80x25 [ 183.563406][ T6379] loop3: detected capacity change from 0 to 8 [ 185.196713][ T6379] SQUASHFS error: zlib decompression failed, data probably corrupt [ 185.289047][ T6379] SQUASHFS error: Failed to read block 0x9b: -5 [ 185.295381][ T6379] SQUASHFS error: Unable to read metadata cache entry [99] [ 185.322633][ T6379] SQUASHFS error: Unable to read inode 0x127 [ 185.541317][ T6379] loop3: detected capacity change from 0 to 4096 [ 186.289649][ T6389] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 188.678334][ T6405] loop1: detected capacity change from 0 to 164 [ 189.176031][ T6408] rock: directory entry would overflow storage [ 189.182592][ T6408] rock: sig=0x4f50, size=4, remaining=3 [ 189.188321][ T6408] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 194.772653][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.779473][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.159524][ T6435] Mass Storage Function, version: 2009/09/11 [ 196.165798][ T6435] LUN: removable file: (no medium) [ 200.498525][ T6444] kernel profiling enabled (shift: 23) [ 203.751193][ T28] kauditd_printk_skb: 60 callbacks suppressed [ 203.751213][ T28] audit: type=1326 audit(1790318399.570:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 203.945264][ T28] audit: type=1326 audit(1790318399.570:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.013766][ T28] audit: type=1326 audit(1790318399.570:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.048861][ T28] audit: type=1326 audit(1790318399.570:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.177916][ T28] audit: type=1326 audit(1790318399.580:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.429476][ T28] audit: type=1326 audit(1790318399.590:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.618027][ T6462] loop0: detected capacity change from 0 to 1024 [ 204.657517][ T6462] EXT4-fs: Ignoring removed bh option [ 204.663700][ T28] audit: type=1326 audit(1790318399.590:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.808117][ T6462] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 204.848549][ T28] audit: type=1326 audit(1790318399.590:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.889634][ T28] audit: type=1326 audit(1790318399.590:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 204.914525][ T28] audit: type=1326 audit(1790318399.590:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6445 comm="syz.3.139" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa82f19e159 code=0x7ffc0000 [ 205.184637][ T6470] loop3: detected capacity change from 0 to 164 [ 205.356765][ T6473] netlink: 'syz.2.148': attribute type 10 has an invalid length. [ 205.395476][ T6473] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.403737][ T6473] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.414631][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.549020][ T6473] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.556354][ T6473] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.565017][ T6473] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.572330][ T6473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.620918][ T6473] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 205.895290][ T6477] rock: directory entry would overflow storage [ 205.901784][ T6477] rock: sig=0x4f50, size=4, remaining=3 [ 205.907983][ T6477] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 206.510988][ T6483] binder: 6479:6483 ioctl c0306201 0 returned -14 [ 206.913364][ T5086] Bluetooth: hci1: command 0x0406 tx timeout [ 206.919687][ T5792] Bluetooth: hci2: command 0x0406 tx timeout [ 206.925786][ T5792] Bluetooth: hci0: command 0x0406 tx timeout [ 211.807868][ T28] kauditd_printk_skb: 61 callbacks suppressed [ 211.807909][ T28] audit: type=1326 audit(1790842696.472:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 212.338280][ T28] audit: type=1326 audit(1790842696.482:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 212.549309][ T28] audit: type=1326 audit(1790842696.482:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 212.764318][ T28] audit: type=1326 audit(1790842696.482:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 212.859866][ T6518] syzkaller0: entered promiscuous mode [ 212.888271][ T6518] syzkaller0: entered allmulticast mode [ 212.990797][ T6519] tipc: Started in network mode [ 213.015632][ T28] audit: type=1326 audit(1790842696.492:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 213.042412][ T6519] tipc: Node identity 76ea2b3876c2, cluster identity 4711 [ 213.120698][ T6519] tipc: Enabled bearer , priority 0 [ 213.283996][ T28] audit: type=1326 audit(1790842696.492:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 213.496718][ T6518] tipc: Resetting bearer [ 213.662386][ T28] audit: type=1326 audit(1790842696.503:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 213.733495][ T6516] tipc: Resetting bearer [ 213.829285][ T28] audit: type=1326 audit(1790842696.503:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 213.943648][ T28] audit: type=1326 audit(1790842696.503:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 213.964244][ T6516] tipc: Disabling bearer [ 214.012248][ T28] audit: type=1326 audit(1790842696.503:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6507 comm="syz.2.156" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcebf19e159 code=0x7ffc0000 [ 217.206816][ T28] kauditd_printk_skb: 58 callbacks suppressed [ 217.206833][ T28] audit: type=1326 audit(1790842702.274:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6531 comm="syz.3.165" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa82f19e159 code=0x0 [ 218.844520][ T6554] loop2: detected capacity change from 0 to 1024 [ 218.873436][ T6554] EXT4-fs: Ignoring removed bh option [ 219.107025][ T6554] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.743781][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.758628][ T5786] IPVS: starting estimator thread 0... [ 222.964370][ T28] audit: type=1326 audit(1790842707.603:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 222.969605][ T6574] IPVS: using max 18 ests per chain, 43200 per kthread [ 223.068971][ T28] audit: type=1326 audit(1790842707.603:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.097845][ T28] audit: type=1326 audit(1790842707.603:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.123036][ T28] audit: type=1326 audit(1790842707.603:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.147140][ T3068] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 223.196776][ T28] audit: type=1326 audit(1790842707.613:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.305311][ T28] audit: type=1326 audit(1790842707.623:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.371368][ T28] audit: type=1326 audit(1790842707.623:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.395593][ T28] audit: type=1326 audit(1790842707.623:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.401518][ T3068] usb 2-1: Using ep0 maxpacket: 16 [ 223.587577][ T28] audit: type=1326 audit(1790842707.623:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 223.708186][ T6585] loop3: detected capacity change from 0 to 4096 [ 223.954212][ T28] audit: type=1326 audit(1790842707.623:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6577 comm="syz.0.172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa2739e159 code=0x7ffc0000 [ 224.186067][ T3068] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.197169][ T3068] usb 2-1: config 0 interface 0 has no altsetting 0 [ 224.203928][ T3068] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 224.213101][ T3068] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.283561][ T3068] usb 2-1: config 0 descriptor?? [ 224.480591][ T6591] loop0: detected capacity change from 0 to 256 [ 224.841107][ T3068] usbhid 2-1:0.0: can't add hid device: -71 [ 224.849473][ T3068] usbhid: probe of 2-1:0.0 failed with error -71 [ 224.876621][ T3068] usb 2-1: USB disconnect, device number 2 [ 227.159161][ T3068] IPVS: starting estimator thread 0... [ 228.809684][ T6628] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 228.884434][ T6622] IPVS: using max 17 ests per chain, 40800 per kthread [ 230.622523][ T5788] Bluetooth: hci3: link tx timeout [ 230.630282][ T5788] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 231.247990][ T6647] tipc: Started in network mode [ 231.252949][ T6647] tipc: Node identity 2000004, cluster identity 4711 [ 231.297488][ T6647] tipc: Node number set to 33554436 [ 232.796401][ T5780] Bluetooth: hci3: command 0x0406 tx timeout [ 233.061251][ T6661] loop1: detected capacity change from 0 to 512 [ 233.110393][ T6661] ext4: Unknown parameter 'smackfshat' [ 234.045640][ T6665] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 235.336652][ T6667] syzkaller0: entered promiscuous mode [ 235.350671][ T6667] syzkaller0: entered allmulticast mode [ 235.381027][ T6667] simple: /dev/video#_0 [ 235.385726][ T6667] simple: /dev/video#_0 [ 235.390012][ T6667] simple: /dev/video#_0 [ 235.394286][ T6667] simple: /dev/video#_0 [ 235.398511][ T6667] simple: /dev/video#_0 [ 235.402776][ T6667] simple: /dev/video#_0 [ 235.407126][ T6667] simple: /dev/video#_0 [ 235.411397][ T6667] simple: /dev/video#_0 [ 235.415596][ T6667] simple: /dev/video#_0 [ 235.419793][ T6667] simple: /dev/video#_0 [ 235.424047][ T6667] simple: /dev/video#_0 [ 235.428246][ T6667] simple: /dev/video#_0 [ 235.432511][ T6667] simple: /dev/video#_0 [ 235.436716][ T6667] simple: /dev/video#_0 [ 235.440954][ T6667] simple: /dev/video#_0 [ 235.445153][ T6667] simple: /dev/video#_0 [ 235.449389][ T6667] simple: /dev/video#_0 [ 235.453690][ T6667] simple: /dev/video#_0 [ 235.457891][ T6667] simple: /dev/video#_0 [ 235.462180][ T6667] simple: /dev/video#_0 [ 235.466385][ T6667] simple: /dev/video#_0 [ 235.470628][ T6667] simple: /dev/video#_0 [ 235.474832][ T6667] simple: /dev/video#_0 [ 235.479038][ T6667] simple: /dev/video#_0 [ 235.483285][ T6667] simple: /dev/video#_0 [ 235.487504][ T6667] simple: /dev/video#_0 [ 235.491766][ T6667] simple: /dev/video#_0 [ 235.496144][ T6667] simple: /dev/video#_0 [ 235.500393][ T6667] simple: /dev/video#_0 [ 235.504605][ T6667] simple: /dev/video#_0 [ 235.508817][ T6667] simple: /dev/video#_0 [ 235.513084][ T6667] simple: /dev/video#_0 [ 235.517291][ T6667] TC_ACT_REPEAT abuse ? [ 235.734321][ T6673] netlink: 'syz.3.187': attribute type 3 has an invalid length. [ 239.425741][ T6689] syzkaller0: entered promiscuous mode [ 239.450178][ T6689] syzkaller0: entered allmulticast mode [ 241.002317][ T6704] futex_wake_op: syz.0.207 tries to shift op by 144; fix this program [ 241.041020][ T6704] loop0: detected capacity change from 0 to 256 [ 241.240652][ T6704] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 241.550484][ T28] kauditd_printk_skb: 62 callbacks suppressed [ 241.550502][ T28] audit: type=1800 audit(1790842726.600:286): pid=6704 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.207" name="file1" dev="loop0" ino=1048593 res=0 errno=0 [ 241.905040][ T6709] syzkaller0: entered promiscuous mode [ 241.946035][ T6709] syzkaller0: entered allmulticast mode [ 242.018736][ T6709] tipc: Enabled bearer , priority 0 [ 242.358601][ T6709] tipc: Resetting bearer [ 242.697989][ T6708] tipc: Resetting bearer [ 242.775770][ T6716] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 242.856427][ T6708] tipc: Disabling bearer [ 244.208240][ T6728] netlink: 'syz.2.213': attribute type 3 has an invalid length. [ 245.301281][ T6737] loop1: detected capacity change from 0 to 1024 [ 245.316018][ T6737] EXT4-fs: Ignoring removed bh option [ 245.432095][ T6737] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 247.060389][ T6754] netlink: 'syz.3.218': attribute type 3 has an invalid length. [ 247.222352][ T6756] jffs2: notice: (6756) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 247.902728][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 248.809689][ T6764] bond0: (slave bridge0): Releasing backup interface [ 248.961696][ T6764] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.969190][ T6764] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.243636][ T6764] bridge_slave_0: left allmulticast mode [ 249.275047][ T6764] bridge_slave_0: left promiscuous mode [ 249.281911][ T6764] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.394857][ T6764] bridge_slave_1: left allmulticast mode [ 249.416166][ T6764] bridge_slave_1: left promiscuous mode [ 249.431730][ T6764] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.460262][ T6764] bond0: (slave bond_slave_0): Releasing backup interface [ 249.593899][ T6764] bond0: (slave bond_slave_1): Releasing backup interface [ 250.383211][ T6764] team0: Port device team_slave_0 removed [ 250.436351][ T6764] team0: Port device team_slave_1 removed [ 250.544057][ T6764] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 250.647028][ T6764] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 251.198228][ T6764] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 251.297468][ T6764] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 252.358200][ T6765] team0: Mode changed to "broadcast" [ 255.541323][ T6797] netlink: 'syz.1.228': attribute type 3 has an invalid length. [ 255.642339][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.648708][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.746480][ T6801] loop2: detected capacity change from 0 to 16 [ 255.790386][ T6801] erofs: (device loop2): mounted with root inode @ nid 36. [ 256.301214][ T6803] overlayfs: missing 'lowerdir' [ 257.679869][ T6814] netlink: 'syz.2.235': attribute type 3 has an invalid length. [ 265.834141][ T6879] hub 8-0:1.0: USB hub found [ 265.845884][ T6879] hub 8-0:1.0: 1 port detected [ 268.375131][ T6889] loop2: detected capacity change from 0 to 40427 [ 268.399671][ T6889] F2FS-fs (loop2): invalid crc value [ 268.428248][ T6889] F2FS-fs (loop2): Found nat_bits in checkpoint [ 268.469681][ T6889] F2FS-fs (loop2): access invalid blkaddr:0 [ 268.475707][ T6889] CPU: 0 PID: 6889 Comm: syz.2.255 Not tainted syzkaller #0 [ 268.483059][ T6889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.493285][ T6889] Call Trace: [ 268.496625][ T6889] [ 268.499604][ T6889] dump_stack_lvl+0x18c/0x250 [ 268.504358][ T6889] ? show_regs_print_info+0x20/0x20 [ 268.509642][ T6889] ? __up_read+0x2b8/0x6b0 [ 268.514128][ T6889] ? __lock_acquire+0x7d80/0x7d80 [ 268.519225][ T6889] f2fs_is_valid_blkaddr+0xe6c/0x15c0 [ 268.524686][ T6889] sanity_check_extent_cache+0xfc/0x1f0 [ 268.530304][ T6889] f2fs_iget+0x336f/0x47d0 [ 268.534815][ T6889] f2fs_fill_super+0x4853/0x6b60 [ 268.539872][ T6889] ? kill_f2fs_super+0x3f0/0x3f0 [ 268.544874][ T6889] ? down_write+0x16e/0x200 [ 268.549434][ T6889] ? down_read_killable+0x340/0x340 [ 268.554685][ T6889] ? setup_bdev_super+0x559/0x660 [ 268.559754][ T6889] ? setup_bdev_super+0x56b/0x660 [ 268.564820][ T6889] mount_bdev+0x21c/0x2c0 [ 268.569195][ T6889] ? kfree+0x31/0x1a0 [ 268.573230][ T6889] ? kill_f2fs_super+0x3f0/0x3f0 [ 268.578262][ T6889] ? get_tree_bdev+0x520/0x520 [ 268.583066][ T6889] ? vfs_parse_fs_param+0x420/0x420 [ 268.588415][ T6889] legacy_get_tree+0xea/0x180 [ 268.593137][ T6889] ? trace_raw_output_f2fs__rw_end+0x110/0x110 [ 268.599344][ T6889] vfs_get_tree+0x8c/0x280 [ 268.603801][ T6889] do_new_mount+0x24a/0xa40 [ 268.608351][ T6889] __se_sys_mount+0x2e7/0x3d0 [ 268.613082][ T6889] ? __x64_sys_mount+0xc0/0xc0 [ 268.617984][ T6889] ? lockdep_hardirqs_on+0x98/0x150 [ 268.623220][ T6889] ? __x64_sys_mount+0x20/0xc0 [ 268.628084][ T6889] do_syscall_64+0x55/0xb0 [ 268.632558][ T6889] ? clear_bhb_loop+0x40/0x90 [ 268.637283][ T6889] ? clear_bhb_loop+0x40/0x90 [ 268.642006][ T6889] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 268.647959][ T6889] RIP: 0033:0x7fcebf19f3ca [ 268.652461][ T6889] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.672129][ T6889] RSP: 002b:00007fcec0020e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 268.680599][ T6889] RAX: ffffffffffffffda RBX: 00007fcec0020ee0 RCX: 00007fcebf19f3ca [ 268.689060][ T6889] RDX: 0000200000000140 RSI: 00002000000002c0 RDI: 00007fcec0020ea0 [ 268.697099][ T6889] RBP: 0000200000000140 R08: 00007fcec0020ee0 R09: 0000000001000880 [ 268.705135][ T6889] R10: 0000000001000880 R11: 0000000000000246 R12: 00002000000002c0 [ 268.713159][ T6889] R13: 00007fcec0020ea0 R14: 0000000000005545 R15: 0000200000000500 [ 268.721225][ T6889] [ 268.725612][ T6889] F2FS-fs (loop2): sanity_check_extent_cache: inode (ino=3) extent info [0, 0, 2] is incorrect, run fsck to fix [ 268.739535][ T6889] F2FS-fs (loop2): Failed to read root inode [ 268.837517][ T6889] netlink: 'syz.2.255': attribute type 4 has an invalid length. [ 268.845300][ T6889] netlink: 17 bytes leftover after parsing attributes in process `syz.2.255'. [ 272.990198][ T6916] oxu210hp-hcd serial8250: error -ENXIO: IRQ index 0 not found [ 273.210309][ T6921] netlink: 'syz.2.267': attribute type 8 has an invalid length. [ 273.254856][ T6921] netlink: 4 bytes leftover after parsing attributes in process `syz.2.267'. [ 273.305161][ T6921] bond0: entered promiscuous mode [ 273.329246][ T6921] gretap0: entered promiscuous mode [ 273.562269][ T6921] team0: entered promiscuous mode [ 273.577610][ T6921] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 273.623786][ T6921] hsr1: Interlink (team0) is not up; please bring it up to get a fully working HSR network [ 273.643952][ T6921] hsr1: entered promiscuous mode [ 274.899391][ T6934] mmap: syz.0.270 (6934) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 274.924131][ T6934] loop0: detected capacity change from 0 to 64 [ 274.935321][ T6934] hfs: unable to parse mount options [ 275.390998][ T6939] loop0: detected capacity change from 0 to 1024 [ 275.403980][ T6939] EXT4-fs: Ignoring removed bh option [ 275.589203][ T6939] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 276.563386][ T6950] loop3: detected capacity change from 0 to 128 [ 276.633010][ T6450] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 278.617766][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 278.658893][ T6954] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 279.791102][ T6970] netlink: 'syz.1.281': attribute type 3 has an invalid length. [ 281.128558][ T6982] UBIFS error (pid: 6982): cannot open "(null)", error -22 [ 283.307878][ T6990] loop0: detected capacity change from 0 to 1024 [ 283.329605][ T6990] EXT4-fs: Ignoring removed bh option [ 283.382041][ T6990] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 285.069360][ T7015] netlink: 'syz.1.293': attribute type 3 has an invalid length. [ 287.187659][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 289.819650][ T7051] netlink: 'syz.3.305': attribute type 3 has an invalid length. [ 290.149089][ T7054] loop0: detected capacity change from 0 to 1024 [ 290.157578][ T7054] EXT4-fs: Ignoring removed bh option [ 290.195746][ T7054] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 290.665896][ T7071] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 291.086494][ T7074] netlink: 40 bytes leftover after parsing attributes in process `syz.1.311'. [ 292.664633][ T7084] sctp: failed to load transform for md5: -2 [ 294.645563][ T7099] 9pnet_virtio: no channels available for device syz [ 295.803811][ T7102] syz_tun: entered allmulticast mode [ 295.844832][ T7101] syz_tun: left allmulticast mode [ 295.949645][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 297.058182][ T7111] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 301.482942][ T7125] o2cb: This node has not been configured. [ 301.489445][ T7125] o2cb: Cluster check failed. Fix errors before retrying. [ 301.497045][ T7125] (syz.1.326,7125,0):user_dlm_register:674 ERROR: status = -22 [ 301.504951][ T7125] (syz.1.326,7125,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file0" [ 302.806985][ T7134] netlink: 'syz.2.320': attribute type 3 has an invalid length. [ 304.034265][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.041060][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.047340][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.053617][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.059915][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.066129][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.072393][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.078627][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.084823][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.091071][ T7143] tc action pedit 'at' offset 49 out of bounds [ 304.097291][ T7143] 0: reclassify loop, rule prio 0, protocol 800 [ 304.815597][ T7159] FAULT_INJECTION: forcing a failure. [ 304.815597][ T7159] name failslab, interval 1, probability 0, space 0, times 0 [ 304.858495][ T7159] CPU: 0 PID: 7159 Comm: syz.1.328 Not tainted syzkaller #0 [ 304.865930][ T7159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 304.876050][ T7159] Call Trace: [ 304.879380][ T7159] [ 304.882370][ T7159] dump_stack_lvl+0x18c/0x250 [ 304.887125][ T7159] ? show_regs_print_info+0x20/0x20 [ 304.892398][ T7159] ? load_image+0x420/0x420 [ 304.896977][ T7159] ? __might_sleep+0xe0/0xe0 [ 304.901636][ T7159] ? __lock_acquire+0x7d80/0x7d80 [ 304.906749][ T7159] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 304.912721][ T7159] should_fail_ex+0x394/0x4c0 [ 304.917484][ T7159] should_failslab+0x9/0x20 [ 304.922085][ T7159] slab_pre_alloc_hook+0x59/0x300 [ 304.927178][ T7159] ? pcpu_alloc+0x11e7/0x1880 [ 304.931910][ T7159] ? percpu_ref_init+0xc3/0x340 [ 304.936821][ T7159] __kmem_cache_alloc_node+0x53/0x250 [ 304.942263][ T7159] ? percpu_ref_init+0xc3/0x340 [ 304.947220][ T7159] ? blk_timeout_work+0x10/0x10 [ 304.952128][ T7159] kmalloc_trace+0x2a/0xe0 [ 304.956620][ T7159] percpu_ref_init+0xc3/0x340 [ 304.961368][ T7159] blk_alloc_queue+0x369/0x4c0 [ 304.966195][ T7159] __blk_alloc_disk+0x19/0x80 [ 304.970938][ T7159] dm_create+0x46f/0xf90 [ 304.975239][ T7159] dev_create+0x1f8/0x400 [ 304.979629][ T7159] ? list_devices+0x820/0x820 [ 304.984373][ T7159] ? __might_fault+0xaa/0x120 [ 304.989114][ T7159] ? __might_fault+0xc6/0x120 [ 304.993930][ T7159] ? __might_fault+0xaa/0x120 [ 304.998673][ T7159] ? list_devices+0x820/0x820 [ 305.003415][ T7159] dm_ctl_ioctl+0x975/0xd00 [ 305.008000][ T7159] ? list_devices+0x820/0x820 [ 305.012755][ T7159] ? dm_poll+0x120/0x120 [ 305.017109][ T7159] ? bpf_lsm_file_ioctl+0x9/0x10 [ 305.022109][ T7159] ? security_file_ioctl+0x80/0xa0 [ 305.027288][ T7159] ? dm_poll+0x120/0x120 [ 305.031608][ T7159] __se_sys_ioctl+0xfd/0x170 [ 305.036275][ T7159] do_syscall_64+0x55/0xb0 [ 305.040783][ T7159] ? clear_bhb_loop+0x40/0x90 [ 305.045567][ T7159] ? clear_bhb_loop+0x40/0x90 [ 305.050319][ T7159] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 305.056454][ T7159] RIP: 0033:0x7f4fdb99e159 [ 305.060993][ T7159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.080709][ T7159] RSP: 002b:00007f4fdc7ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 305.089188][ T7159] RAX: ffffffffffffffda RBX: 00007f4fdbc25fa0 RCX: 00007f4fdb99e159 [ 305.097212][ T7159] RDX: 0000200000000000 RSI: 00000000c138fd03 RDI: 0000000000000005 [ 305.105255][ T7159] RBP: 00007f4fdba3506b R08: 0000000000000000 R09: 0000000000000000 [ 305.113278][ T7159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.121306][ T7159] R13: 00007f4fdbc26038 R14: 00007f4fdbc25fa0 R15: 00007ffe0d710e48 [ 305.129351][ T7159] [ 305.677751][ T7164] netlink: 8 bytes leftover after parsing attributes in process `syz.2.342'. [ 306.365198][ T7172] sctp: [Deprecated]: syz.1.335 (pid 7172) Use of struct sctp_assoc_value in delayed_ack socket option. [ 306.365198][ T7172] Use struct sctp_sack_info instead [ 307.528336][ T7181] netlink: 'syz.1.340': attribute type 3 has an invalid length. [ 310.104934][ T7197] loop0: detected capacity change from 0 to 16 [ 310.134303][ T7197] erofs: (device loop0): mounted with root inode @ nid 36. [ 314.138416][ T7220] netlink: 'syz.0.351': attribute type 3 has an invalid length. [ 315.273047][ T5788] [ 315.275483][ T5788] ====================================================== [ 315.282549][ T5788] WARNING: possible circular locking dependency detected [ 315.289637][ T5788] syzkaller #0 Not tainted [ 315.294099][ T5788] ------------------------------------------------------ [ 315.301170][ T5788] kworker/u5:5/5788 is trying to acquire lock: [ 315.307366][ T5788] ffffffff8e562248 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_security_cfm+0x41/0x550 [ 315.316660][ T5788] [ 315.316660][ T5788] but task is already holding lock: [ 315.324072][ T5788] ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_encrypt_cfm+0x2fe/0x4d0 [ 315.333492][ T5788] [ 315.333492][ T5788] which lock already depends on the new lock. [ 315.333492][ T5788] [ 315.344029][ T5788] [ 315.344029][ T5788] the existing dependency chain (in reverse order) is: [ 315.353081][ T5788] [ 315.353081][ T5788] -> #2 (hci_cb_list_lock){+.+.}-{3:3}: [ 315.360870][ T5788] __mutex_lock+0x135/0xc80 [ 315.365942][ T5788] hci_remote_features_evt+0x535/0x900 [ 315.371974][ T5788] hci_event_packet+0x807/0x1280 [ 315.377578][ T5788] hci_rx_work+0x43a/0xd60 [ 315.382581][ T5788] process_scheduled_works+0xa60/0x1600 [ 315.388966][ T5788] worker_thread+0xa5e/0xfe0 [ 315.394130][ T5788] kthread+0x2fa/0x390 [ 315.398772][ T5788] ret_from_fork+0x48/0x80 [ 315.403774][ T5788] ret_from_fork_asm+0x11/0x20 [ 315.409120][ T5788] [ 315.409120][ T5788] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 315.416476][ T5788] __mutex_lock+0x135/0xc80 [ 315.421558][ T5788] l2cap_chan_connect+0xfc/0xe30 [ 315.427057][ T5788] l2cap_sock_connect+0x586/0x760 [ 315.432649][ T5788] kernel_connect+0x142/0x1c0 [ 315.437929][ T5788] rfcomm_dlc_open+0xa1f/0xec0 [ 315.443311][ T5788] rfcomm_sock_connect+0x2ed/0x600 [ 315.449013][ T5788] __sys_connect+0x3da/0x470 [ 315.454180][ T5788] __x64_sys_connect+0x7a/0x90 [ 315.459516][ T5788] do_syscall_64+0x55/0xb0 [ 315.464505][ T5788] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 315.470978][ T5788] [ 315.470978][ T5788] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 315.478427][ T5788] __lock_acquire+0x37ef/0x7d80 [ 315.483877][ T5788] lock_acquire+0x19e/0x420 [ 315.488957][ T5788] __mutex_lock+0x135/0xc80 [ 315.494021][ T5788] rfcomm_security_cfm+0x41/0x550 [ 315.499605][ T5788] hci_encrypt_cfm+0x363/0x4d0 [ 315.504923][ T5788] hci_encrypt_change_evt+0x5c3/0xe30 [ 315.510846][ T5788] hci_event_packet+0x807/0x1280 [ 315.516351][ T5788] hci_rx_work+0x43a/0xd60 [ 315.521694][ T5788] process_scheduled_works+0xa60/0x1600 [ 315.527813][ T5788] worker_thread+0xa5e/0xfe0 [ 315.532962][ T5788] kthread+0x2fa/0x390 [ 315.537592][ T5788] ret_from_fork+0x48/0x80 [ 315.542571][ T5788] ret_from_fork_asm+0x11/0x20 [ 315.547891][ T5788] [ 315.547891][ T5788] other info that might help us debug this: [ 315.547891][ T5788] [ 315.558154][ T5788] Chain exists of: [ 315.558154][ T5788] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 315.558154][ T5788] [ 315.570885][ T5788] Possible unsafe locking scenario: [ 315.570885][ T5788] [ 315.578463][ T5788] CPU0 CPU1 [ 315.583853][ T5788] ---- ---- [ 315.589246][ T5788] lock(hci_cb_list_lock); [ 315.593782][ T5788] lock(&hdev->lock); [ 315.600420][ T5788] lock(hci_cb_list_lock); [ 315.607577][ T5788] lock(rfcomm_mutex); [ 315.611774][ T5788] [ 315.611774][ T5788] *** DEADLOCK *** [ 315.611774][ T5788] [ 315.619956][ T5788] 4 locks held by kworker/u5:5/5788: [ 315.625703][ T5788] #0: ffff88802854a538 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 315.636732][ T5788] #1: ffffc90004617d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 315.648792][ T5788] #2: ffff8880638780b8 (&hdev->lock){+.+.}-{3:3}, at: hci_encrypt_change_evt+0x93/0xe30 [ 315.658695][ T5788] #3: ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_encrypt_cfm+0x2fe/0x4d0 [ 315.668538][ T5788] [ 315.668538][ T5788] stack backtrace: [ 315.674457][ T5788] CPU: 0 PID: 5788 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 315.682037][ T5788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 315.692129][ T5788] Workqueue: hci3 hci_rx_work [ 315.696856][ T5788] Call Trace: [ 315.700166][ T5788] [ 315.703128][ T5788] dump_stack_lvl+0x18c/0x250 [ 315.707939][ T5788] ? load_image+0x420/0x420 [ 315.712481][ T5788] ? show_regs_print_info+0x20/0x20 [ 315.717723][ T5788] ? print_circular_bug+0x12b/0x1a0 [ 315.722956][ T5788] check_noncircular+0x2fc/0x400 [ 315.727973][ T5788] ? print_deadlock_bug+0x5d0/0x5d0 [ 315.733209][ T5788] ? lockdep_lock+0xf5/0x230 [ 315.737837][ T5788] ? _find_first_zero_bit+0xd6/0x100 [ 315.743155][ T5788] __lock_acquire+0x37ef/0x7d80 [ 315.748065][ T5788] ? verify_lock_unused+0x140/0x140 [ 315.753302][ T5788] ? l2cap_security_cfm+0x1277/0x1300 [ 315.758717][ T5788] ? __lock_acquire+0x7d80/0x7d80 [ 315.763774][ T5788] lock_acquire+0x19e/0x420 [ 315.768324][ T5788] ? rfcomm_security_cfm+0x41/0x550 [ 315.773580][ T5788] ? __might_sleep+0xe0/0xe0 [ 315.778217][ T5788] ? read_lock_is_recursive+0x20/0x20 [ 315.783621][ T5788] ? __mutex_trylock_common+0x160/0x270 [ 315.789205][ T5788] __mutex_lock+0x135/0xc80 [ 315.793744][ T5788] ? rfcomm_security_cfm+0x41/0x550 [ 315.799019][ T5788] ? trace_contention_end+0x39/0xe0 [ 315.804262][ T5788] ? __mutex_lock+0x30d/0xc80 [ 315.808971][ T5788] ? rfcomm_security_cfm+0x41/0x550 [ 315.814204][ T5788] ? mutex_lock_nested+0x20/0x20 [ 315.819173][ T5788] ? hci_encrypt_cfm+0x2fe/0x4d0 [ 315.824137][ T5788] ? mutex_lock_nested+0x20/0x20 [ 315.829104][ T5788] ? __lock_acquire+0x7d80/0x7d80 [ 315.834163][ T5788] rfcomm_security_cfm+0x41/0x550 [ 315.839225][ T5788] ? hci_conn_hash_lookup_handle+0x20/0x240 [ 315.845329][ T5788] ? rfcomm_send_msc+0x360/0x360 [ 315.850316][ T5788] hci_encrypt_cfm+0x363/0x4d0 [ 315.855114][ T5788] hci_encrypt_change_evt+0x5c3/0xe30 [ 315.860525][ T5788] ? __skb_clone+0x446/0x6c0 [ 315.865150][ T5788] ? hci_remote_name_evt+0x610/0x610 [ 315.870477][ T5788] ? skb_pull_data+0xf0/0x1f0 [ 315.875204][ T5788] ? hci_remote_name_evt+0x610/0x610 [ 315.880530][ T5788] hci_event_packet+0x807/0x1280 [ 315.885496][ T5788] ? __lock_acquire+0x7d80/0x7d80 [ 315.890559][ T5788] ? lock_chain_count+0x20/0x20 [ 315.895447][ T5788] ? bis_list+0x290/0x290 [ 315.899822][ T5788] ? kcov_remote_start+0x513/0x810 [ 315.904986][ T5788] ? lockdep_hardirqs_on+0x98/0x150 [ 315.910219][ T5788] ? hci_send_to_monitor+0xd7/0x4f0 [ 315.915549][ T5788] hci_rx_work+0x43a/0xd60 [ 315.920008][ T5788] ? process_scheduled_works+0x975/0x1600 [ 315.925764][ T5788] process_scheduled_works+0xa60/0x1600 [ 315.931365][ T5788] ? worker_attach_to_pool+0x370/0x370 [ 315.936866][ T5788] ? assign_work+0x3cc/0x5d0 [ 315.941492][ T5788] worker_thread+0xa5e/0xfe0 [ 315.946133][ T5788] kthread+0x2fa/0x390 [ 315.950231][ T5788] ? pr_cont_work+0x550/0x550 [ 315.954979][ T5788] ? kthread_blkcg+0xd0/0xd0 [ 315.959639][ T5788] ret_from_fork+0x48/0x80 [ 315.964101][ T5788] ? kthread_blkcg+0xd0/0xd0 [ 315.968728][ T5788] ret_from_fork_asm+0x11/0x20 [ 315.973539][ T5788] [ 316.254928][ T7234] loop2: detected capacity change from 0 to 4096 [ 316.982069][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.500555][ T5780] Bluetooth: hci3: command 0x0406 tx timeout [ 318.531212][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.581634][ T7234] ntfs3: loop2: Failed to read $AttrDef (-4).