last executing test programs: 3m18.655051135s ago: executing program 1 (id=116): r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r0, 0x50009403, &(0x7f0000000040)={{r1}, {@void, @actul_num={@val=0x2b, 0x4, 0x54}}}) userfaultfd(0x1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x2, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x9622f819df659fd3}, 0x45) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f00000001c0)={0x7}, 0x4) r3 = socket$inet6(0xa, 0x80000, 0x7) bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x4, @loopback, 0x401}, 0x1c) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000240)=0x0) sched_setscheduler(r4, 0x0, &(0x7f0000000280)=0x81) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x8000, 0x40, 0x80000001, 0x81, {{0x6, 0x4, 0x3, 0x4, 0x18, 0x68, 0x0, 0x2, 0x29, 0x0, @loopback, @rand_addr=0x64010101, {[@end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000003c0)={'syztnl2\x00', &(0x7f0000000340)={'syztnl1\x00', r6, 0x2f, 0x7, 0xb, 0xb, 0x8, @mcast1, @mcast2, 0x8, 0x20, 0xaf4, 0x2}}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000400)={0x0, 0x2, 0x30, 0x1, 0xff}, &(0x7f0000000440)=0x18) setsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000480)={r7, 0x4, 0x2, 0x4}, 0x10) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000004c0)={@rand_addr=' \x01\x00', 0x6, 0x1, 0x1, 0x6, 0x2, 0x9}, 0x20) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x8000, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r8, 0x3ba0, &(0x7f0000000640)={0x48, 0x3, r9, 0x0, 0xda, 0x4c, &(0x7f00000005c0)="1f584e032a85619de7f71a65e49582f0f1aec68506aeeb281f740d32c2a7eb689ccd506a717299a81027073a67bc9b86d12c0e2240bd583e41f1d2e0ccbf93a5916f0d4fc6f2083a0cc37e78"}) write$ppp(r8, &(0x7f00000006c0)="411d4ef58cf1b6212d4e804a99a449c72527d6046471c14c9e949b9b0f94b59ba5102e75f9c7a8b79619cf7d410075db470ce062faf2b038fad39902af7630d10bf3a23c088fddfe6ef3a99011286a7c628a6a8b377ede1964f0f94891aa39d6a17f83126564097cb70800134bc1f96f94612778bf5dcd0c23c52846a7fb3168f14dfad0927c567dff09a69ea265d847eb85c3e20c39ac3ed2463e47b73dbbc4d841dced9d985b4cc218eeb274ec0ca8bf3654cd399c27f910cd592097ef0442fbf856a020d8493e5f18cb7336fe0c8cb25c6172b5096f6fd53aa20c8800ab285c4e92b652e229870a471cfe517f79541e11b28b98e1a33f9a5b3bf645e0b9d877701e69d1ce5eaebd395606919a00008e8b4021b05a234a0101305dd0873715169deff28977f155fb5c55d1b2426e2797b23de072453a74b52fe60d910aec46ea73311e184a1ee5611bf9e151c7e807e016edaaba9c3d168f46b608806cc06dbbd4a8b6f4e7e2b072abaf7fe0bbf72fd3045ec6f2986c5ada4ab282cc1dfa38da816d3064e197bd2fe897b266954358f8e7ea0f55f6a723c85cffca1f6c3dc72b7600f1cc34c1661fa632d9b19cbe9fd3f29a93624cf09954f1b876aa35f684180e65fb92c34859860ba401e4e806ad3795196395800b5b2a9e185dae5c671d66232d712223192367dcf83de972476e8be920641715970304ebc472d69d9fd1a2213c37ed36c89a5a0040d07935d2679efc77cc54f9eed3bcf0fcfef1fa37cd51f8fcb3bb586b4b513b69edf85758642439dead4bc8b9e327dc28156457d3de34e67830e9ac52fef22d9e22611be67d9f31d512675f2f1d400f0d6e604e3f2a242e0b7a9c70be6b6410904fadca34e59492d90c28b53480440d47bf1495579d40017a588e9b4f0273aac7f48242f94145bbe46723151a9290c9eb462997674e4b9a24f29e32f4161671ec10f28ae89f5195023770aa4d255619eec384ea73601e5604fff86bc8a8a155040337a3a58ae63f86245860cf6c1eaf524bfc1651f7fa3266acdfecfe0a64d13dbac386a353a3290539aace61eb69a523af7ba5361faf67d6befd7261591cf29d395fe2465e08f7ef75d4152fd868b320d8bf7d78cd60f59d98a49e384eeb876333fcfe86e92ab26bb2bc2ac74185f448f1eda47fb5b2b6f03090744fc32a44da7994ddabf2f0e77211118cecec5a2e23e3031af35deebd9ba6e0c60eed5796159e09614fcdb56550bbd5bfbbbf6d956d61d7e4df4b8383846384190b30dd9adff90183bcee507de2ec9ec80f04325ab859fe6f89e4b576d9fdb141fa7bad8aab3c0e129f47643944de8fdc49835ccd7a6d7db3f7a474fa4cf61e525bbfd10699cf7f7b1a46657d1df69765c5a3f254d7d12131dc7f0c5370eb06ef1dff54b661b9e13f6e49dfe541bca2870fc667649b5d26004dcfcaa31bd26e6b3480929c7fd54c3a440a1149fb390aed0bb64bd469486f56675f6c6df282391c6eb6e40db405c0c62ab0637a583218b0f962ed04e51290641ced0c58238ed5d54e2e1d7e32326335120a9ed31b0746277854aeefb7b01734af4e142c1e5f47da2747ec9afe9c19d582915a658aefa0cf99cadd54950798402fa0c6b2180c13400b0dfbd68266b82f4804846231d02b3dfc330c06af4351d461f1d5c9adcb99f1c70132d17c1974e4ec29168a88415ce15f3b8bbaf80c8b4d3cc37670b4e04f4d48ae94ec1d2737b1998c364e0775ac53d3a0cd18c5ad65d7185a48dfd5ab92e768394eba485a141a73213bf1bb93002081aec93ffd8b51488eb9e403d7e0ef969d263854758ee70fa09f65ccda8b7cbc918b9a816003bfbf9a62611649f4a4d395ad0b50d7a0ec14e14d9ef3914ae208898c653758b11b12bd25e2c926381f16bb5e342abea89834b8bf171291cd5c36c1b8d4412daed79a54c27275911879a78195474c2817935e92b74503a2f27477b38ffa0d72be1a91a2e387f7fe2f8ed81d8551418791061f2959523264d437db81900244c7700a37e5fbbb7492c1457b012777e6804421fcc752d948dabf5785dd212f56b480346742dae6b13169076bceb7d1a059026dda1bf129c72b89a00b0cb543024ef40c17fc1c10bbb18b8fb783b13aad12c73021c569d72acb7474a1ec9a93061347c99dfe299814ee6dd5fb9b2f38747c0b9df090f2f328e266bd381afaf4b2c1f241dfb3149ab1c2f9ded87c62913350e07fd906ffdf7e0de0596a768702e221f8d2c894eda10ede983aff08dd42c7f03af18a5b9d0a2486c8bf2fdd23c2cf87e5a9e603826232e4003991b7535454167ae81ca4660c6eae9c06855dcc69b094976dfabdff243786db0fe22d989caf1333844442055de02916e0883b0a89375317f6220d36b276c03aaa850a9e0f34762ba51d4283ced77bd8e8bdcfb0162f979878d14adb7ef7a8229a7ecccabb2ef3ce55b6f99c4071a1d138a135ac0b67a8f2429c7ae2a341d43fc9ab18088bc5680624541c817e418bddc98cea8fb7eaf1639c92139b3285f564653ba21e6b1020872bb6c715b320554b4e343627ea31800759d9b40762a70931b305e7afe711daf9a4da6be963a1266e4db278497b57e1b5b798334edfb5299fc8c1a4c5414b3d351346eacfdf5ca1dfb8bcadd21d3f5242827f443fa0e205755f5d551577375e6ff44986684e3cbe61bcca1c52d4b558d539837e057d5562536f9b33681c415080ac4e485cf2b68268e3986f93cff5612f45426924cf8318492d9be76f3548dfec4baee1244944431d716b3edee03de34ec6fadfb5f95ff0f580695316fc3f462af60b888fde21ea1c9a4d0ec7d82eed0d60f89a81943ea02fa9562687ed93f9af126cf6cd1508160b1b4a3c1a4c5235733e094fd8f51102d058cab36276372f126063e5ece40c454dea435cd275209054ef6e91adc6e4895db61ceb08c84333eee275cbddcf8e30aa3dc0ba2ab13505e611a1f77ba5152cb626d063b2f68e1f12d77d010b78ab299d40b45c37cb559206d3126f83e3cec976db54ece6469a4bef32137237688348c2ad7a5749c8392aa04ea85e201a11369d39382dae852595d7af3f835e848a36bcbee623354b3e3a2349403ce96ad14fbd68ec76b15ac02f52b9a1df7449554cd7780bbea93fbd2d88d24f3143562d447cae29bf9333f6b7cb6a6b60ec23a8fbf67ade36bdc791d7b325b40aadc765fcf9ffc7e5ab76ec617252a2fef761be5580b8e461b0be40abefd11fa3a843d543c19125e94b4fc37edb90808d1eaf70eaea8e287aca910ecfa7e3aa3e64e48c2fdfccb70e180168efe60be90bd11f67b6c2feecc8f76f7036758b5d576f1fa3cefa5555c945f0193c2a3b2d2276bc30f2f54211601a9de8f2bba4ea1833916e0f8ed9e3d3c748ebddbebd9a2723a3391917ab117bd617c7a2a4c9e71bd5de72b5fcc795293e5ba333cf7bba92c1c14180834fb182a80667da4c6fe38e6214ad2afe7e62ab658088744e69340f1b450cb1077a16be94f1ad02b2d2fde180564ecaac34cd2136e19d2d22d159b88080158e0047cb7b94488bccf14fe970de4186fb6b92ad4753fe181183026d10fc644acde0916f5bb5a0d81ba7b5bcc7cd7b7907831c9f5496f89e2df69eb343ecec87f3b42cd004ca88321244d57035867ea0666b54e23e7709d839c5b36c3a1d85cea9c92cdb7ee747ee764fdea56a9f10bf975f182474b68a691f48e2812a6c7735aee94491701698268c7a338b051788bf014bc0f574d751ccfa521f8ad7fc40d6bcfad136b648e8d93fcc2c4e48ed082d97d034971a431a4bb6841994c4ea640f1cf2bd82bfdb7361894470723537d7eef7a754b26479372579b1c971ee070d3d4b6ab3da9a76ba128f4860d8b7f3e90f828c5c66fc052e3c9c35c6453449049f1078268c17ea6f0c3d7bca2f79d292b6b2c739747900b9dd637c31d247f5687842ba51b5e39291393b5bc43e577aceb30736cc0821b675d02bd44895301023c7517f8edb49935425270046d0f69a193103a2ddec6337c140fe7caf365c592e7a96e0498b9f0608e18b5e7abd19018281c7a8911286f5d3a861c8f2dc9dcb5d66404f4479d432f63559f167852a6e42bbf6400e2eddc0d917011dfbc0a9b58872a990733abf06e52074defc5deebc8870b589b1e04fb7b1d7bf4bb638206855beef95bdfd8e8ab450c141e27104e38d3209714886c7b0f5af8bc57293e9f268cae339b8b4cc016129e01e9ce2a480761dcc254e86a1e26297d04ce387fc5b2d03272e9ed73c14cdd0e1661ce11b13bcb99cd80d50ca728da2dcb8355cf13b13123a0178bb1c8067942ad25fbf355ca29377c01cfc1a641b0587a48fd35a9d867fbb814c8b9c12637782fdd12915875eee74864daf112a308147f959fe5077afa8324a6d5881abc28d314d6520149edf2ae5288e90de9d1e1a648ecc8aba7e4b50615918edc727cdee501684b9aa184565e95cee9810cdd1242cf7a4aa7217f5356f231012f966f2eb5cd68d31472855efdefe72b2b1c9de1ee6274b367b738a3139e26430c796a627279df020d73027ec1e08ba31b319f3d499a3c30ddd7c193c1c4e03b89d60d6822abe5078ab71b16a15a42e2d8c1ece5c7bffa874dfe55632189e5b04ce8abca264fd9a2b750489c4d45bc5b81b57608355fafbe0cb7f23d8ab595bcd2c3ed317e74d2b6b93c8290ab98eb4dc3453a5e145f3444ec64399eefd2a9ab773d577ab4de77d47c744ac090b17e74990cb4f00ac494306731a266f679a12659981376efd1129d3d0e22e616f6bbfe7593b89250a6220ad157d1622e436de72236fd7597528cc2305883153862d6139a33cf7f8c398abb5c9cee096e47838372c64f2f82472c89b448b49f9d84d107349baa6f1680b0dea8a75a2eccf278912b8baaa6a7d60e56438fef452dacbf4eb269a3f07f0197a8dec3597683b62818f64aa4f4cc50029ee7b20370f7c2a7de1787677d89f257ffa2d34e45bfa89deee33713f433a775d963068550bbcca7eaabc7f617bed1a35bb94cac2795991595443d0a821c5386cffc459b22c4af3e0237e21ee5fdc59e0155dfb920d44724380de967c86ffe1d6e9ce3d6166134cb03c9ad66c47f7306f79a3f448d337aaef245e5d9b3066c82a5f1a2fd3c24874ebdcd826241327326e1a0ee4f56863e826db67c1cfb4f869225609b8108de30133f8d63f755efe05fc27c18b07edd5d2b8fe4b06b47af694c1c13c28bc541c322749625ce53af27d711812f4337b4445a6921f0c48d73fce2c21886aa087155eb867afd7d40ff84aeb9fe3844e55abf2b8bc12f3898f1d75d225a6319a80c529fb915c35ce7b4469ab9b057156a7338d3d76476b62d3af2d56c6228323c2596d3b90b81190256b85aed909ba9a8fee20fa454062a78819dd3b0decbbb6e08114c30c6e36a441c48845497bdd95ce7b4eac7d8354a3181d2dd18c860e65a8b172a0cf9fadf2f886a756b5ce246f79056e507fc75678d145925ce47e2cb91c2ffd630b7bbee1f12b61a9f5de3d087f1ca342171bac3e0b60539e01e338efaff617c55b2f0da215a73cb8e99aa3a70eb87eb8a7cd4eeac3467c4cc46b6d951304bd1c49c99b0661c33a9b35db629824ef2f97c1ca99cbe24c1b5042fb4056a3e6032d00cda932523a5f7b429e9f8d84bef3d1dbd787314938c56df02715d7d4830d2c5bf909ec4c27c92a9bf386c87ff9fd6127f64f2ef2ee0c04f0264e6a2ef444018731ed5ccadfbc17e13cc56ff3eae37ff44a627b0d8650eae7d7fd", 0x1000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001880)={0xffffffffffffffff, &(0x7f00000016c0)="936b27428324f14303a327b7bd826941ed76c06ab2ed12f9f82f24f4fb2d423e9d27ffc06b6960319061d341def02d70e33d861d23302b4383190dfe28d165ec7a4df0ae40a512ae8852a6db23dfa62997606d4e916a5272fcc6c039090b1a644168fbfd764533223a98a4f1ac93a2f77d258626fb0abb5a68bb527d3a96e1f4b6f6f0b8b341cdbdf4e17aa765cc6d2aed99b564ae25e099db0c6fe8eeadf315ba", &(0x7f0000001780)=@buf="a9b98b0ddf95c19d5d2abc5db685fbaf2c7085f2eba81a4de62f4e35ec2e7c2e02ada73c0c7762ad84e3e1e98a67c4b0dbe5b22147c384dc8a2170602417e45acaaf749bd6209479c59b980cdd9f4bdc4c8452a24a2fcc1e71735772efce6b2553b867139f1d14690f870c73b91159dd04e91b3f95ff5d8538c7d3ed887c31c059209f376f769057cfdc7094634a82e32dc2ce6d2019e4d1045cb31ebc4740b7b31e4c3ec95a6fa6b1ea43278739ac652127267295c0dc7f65a42f6ee1db4ae460e5a01f7a4a15dc21294736cdef09631ef7a6c2093751e3a419494d32f4ab96750f2aabe782a8f60cdb74519a741c71", 0x1}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000001940)={'ip6_vti0\x00', &(0x7f00000018c0)={'ip6gre0\x00', r6, 0x4, 0x5, 0x0, 0x9, 0x1, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00', 0x20, 0x86cfcea2621fbe4f, 0x7ff, 0x3}}) syz_genetlink_get_family_id$tipc2(&(0x7f0000001980), 0xffffffffffffffff) r10 = syz_open_dev$video(&(0x7f00000019c0), 0xfffffffffffffe00, 0x4240) ioctl$VIDIOC_S_PARM(r10, 0xc0cc5616, &(0x7f0000001a00)={0x4, @output={0x1000, 0x1, {0x7, 0x200000}, 0x9, 0x8}}) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r11, 0x84, 0x13, &(0x7f0000001b00)=0x6, 0x4) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000001b40)={0x3, 0x5, 0x101, 0x9}, 0x8) 3m18.576116529s ago: executing program 1 (id=122): bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x10022, 0x0) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800ffa70000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4"], 0x10b8}, 0x588) 3m17.533969841s ago: executing program 1 (id=131): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r1, @ANYBLOB="010000002000000000003900000008000300", @ANYRES32=r2, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) 3m17.342840136s ago: executing program 1 (id=132): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001800800018008000100e000000108000200e00000011c0002800500010000000000180002"], 0x50}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000000c0)={0x2, 0x3, 0x200, 0xb, 0x100, 0x4, 0x9, 0xffffff0c}, 0x0) r2 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r2, &(0x7f0000000100)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1={0xff, 0x2}}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000000), 0x4c00}], 0x1}, 0x0) recvmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x1200, &(0x7f0000000040)=[{&(0x7f0000000340)=""/4106, 0x5a8}], 0x10}, 0x406) sendmmsg$inet6(r1, &(0x7f0000004bc0)=[{{&(0x7f0000001640)={0xa, 0x4e21, 0x196f8a4, @remote, 0x7}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000001680)="b4", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000280)={0x0, 0x6}, &(0x7f00000002c0)=0x8) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c00000002000000ffff000005"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x7b, r3, 0x4}, 0x38) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a400000000328000480080002400000001208000140"], 0xa4}}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x3000000, &(0x7f0000000000)={[{@grpid}, {@dax_never}, {@min_batch_time={'min_batch_time', 0x3d, 0x76}}]}, 0x1, 0x521, &(0x7f0000000640)="$eJzs3d9rZFcdAPDvvcmkyW5qpiqyFmyLrewW3ZmksRpF2gqiTwW1vq8xmYSQSSZkJnUTiqb4BwgiKvgH+CL44KMg/RNEWNB3UVFEd/VR98qdudH8mEnGZJJZJ58PnMw598f5nnPJ3Lk/DvcGcG29EBFvRMRYRLwcETPF9LRIsd9J+XKPHr6zlKcksuytvyaRFNMO6srL4xFxs1htMiK++qWIbyQn4zZ399YX6/XadlGutja2qs3dvbtrG4urtdXa5vz83M8j4tWF2axwoX6WI+K1L/zxB9/9yRdf++Unvvm7e3++8628WZ/7UKfdEbF0oQA9dOoutbfFgXwbbV9GsCHJ+1MaG3YrAADoR36M//6I+Gj7+H8mxtpHcwAAAMAoyV6fjn8mERkAAAAwstKImI4krRRjAaYjTSuVzhjeD8aNtN5otj6+0tjZXM7nRZSjlK6s1WuzxVjhcpSSvDxXjLE9KL9yrDwfEc9ExPdnptrlylKjvjzsix8AAABwTdx8/uj5/z9m0nYeAAAAGDHlngUAAABgVDjlBwAAgNHn/B8AAABG2pfffDNP2cF7vJff3t1Zb7x9d7nWXK9s7CxVlhrbW5XVRmO1/cy+jbPqqzcaW5+MzZ371Vat2ao2d/fubTR2Nlv31o68AhsAAAC4Qs88/95vk4jY/+xUO0XxHECAI/4w7AYAgzQ27AYAQzM+7AYAQ1M6cwl7CBh1yRnzTw7e6VwrjF9dTnsAAIDBu/3hk/f/J4p5Z18bAP6fGesDANfP0bt7U0NrB3D1SucdAXhr0C0BhuV9nY+nes3v+fCOPu7/d64xZNm5GgYAAAzMdDslaaU4Tp+ONK1UIp6Ox1k5SsnKWr02W5wf/Gam9FRenmuvmZw5ZhgAAAAAAAAAAAAAAAAAAAAAAAAA6MiyJDIAAABgpEWkf0raT/OPuD3z0vTRqwPH3vr147d+eH+x1dqei5hI/jaTT5qIiNaPiumvZF4JAAAAAMM1lf/pnKcXn3PDbhIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo+bRw3eWDtJVxv3L5yOi3C3+eEy2PyejFBE3/p7E+KH1kogYG0D8/Xcj4la3+Ek8zrKsXLSiW/ypS45fbm+a7vHTiLg5gPhwnb2X73/e6Pb9S+OF9mf37994kS6q9/4v/c/+b6zH/ufpY+Venn3ws2rP+O9GPDveff9zED/pxD8SIi+82Gcfv/61vb2uMw5V2S3+4VjV1sZWtbm7d3dtY3G1tlrbnJ+f+9TCpxdeXZitrqzVa8XfrmG+95FfPD6t/zd6xC8f7f+J7f9SX73P4l8P7j/8QKdQ6hb/zovdf39v9YifFr99Hyvy+fzbB/n9Tv6w53766+dO6/9yj/5PntH/O331Pz7z8le+8/uuc05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERet5/WBtudJyMTZy0w+IU29jEz27c7/48XqueDqJzLZRVYfjwE0Y+LE93QszlthErGf19XnPyQAADBi/nvQf9odJAAAAAAAAAAAAAAAAAAAAOAynfOxZJMR0ffCx2PuD6erAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACn+ncAAAD//+8b0g8=") mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2390024, &(0x7f0000000000)) socket$nl_netfilter(0x10, 0x3, 0xc) 3m17.324808629s ago: executing program 1 (id=135): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x45) write$FUSE_LSEEK(r2, &(0x7f0000002700)={0x4e, 0x7ffffffffffffffa, 0x0, {0xff}}, 0x18) setns(r1, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r6, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r8, r7, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) getsockopt$inet_tcp_buf(r4, 0x6, 0x5, 0x0, 0x0) r9 = syz_pidfd_open(r3, 0x0) setns(r9, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='net/wireless\x00') mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x9, 0x0, 0x11, r10, 0x20000000) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') 3m16.823464074s ago: executing program 1 (id=141): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000100)={0x30, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x10000000}}) socket(0x15, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000003c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000300)={0x4, &(0x7f00000001c0)=[{0xe4, 0x5, 0xf7, 0x400}, {0x5, 0x2, 0x0, 0x7}, {0xfff, 0x3, 0x3}, {0xffff, 0x2, 0x3, 0x9}]}) syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000400), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff1704b45adbde0800450000740000000000019078ac1e0001ba1414aa05009078e00000e04600000000000100000000000008000006000004830300070300443c0003e0002089000000000000000000000500ac1414aa00000000ac1414bb000000000000000000000000ac00"/124], 0x0) 3m0.762099765s ago: executing program 32 (id=141): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000100)={0x30, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x10000000}}) socket(0x15, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000003c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000300)={0x4, &(0x7f00000001c0)=[{0xe4, 0x5, 0xf7, 0x400}, {0x5, 0x2, 0x0, 0x7}, {0xfff, 0x3, 0x3}, {0xffff, 0x2, 0x3, 0x9}]}) syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000400), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff1704b45adbde0800450000740000000000019078ac1e0001ba1414aa05009078e00000e04600000000000100000000000008000006000004830300070300443c0003e0002089000000000000000000000500ac1414aa00000000ac1414bb000000000000000000000000ac00"/124], 0x0) 2m7.756383812s ago: executing program 0 (id=361): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000200b000000bfa30000000000000703000000feffff7a0bf0fff8ffffff71a4f0ff000000004e04010000000000d330020200ff00004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc303fffde1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd99fb4d335ff00d15bc4630c993fffffe000000000000a236a791bcb6eff8d488041db6b8f2c158c2c3f4baacd0c8cc7eb1fd7fba93237e598771cf6f281aa72139"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 2m7.311239488s ago: executing program 0 (id=365): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() r3 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000100)={0x0, 'veth1_to_batadv\x00', {0x4}, 0x26}) r6 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r7, 0x1, 0x70bd2f, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x3}, @ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0xfffffff1}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x44}}, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) ptrace$ARCH_MAP_VDSO_32(0x1e, r2, 0xf30f, 0x2002) close(r1) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 2m5.075653859s ago: executing program 0 (id=371): mkdirat(0xffffffffffffff9c, 0x0, 0x180) r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = syz_clone(0x8202000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregset(0x4205, r4, 0x40a, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, 0x0, 0x7, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x11, 0x4, 0x4, 0x7, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800001f00000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000480)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "361db3", 0x0, 0x84, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2}}}}, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f00000001c0)=ANY=[@ANYBLOB='nr_inodes=0,si']) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) 2m0.699031185s ago: executing program 0 (id=383): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1000010, &(0x7f0000000140)={[{@shortname_winnt}, {@uni_xlateno}, {@shortname_mixed}, {@shortname_mixed}, {@fat=@nfs}, {@utf8}, {@shortname_winnt}, {@utf8no}, {@uni_xlate}, {@fat=@uid}, {@rodir}, {@numtail}, {@iocharset={'iocharset', 0x3d, 'cp865'}}, {@shortname_lower}, {@shortname_mixed}, {@shortname_win95}]}, 0x27, 0x2a6, &(0x7f0000000740)="$eJzs3c2KI1UUAOBT+ekkukgWrkSYAl24GqZ9gm5kBLVBULJQF9o4GZBUGOhAIK0YZ+UT+AQ+jxtx6cYHUNw5C7GkUpWYzFR6TDvTPTTft+nDuffU/amia1U3n782Gd97ML3/8Otfo9tNonEUR/EoiUE0YuXbqPXz7/V5AOAF9yjP44+81ClT8+0e7R2VrcZznxwA8Fxsvv+3GrzdAeDG+ujjT94/Pjm5+2GadiMm382GSZR/y/bj+/FlZDGKO9GPvyLytTJ+592Tu9FKC4N4Y7KYDYvKyWc/Vtc//i1iWX8Y/RjU1x+mpY36xWzYjpeq8Y+yGH3wQ/TjlaLml/dWc1/Vv1VTH8ODePP1jfnfjn789EU8iCzuPVb/zWGavp1//+dXnxbZoj5ZzIaddb+qd/Oq7gkAAAAAAAAAAAAAAAAAAAAAADff7XRtsH3+zurg/wvanzwfqLc64Gexcb7PnTRN86Ts/299K15tRes61w4AAAAAAAAAAAAAAAAAAAAviun8fHya9SJiGWSjszKTzSNiO7NHsPqsv6Yp/t7OdCLiMkOUwa19q6JZTS1LiiW347+Xt6OzrHx65+aeqyi2PxudJa247IY/GSTrTK8MohFxNr0V5VhFplcGG5n/PXo3yrEq49PkaTe3W/eQPIMgr3n8mjurDh7P9KoV1HTuXTD6wcuXmnPe39GURER7vZkXX6f9bPfw6v4HAQAAAAAAAAAAAAAAAAAApen8fNxYfvRb0/jwGiYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANdgOj8fny5//3+PYFEV7+qTN4ugFVWmZtiDK14mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN9w/AQAA//8XQlpx") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) unshare(0x2a020480) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r2 = inotify_init1(0x800) r3 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400) inotify_rm_watch(r2, r3) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x106, 0x2}}, 0x20) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r4, 0x40f, &(0x7f0000000200)={0x0, 0x0, 0x5, 0x8}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) write$uinput_user_dev(r1, &(0x7f0000001740)={'syz1\x00', {0x8000}, 0x0, [0x9, 0x0, 0x0, 0x0, 0x0, 0xa5b0e763, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0xc0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x487, 0xd6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x1000, 0x14], [0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffffffc, 0x8001, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x7, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x27], [0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x403, 0x40, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xfffffffb, 0x806, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x5, 0xff, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x0, 0x2000000], [0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x4, 0x0, 0x9, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x2, 0x0, 0x0, 0x0, 0x1, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz0\x00', {0x2, 0xf, 0x2, 0x3}, 0x8, [0x9, 0x4, 0x401, 0x7, 0x8, 0x5, 0x3c, 0x4, 0x9, 0x9, 0xff, 0x2, 0x4, 0x1, 0x1, 0x2, 0x7ff, 0x8, 0xfffffff2, 0xfffffffb, 0xf4b, 0x0, 0x1, 0x9, 0x2, 0x9, 0x5b, 0xa81, 0x10000, 0x8, 0x1, 0x5, 0xfffffff7, 0x7, 0x6, 0x3, 0x1ff, 0xfffffffa, 0x4, 0x3, 0xc, 0x400, 0xdf1c, 0x10000, 0x1, 0x6, 0x10000, 0xffffff37, 0x81d, 0x4c, 0x16e0000, 0x0, 0x9, 0xffffffff, 0x3, 0x5, 0x5, 0x7, 0x101, 0x9d, 0x7, 0x6, 0x5120, 0xffff8001], [0x10000, 0x2, 0x1, 0x4, 0x4, 0x8, 0x100, 0x5, 0x1, 0x2, 0x4, 0x0, 0xe7f, 0x7, 0x1, 0x1c00, 0x55, 0x8001, 0x744, 0x5, 0x7d0, 0xea8, 0x5, 0x533, 0x4, 0x0, 0x401, 0x0, 0x4, 0x9, 0x5, 0x8, 0x1, 0xe, 0x8, 0x1, 0xfffffff7, 0x43f, 0x401, 0x1e1, 0x6, 0x5, 0x8, 0x8, 0x4, 0x6, 0x1000, 0x7, 0x7, 0x3, 0xc27, 0x6, 0x28d76d5b, 0x1, 0x3, 0x5, 0x0, 0x8, 0x4, 0x401, 0x8, 0x9, 0x9a37, 0xb3bd2d5], [0x7, 0xff, 0x8de, 0x5, 0x401, 0x0, 0x2, 0x6be2e0ae, 0x50, 0x2c1, 0x9, 0x3ff, 0x3, 0x1, 0x0, 0x8, 0x6, 0x3, 0x9, 0xa, 0x6d, 0x8, 0x7, 0x8, 0x4, 0x726, 0x5, 0x4, 0xcad5, 0x8, 0x6, 0x80000000, 0x4, 0x3, 0xc27, 0xffffffff, 0x10000, 0xb6, 0x5, 0x6, 0x9, 0x4, 0xb2, 0x3, 0x3, 0x10001, 0x7fff, 0x3, 0x6, 0xa9, 0x7fff, 0x1b47af25, 0x7fff, 0x300, 0x9, 0x5, 0x4, 0x8926, 0x7, 0x40, 0x7f, 0x3, 0x8, 0x5], [0x61ffd85e, 0x7, 0x1, 0x7, 0x8, 0x5faf, 0xfffffff7, 0x5, 0x6, 0x1, 0x40, 0x2, 0xffff, 0x400, 0x10000, 0x4, 0x4, 0x4c19, 0x2, 0x1ff, 0x401, 0x4, 0x8, 0xf3, 0xec, 0x1, 0x5, 0x51a, 0x10000, 0xde55, 0x4, 0x3, 0x80000000, 0x673, 0x9, 0x2, 0x3, 0xffff, 0x2, 0x5, 0x9, 0x3, 0x5, 0x3, 0x60, 0x1, 0x2, 0x4, 0x7, 0x8000, 0x7, 0x401, 0x400, 0x7ff, 0x5, 0xfff, 0x6, 0x0, 0xd, 0x0, 0x7, 0x6, 0x7dc, 0x1]}, 0x45c) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000100)=0xffffffffffffffff, 0x0, 0x0, {0x38}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) pidfd_send_signal(r5, 0x20, 0x0, 0x0) 2m0.479057672s ago: executing program 0 (id=387): r0 = socket(0x2b, 0x80801, 0x1) listen(r0, 0x9) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4001af84, &(0x7f0000000140)={0x2}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000240)='nv', 0x2) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x0, {0xa, 0x0, 0x2, 0x0, 0x4}, [@NHA_BLACKHOLE={0x4}, @NHA_OIF={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = gettid() r5 = syz_clone(0x200, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp(r4, r5, 0x5, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0xffffffffffffff2d, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0xf3f, 0x30bd29, 0x25dfd3f5, {0x0, 0x0, 0x0, r6, {0x1}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x63a4, 0x4, 0x4, 0x4, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0x403, @dev={0xfe, 0x80, '\x00', 0x25}, 0x200101}, 0x1c) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, 0x4, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}}, 0x4008080) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="c0000000000101040000000000000000020000007400018014000180080001000000000008000200e00000020c00028005000100000000004300028005000100060000000c00038205000100000000000c0002"], 0xc0}}, 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x40000000, 0x80000804, 0x9, 0xfffffffb, 0xffffffff}) r8 = socket$netlink(0x10, 0x3, 0xc) writev(r8, &(0x7f0000000040)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000014001080800418e00000004fcff", 0x58}], 0x1) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1818e58, &(0x7f0000000000)={[], [{@smackfsroot={'smackfsroot', 0x3d, '%'}}]}, 0x2a, 0x63f, &(0x7f0000000d80)="$eJzs3c9rXFsdAPDvvZPkJWl86RMRX1AMuHgP5KVJfVh1Y1sXdlGwYBciLhqapIZOf5CkYGvBBFwoKIi4LdKN/4B76d6dCOrOtVBFKha0dB73zp1mMplfaTIzSe7nA5M599wzOeebOyf33HvnzA2gtOazH2nE+xGvbyQRs03rZqK+cr4o9+Lfj29mjyRqte/+K4mkyGuUT4rnM8XCZET86XLEpyv76918+Oj2crVW95OIc1t37p/bfPjoo/U7y7dWb63eXTr/tY8vLH596eOlpoa+vTPF85Wr3/n8L3/6w6+u/bn6URIX4/r4j1eiJY6jMh/z8boIsTl/LCIuZIk2f5eT5hSEUGqVot+OR8RnYzYq+buzbjbWfzHSxgEDVatE1LpLehUATirdG8qqMQ5oHNv3dxx8fcCjkuF5fql+QL4//rHilMNkfmw0/SJpOjKqn9s4ewT1Z3W8ejz55NXjuSex5zzEyzdbZ+wI6ulkeyciPtcu/iRv29k80iz+dM+xfhoRixExUbTvW4doQ9KUHsR5mG4OEn/zdsjiv1g8Z/mX37L+1tNaw44fgHJ6dqnYkW9nS7v7v2zs0Rj/RJvxz8zhL8nkRr3/6zz+a+zvJ/NxT9oyDsvGLNfa/8rx1oy///zKrzvVXx//zT1pPLL6G2PBYXi+EzHXEv/PsmCL8U8Wf9Jm+2dFblzsr45v/+WfVzqtG3X8tacRH7Q9/tkdlWapLtcnz62tV1cX6z/b1vGHP/7gd53qbx//OwOItL1s+093iL9p+6etr8v+Jvfb/8qd1ozfX3t6p1P9Mz23f/qPiaR+vDlR5PxoZ2trYyliIrlaFCnyl7e2Ns53j7de5mUtf16qx//hl9r3/z3v/5aophr/Mvtw/3u3X3Ra9zbv/6aLya9rfbahkyz+ld7bf1//z/J+1Wcd//3+gy90Wtct/qnDBAYAAAAAAAAllObXYJN04U06TRcW6vNlPxPTafXe5taX1+49uLsS8WH+ecjxNNIk/8jIbH05WVuvri4Vn4dtLJ9vWf5KRLwXEb+pTOXLCzfvVVdGHTwAAAAAAAAAAAAAAAAAAAAcE2eK+f+N+1T/p1Kf/w+URO8bzO27/wNwSgzyBpPA8Zb3/267+HeH1xZguOz/obz0fygv/R/KS/+H8tL/obz0fygv/R/KS/8HAAAAgFPpvS8++1sSEdvfmMofmYlinUm/cLqNH6h0ZWDtAIZPj4byenPp32AfSqev8f//ii8HHHxzgBFI2mXmg4Na987/rO0rd+0cvm0AAAAAAAAAAAAAQN0H73ee/3+wucHASWPaH5TXIeb/++oAOOF89T+Ul2N8oMcs/pjstKLX/H8AAAAAAAAAAAAA4MjM5I8kXSjmAs9Emi4sRHwqIs7GeLK2Xl1djIh3I+KvlfF3suWlUTcaAAAAAAAAAAAAAAAAAAAATpnNh49uL1erqxvNif/vyzndicZdUHsXrvVRpmvim3HAV0Uy/D/LVESMfKMMLDHWlJNEbGdb/lg0bGMzjkcz8sSI/zEBAAAAAAAAAAAAAAAAAEAJNc09bm/ut0NuEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM3+79/3skVqbrL+ir8N7EqGMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mTwIAAP//rwQ8NA==") 1m59.850026489s ago: executing program 0 (id=395): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xeed7e89f6334d838}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000200)=[@acquire], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5) r3 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xd8b) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x5c, 0x0, &(0x7f0000000000)=[@enter_looper, @free_buffer={0x40086303, r2}, @free_buffer={0x40086303, r3}, @free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x2}, @increfs={0x40046304, 0x3}, @exit_looper], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) close_range(r4, r4, 0x0) read$FUSE(r4, &(0x7f0000000480)={0x2020}, 0x2020) 1m59.634672574s ago: executing program 33 (id=395): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xeed7e89f6334d838}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000200)=[@acquire], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5) r3 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xd8b) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x5c, 0x0, &(0x7f0000000000)=[@enter_looper, @free_buffer={0x40086303, r2}, @free_buffer={0x40086303, r3}, @free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x2}, @increfs={0x40046304, 0x3}, @exit_looper], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) close_range(r4, r4, 0x0) read$FUSE(r4, &(0x7f0000000480)={0x2020}, 0x2020) 8.37854156s ago: executing program 6 (id=953): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x0) listen(r3, 0x8) open_by_handle_at(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="08000000020000000b"], 0x0) sendmsg$inet(r3, &(0x7f0000000cc0)={&(0x7f0000000840)={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000000bc0)=[{&(0x7f0000000b80)="f7625c186af7eed7e419", 0xa}], 0x1, &(0x7f0000000c00)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x1000}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @multicast1, @local}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_ttl={{0x14, 0x0, 0x2, 0xfa}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x88}, 0xc090) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r4, 0x3b71, &(0x7f0000000340)={0x20, 0x3, &(0x7f0000000280)="f427527cef22fcb850c9f23f2256baf4b2109c6fa7e3e69cdd965899a411465a4405ba730cfbc5f2e9f412cc1ffba3e9fb740da05aabc752e36a524645e0a64ef1cf747014402300aef367cd0e36dcb909aa277ad19d3059afe07b73502bbee93da8b853ddf34e032664f48bde6c5dcfdc2ab98fbc0c225c0247e5a8ce4126d610600b957d713095b0eaf181cd73d7cd89ac12de68b1d289581c4a129fbf1fc579ca2367060d8a11ed9477a4429d", 0x5b, 0xe}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x2, [@enum={0x0, 0x4c, 0x0, 0x6, 0x4, [{0xfffffffe}]}]}}, &(0x7f0000001f40)=""/4103, 0x2e, 0xff9, 0x8}, 0x28) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f00000000c0)=0x4, 0x4) syz_io_uring_setup(0xc68, &(0x7f0000000640)={0x0, 0x8ae8, 0x1103, 0x2, 0x169, 0x0, r4}, &(0x7f00000006c0)=0x0, &(0x7f0000000700), &(0x7f0000000740)) syz_io_uring_submit(r5, 0x0, 0x0, &(0x7f00000007c0)=@IORING_OP_PIPE={0x3e, 0x2, 0x0, 0x0, 0x0, &(0x7f0000000780)=[0xc, 0xffff], 0x0, 0x1000, 0x1, {0x0, 0x0, 0x5}}) setsockopt$inet6_int(r3, 0x29, 0x10, &(0x7f0000000000)=0xfffffffe, 0x4) bind$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x28}, 0x11}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODESET_CTL(r4, 0x40086408, &(0x7f0000000400)={0x4, 0x4}) sendmsg$NL80211_CMD_CONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x118, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @random='u/:\x00~H'}, @NL80211_ATTR_IE={0xdb, 0x2a, [@measure_req={0x26, 0x10, {0xe, 0x40, 0x9, "93ce375f35ce79b47eafa7f7a4"}}, @fast_bss_trans={0x37, 0x52, {0x0, 0x0, "b5b48ddcb9a1e38c9bd9cd083513d3f5", "40496c27aa8fe209a0c13ea00d7b8217002de50c3f7e2b907d2a3bdd4ad8cb93", "1f77414ae0f19996ad74dd7ab72b8b3debdc5f71766edf07d49c92980da447e1", [{0x1, 0x0, "ff88ce79eaea7b"}]}}, @measure_req={0x26, 0x6f, {0x3, 0xf, 0x5, "2a8c9fe4dadd8cb27c43ae262df68f79cbcfabfc22e157aa8f864ef1f496d055d631c030d9be76eb44937937b95fba9a25a6461295f5ad23594731546ce774fe2b68ef13a516bb293b5d167df178cbc8de33bb869c19d5c3e6e3dbdffa5e5a06bfc1907dba1dbf337d687112"}}]}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0xffffffffffffffec}]]}, 0x118}}, 0x0) syz_mount_image$vfat(&(0x7f0000000380), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000002, &(0x7f00000000c0)=ANY=[@ANYBLOB="e96cb145722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6b7765722c696f636861727365743d63703733372c726f6469722c636f6465706167653d3836322c696f636861727365743d63703836332c73686f72746e616d653d77696e39352c696f636861727365743d6d61636963656c616e642c726f6469722c757466383d302c73686f72746e616d653d77696e6e742c682c73686f72746e616d653d77696e6e742c0000000000"], 0x81, 0x2d5, &(0x7f0000000d00)="$eJzs3ctqJFUYAOC/Ot1Jtw6kF65EsEAXrsLMPEGCRBjMSqmFbjQ4PSCpZiCBBi/YMxvdC658B3c+gA/gxjfwARR3zkIsqaquvtR0ksmYiw7ft6m/zzn/ufUhCQ198vFr46P7D08ePP7y1+j3k+jsxm48SWIYnWg8ihVf3woA4P/sSVHEH0XtvLabK6+6naucFwBwdZ759//GtU0JALhi73/w4bt7Bwf776VpP2L8zSRLon7W9XsP4tPIYxS3Yzv+iijm6vjWvYP96KZp82HAZBBZxPijn2ev936LqPLvxHYM2/nNJwppJd4cTydZOXL57MVLScRekdRN7sZ2vBJR9GLWSf14597B/t20lV9OJtuMt974fjb/v0exE9vxyyfxMPK4X3WxyP/qTpq+XXz35xf1CrKIZDrJtqp2C4W/gAAAAAAAAAAAAAAAAAAAAAAAuDQ76dxw+f6d5jbAnZ12fTeL+H3c5C/uB9qN6n6g2Q0/0/p+nV5E7N9O07S5xmeSlUVVP/FqN7o3tW4AAAAAAAAAAAAAAAAAAAD4Lzn57POjwzwfHa8EPxVlMDizTTvoLpU0X+s/P2t9cPRDxMWzymDznDaxMZtanjw1RNJUtbOKoihO6fDHU8bausjkB+sGjc5pe9jNo578txffn9fXLvBfBRFJlMFwMdXmdB0d1lXVzj+a7W4+2lpK78dh3ot5VdPz0qlrjuHxSXLGgRy0SoqlrWuCjec+Ns98/F5+3vRBrKsqV9ybb+ZqVn91x0a9S3xPy/erJbm8HzoAAAAAAAAAAAAAAAAAAMBaiy/9xuZTlY9vZEoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcO0W//9/HsSwXdIOprPkqqRzduOt45M1ww6veZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC84P4JAAD//6i6SMw=") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x58342, 0x0) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x34, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000400800000008000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000081000000030000e0030200005e3dba8ae862e81c"], 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r8 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x4, 0x93d5, 0x58565559, 0x7, 0x10001, 0x9, 0x9, 0x900, 0x0, 0x4, 0x0, 0x2}}) sendmsg$can_bcm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="01000000440900000100000000000000", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000060af030000f1b68c3e70a5d4bb02ab9dd19a6faf62d4bcfd6c350a928a417ccf61f72b6378965ff4776ad1e8e0b6d8bc529caeb5e8ff90381a02e9b1826bd45bc45cb236d7"], 0x80}, 0x1, 0x0, 0x0, 0x20000040}, 0x8050) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r2, 0x40049366, &(0x7f0000000380)=0x4) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[{@cache_fscache}, {@cachetag={'cachetag', 0x3d, '\x14\xe2\xc3\x11\xe2\xcb\x86\xc8-Hs\xc6\xafm\xdc{\xdeU#\xebp7-\x9f\xb8\xf3A\xb2CX\xd3//\xdd28+\x9dS\"\x9bm\x19\xd0K4a\xe6\xfb\xdb\xf7\xe4K\xb5\xc8\x94_\a\xe61\x91\xe4<@\xc37+\x9c\xb2\xe8E=T\xd5\xb1\'\xc3w\f\'\xd4\x97\xf8\xba\xe8\xa0\n\x8d\xc7\xc9\x7f\xa8\x1d\x88\xa3\x17\xca\xa5e\x7fYj\x82Z\xe9K\xa0T\\\x87u\x8coL\a|\xc8f^\x01\x04\xe4\x8e\x0f\xfe\x16\xa7G\xd4\xa1\xef\xc5\xa7k\x1dE\xb0\x9d!i\x99\\^\\]G?E+\xcd}\xf7i\xe2\xa2\x8dEW\xab\xdc\x8c\xe9Y\xb1\xc8\xc4\x97!\xbc\xf4\xef\xc9\x03v\xf3 \xb2\xc5\xd5\xf0$\xa0KD5\xf4\x9c\xe1\r\xc4\xa0\xd1\'\xadC\xb7Z\f[t\xd1\xadYk\x90v0x0) io_submit(r1, 0x1, &(0x7f0000002680)=[&(0x7f0000000240)={0x0, 0xf1ff, 0x0, 0x1, 0x0, r0, 0x0, 0x4000, 0x600}]) 3.970303479s ago: executing program 2 (id=985): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140020000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) 3.83489823s ago: executing program 2 (id=988): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000240)='./file3\x00', 0x4010, &(0x7f00000001c0), 0x2, 0xbd8, &(0x7f00000083c0)="$eJzs3M1rHOcZAPBnRqu1ZKtduZRS91KVUmwoXUsuMrUp1C4uvfRQaK8FC3llhNYfSCquZB1W7T9Q2p5begk4MQk5xGdfEpJrLol9TcghYIJiJWBCsmH2Q1K8Wkm2dzWO/PvBu/O+887u8zwer2Ze2N0AXlhj2UMacSwiLiYRpdb+NCKKjd5QRK153PrayvTnayvTSdTrf/okiSQiHq6tTLdfK2ltj7QGQxHx7m+T+N4/OuMuLC3PTVWrlfnW+OTilesnF5aWfzF7Zepy5XLl6sTpX02emjw9fmayZ7U++uDcnc9+8vuPal+8/OXtT//9UhLnYqQ1t7WOXhmLsY1/k60KETHV62A5GWjVs7XOpLDLk9I+JwUAQFfplnu4H0QpBmLz5q0Ub76Xa3IAAABAT9QHIuoAAADAAZdY/wMAAMAB1/4cwMO1lel2y/cTCfvrwfmIGG3Wv95qzZlC1BrboRiMiMMPk9j6tdak+bRnNhYRH94/81rWouN7yP+71YMQO6qtRsQPtzv/SaP+0ca3uDvrTyNivAfxxx4b7/f/v2ep/1wP4uddPwAvprvnmxeyzutfunH/E9tc/wrbXLueRt7Xv/b933rH/d9m/QNd7v/+uMcYN2/990a3uaz+X9/53avtlsXPts9U1BN4sBrxo8J29Scb9Sdd6r+4xxilr25Uus3lXX/9/xHHY/v625Kdf5/o5MxstTLefNw2xuo7k690i593/dn5P9yl/vbvP3U7/9f3GOMvFy683rHz/mZ35/rTj4vJnxu9YmvP36YWF+cnIorJHzr3n9ohkdrmMe3XyOo/8dOd3//b1T/QfLnGXLYWWG1ts/HfHwv7m9s33+iWUnv998Tnf3jXI/Ykq/9Sl/O/tf63C53n/597jPGzt/51otvc1vVv1rL47bUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALSlETESSVre6KdpuRxxJCK+H4fT6rWFxZ/PXPvr1UvZXMRoDKYzs9XKeESUmuMkG080+pvjU4+NfxkRRyPiP6Xhxrg8fa16Ke/iAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2HAkIkYiScsRkUbEeilNy+W8swIAAAB6bjTvBAAAAIC+s/4HAACAg8/6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD47+uO795KIqJ0dbrRMsTU3mGtmQL+leScA5GYg7wSA3BTyTgDIzROu8d0uwAGU7DI/1HXmUM9zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD5dfzY3XtJRNTODjdaptiaG8w1M6Df0rwTAHIzsNNkYf/yAPaftzi8uKzxgWSX+aHNY2rfnDnUt5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeP6MNFqSliOi2NpXLkd8JyJGYzCZma1WxiPiuxHxfmnwUDaeyDlnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAem9haXluqlqtzGedNFqdjT3fgk4kzUr6HqsVp5Z/yTo96RTjKZ/+qF6v55183zu5/lkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnC0vLc1PVamV+Ie9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgLwtLC3PTVWrlfk+dvKuEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/HwdAAD///TiCwo=") renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="fab0817dbcb5f31a70001280110001006272696467655f736c6176650000000058000580050019a103000000050005000000000005000c0000000000050007000000000005000a00ffa100000500080000000000040018000500060001000000060002000100000005001e00000000000500010003000000140003006272696467655f736c6176655f30"], 0xa4}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 3.500003757s ago: executing program 2 (id=990): setns(0xffffffffffffffff, 0x8000000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x94002, 0x0) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000080)) symlinkat(&(0x7f0000001040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0/file1\x00', &(0x7f00000001c0), 0x0, 0x0, 0x0) ioctl(r0, 0x8b1a, &(0x7f0000000040)) 3.295211551s ago: executing program 2 (id=993): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x2}, {{0x18, 0x7, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x2f}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x0, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0xb}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x4, 0x0, 0x7}, {0x18, 0x9, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8, 0x4}, {0x6, 0x0, 0x5, 0x7, 0x0, 0xfff8}, {0x85, 0x0, 0x0, 0x55}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40800}, 0x20000040) 3.035067443s ago: executing program 5 (id=998): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000040)=0x2) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, 0x0) 2.987138654s ago: executing program 5 (id=999): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x400, &(0x7f00000001c0)={[{@numtail}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@shortname_winnt}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '737'}}, {@shortname_winnt}, {@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'iso8859-13'}}]}, 0x1, 0x21e, &(0x7f0000000500)="$eJzs3bFqU1EYB/AvbdQiSDoIRRG84uIU2op7RBSEgoJkcLPYFKWJBQMBHVqdfAl9hTq6Cg7i6guIIFVwsVsHIVJvbWJIk0h7c6X8fks/es//nPPdQC4ZcnLvXGNlabW5vLW1GVNThShWohLbhZiOiZiM1LMAAI6S7XY7frRTvdc28tkSAJCxQc9/AOBoGvH5f3uMWwIAMjby5/+JsW0JAMjYnbvtQlolUxGNF61qq5r+Tf97dTkeRj1qMRul+BnR3pPWN24uXJ9NdnydjmpjfTe/3qpO/p2fi1JM98/PJanufBQ66386GbWYj1Kc7p+f75NvVY/HpYtd65ejFB/vx2rUYyl2sp382lySXLu10JM/8XscAAAAAAAAAAAAAAAAAAAAAABkoZzs6Xt+T7m83/U0n56vU4zh5wP1ns9TjLPFfHsHAAAAAAAAAAAAAAAAAACA/0XzydOVxXq99nhQ8ejDxrthY0YsCrvrHnSegxenLnx5uf+Y5/9yfw63eHv+MCeczOaGv998cOZyc+ZKnq9gT3FsUKffSxEZrf46197/dD108MyryuKbtc/fRp15zG9EAAAAAAAAAAAAAAAAAABA1/fb894JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOSn8/v/2RV59wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL8CAAD//33Gm5U=") socket$tipc(0x1e, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$l2tp(0x2, 0x2, 0x73) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x106f) semctl$GETVAL(0x0, 0x2, 0xc, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000100)={0x4004, 0xffffffffffffffff, 0x2}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) 2.10708335s ago: executing program 4 (id=1005): syz_open_dev$tty1(0xc, 0x4, 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udp\x00') recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa2}, [@ldst={0x7}]}, &(0x7f0000000080)='syzkaller\x00', 0x5, 0xd1, &(0x7f0000000440)=""/209, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(0xffffffffffffffff) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x11, 0x4, 0x4, 0x2}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000040000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 1.97737652s ago: executing program 5 (id=1006): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f00000001c0)=0x82, 0x4) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="480100000a0a01020000000000000000000000071c00128018000180080001006f7366000c000280050002080007400000002e0c000b4000000000000007ff93000d40ab7be2b23d29ebc93c7c5ca7b5221eede879e366474970e43822b2a127b96c0af7b30bae373b238c6ef2ed8484a488c672ae959e3fb06207e310141e7abe68bfa03ef057db72e98ed85d0c33cfac957082e76aa34281dbcc40d07900931ec7f81e619fa3af2c3d18e0aef0350b1c3486ee8065650db33639249429ab4c188ba4b09dfea8dc1fb032a7e1cae4257163000900010073797a300000000043000640ffffff005b000d40c4e2bbe1d044738e2d7d7d4586a1941a3784c350b1e1e225b0956422b60b95221e66cdebe00319aa0624727240f7b50bc762d7b388c28aca1789bc418ddcaa93be90a6716ed5407c49140dc1cb5c0218538607af1dfc0000d1d993215d8e2efc24e02c1a6554b1f8d19cf518eb65a64c2d0029874abf0924440852217332028ada5ccd9c43fe0896740fade914c4ffbd20a1ad413b518189ff239f5e3cd83892d3c8c2499e4974fbb9c7048172583f44e3533c1ee5c8ccc5505e7406b7578c5b095a9623f697fd0d1df06fd23cb5e3c7cfdee2fdcbdf07043876383f3e3349b764adca3ccc469c10461deae235098a47add8f3e63a9c"], 0x148}, 0x1, 0x0, 0x0, 0x4000}, 0x4080) 1.080299486s ago: executing program 4 (id=1008): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a3100000000140007800800124000000000050014ff80000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) 1.020686138s ago: executing program 5 (id=1009): mkdirat(0xffffffffffffff9c, 0x0, 0x180) r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = syz_clone(0x8202000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregset(0x4205, r4, 0x40a, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, 0x0, 0x7, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x11, 0x4, 0x4, 0x7, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000010200000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000480)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "361db3", 0x0, 0x84, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2}}}}, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f00000001c0)=ANY=[@ANYBLOB='nr_inodes=0,si']) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) 951.374077ms ago: executing program 4 (id=1010): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0006}]}) socket$l2tp6(0xa, 0x2, 0x73) socket$inet6_sctp(0xa, 0x1, 0x84) inotify_init1(0x800) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5972, 0x10000, 0x0, 0x4e}, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2007, @fd_index=0x5, 0x4, &(0x7f0000003100)=[{&(0x7f0000000480)=""/89, 0x59}], 0x1, 0x0, 0x1, {0x0, 0x0, 0xfc, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r5 = openat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x300, 0x140}, 0x18) sendmsg$DEVLINK_CMD_RATE_GET(r5, &(0x7f0000000180)={0x0, 0xffffffffffffffbb, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="080001000000080000000b00000057de575c5af784f08308ac3a3d00c21fdf09013166ecbf965cc5db07099382abfab788703bf732b274afb572c9b94bee2527ef3dc33b6b400f1c089d341619c08cd470edd435a1d4aab460886dc3c4cfb298f58e2b6696ac528e8a9859bf9b9cc0dc0d0fc3d6cd93be22f45656322fbcf30d28271cc7d687ce26d7cb5d87ba12b1af0d7e111d93e3e83014b984ea32"], 0x34}, 0x1, 0x0, 0x0, 0x20054015}, 0x20048084) socket(0x40000000015, 0x5, 0x0) 864.603564ms ago: executing program 4 (id=1012): keyctl$link(0x8, 0x0, 0xffffffffffffffff) r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r0, r0, r0}, &(0x7f00000000c0)=""/61, 0xfffffffffffffd7e, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000fc0), 0x0, 0x2000) ioctl$DRM_IOCTL_MODE_GETFB(r1, 0xc01c64ad, &(0x7f0000001140)) keyctl$revoke(0x3, r0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'netdevsim0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000280)=@newlink={0x18c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0xe04}, [@IFLA_LINK={0x8, 0x5, r3}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_BROADCAST={0xa, 0x2, @local}, @IFLA_MAP={0x24, 0xe, {0x6, 0x2, 0x4, 0x9, 0x1, 0x43}}, @IFLA_VF_PORTS={0x110, 0x18, 0x0, 0x1, [{0x94, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "9969566ecc4451196ef3b3740d24c09b"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "03347a2b980c9bc0b6d508e455a3eafa"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "eb34aa361f9ad224b515fbee4e075084"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "c30262827cd9f4b05d92bec81ad2b5ce"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "5f85729544889761c10a22c9b31431ce"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "8f4b9a50099cecf38cffe7819f012d10"}, @IFLA_PORT_PROFILE={0x8, 0x2, '}\x84+\x00'}, @IFLA_PORT_REQUEST={0x5}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x5}]}, {0x2c, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x6}, @IFLA_PORT_PROFILE={0xc, 0x2, 'nl80211\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "e6c31c8ea47c20d75625b2d9c8cb5ef4"}]}, {0x20, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "a2601a8a51d454769d2a8dcd9344bfca"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x1}]}, {0x2c, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "56f887460ad4364ebfb5645ce3a8a46c"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "04319e900081b392d074c05c08c019e0"}]}]}, @IFLA_ADDRESS={0xa, 0x1, @random="1fe2fcbe1481"}, @IFLA_NET_NS_FD={0x8}, @IFLA_EXT_MASK={0x8, 0x1d, 0x6}]}, 0x18c}}, 0x0) 659.774497ms ago: executing program 2 (id=1013): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x400, &(0x7f00000001c0)={[{@numtail}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@shortname_winnt}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '737'}}, {@shortname_winnt}, {@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'iso8859-13'}}]}, 0x1, 0x21e, &(0x7f0000000500)="$eJzs3bFqU1EYB/AvbdQiSDoIRRG84uIU2op7RBSEgoJkcLPYFKWJBQMBHVqdfAl9hTq6Cg7i6guIIFVwsVsHIVJvbWJIk0h7c6X8fks/es//nPPdQC4ZcnLvXGNlabW5vLW1GVNThShWohLbhZiOiZiM1LMAAI6S7XY7frRTvdc28tkSAJCxQc9/AOBoGvH5f3uMWwIAMjby5/+JsW0JAMjYnbvtQlolUxGNF61qq5r+Tf97dTkeRj1qMRul+BnR3pPWN24uXJ9NdnydjmpjfTe/3qpO/p2fi1JM98/PJanufBQ66386GbWYj1Kc7p+f75NvVY/HpYtd65ejFB/vx2rUYyl2sp382lySXLu10JM/8XscAAAAAAAAAAAAAAAAAAAAAABkoZzs6Xt+T7m83/U0n56vU4zh5wP1ns9TjLPFfHsHAAAAAAAAAAAAAAAAAACA/0XzydOVxXq99nhQ8ejDxrthY0YsCrvrHnSegxenLnx5uf+Y5/9yfw63eHv+MCeczOaGv998cOZyc+ZKnq9gT3FsUKffSxEZrf46197/dD108MyryuKbtc/fRp15zG9EAAAAAAAAAAAAAAAAAABA1/fb894JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOSn8/v/2RV59wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL8CAAD//33Gm5U=") socket$tipc(0x1e, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x106f) r3 = semget(0x2, 0x3, 0x33a) semctl$GETVAL(r3, 0x2, 0xc, 0x0) mount$fuseblk(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) 571.450689ms ago: executing program 4 (id=1014): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x8800, &(0x7f0000000040)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noauto_da_alloc}, {@dioread_nolock}, {@test_dummy_encryption}, {@block_validity}, {@nodelalloc}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x1020000}}, {@auto_da_alloc}]}, 0x1, 0xba6, &(0x7f0000000c00)="$eJzs3M1rXFUbAPDn3ny3ed9JX17EumlEpAVxmlZSbBFspeLGhaBboSGdlJDpB0mkJs1iov+AqGvBjaAWpQu77kbBrRutW4sLoUhsFEQ0cucjic1MkraT3Jr8fnByz5nnTs7z5DJzz4GZBLBrDWY/0oj9EXEmiSjUH08jorva642o1M5bXJgb/W1hbjSJpaVXf04iiYg7C3Ojjd+V1I9764PeiPjmhST+9/baeadmZidGyuXSZH18ePr8pcNTM7NPj58fOVc6V7pw5Nizw0eHjw0dH25brb//cPL6r4+/9GPlj0/+vPrLex8lcTL667HVdbTLYAwu/01W64yIkXZPlpOOej2r60w6N3hSusVJAQDQUrYU66uv4R6JQnTEyuKtEF9+m2tyAAAAQFssdUQsAQAAADtcYv8PAAAAO1zjcwB3FuZGGy3fTyRsr9unImKgVv9ivdUinVGpHnujKyL23Eli9ddak9rTHthgRNz6/vjnWYst+h7yeirzEfFos+ufVOsfqH6Le239aUQMtWH+wbvG/6b6T7Zh/rzrB2B3unGqdiNbe/9Ll9c/0eT+19nk3nU/8r7/NdZ/i2vWfyv1d7RY/72yyTmufPzB5VaxrP7nrr/4WaNl82fHByrqHtyej3iss1n9yXL9SYv6z2xyjsJfl0utYnnXv/RhxMFoXn9Dsv7/Jzo8Nl4uDdV+Np1j/uvhT1vNn3f92fXf06L+ja7/pU3O8frp09daxTauP/2pO3mt2uuuP/LmyPT05JGI7uTltY8fXT+XxjmN35HVf+iJ9V//zerP3hMq9b9DtheYrx+z8Vt3zfn81StfrFd/tvfL8/qfvc/r/84m53jyq3cPtYqt3v9mLZv/VlLbCwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQxoR/ZGkxeV+mhaLEXsj4v+xJy1fnJp+auziGxfOZrGIgehKx8bLpaGIKNTGSTY+Uu2vjI/eNX4mIvZFxPuFvuq4OHqxfDbv4gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFi2NyL6I0mLEZFGxGIhTYvFvLMCAAAA2m4g7wQAAACALWf/DwAAADuf/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABbbN+BGzeTiKic6Ku2THc91pVrZsBWS/NOAMhNR94JALnpzDsBIDf3uMe3XIAdKNkg3tsy0tP2XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4eB3cf+NmEhGVE33Vlumux7qaPuPANmYHbKU07wSA3HSsF+zcvjyA7eclDrtX8z0+sJskG8R7V86p/DPSs2U5AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDw6a+2JC1GRFrtp2mxGPGfiBiIrmRsvFwaioj/RsR3ha6ebNyTd9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC03dTM7MRIuVya1NHRybeTPBxp1Dp5vzMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCHqZnZiZFyuTQ5lXcmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN6mZmYnRsrl0uQmOtfu5eRVnbxrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP38HAAD//zaIDfE=") 571.242017ms ago: executing program 3 (id=1015): socket$nl_sock_diag(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) fanotify_init(0x40, 0x80000) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000040c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee00ba19ce670d25010000020000040000009fc40400d2532e764975f03f1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac05c04683712a0b09ec39e9ef8f6e396ad200a011ea665c45a3449abe802f5ab3e89cf40b858e217ce740068720000074e468eea3fcfcf498278ad15f5f87e1c26433a8acdc0e65888b2007f00000000000000000100000000000000010000000000000053350000000034a70c2ab40c7cf5691db43a5c00000000000000000000e75a89faff01210cce39bf405f1e846c1242000000000040cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d01000000520655a8056085f4d431623c850af895abba14f6fbd7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf9938d6df8600a62e96b7cb8e52cbdc2ba9d580609e31c30891e7d87a79d6fce424c2200af6cb784a1975fa657de38a3a32a4fd67ce446adb431d07db79240aca1dd9ba02450500000000000000e645f091231b986e77d05d988d6edc6f9b4eb883ec8f878300cabf2b5543ffc1bdb92618242852e6e8b3e56fefbfff81669557b3809d8c396d2c0361629d1822f722ec23812770d72cd0010000007889b8c7044f563a1f68d4efe895fdbc463f747c08f4010586903500000000000000e800000000000000000000000000000000000000003ddf4aa4b1c8b0a0ae6feb6737c275dc2740f742b5425f1d581961471cdb51f8940290e99ccff4123f955267fe4a75c11448741f064fe7ce7e62ee4df874e086287547d4099aeec9f1538ee25a2a5ccf4a9b604e88e12ff251845d0fff45bdbaeba4d4e3c6f7f623579435b2c505fb711300000000040000000000000000000000004c00e67ccc02148a4fc43021cce9f24f4b2f9492c32e7a92a557ac2b44b84e88bbf7611589906d923e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd0294bea179b0433f5c899119ec0c0acef5385c5a2720caeb68f1e9c05b0591d89467ded84da092dea262e51811e2d7fa515722516bd5ef6cfa4966e5937562a5649a1a0000a042a7097ddefe0671a5767014b09b78f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb32879d326497e21e041254f06bd7f3a067e147e82e841dba3867da8bfbc101d3960e07d282f483e7be49833f3c435f9700bc84680549f9eb16682ecb72277ffaca907a3eac4bfc8e0a47c0076d7cc9d32b3cc96aa751d890881c3c33bd91f6ecf45ab3f12f816318346f9b883427b9190024edc1eddd68f34ce3bfedb5fe5d7beae4d3ca561e37570587783f9673e7ab17f5a09efc1114777d2707d2996961203aedff1c5a87013b98649805216631e20d07dff3ae567ca0d38a828542625fc6096aedc0ac5c144f0965071274bea051007e398cf9090c53d4b8b7dc784e3d83b78b007a43d744aa99d6a7c576e20b4281eff511122ccb399bcef0a0471639c81aab7445cebfc9b00b31fcbaf63086b3c16f51b593acee0b3a4830dd6af1accb15cc6163cabc01442527aa10000000000000000a4ba25997affe74ec552bf9deafbd63e"], 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r3, r5, 0x16, 0x0, @void}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000), 0x20000000000000d5) 322.818545ms ago: executing program 3 (id=1016): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x4008, 0x3, 0x2, 0x0, 0x1}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r3, 0x2, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe}, 0x1) r4 = syz_io_uring_setup(0x31d3, &(0x7f0000000140)={0x0, 0x9, 0x1000, 0x3, 0xf1}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) r5 = mmap$IORING_OFF_PBUF_RING(0x0, 0x6, 0x0, 0x100010, 0xffffffffffffffff, 0x83066879) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000017c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2007, @fd_index=0x5, 0xc, &(0x7f0000001740)=[{&(0x7f0000002080)=""/4096, 0x1000}], 0x1, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r9 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) syz_ublk_add_dev(r4, 0x0, r5, r8, &(0x7f0000000340)={0x2e, 0x19, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x43e, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@any_dev={0x4, 0xe50, 0x0, 0x0, 0x1000, 0x3, 0xffffffffffffffff, 0x0, 0x110}}}, &(0x7f0000000440)) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x468, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x438, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "7e85df4bdf2465e1d84fd301c1bc6c9e94d3647af650445f3a7e414602f55bd5ef4b72958ce584fbe5721dc6c1363b0e1660e9f519926bb8f5d438d585ae65856e1333c2646d68f0f4f9a04206e93910d6370f36db3b6f819a7677cfbdf477dc9af88d32098662cf406426219acf127b628b96e23f97f683de5139ea7e4cd7f2783a229322a034c2192a516bf74e9a380f2747833a447a960501762817e604b14d2f2aaa18dba39f4e554ed95dd4b91a93ab262207d5846bd34e19ebe92ac7afbfcd0dd5bb8a101f68fd185e7868824da06034cb8f28169f7a8a3b4422a0697b09559641e361a9dd1b4bf694f51902ef3893d48297a9d71e13d52d9be57cf053"}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x8ea1}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x6, 0x3, 0x1, 0xe, 0x11, 0x3}}, @TCA_CHOKE_STAB={0x104, 0x2, "5fd6d990d3f7fee095fa101d176f60a5065d5d2a7e524e60009e2d2b61d5df129921b150e526ca5bb8c3406432b183fc2479b11f465c580c0b777e690d92af9c506b94a786bd958c3c7277f963c20611c782eed2776a0d563985a79ca6426bbb8b34fc09e9aeeee2cf71a637517650cd54d633469565244e19074e96aace7f6153ff3c138cab84bd0262081465c3f9a287f6aac8efc9e1be93d95133f438a476911b0f34e23abe2fa77d1664fd8bf8a6a04ae433c30093e9ba6939dedfb35f8f2df924dd06cf3a9e6738a669e4bc66bfb447d1bb212b40714f124be1a83012fad11c3f37e91c35903ce88377c35c43a8854a3cefafe33f95203cbe2625e91772"}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x111}, @TCA_CHOKE_STAB={0x104, 0x2, "5d4aa8dafddafda4f5b556f8ede685513c8190602b9e34015fea97ff6ab277141801944560499cfec535bf08a0cf6eb90597a44242ca29d239b4a41ba80f86468426123eb36ac411f7255ee83019448ae75b3b675e06f77c8b91d5b718a3cbc11037796b4865599f2e9bae2d11495b86e0b9a965a689743ba11ea825300af8353ed30a108ad6f7ece055eb573c33c51b194afcb2e20c0fffd09fce2d47cbbd145554af7940c0a6cf94fc68afd928d04a62c0d6624fe83893c70d98fa470bb64f01fa6272a388b85322d031937c34cd89035ccb41943e8aad8ab364f6d0732f9cab684d8997c0cc800b24e03e66983fc72d9d998dff8b8bb531d7291421ab4699"}, @TCA_CHOKE_STAB={0x62, 0x2, "588febe1f73f242fa683131187a7f5f71b4e59f2e6aa2b4d9b1a12dbf1a4fdc566a40979cf6c6320ca3900a4f40885aba51e4395cb263707331f541a86a1d6ac4bf60356368508e65fd7581d111e4864d52f0e95bf8e3677a1b465ae89c85fa525a7ec66b5c9b2c47d12f55e43c701289a03614c322a35c20da627150171b200f3a4afb058c180768cddc491a09dc6486fe64317f26804b5b3ed90b409091c91b79b76e13ae9d200ba1e3f029e5b10314d07e573b97d2dff0491f725fab068f0862972db175c9a0af3638da6e62fa5ebc16787932a36032a7852f226adff2717dbe17fec086c628e3fd18ea20cb93f3de3e508afd9e506e223faf19d2c76b9f5"}]}}]}, 0x4b6}}, 0x0) pwritev2(r0, &(0x7f0000000600)=[{&(0x7f0000000480)}, {&(0x7f0000000540)="c5", 0x1}], 0x2, 0x25e, 0x1, 0x1) 317.469226ms ago: executing program 4 (id=1017): ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000011c0)=0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x7) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/210, 0xd2}, {&(0x7f0000002d80)}], 0x3, &(0x7f00000031c0)=[{0x0}, {&(0x7f00000030c0)=""/218, 0xda}], 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg$inet(r1, &(0x7f0000002b00), 0x400000000000358, 0x40844) 199.389267ms ago: executing program 3 (id=1018): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x2}, 0x2, r3}}]}, {0x4, 0xa}, {0xc, 0x7, {0xe4}}, {0xc}}}]}]}, 0x68}}, 0x0) 194.829757ms ago: executing program 3 (id=1019): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011"], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010400000000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="3a2205000a010000300012800b00010067656e6576650000200002"], 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x0, 0x6, 0x3) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x13, 0x9, &(0x7f0000000200)=ANY=[@ANYBLOB="bfa200001000000007020000fc00ffffbfa30000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70400000000000085000000020000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94) 133.448267ms ago: executing program 3 (id=1020): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000140)="2e1221b23bb601c493d3df163e75963d86dd606712e9000d2f8db0049d90491c3248040000dbb8a10000", 0x2a}, {&(0x7f0000000280)="8bcceb216f624c06f5ff8408750900000002", 0x12}, {&(0x7f00000002c0)="c04334e824da767d894c12f4", 0xc}], 0x3) 19.415592ms ago: executing program 5 (id=1021): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x5, &(0x7f00000006c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffbff, 0x0, 0x0, 0x0, 0x18000000}, [@call={0x85, 0x0, 0x0, 0x17}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000680)='GPL\x00', 0x3}, 0x94) 17.819969ms ago: executing program 3 (id=1022): r0 = socket(0x5, 0x800, 0x0) syz_clone(0x20300000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@bridge_getneigh={0x20, 0x1e, 0x1, 0x70bd28, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x41806, 0x200}}, 0x20}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2d, 0x20, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x57c02931d9dbff28}, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000300), 0x1, 0x47a, &(0x7f00000006c0)="$eJzs28uPFMUfAPBv9z6AH4/lh/gAUVeJyUbjLrugcvCi0cQYjCZ6wOM6O5ANA2vY1QgSWYzxZGJI9Ew8Gv0LvBkTo55MuHryZEiIcgE8remebpgdZni4M8yy8/kkPVPVXT1VNdWP6qqZAPrWaPaSRGyKiN8jYqQeXZ5gtP525dKpytVLpypJLC299VeSp7t86VSlTFrut7GIjKUR6adJkcly8ydOHpmu1arHi/jEwtH3JuZPnHzmg6PTh6uHq8em9u/ft3fy+eemnu1IPbN6Xd758dyuHa++c/b1ysGz7/7yXVbeTcX2xnp0ymhW8b+Xcs3bnux0Zj22uSGcDPawINyRgYjImmsoP/9HYiCuN95IvPJJTwsHdFV2b1rXfvPiErCGJdHrEgC9Ud7os+ffcrlLXY9V4eKL9QegrN5XiqW+ZTDSIs1Q0/NtJ41GxMHFf85lS3RpHAIAoNHnla8ODEfER1e/fS3re4xERDke9ED++kf+uqWYQ9kaEf+PiG0RcV9EbI+I+4u0D0bEQyssz439n/TCCj/yprL+3wvF3Nby/l/Z+4utA0Vsc17/oeTQbK26J9bl38lYDK3L4pM3yeOHl89/0W5bY/8vW7L8y75gUY4Lg00DdDPTC9N5p7QDLp6J2DnYqv7JtZmAJCJ2RMTOO/voLWVg9qlvdrVL1Lr+l8/dVg4dmGda+jqr3mJW/8Voqn8paZyfnL1hfnJifdSqeybqR0Urv/722Zvt8r91+3fXxWr9vaH9m5NsTRrna+c7m/9/PP7T4eTtfJ55uFj34fTCwvHJiOHkQB5ftn7q+r5lvEyfHf9ju1uf/9uKfbL6PxwR2UH8SEQ8GhGPFWV/PCKeiIjdN6njzy/duv6R9qj9z0TMtLz+XTv+m9r/zgMDR376vl3+t9f++/LQWLEmv/7dQqviZJeL5gKu5LsDAACAe0Wa/wY+ScevhdN0fLz+G/7t8b+0Nje/8PShufePzcT5LfXxz7Qc6RopxkNrs7XqZLJYfGJ9fHSqGCsux0v3FuPGXw5syOPjlbnaTI/rDv1uY5vzP/PnQK9LB3TZhpZrp4bvekGAHmieR0+XR0+/ES4GsFb5vzb0r/L8b/O83/g/GGCNcf+H/tXq/D/dFDcXAGuT+z/0L+c/9Kn0xxXs7KkA7nXu/9CXVvK//i4G1q+OYvQmsFobJQ9ElIF0VZRHoEuBXl+ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOuPfAAAA//+Pc+dq") ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="09005e01"], 0x2c}}, 0x800) r5 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000007000000890704ac14140f0011000000000000000000000001000000fc000000000000001400000000000000010000000200000004000000000000001c000000000000000000000008"], 0x68}, 0x0) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000100)={r2, 0x0, 0x7}) socket(0x5, 0x800, 0x0) (async) syz_clone(0x20300000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@bridge_getneigh={0x20, 0x1e, 0x1, 0x70bd28, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x41806, 0x200}}, 0x20}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) (async) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) (async) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2d, 0x20, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x57c02931d9dbff28}, 0x0) (async) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000300), 0x1, 0x47a, &(0x7f00000006c0)="$eJzs28uPFMUfAPBv9z6AH4/lh/gAUVeJyUbjLrugcvCi0cQYjCZ6wOM6O5ANA2vY1QgSWYzxZGJI9Ew8Gv0LvBkTo55MuHryZEiIcgE8remebpgdZni4M8yy8/kkPVPVXT1VNdWP6qqZAPrWaPaSRGyKiN8jYqQeXZ5gtP525dKpytVLpypJLC299VeSp7t86VSlTFrut7GIjKUR6adJkcly8ydOHpmu1arHi/jEwtH3JuZPnHzmg6PTh6uHq8em9u/ft3fy+eemnu1IPbN6Xd758dyuHa++c/b1ysGz7/7yXVbeTcX2xnp0ymhW8b+Xcs3bnux0Zj22uSGcDPawINyRgYjImmsoP/9HYiCuN95IvPJJTwsHdFV2b1rXfvPiErCGJdHrEgC9Ud7os+ffcrlLXY9V4eKL9QegrN5XiqW+ZTDSIs1Q0/NtJ41GxMHFf85lS3RpHAIAoNHnla8ODEfER1e/fS3re4xERDke9ED++kf+uqWYQ9kaEf+PiG0RcV9EbI+I+4u0D0bEQyssz439n/TCCj/yprL+3wvF3Nby/l/Z+4utA0Vsc17/oeTQbK26J9bl38lYDK3L4pM3yeOHl89/0W5bY/8vW7L8y75gUY4Lg00DdDPTC9N5p7QDLp6J2DnYqv7JtZmAJCJ2RMTOO/voLWVg9qlvdrVL1Lr+l8/dVg4dmGda+jqr3mJW/8Voqn8paZyfnL1hfnJifdSqeybqR0Urv/722Zvt8r91+3fXxWr9vaH9m5NsTRrna+c7m/9/PP7T4eTtfJ55uFj34fTCwvHJiOHkQB5ftn7q+r5lvEyfHf9ju1uf/9uKfbL6PxwR2UH8SEQ8GhGPFWV/PCKeiIjdN6njzy/duv6R9qj9z0TMtLz+XTv+m9r/zgMDR376vl3+t9f++/LQWLEmv/7dQqviZJeL5gKu5LsDAACAe0Wa/wY+ScevhdN0fLz+G/7t8b+0Nje/8PShufePzcT5LfXxz7Qc6RopxkNrs7XqZLJYfGJ9fHSqGCsux0v3FuPGXw5syOPjlbnaTI/rDv1uY5vzP/PnQK9LB3TZhpZrp4bvekGAHmieR0+XR0+/ES4GsFb5vzb0r/L8b/O83/g/GGCNcf+H/tXq/D/dFDcXAGuT+z/0L+c/9Kn0xxXs7KkA7nXu/9CXVvK//i4G1q+OYvQmsFobJQ9ElIF0VZRHoEuBXl+ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOuPfAAAA//+Pc+dq") (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="09005e01"], 0x2c}}, 0x800) (async) socket$kcm(0x2, 0x3, 0x84) (async) sendmsg$inet(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000007000000890704ac14140f0011000000000000000000000001000000fc000000000000001400000000000000010000000200000004000000000000001c000000000000000000000008"], 0x68}, 0x0) (async) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000100)={r2, 0x0, 0x7}) (async) 0s ago: executing program 5 (id=1023): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000380)="3900000013000318680907070000000f0000ff3f04000000170a0017c3ffffff040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) kernel console output (not intermixed with test programs): er (/, name='file0', err=-40): overlapping layers [ 96.181180][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 96.230113][ T6030] comedi comedi0: comedi_config --init_data is deprecated [ 96.401454][ T6036] loop3: detected capacity change from 0 to 512 [ 96.588254][ T6036] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 96.590272][ T6036] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 96.593070][ T6036] System zones: 0-1, 15-15, 18-18, 34-34 [ 96.594679][ T6036] EXT4-fs (loop3): orphan cleanup on readonly fs [ 96.596116][ T6036] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 96.598254][ T6036] EXT4-fs warning (device loop3): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 96.601541][ T6036] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 96.605107][ T6036] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.309: bg 0: block 40: padding at end of block bitmap is not set [ 96.609262][ T6036] loop3: lost filesystem error report for type 5 error -117 [ 96.611442][ T6036] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 96.611478][ T6036] loop3: lost filesystem error report for type 5 error -117 [ 96.611593][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 96.611612][ C0] EXT4-fs (loop3): initial error at time 95: ext4_validate_block_bitmap:441 [ 96.611637][ C0] EXT4-fs (loop3): last error at time 95: ext4_mb_clear_bb:6679 [ 96.626111][ T6036] EXT4-fs (loop3): 1 truncate cleaned up [ 96.626606][ T6036] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 96.748336][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.044772][ T5473] udevd[5473]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 97.167924][ T6057] netlink: 5 bytes leftover after parsing attributes in process `syz.5.316'. [ 97.316562][ T6067] loop2: detected capacity change from 0 to 512 [ 97.316917][ T6067] EXT4-fs: Ignoring removed nomblk_io_submit option [ 97.326341][ T6067] EXT4-fs (loop2): can't mount with both data=journal and dax [ 97.431661][ T6065] netlink: 24 bytes leftover after parsing attributes in process `syz.4.319'. [ 97.440703][ T5478] udevd[5478]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 104.099174][ T6104] netlink: 140 bytes leftover after parsing attributes in process `syz.4.329'. [ 104.105315][ T6104] loop4: detected capacity change from 0 to 256 [ 104.107180][ T6104] vfat: Unknown parameter 'ioKharset' [ 104.112021][ T6104] netlink: 20 bytes leftover after parsing attributes in process `syz.4.329'. [ 104.745801][ T6109] comedi comedi0: comedi_config --init_data is deprecated [ 104.971896][ T30] audit: type=1326 audit(102.803:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6118 comm="syz.5.334" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff94379228 code=0x0 [ 104.993123][ T6124] loop0: detected capacity change from 0 to 512 [ 105.002813][ T6129] overlayfs: failed to resolve './bus': -2 [ 106.036171][ T6124] EXT4-fs (loop0): Test dummy encryption mode enabled [ 106.036205][ T6124] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 106.053000][ T6124] EXT4-fs error (device loop0): ext4_orphan_get:1425: comm syz.0.335: bad orphan inode 131083 [ 106.053036][ T6124] loop0: lost filesystem error report for type 5 error -117 [ 106.055732][ T6124] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 107.153090][ T4802] page_pool_release_retry() stalled pool shutdown: id 29, 1 inflight 60 sec [ 108.340827][ T6143] netlink: 57 bytes leftover after parsing attributes in process `syz.4.340'. [ 110.459718][ T4709] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.536501][ T6152] loop4: detected capacity change from 0 to 512 [ 112.644960][ T6152] EXT4-fs (loop4): 1 truncate cleaned up [ 112.645432][ T6152] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.385582][ T6168] loop2: detected capacity change from 0 to 4096 [ 113.394965][ T6168] EXT4-fs (loop2): Test dummy encryption mode enabled [ 113.399212][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.259262][ T6173] tmpfs: Bad value for 'mpol' [ 114.265246][ T6168] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 114.460746][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.529364][ T6193] syz.3.351 uses obsolete (PF_INET,SOCK_PACKET) [ 114.614649][ T6200] loop0: detected capacity change from 0 to 512 [ 115.648688][ T6200] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.075689][ T4709] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.213609][ T6226] loop4: detected capacity change from 0 to 512 [ 118.215138][ T6223] loop0: detected capacity change from 0 to 512 [ 118.235568][ T6223] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.242152][ T6226] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.338970][ T6223] overlayfs: failed lookup in lower (/, name='file0', err=-40): overlapping layers [ 118.342913][ T6226] overlayfs: failed lookup in lower (/, name='file0', err=-40): overlapping layers [ 118.440987][ T6238] binder: 6237:6238 tried to acquire reference to desc 0, got 1 instead [ 118.443123][ T6238] binder: 6237:6238 got transaction with invalid parent offset [ 118.444999][ T6238] binder: 6238:6237 failed to fixup parent [ 118.446463][ T6238] binder: 6237:6238 transaction call to 6237:0 failed 5/29201/-22, code 1342177280 size 104-24 line 3717 [ 118.450289][ T10] binder: undelivered TRANSACTION_ERROR: 29201 [ 118.582946][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.585926][ T4709] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.049645][ T6263] loop5: detected capacity change from 0 to 4096 [ 120.049821][ T6260] syzkaller0: entered promiscuous mode [ 120.049848][ T6260] syzkaller0: entered allmulticast mode [ 120.912208][ T6265] loop2: detected capacity change from 0 to 512 [ 120.954767][ T6260] netlink: 4 bytes leftover after parsing attributes in process `syz.3.366'. [ 120.962914][ T6265] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 120.976446][ T6265] EXT4-fs warning (device loop2): ext4_update_dynamic_rev:1148: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 120.979647][ T6265] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.368: bg 0: block 248: padding at end of block bitmap is not set [ 120.979691][ T6265] loop2: lost filesystem error report for type 5 error -117 [ 120.983058][ T6265] Quota error (device loop2): write_blk: dquota write failed [ 120.983107][ T6265] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota [ 120.983136][ T6265] EXT4-fs error (device loop2): ext4_acquire_dquot:7041: comm syz.2.368: Failed to acquire dquot type 1 [ 120.983153][ T6265] loop2: lost filesystem error report for type 5 error -28 [ 120.983338][ C0] EXT4-fs (loop2): error count since last fsck: 2 [ 120.983361][ C0] EXT4-fs (loop2): last error at time 117: ext4_acquire_dquot:7041 [ 120.996909][ T6265] EXT4-fs (loop2): 1 truncate cleaned up [ 120.997401][ T6265] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0008-000000000000 r/w without journal. Quota mode: writeback. [ 121.008639][ T6263] EXT4-fs (loop5): Test dummy encryption mode enabled [ 121.047759][ T6263] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 121.373057][ T6274] Soft offlining pfn 0x13b2b6 at process virtual address 0x20ffe000 [ 121.375027][ T6274] Soft offlining pfn 0x13b2b4 at process virtual address 0x20fff000 [ 121.378454][ T6274] netlink: 8 bytes leftover after parsing attributes in process `syz.5.367'. [ 121.391059][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0008-000000000000. [ 121.415243][ T5382] Quota error (device loop2): do_check_range: Getting block 0 out of range 1-5 [ 121.415280][ T5382] EXT4-fs error (device loop2): ext4_release_dquot:7077: comm kworker/u8:18: Failed to release dquot type 1 [ 121.415305][ T5382] loop2: lost filesystem error report for type 5 error -117 [ 121.563719][ T6283] netlink: 5 bytes leftover after parsing attributes in process `syz.3.372'. [ 121.567496][ T5530] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.848704][ T6292] netlink: 8 bytes leftover after parsing attributes in process `syz.2.375'. [ 123.204630][ T6308] netlink: 12 bytes leftover after parsing attributes in process `syz.5.381'. [ 125.363901][ T6308] bridge1: port 1(veth3) entered blocking state [ 125.363952][ T6308] bridge1: port 1(veth3) entered disabled state [ 125.364034][ T6308] veth3: entered allmulticast mode [ 125.364584][ T6308] veth3: entered promiscuous mode [ 125.378013][ T6310] bridge1: port 2(veth0_to_bond) entered blocking state [ 125.379575][ T6310] bridge1: port 2(veth0_to_bond) entered disabled state [ 125.553329][ T6310] veth0_to_bond: entered allmulticast mode [ 125.553907][ T6310] veth0_to_bond: entered promiscuous mode [ 125.584458][ T6314] loop0: detected capacity change from 0 to 256 [ 125.632248][ T6314] input: syz1 as /devices/virtual/input/input2 [ 125.670770][ T6317] Driver unsupported XDP return value 0 on prog (id 41) dev N/A, expect packet loss! [ 125.698902][ T6317] loop2: detected capacity change from 0 to 1024 [ 125.717826][ T6317] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 125.717875][ T6317] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 125.726806][ T6317] EXT4-fs (loop2): invalid journal inode [ 125.726880][ T6317] EXT4-fs (loop2): can't get journal size [ 125.733144][ T6317] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 125.736059][ T6308] bridge1: port 3(veth5) entered blocking state [ 125.736104][ T6308] bridge1: port 3(veth5) entered disabled state [ 125.736182][ T6308] veth5: entered allmulticast mode [ 125.737388][ T6308] veth5: entered promiscuous mode [ 125.749847][ T4709] FAT-fs (loop0): error, corrupted directory (invalid entries) [ 125.749876][ T4709] FAT-fs (loop0): Filesystem has been set read-only [ 125.750093][ T4709] FAT-fs (loop0): error, corrupted directory (invalid entries) [ 125.760851][ T6319] loop4: detected capacity change from 0 to 2048 [ 125.803800][ T6319] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 125.904807][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.933798][ T6319] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 125.937595][ T6319] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 32 with error 28 [ 125.940254][ T6319] EXT4-fs (loop4): This should not happen!! Data will be lost [ 125.940254][ T6319] [ 125.940307][ T6319] EXT4-fs (loop4): Total free blocks count 0 [ 125.940324][ T6319] EXT4-fs (loop4): Free/Dirty block details [ 125.940347][ T6319] EXT4-fs (loop4): free_blocks=66060288 [ 125.940366][ T6319] EXT4-fs (loop4): dirty_blocks=32 [ 125.940381][ T6319] EXT4-fs (loop4): Block reservation details [ 125.940393][ T6319] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 126.024279][ T4710] EXT4-fs warning (device loop4): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 126.028093][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 126.179131][ T6335] netlink: 210872 bytes leftover after parsing attributes in process `syz.4.392'. [ 126.181814][ T6335] netlink: zone id is out of range [ 126.187304][ T6335] netlink: zone id is out of range [ 126.188501][ T6335] netlink: zone id is out of range [ 126.190233][ T6335] netlink: zone id is out of range [ 126.191653][ T6335] netlink: get zone limit has 8 unknown bytes [ 126.448438][ T6340] netlink: 'syz.4.394': attribute type 5 has an invalid length. [ 126.475896][ T4802] page_pool_release_retry() stalled pool shutdown: id 30, 1 inflight 60 sec [ 126.513540][ T5379] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.566593][ T5379] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.603584][ T5379] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.646152][ T5379] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.745196][ T5379] bridge_slave_1: left allmulticast mode [ 126.745231][ T5379] bridge_slave_1: left promiscuous mode [ 126.745332][ T5379] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.760958][ T5379] bridge_slave_0: left allmulticast mode [ 126.760992][ T5379] bridge_slave_0: left promiscuous mode [ 126.761079][ T5379] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.793980][ T4720] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 127.796222][ T4720] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 127.802280][ T4720] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 127.804930][ T4720] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 127.806803][ T4720] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 127.875619][ T6355] netlink: 5 bytes leftover after parsing attributes in process `syz.3.400'. [ 127.901259][ T4720] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 127.907764][ T4720] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 127.909897][ T4720] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 127.911863][ T4720] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 127.913675][ T4720] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 127.970360][ T5379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.976120][ T5379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.978693][ T5379] bond0 (unregistering): Released all slaves [ 128.083548][ T6364] loop2: detected capacity change from 0 to 512 [ 128.091622][ T6364] EXT4-fs: inline encryption not supported [ 128.091680][ T6364] EXT4-fs: Ignoring removed i_version option [ 128.100990][ T6364] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 128.101024][ T6364] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 128.106387][ T6364] EXT4-fs (loop2): orphan cleanup on readonly fs [ 128.139055][ T6364] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.401: bg 0: block 64: padding at end of block bitmap is not set [ 128.139097][ T6364] loop2: lost filesystem error report for type 5 error -117 [ 128.146448][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 128.146480][ C0] EXT4-fs (loop2): initial error at time 124: ext4_validate_block_bitmap:441 [ 128.146502][ C0] EXT4-fs (loop2): last error at time 124: ext4_validate_block_bitmap:441 [ 128.154583][ T6364] EXT4-fs (loop2): Remounting filesystem read-only [ 128.154670][ T6364] Quota error (device loop2): write_blk: dquota write failed [ 128.154739][ T6364] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 128.154811][ T6364] EXT4-fs (loop2): 1 truncate cleaned up [ 128.171997][ T6364] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 128.276542][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.450322][ T6399] loop4: detected capacity change from 0 to 512 [ 129.466803][ T6399] EXT4-fs (loop4): Test dummy encryption mode enabled [ 129.468121][ T6399] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 129.507159][ T6399] EXT4-fs error (device loop4): ext4_orphan_get:1425: comm syz.4.407: bad orphan inode 131083 [ 129.507199][ T6399] loop4: lost filesystem error report for type 5 error -117 [ 129.532578][ T6399] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 129.808792][ T4720] Bluetooth: hci0: command tx timeout [ 129.853645][ T4399] 8021q: adding VLAN 0 to HW filter on device eth4 [ 129.869075][ T6415] IPVS: set_ctl: invalid protocol: 51 0.0.0.0:20002 [ 129.886272][ T4720] Bluetooth: hci2: command tx timeout [ 129.901080][ T6419] Cannot find add_set index 0 as target [ 129.908777][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.929184][ T6419] netlink: 'syz.2.409': attribute type 25 has an invalid length. [ 129.929218][ T6419] netlink: 4 bytes leftover after parsing attributes in process `syz.2.409'. [ 129.947874][ T6419] netlink: 'syz.2.409': attribute type 25 has an invalid length. [ 129.949736][ T5377] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.949877][ T5377] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.949924][ T5377] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.949950][ T5377] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.964921][ T6419] netlink: 4 bytes leftover after parsing attributes in process `syz.2.409'. [ 130.076737][ T5379] hsr_slave_0: left promiscuous mode [ 130.082145][ T5379] hsr_slave_1: left promiscuous mode [ 130.083573][ T5379] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 130.085036][ T5379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 130.090244][ T5379] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 130.092301][ T5379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 130.272584][ T6425] comedi comedi0: bad chanlist[0]=0x00001400 chan=5120 range length=2 [ 130.284625][ T5379] veth1_macvtap: left promiscuous mode [ 130.285930][ T5379] veth0_macvtap: left promiscuous mode [ 130.292604][ T5379] veth1_vlan: left promiscuous mode [ 130.292659][ T5379] veth0_vlan: left promiscuous mode [ 130.592721][ T5379] team0 (unregistering): Port device team_slave_1 removed [ 130.613105][ T5379] team0 (unregistering): Port device team_slave_0 removed [ 130.762930][ T4399] 8021q: adding VLAN 0 to HW filter on device eth5 [ 130.771636][ T1594] ieee802154 phy0 wpan0: encryption failed: -22 [ 130.771678][ T1594] ieee802154 phy1 wpan1: encryption failed: -22 [ 131.127681][ T6457] comedi comedi0: bad chanlist[0]=0x00001b00 chan=6912 range length=2 [ 131.159504][ T6356] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.163273][ T6356] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.165011][ T6356] bridge_slave_0: entered allmulticast mode [ 131.171068][ T6356] bridge_slave_0: entered promiscuous mode [ 131.175594][ T6356] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.180638][ T6356] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.184746][ T6356] bridge_slave_1: entered allmulticast mode [ 131.193820][ T6356] bridge_slave_1: entered promiscuous mode [ 131.267417][ T6348] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.269923][ T6348] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.272154][ T6348] bridge_slave_0: entered allmulticast mode [ 131.277661][ T6348] bridge_slave_0: entered promiscuous mode [ 131.282890][ T6348] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.286482][ T6348] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.288259][ T6348] bridge_slave_1: entered allmulticast mode [ 131.293579][ T6348] bridge_slave_1: entered promiscuous mode [ 131.307542][ T6356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 131.358934][ T6348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 131.368362][ T6356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 131.391932][ T6348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 131.479893][ T6356] team0: Port device team_slave_0 added [ 131.483788][ T6356] team0: Port device team_slave_1 added [ 131.491530][ T6348] team0: Port device team_slave_0 added [ 131.533327][ T5379] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.570897][ T6348] team0: Port device team_slave_1 added [ 131.610200][ T6356] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 131.613351][ T6356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 131.619081][ T6356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 131.658166][ T5379] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.790396][ T6348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 131.799899][ T6348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 131.799938][ T6348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 131.800389][ T6356] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 131.800403][ T6356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 131.800423][ T6356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 132.660129][ T4720] Bluetooth: hci0: command tx timeout [ 132.660157][ T4720] Bluetooth: hci2: command tx timeout [ 133.723041][ T6348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.723069][ T6348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.723096][ T6348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.728107][ T5379] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.327050][ T50] Bluetooth: hci2: command tx timeout [ 135.327099][ T50] Bluetooth: hci0: command tx timeout [ 135.373405][ T6348] hsr_slave_0: entered promiscuous mode [ 135.376447][ T6348] hsr_slave_1: entered promiscuous mode [ 135.450309][ T6348] debugfs: 'hsr0' already exists in 'hsr' [ 135.453049][ T6348] Cannot create hsr debugfs directory [ 135.701873][ T5379] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.724223][ T6356] hsr_slave_0: entered promiscuous mode [ 135.726632][ T6356] hsr_slave_1: entered promiscuous mode [ 135.729166][ T6356] debugfs: 'hsr0' already exists in 'hsr' [ 135.730554][ T6356] Cannot create hsr debugfs directory [ 135.756507][ T6495] netlink: 68 bytes leftover after parsing attributes in process `syz.3.423'. [ 135.848805][ T4399] 8021q: adding VLAN 0 to HW filter on device eth6 [ 138.220636][ T4720] Bluetooth: hci0: command tx timeout [ 138.220684][ T4720] Bluetooth: hci2: command tx timeout [ 141.002128][ T5379] bridge_slave_1: left allmulticast mode [ 141.002167][ T5379] bridge_slave_1: left promiscuous mode [ 141.002280][ T5379] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.022983][ T5379] bridge_slave_0: left allmulticast mode [ 142.023015][ T5379] bridge_slave_0: left promiscuous mode [ 142.023118][ T5379] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.233732][ T5379] veth5: left allmulticast mode [ 142.233768][ T5379] veth5: left promiscuous mode [ 142.233857][ T5379] bridge1: port 3(veth5) entered disabled state [ 142.343442][ T5379] veth0_to_bond: left allmulticast mode [ 142.343672][ T5379] veth0_to_bond: left promiscuous mode [ 142.343765][ T5379] bridge1: port 2(veth0_to_bond) entered disabled state [ 142.451132][ T5379] veth3: left allmulticast mode [ 142.451170][ T5379] veth3: left promiscuous mode [ 142.451265][ T5379] bridge1: port 1(veth3) entered disabled state [ 142.766950][ T5379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 142.770117][ T5379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 142.774070][ T5379] bond0 (unregistering): Released all slaves [ 142.782903][ T5379] bond1 (unregistering): Released all slaves [ 142.814154][ T4399] 8021q: adding VLAN 0 to HW filter on device eth7 [ 142.917169][ T6553] loop4: detected capacity change from 0 to 256 [ 142.927792][ T6553] FAT-fs (loop4): Directory bread(block 1285) failed [ 142.929060][ T6553] FAT-fs (loop4): Directory bread(block 1286) failed [ 142.930572][ T6553] FAT-fs (loop4): Directory bread(block 1287) failed [ 142.932106][ T6553] FAT-fs (loop4): Directory bread(block 1288) failed [ 143.505514][ T5379] hsr_slave_0: left promiscuous mode [ 143.507009][ T5379] hsr_slave_1: left promiscuous mode [ 143.509267][ T5379] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.512028][ T5379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.514848][ T5379] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 143.516401][ T5379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 143.536189][ T5379] veth1_macvtap: left promiscuous mode [ 143.537428][ T5379] veth0_macvtap: left promiscuous mode [ 143.538912][ T5379] veth1_vlan: left promiscuous mode [ 143.542526][ T5379] veth0_vlan: left promiscuous mode [ 143.592227][ T6560] loop2: detected capacity change from 0 to 512 [ 143.598786][ T6560] EXT4-fs (loop2): Test dummy encryption mode enabled [ 143.606743][ T6560] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.434: corrupted in-inode xattr: invalid ea_ino [ 143.606774][ T6560] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 143.609618][ T6560] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.434: couldn't read orphan inode 15 (err -117) [ 143.609654][ T6560] loop2: lost filesystem error report for type 5 error -117 [ 143.614677][ T6560] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 143.774558][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.015713][ T5379] team0 (unregistering): Port device team_slave_1 removed [ 145.031317][ T5379] team0 (unregistering): Port device team_slave_0 removed [ 147.372750][ T6569] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.392212][ T6569] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.402221][ T6575] netlink: 296 bytes leftover after parsing attributes in process `syz.4.439'. [ 147.403889][ T6575] netlink: 40 bytes leftover after parsing attributes in process `syz.4.439'. [ 147.599051][ T6356] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 147.697733][ T6356] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 147.699655][ T6356] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 147.708294][ T6356] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 147.712437][ T6356] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 147.725696][ T6356] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 148.625673][ T6356] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 148.633596][ T6356] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 149.711289][ T6348] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 149.713763][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 149.715722][ T6348] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 149.723492][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 149.732493][ T6348] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 149.743066][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 149.744997][ T6348] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 149.751132][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 149.802894][ T6608] loop3: detected capacity change from 0 to 4096 [ 149.850877][ T6608] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 149.957014][ T6608] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.442: corrupted inode contents [ 149.967488][ T6608] EXT4-fs error (device loop3): ext4_dirty_inode:6639: inode #15: comm syz.3.442: mark_inode_dirty error [ 149.970909][ T6608] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.442: corrupted inode contents [ 149.976176][ T6608] EXT4-fs error (device loop3): __ext4_ext_dirty:207: inode #15: comm syz.3.442: mark_inode_dirty error [ 149.978959][ T6608] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.442: corrupted inode contents [ 149.982058][ T6608] EXT4-fs error (device loop3): __ext4_ext_dirty:207: inode #15: comm syz.3.442: mark_inode_dirty error [ 149.984663][ T6608] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.442: corrupted inode contents [ 149.988340][ T6608] EXT4-fs error (device loop3): ext4_truncate:4691: inode #15: comm syz.3.442: mark_inode_dirty error [ 149.991672][ T6608] EXT4-fs error (device loop3) in ext4_setattr:6172: Corrupt filesystem [ 150.010626][ T6622] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.442: corrupted inode contents [ 150.014393][ T6356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.039496][ T6620] loop4: detected capacity change from 0 to 512 [ 150.047787][ T6356] 8021q: adding VLAN 0 to HW filter on device team0 [ 150.058446][ T6620] EXT4-fs (loop4): Test dummy encryption mode enabled [ 150.058472][ T6620] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 150.067005][ T6620] EXT4-fs error (device loop4): ext4_orphan_get:1425: comm syz.4.443: bad orphan inode 131083 [ 150.069041][ T6620] loop4: lost filesystem error report for type 5 error -117 [ 150.069826][ T6620] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 150.089064][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.089106][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.089691][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.089720][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.137377][ T6348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.171658][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 150.191702][ T6356] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 150.215818][ T6356] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 150.219189][ T6348] 8021q: adding VLAN 0 to HW filter on device team0 [ 150.264112][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 150.296126][ T5378] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.296175][ T5378] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.299667][ T5378] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.299719][ T5378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.325415][ T6348] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 150.338420][ T6630] Invalid logical block size (1073741824) [ 150.345212][ T6348] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 154.896309][ T6677] netlink: 32 bytes leftover after parsing attributes in process `syz.3.452'. [ 155.930656][ T6356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 157.146429][ T6348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 157.598799][ T6698] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.439848][ T6356] veth0_vlan: entered promiscuous mode [ 158.441722][ T6356] veth1_vlan: entered promiscuous mode [ 158.484443][ T6356] veth0_macvtap: entered promiscuous mode [ 158.528020][ T6356] veth1_macvtap: entered promiscuous mode [ 158.542332][ T6713] loop3: detected capacity change from 0 to 4096 [ 158.561810][ T6348] veth0_vlan: entered promiscuous mode [ 158.566693][ T6713] EXT4-fs (loop3): Test dummy encryption mode enabled [ 158.583257][ T6356] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 158.588268][ T6713] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 158.619780][ T6348] veth1_vlan: entered promiscuous mode [ 158.631186][ T6356] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 158.643784][ T6348] veth0_macvtap: entered promiscuous mode [ 158.684096][ T6348] veth1_macvtap: entered promiscuous mode [ 158.741137][ T6348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 158.745353][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.778975][ T5377] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.779020][ T5377] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.779052][ T5377] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.790431][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.797287][ T6348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 158.842500][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.844676][ T5377] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.846276][ T5377] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.848015][ T5377] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.939759][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 158.941273][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.044631][ T4720] Bluetooth: hci1: command 0x0406 tx timeout [ 162.067258][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.067286][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.260767][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 162.260798][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 162.356012][ T6735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.370705][ T6735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.516272][ T6740] loop5: detected capacity change from 0 to 512 [ 165.475898][ T5377] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.475938][ T5377] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.663563][ T6748] loop3: detected capacity change from 0 to 256 [ 165.665289][ T6748] vfat: Bad value for 'gid' [ 165.673526][ T6748] vfat: Bad value for 'gid' [ 166.100564][ T6758] netlink: 44 bytes leftover after parsing attributes in process `syz.2.467'. [ 166.101205][ T6758] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.101417][ T6758] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.104111][ T6758] netlink: 44 bytes leftover after parsing attributes in process `syz.2.467'. [ 166.471730][ T6773] capability: warning: `syz.5.473' uses 32-bit capabilities (legacy support in use) [ 166.548763][ T6779] binder: 6777:6779 tried to acquire reference to desc 0, got 1 instead [ 166.549053][ T6779] binder: 6777:6779 unknown command 0 [ 166.549076][ T6779] binder: 6777:6779 ioctl c0306201 20000180 returned -22 [ 166.747633][ T6786] loop3: detected capacity change from 0 to 4096 [ 166.768615][ T6786] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 166.878013][ T6786] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.478: corrupted inode contents [ 166.883780][ T6786] EXT4-fs error (device loop3): ext4_dirty_inode:6639: inode #15: comm syz.3.478: mark_inode_dirty error [ 166.886093][ T6786] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.478: corrupted inode contents [ 166.892625][ T6786] EXT4-fs error (device loop3): __ext4_ext_dirty:207: inode #15: comm syz.3.478: mark_inode_dirty error [ 166.897186][ T6786] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.478: corrupted inode contents [ 166.906441][ T6786] EXT4-fs error (device loop3): __ext4_ext_dirty:207: inode #15: comm syz.3.478: mark_inode_dirty error [ 166.908734][ T6786] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #15: comm syz.3.478: corrupted inode contents [ 166.913750][ T6786] EXT4-fs error (device loop3): ext4_truncate:4691: inode #15: comm syz.3.478: mark_inode_dirty error [ 166.917204][ T6786] EXT4-fs error (device loop3) in ext4_setattr:6172: Corrupt filesystem [ 167.011161][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.022907][ T6806] netlink: 36 bytes leftover after parsing attributes in process `syz.4.486'. [ 167.111621][ T6809] loop5: detected capacity change from 0 to 4096 [ 167.124338][ T6809] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.132329][ T6809] EXT4-fs error (device loop5): ext4_do_update_inode:5742: inode #15: comm syz.5.483: corrupted inode contents [ 167.134698][ T6809] EXT4-fs error (device loop5): ext4_dirty_inode:6639: inode #15: comm syz.5.483: mark_inode_dirty error [ 167.137130][ T6809] EXT4-fs error (device loop5): ext4_do_update_inode:5742: inode #15: comm syz.5.483: corrupted inode contents [ 167.140086][ T6809] EXT4-fs error (device loop5): __ext4_ext_dirty:207: inode #15: comm syz.5.483: mark_inode_dirty error [ 167.142447][ T6809] EXT4-fs error (device loop5): ext4_do_update_inode:5742: inode #15: comm syz.5.483: corrupted inode contents [ 167.144993][ T6809] EXT4-fs error (device loop5): __ext4_ext_dirty:207: inode #15: comm syz.5.483: mark_inode_dirty error [ 167.147279][ T6809] EXT4-fs error (device loop5): ext4_do_update_inode:5742: inode #15: comm syz.5.483: corrupted inode contents [ 167.151355][ T6809] EXT4-fs error (device loop5): ext4_truncate:4691: inode #15: comm syz.5.483: mark_inode_dirty error [ 167.154103][ T6809] EXT4-fs error (device loop5) in ext4_setattr:6172: Corrupt filesystem [ 167.300202][ T6809] EXT4-fs error (device loop5): ext4_do_update_inode:5742: inode #15: comm syz.5.483: corrupted inode contents [ 167.361185][ T6809] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.479125][ T6822] Invalid logical block size (1073741824) [ 168.397900][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 168.852744][ T6841] loop2: detected capacity change from 0 to 1024 [ 168.854585][ T6841] EXT4-fs: Ignoring removed nomblk_io_submit option [ 168.872449][ T6841] EXT4-fs (loop2): mounted filesystem 00fc0c00-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 168.985499][ T4719] EXT4-fs (loop2): unmounting filesystem 00fc0c00-0000-0006-0000-000000000000. [ 169.642857][ T6868] loop6: detected capacity change from 0 to 1024 [ 169.658631][ T6868] EXT4-fs (loop6): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 169.658668][ T6868] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (65400!=20869) [ 169.658730][ T6868] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 169.658747][ T6868] EXT4-fs (loop6): filesystem has both journal inode and journal device! [ 169.824131][ T6871] loop6: detected capacity change from 0 to 4096 [ 169.859402][ T6871] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 169.901095][ T6871] EXT4-fs error (device loop6): ext4_do_update_inode:5742: inode #15: comm syz.6.503: corrupted inode contents [ 169.902017][ T6871] EXT4-fs error (device loop6): ext4_dirty_inode:6639: inode #15: comm syz.6.503: mark_inode_dirty error [ 169.902431][ T6871] EXT4-fs error (device loop6): ext4_do_update_inode:5742: inode #15: comm syz.6.503: corrupted inode contents [ 169.904995][ T6871] EXT4-fs error (device loop6): __ext4_ext_dirty:207: inode #15: comm syz.6.503: mark_inode_dirty error [ 169.913572][ T6871] EXT4-fs error (device loop6): ext4_do_update_inode:5742: inode #15: comm syz.6.503: corrupted inode contents [ 169.916644][ T6871] EXT4-fs error (device loop6): __ext4_ext_dirty:207: inode #15: comm syz.6.503: mark_inode_dirty error [ 169.926002][ T6871] EXT4-fs error (device loop6): ext4_do_update_inode:5742: inode #15: comm syz.6.503: corrupted inode contents [ 169.928260][ T6871] EXT4-fs error (device loop6): ext4_truncate:4691: inode #15: comm syz.6.503: mark_inode_dirty error [ 169.936901][ T6871] EXT4-fs error (device loop6) in ext4_setattr:6172: Corrupt filesystem [ 169.987190][ T6874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.023706][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.099845][ T6879] netlink: 8 bytes leftover after parsing attributes in process `syz.4.505'. [ 170.101674][ T6879] netlink: 4 bytes leftover after parsing attributes in process `syz.4.505'. [ 170.114629][ T6879] netlink: 'syz.4.505': attribute type 6 has an invalid length. [ 170.143710][ T6880] loop6: detected capacity change from 0 to 512 [ 170.160205][ T6880] EXT4-fs (loop6): Test dummy encryption mode enabled [ 170.161638][ T6880] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 170.170493][ T6880] EXT4-fs error (device loop6): ext4_orphan_get:1425: comm syz.6.504: bad orphan inode 131083 [ 170.170526][ T6880] loop6: lost filesystem error report for type 5 error -117 [ 170.173132][ T6880] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.355035][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.183603][ T6908] loop4: detected capacity change from 0 to 4096 [ 171.200292][ T6908] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 171.210870][ T6908] EXT4-fs error (device loop4): ext4_do_update_inode:5742: inode #15: comm syz.4.515: corrupted inode contents [ 171.213427][ T6908] EXT4-fs error (device loop4): ext4_dirty_inode:6639: inode #15: comm syz.4.515: mark_inode_dirty error [ 171.216244][ T6908] EXT4-fs error (device loop4): ext4_do_update_inode:5742: inode #15: comm syz.4.515: corrupted inode contents [ 171.219187][ T6908] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.515: mark_inode_dirty error [ 171.222726][ T6908] EXT4-fs error (device loop4): ext4_do_update_inode:5742: inode #15: comm syz.4.515: corrupted inode contents [ 171.226236][ T6908] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.515: mark_inode_dirty error [ 171.229120][ T6908] EXT4-fs error (device loop4): ext4_do_update_inode:5742: inode #15: comm syz.4.515: corrupted inode contents [ 171.232593][ T6908] EXT4-fs error (device loop4): ext4_truncate:4691: inode #15: comm syz.4.515: mark_inode_dirty error [ 171.235913][ T6908] EXT4-fs error (device loop4) in ext4_setattr:6172: Corrupt filesystem [ 171.237666][ T6914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.517'. [ 171.300100][ T6908] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.350280][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.476895][ T6928] SET target dimension over the limit! [ 171.611897][ T6937] loop3: detected capacity change from 0 to 2048 [ 171.642461][ T6937] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 171.683459][ T6937] 9p: Bad value for 'rfdno' [ 171.766522][ T6937] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.788924][ T6947] loop6: detected capacity change from 0 to 512 [ 171.793107][ T6948] netlink: 'syz.5.530': attribute type 7 has an invalid length. [ 171.793136][ T6948] netlink: 'syz.5.530': attribute type 5 has an invalid length. [ 171.815323][ T6947] EXT4-fs: Ignoring removed nomblk_io_submit option [ 171.834541][ T6947] EXT4-fs (loop6): can't mount with both data=journal and dax [ 171.975502][ T6954] netlink: 8 bytes leftover after parsing attributes in process `syz.5.534'. [ 171.977212][ T6954] netlink: 8 bytes leftover after parsing attributes in process `syz.5.534'. [ 173.380087][ T6989] netlink: 8 bytes leftover after parsing attributes in process `syz.5.542'. [ 173.381980][ T6989] netlink: 8 bytes leftover after parsing attributes in process `syz.5.542'. [ 173.455797][ T6995] loop6: detected capacity change from 0 to 512 [ 173.480904][ T6998] netlink: 4 bytes leftover after parsing attributes in process `syz.3.543'. [ 173.485089][ T6995] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 173.542057][ T7004] netlink: 16 bytes leftover after parsing attributes in process `syz.3.543'. [ 173.544923][ T7004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.543'. [ 173.569545][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 174.027775][ T7017] netlink: 16 bytes leftover after parsing attributes in process `syz.4.549'. [ 174.031647][ T7017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.549'. [ 175.329999][ T7027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.472892][ T7035] netlink: 16 bytes leftover after parsing attributes in process `syz.3.555'. [ 175.848147][ T7054] loop5: detected capacity change from 0 to 512 [ 175.853760][ T7054] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 175.853784][ T7054] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 175.853816][ T7054] System zones: 0-1, 15-15, 18-18, 34-34 [ 175.853958][ T7054] EXT4-fs (loop5): orphan cleanup on readonly fs [ 175.853994][ T7054] Quota error (device loop5): v2_read_header: Failed header read: expected=8 got=0 [ 175.854031][ T7054] EXT4-fs warning (device loop5): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 175.854047][ T7054] EXT4-fs (loop5): Cannot turn on quotas: error -22 [ 175.870863][ T7054] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.560: bg 0: block 40: padding at end of block bitmap is not set [ 175.870924][ T7054] loop5: lost filesystem error report for type 5 error -117 [ 175.874256][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 175.874279][ C0] EXT4-fs (loop5): initial error at time 170: ext4_validate_block_bitmap:441 [ 175.874305][ C0] EXT4-fs (loop5): last error at time 170: ext4_validate_block_bitmap:441 [ 175.884064][ T7054] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 175.884096][ T7054] loop5: lost filesystem error report for type 5 error -117 [ 175.886126][ T7054] EXT4-fs (loop5): 1 truncate cleaned up [ 175.886616][ T7054] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 175.894497][ T7054] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 175.989159][ T7059] loop2: detected capacity change from 0 to 256 [ 175.999618][ T7059] FAT-fs (loop2): Directory bread(block 1285) failed [ 175.999654][ T7059] FAT-fs (loop2): Directory bread(block 1286) failed [ 175.999680][ T7059] FAT-fs (loop2): Directory bread(block 1287) failed [ 175.999759][ T7059] FAT-fs (loop2): Directory bread(block 1288) failed [ 177.549710][ T7077] binder: Bad value for 'stats' [ 178.272506][ T7100] bond1: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 178.282843][ T7100] bond1 (unregistering): Released all slaves [ 178.368529][ T7108] loop4: detected capacity change from 0 to 256 [ 178.386927][ T7108] FAT-fs (loop4): Directory bread(block 1285) failed [ 178.386962][ T7108] FAT-fs (loop4): Directory bread(block 1286) failed [ 178.386986][ T7108] FAT-fs (loop4): Directory bread(block 1287) failed [ 178.387041][ T7108] FAT-fs (loop4): Directory bread(block 1288) failed [ 178.523895][ T7110] loop2: detected capacity change from 0 to 256 [ 178.531779][ T7110] FAT-fs (loop2): Directory bread(block 1285) failed [ 178.531817][ T7110] FAT-fs (loop2): Directory bread(block 1286) failed [ 178.531842][ T7110] FAT-fs (loop2): Directory bread(block 1287) failed [ 178.531885][ T7110] FAT-fs (loop2): Directory bread(block 1288) failed [ 179.192920][ T7122] FAULT_INJECTION: forcing a failure. [ 179.192920][ T7122] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 179.195655][ T7122] CPU: 0 UID: 0 PID: 7122 Comm: syz.3.584 Tainted: G L syzkaller #0 PREEMPT [ 179.195685][ T7122] Tainted: [L]=SOFTLOCKUP [ 179.195689][ T7122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 179.195694][ T7122] Call trace: [ 179.195698][ T7122] show_stack+0x2c/0x3c (C) [ 179.195722][ T7122] __dump_stack+0x30/0x40 [ 179.195734][ T7122] dump_stack_lvl+0xd8/0x12c [ 179.195744][ T7122] dump_stack+0x1c/0x28 [ 179.195754][ T7122] should_fail_ex+0x41c/0x590 [ 179.195762][ T7122] should_fail+0x14/0x24 [ 179.195769][ T7122] should_fail_usercopy+0x20/0x30 [ 179.195776][ T7122] _inline_copy_from_user+0x3c/0x174 [ 179.195787][ T7122] copy_msghdr_from_user+0xb8/0x194 [ 179.195797][ T7122] ___sys_sendmsg+0x14c/0x224 [ 179.195809][ T7122] __sys_sendmsg+0x158/0x204 [ 179.195819][ T7122] __arm64_sys_sendmsg+0x88/0x9c [ 179.195834][ T7122] invoke_syscall+0x98/0x244 [ 179.195845][ T7122] el0_svc_common+0xec/0x23c [ 179.195855][ T7122] do_el0_svc+0x4c/0x5c [ 179.195865][ T7122] el0_svc+0x64/0x260 [ 179.195874][ T7122] el0t_64_sync_handler+0x44/0x104 [ 179.195883][ T7122] el0t_64_sync+0x198/0x19c [ 180.119585][ T7152] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 181.292576][ T7170] loop5: detected capacity change from 0 to 1024 [ 181.306295][ T7170] EXT4-fs: Ignoring removed bh option [ 181.307578][ T7170] EXT4-fs: Ignoring removed nomblk_io_submit option [ 181.309703][ T7170] EXT4-fs: Mount option(s) incompatible with ext3 [ 182.290085][ T7176] loop5: detected capacity change from 0 to 512 [ 182.326466][ T7176] Quota error (device loop5): v2_read_file_info: Can't read info structure [ 182.326532][ T7176] EXT4-fs warning (device loop5): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-5, ino=4). Please run e2fsck to fix. [ 182.332138][ T7176] EXT4-fs (loop5): mount failed [ 182.562298][ T7191] loop5: detected capacity change from 0 to 256 [ 182.574010][ T7191] FAT-fs (loop5): Directory bread(block 1285) failed [ 182.574047][ T7191] FAT-fs (loop5): Directory bread(block 1286) failed [ 182.574074][ T7191] FAT-fs (loop5): Directory bread(block 1287) failed [ 182.574121][ T7191] FAT-fs (loop5): Directory bread(block 1288) failed [ 182.710311][ T7197] __nla_validate_parse: 1 callbacks suppressed [ 182.712437][ T7197] netlink: 8 bytes leftover after parsing attributes in process `syz.2.603'. [ 182.935449][ T4724] Bluetooth: hci4: command 0x0406 tx timeout [ 183.025238][ T7206] Cannot find del_set index 0 as target [ 183.047667][ T7209] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.047726][ T7209] bridge0: port 2(bridge_slave_1) entered listening state [ 183.047823][ T7209] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.047871][ T7209] bridge0: port 1(bridge_slave_0) entered listening state [ 183.062332][ T7212] loop3: detected capacity change from 0 to 256 [ 183.107445][ T7209] veth0_vlan: left promiscuous mode [ 183.108095][ T7209] veth0_vlan: entered promiscuous mode [ 183.151839][ T7215] loop6: detected capacity change from 0 to 512 [ 183.168929][ T7215] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 183.207302][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.330265][ T7221] loop3: detected capacity change from 0 to 4096 [ 183.330616][ T7221] EXT4-fs: inline encryption not supported [ 183.335767][ T7221] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 183.338867][ T7221] EXT4-fs (loop3): Test dummy encryption mode enabled [ 183.346479][ T7221] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 183.346533][ T7221] System zones: 0-5 [ 183.352114][ T7221] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 183.401374][ T7228] loop6: detected capacity change from 0 to 128 [ 183.412191][ T7228] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 183.449673][ T4802] page_pool_release_retry() stalled pool shutdown: id 41, 1 inflight 60 sec [ 183.579122][ T6348] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 183.666369][ T7243] batman_adv: batadv0: Adding interface: dummy0 [ 183.666403][ T7243] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 183.666430][ T7243] batman_adv: batadv0: Interface activated: dummy0 [ 183.702417][ T7243] batadv0: mtu less than device minimum [ 183.708353][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.710124][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.711741][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.713367][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.714981][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.716634][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.718262][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.719876][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 183.721488][ T7243] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 184.256360][ T7258] loop5: detected capacity change from 0 to 8 [ 184.298989][ T7261] loop6: detected capacity change from 0 to 512 [ 184.311959][ T7261] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 184.312357][ C0] EXT4-fs (loop6): error count since last fsck: 1 [ 184.312374][ C0] EXT4-fs (loop6): initial error at time 179: ext4_mb_generate_buddy:1317 [ 184.312400][ C0] EXT4-fs (loop6): last error at time 179: ext4_mb_generate_buddy:1317 [ 184.323484][ T7261] EXT4-fs (loop6): Remounting filesystem read-only [ 184.323749][ T7261] EXT4-fs (loop6): 1 truncate cleaned up [ 184.324251][ T7261] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 184.346907][ T7235] evm: overlay not supported [ 184.372408][ T30] audit: type=1400 audit(179.116:3): lsm=SMACK fn=smack_file_lock action=denied subject="_" object="lowerdi" requested=l pid=7220 comm="syz.3.611" path="/140/file0/file0/file1" dev="overlay" ino=13 [ 184.441308][ T7265] tipc: Started in network mode [ 184.443864][ T7265] tipc: Node identity ce21a08c8b5, cluster identity 4711 [ 184.445612][ T7265] tipc: Enabled bearer , priority 0 [ 184.451934][ T7265] syzkaller0: entered promiscuous mode [ 184.455881][ T7265] syzkaller0: entered allmulticast mode [ 184.607950][ T7269] netlink: 20 bytes leftover after parsing attributes in process `syz.2.628'. [ 184.629210][ T7273] netlink: 'syz.5.629': attribute type 5 has an invalid length. [ 185.779545][ T4724] Bluetooth: hci4: command 0x0406 tx timeout [ 185.783506][ T7260] tipc: Resetting bearer [ 185.825641][ T7260] tipc: Disabling bearer [ 186.908781][ T1038] tipc: Node number set to 1165074572 [ 187.953012][ T4724] Bluetooth: hci4: command 0x0406 tx timeout [ 187.963475][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 188.177106][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 188.191155][ T7289] netlink: 8 bytes leftover after parsing attributes in process `syz.5.633'. [ 188.192711][ T7289] netlink: 8 bytes leftover after parsing attributes in process `syz.5.633'. [ 188.205817][ T7290] loop2: detected capacity change from 0 to 256 [ 188.290088][ T7290] FAT-fs (loop2): Directory bread(block 1285) failed [ 188.291530][ T7290] FAT-fs (loop2): Directory bread(block 1286) failed [ 188.293096][ T7290] FAT-fs (loop2): Directory bread(block 1287) failed [ 188.294542][ T7290] FAT-fs (loop2): Directory bread(block 1288) failed [ 188.585453][ T7296] bridge_slave_0: default FDB implementation only supports local addresses [ 188.917606][ T7321] netlink: 'syz.6.643': attribute type 7 has an invalid length. [ 188.919258][ T7321] netlink: 'syz.6.643': attribute type 5 has an invalid length. [ 188.921046][ T7321] netlink: 17 bytes leftover after parsing attributes in process `syz.6.643'. [ 189.026126][ T7328] SET target dimension over the limit! [ 189.108182][ T7334] loop5: detected capacity change from 0 to 4096 [ 189.231487][ T7334] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 189.250193][ T7348] loop6: detected capacity change from 0 to 512 [ 189.273139][ T7348] EXT4-fs: Ignoring removed nomblk_io_submit option [ 189.279799][ T7348] EXT4-fs (loop6): can't mount with both data=journal and dax [ 189.342425][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.653011][ T7361] GUP no longer grows the stack in syz.5.652 (7361): 20005000-20008000 (20004000) [ 189.653046][ T7361] CPU: 0 UID: 0 PID: 7361 Comm: syz.5.652 Tainted: G L syzkaller #0 PREEMPT [ 189.653062][ T7361] Tainted: [L]=SOFTLOCKUP [ 189.653066][ T7361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 189.653071][ T7361] Call trace: [ 189.653074][ T7361] show_stack+0x2c/0x3c (C) [ 189.653096][ T7361] __dump_stack+0x30/0x40 [ 189.653109][ T7361] dump_stack_lvl+0xd8/0x12c [ 189.653121][ T7361] dump_stack+0x1c/0x28 [ 189.653132][ T7361] gup_vma_lookup+0x1ac/0x1cc [ 189.653143][ T7361] fixup_user_fault+0xac/0x4d4 [ 189.653154][ T7361] fault_in_user_writeable+0x6c/0xd4 [ 189.653164][ T7361] futex_lock_pi+0x548/0x6e0 [ 189.653174][ T7361] do_futex+0x2f8/0x378 [ 189.653184][ T7361] __arm64_sys_futex+0x2e4/0x418 [ 189.653194][ T7361] invoke_syscall+0x98/0x244 [ 189.653206][ T7361] el0_svc_common+0xec/0x23c [ 189.653218][ T7361] do_el0_svc+0x4c/0x5c [ 189.653229][ T7361] el0_svc+0x64/0x260 [ 189.653240][ T7361] el0t_64_sync_handler+0x44/0x104 [ 189.653250][ T7361] el0t_64_sync+0x198/0x19c [ 189.719166][ T7361] random: crng reseeded on system resumption [ 189.830951][ T7368] loop3: detected capacity change from 0 to 512 [ 190.144979][ T7378] netlink: 209592 bytes leftover after parsing attributes in process `syz.3.659'. [ 190.717264][ T7403] binder: 7402:7403 tried to acquire reference to desc 0, got 1 instead [ 190.721405][ T7403] binder: 7402:7403 unknown command 0 [ 190.722714][ T7403] binder: 7402:7403 ioctl c0306201 20000180 returned -22 [ 191.383165][ T7419] xt_hashlimit: size too large, truncated to 1048576 [ 191.569954][ T7424] netlink: 20 bytes leftover after parsing attributes in process `syz.2.670'. [ 193.969759][ T7443] loop3: detected capacity change from 0 to 512 [ 193.980403][ T7443] EXT4-fs (loop3): Test dummy encryption mode enabled [ 193.982102][ T7443] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 194.752550][ T7443] EXT4-fs error (device loop3): ext4_orphan_get:1425: comm syz.3.676: bad orphan inode 131083 [ 194.752593][ T7443] loop3: lost filesystem error report for type 5 error -117 [ 194.754801][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 194.754816][ C0] EXT4-fs (loop3): initial error at time 188: ext4_orphan_get:1425 [ 194.754835][ C0] EXT4-fs (loop3): last error at time 188: ext4_orphan_get:1425 [ 194.761951][ T7443] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 194.879533][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.013789][ T7454] loop6: detected capacity change from 0 to 512 [ 195.791241][ T7454] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 195.791269][ T7454] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 195.791305][ T7454] System zones: 0-1, 15-15, 18-18, 34-34 [ 195.791444][ T7454] EXT4-fs (loop6): orphan cleanup on readonly fs [ 195.791483][ T7454] EXT4-fs error (device loop6): ext4_ext_check_inode:521: inode #4: comm syz.6.680: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 195.791505][ T7454] loop6: lost file I/O error report for ino 4 type 5 pos 0x0 len 0x0 error -117 [ 195.794657][ C0] EXT4-fs (loop6): error count since last fsck: 1 [ 195.794672][ C0] EXT4-fs (loop6): initial error at time 189: ext4_ext_check_inode:521: inode 4 [ 195.794689][ C0] EXT4-fs (loop6): last error at time 189: ext4_ext_check_inode:521: inode 4 [ 195.808013][ T7454] EXT4-fs error (device loop6): ext4_quota_enable:7235: comm syz.6.680: Bad quota inode: 4, type: 1 [ 195.808045][ T7454] loop6: lost filesystem error report for type 5 error -117 [ 195.810183][ T7454] EXT4-fs warning (device loop6): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 195.810219][ T7454] EXT4-fs (loop6): Cannot turn on quotas: error -117 [ 195.810693][ T7454] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 195.811525][ T7454] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.851371][ T7456] loop5: detected capacity change from 0 to 4096 [ 195.865676][ T7456] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 195.934570][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.961916][ T7465] loop2: detected capacity change from 0 to 1024 [ 195.990053][ T7465] EXT4-fs: Ignoring removed oldalloc option [ 195.990092][ T7465] EXT4-fs: Ignoring removed orlov option [ 196.001608][ T7465] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 196.097297][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 196.531627][ T1594] ieee802154 phy0 wpan0: encryption failed: -22 [ 196.531674][ T1594] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.637799][ T7488] loop5: detected capacity change from 0 to 256 [ 196.641032][ T7489] loop6: detected capacity change from 0 to 256 [ 196.653912][ T7489] binder: Bad value for 'max' [ 197.166407][ T7496] xt_hashlimit: size too large, truncated to 1048576 [ 197.466671][ T10] IPVS: starting estimator thread 0... [ 197.564601][ T7508] IPVS: using max 65 ests per chain, 156000 per kthread [ 197.705701][ T7516] netlink: 'syz.5.698': attribute type 3 has an invalid length. [ 197.705730][ T7516] netlink: 200 bytes leftover after parsing attributes in process `syz.5.698'. [ 197.732118][ T7513] loop6: detected capacity change from 0 to 4096 [ 197.942375][ T7513] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 197.979035][ T7524] netlink: 'syz.4.701': attribute type 1 has an invalid length. [ 198.008889][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.021884][ T7524] 8021q: adding VLAN 0 to HW filter on device bond1 [ 198.096039][ T7524] vlan3: entered allmulticast mode [ 198.099359][ T7524] bond1: entered allmulticast mode [ 198.145204][ T7524] bond1: (slave geneve2): making interface the new active one [ 198.146883][ T7524] geneve2: entered allmulticast mode [ 198.165853][ T7524] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 198.773160][ T7543] loop2: detected capacity change from 0 to 4096 [ 198.776767][ T7543] EXT4-fs (loop2): Test dummy encryption mode enabled [ 198.792396][ T7543] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.806768][ T7543] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 199.265527][ T7557] loop3: detected capacity change from 0 to 4096 [ 199.295642][ T7557] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 199.304365][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 199.304779][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 199.416088][ T7565] netlink: 'syz.6.714': attribute type 16 has an invalid length. [ 199.419819][ T7565] netlink: 'syz.6.714': attribute type 17 has an invalid length. [ 199.436804][ T7564] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.439120][ T7564] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.644668][ T7565] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.644719][ T7565] bridge0: port 1(bridge_slave_0) entered forwarding state [ 199.651097][ T7565] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.651143][ T7565] bridge0: port 2(bridge_slave_1) entered forwarding state [ 199.820988][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.989315][ T7571] net_ratelimit: 10 callbacks suppressed [ 199.990733][ T7571] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 200.047320][ T7570] loop5: detected capacity change from 0 to 4096 [ 200.057837][ T7570] EXT4-fs (loop5): Test dummy encryption mode enabled [ 200.064466][ T7570] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.100900][ T7576] loop3: detected capacity change from 0 to 512 [ 200.131747][ T7572] overlayfs: failed to resolve './file0': -2 [ 200.145305][ T7576] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.167218][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.189527][ T7576] EXT4-fs error (device loop3): ext4_validate_block_bitmap:423: comm syz.3.718: bg 0: bad block bitmap checksum [ 200.266104][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.352475][ T7586] loop6: detected capacity change from 0 to 512 [ 200.368174][ T7586] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 200.381041][ T7586] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a842c01c, mo2=0002] [ 200.381097][ T7586] System zones: 0-2, 18-18, 34-34 [ 200.384012][ T7586] EXT4-fs error (device loop6): ext4_orphan_get:1425: comm syz.6.721: bad orphan inode 15 [ 200.384044][ T7586] loop6: lost filesystem error report for type 5 error -117 [ 200.386814][ C0] EXT4-fs (loop6): error count since last fsck: 1 [ 200.386854][ C0] EXT4-fs (loop6): initial error at time 193: ext4_orphan_get:1425 [ 200.386877][ C0] EXT4-fs (loop6): last error at time 193: ext4_orphan_get:1425 [ 200.393516][ T7586] ext4_test_bit(bit=14, block=18) = 1 [ 200.393547][ T7586] is_bad_inode(inode)=0 [ 200.393570][ T7586] NEXT_ORPHAN(inode)=2264924160 [ 200.393583][ T7586] max_ino=32 [ 200.393595][ T7586] i_nlink=0 [ 200.399684][ T7586] EXT4-fs error (device loop6): ext4_xattr_delete_inode:2972: inode #15: comm syz.6.721: corrupted xattr block 19: e_value out of bounds [ 200.402585][ T7586] loop6: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 200.408776][ T7586] EXT4-fs warning (device loop6): ext4_evict_inode:287: xattr delete (err -117) [ 200.409537][ T7586] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 200.460339][ T7586] EXT4-fs error (device loop6): ext4_search_dir:1474: inode #2: block 3: comm syz.6.721: bad entry in directory: directory entry overrun - offset=44, inode=262156, rec_len=4096, size=4096 fake=0 [ 204.203281][ T7602] loop3: detected capacity change from 0 to 4096 [ 204.783730][ T7602] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 204.813712][ T6348] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.896205][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.393483][ T7612] FAULT_INJECTION: forcing a failure. [ 207.393483][ T7612] name failslab, interval 1, probability 0, space 0, times 1 [ 207.399286][ T7612] CPU: 0 UID: 0 PID: 7612 Comm: syz.5.728 Tainted: G L syzkaller #0 PREEMPT [ 207.399315][ T7612] Tainted: [L]=SOFTLOCKUP [ 207.399319][ T7612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 207.399324][ T7612] Call trace: [ 207.399328][ T7612] show_stack+0x2c/0x3c (C) [ 207.399353][ T7612] __dump_stack+0x30/0x40 [ 207.399364][ T7612] dump_stack_lvl+0xd8/0x12c [ 207.399375][ T7612] dump_stack+0x1c/0x28 [ 207.399384][ T7612] should_fail_ex+0x41c/0x590 [ 207.399392][ T7612] should_failslab+0xc4/0x120 [ 207.399401][ T7612] __kmalloc_cache_noprof+0x94/0x5ec [ 207.399410][ T7612] nf_tables_newtable+0x460/0x10f4 [ 207.399419][ T7612] nfnetlink_rcv+0xc8c/0x16ec [ 207.399427][ T7612] netlink_unicast+0x600/0x7f8 [ 207.399435][ T7612] netlink_sendmsg+0x648/0x948 [ 207.399444][ T7612] __sock_sendmsg+0xc8/0x17c [ 207.399454][ T7612] ____sys_sendmsg+0x3d0/0x6c8 [ 207.399463][ T7612] ___sys_sendmsg+0x198/0x224 [ 207.399472][ T7612] __sys_sendmsg+0x158/0x204 [ 207.399481][ T7612] __arm64_sys_sendmsg+0x88/0x9c [ 207.399490][ T7612] invoke_syscall+0x98/0x244 [ 207.399500][ T7612] el0_svc_common+0xec/0x23c [ 207.399510][ T7612] do_el0_svc+0x4c/0x5c [ 207.399519][ T7612] el0_svc+0x64/0x260 [ 207.399528][ T7612] el0t_64_sync_handler+0x44/0x104 [ 207.399536][ T7612] el0t_64_sync+0x198/0x19c [ 207.613800][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.778533][ T7621] loop2: detected capacity change from 0 to 4096 [ 207.788631][ T7621] EXT4-fs: EXT4-fs: inode_readahead_blks must be 0 or a power of 2 smaller than 2^31 [ 207.919817][ T5382] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.993594][ T5382] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.098823][ T5382] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.156016][ T7628] loop5: detected capacity change from 0 to 512 [ 208.161088][ T7628] EXT4-fs: Ignoring removed nobh option [ 208.194272][ T7628] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 208.318246][ T7638] loop3: detected capacity change from 0 to 256 [ 208.329885][ T5382] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.352545][ T7641] Soft offlining pfn 0x1356c5 at process virtual address 0x203dd000 [ 208.353820][ T7641] Soft offlining pfn 0x1356c4 at process virtual address 0x203de000 [ 208.449945][ T7639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.450258][ T7639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.454530][ T7639] sctp: [Deprecated]: syz.5.735 (pid 7639) Use of int in max_burst socket option deprecated. [ 208.454530][ T7639] Use struct sctp_assoc_value instead [ 208.479920][ T4724] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 208.484428][ T7628] netlink: 'syz.5.735': attribute type 2 has an invalid length. [ 208.488781][ T4724] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 208.666989][ T4724] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 208.674863][ T4724] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 208.676584][ T4724] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 208.698492][ T7628] Injecting memory failure for pfn 0x13523d at process virtual address 0x20001000 [ 208.703767][ T7628] Memory failure: 0x13523d: Sending SIGBUS to syz.5.735:7628 due to hardware memory corruption [ 208.703867][ T7628] Memory failure: 0x13523d: recovery action for dirty LRU page: Recovered [ 208.703896][ T7628] Injecting memory failure for pfn 0x219070 at process virtual address 0x20002000 [ 208.703986][ T7628] Memory failure: 0x219070: unhandlable page. [ 208.703999][ T7628] Memory failure: 0x219070: recovery action for get hwpoison page: Ignored [ 208.728920][ T7637] loop2: detected capacity change from 0 to 4096 [ 208.748654][ T7637] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 208.856339][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.880445][ T5382] bridge_slave_1: left allmulticast mode [ 208.880476][ T5382] bridge_slave_1: left promiscuous mode [ 208.880572][ T5382] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.891806][ T5382] bridge_slave_0: left allmulticast mode [ 208.896389][ T5382] bridge_slave_0: left promiscuous mode [ 208.896497][ T5382] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.543787][ T7660] loop3: detected capacity change from 0 to 256 [ 209.549251][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 209.703956][ T5382] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.782842][ T5382] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.794209][ T5382] bond0 (unregistering): Released all slaves [ 210.029537][ T7667] loop3: detected capacity change from 0 to 512 [ 210.030125][ T7667] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 210.065213][ T7667] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.744: invalid indirect mapped block 83886080 (level 1) [ 210.065256][ T7667] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 210.067911][ T7667] EXT4-fs (loop3): Remounting filesystem read-only [ 210.068102][ T7667] EXT4-fs (loop3): 1 orphan inode deleted [ 210.068119][ T7667] EXT4-fs (loop3): 1 truncate cleaned up [ 210.068581][ T7667] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 210.086616][ T5382] tipc: Left network mode [ 210.315264][ T7680] netlink: 12 bytes leftover after parsing attributes in process `syz.2.746'. [ 210.408779][ T7680] netlink: 12 bytes leftover after parsing attributes in process `syz.2.746'. [ 210.476407][ T5382] hsr_slave_0: left promiscuous mode [ 210.484668][ T5382] hsr_slave_1: left promiscuous mode [ 210.484969][ T5382] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 210.484993][ T5382] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 210.498648][ T5382] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 210.498676][ T5382] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 210.535225][ T5382] veth1_macvtap: left promiscuous mode [ 210.535276][ T5382] veth0_macvtap: left promiscuous mode [ 210.535388][ T5382] veth1_vlan: left promiscuous mode [ 210.535427][ T5382] veth0_vlan: left promiscuous mode [ 210.617232][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.680998][ T7688] loop5: detected capacity change from 0 to 4096 [ 210.683017][ T7688] EXT4-fs (loop5): Test dummy encryption mode enabled [ 210.719409][ T7688] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 210.725828][ T7696] loop3: detected capacity change from 0 to 256 [ 210.757244][ T7698] loop2: detected capacity change from 0 to 1024 [ 211.044518][ T4724] Bluetooth: hci0: command tx timeout [ 211.055538][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 211.184659][ T7712] netlink: 44 bytes leftover after parsing attributes in process `syz.2.752'. [ 211.310821][ T7715] netlink: 316 bytes leftover after parsing attributes in process `syz.2.752'. [ 211.757416][ T5382] team0 (unregistering): Port device team_slave_1 removed [ 211.784431][ T5382] team0 (unregistering): Port device team_slave_0 removed [ 211.862651][ T7722] loop3: detected capacity change from 0 to 512 [ 211.866790][ T7722] EXT4-fs (loop3): Test dummy encryption mode enabled [ 211.872347][ T7722] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 211.876481][ T7722] EXT4-fs error (device loop3): ext4_orphan_get:1425: comm syz.3.755: bad orphan inode 131083 [ 211.880958][ T7722] loop3: lost filesystem error report for type 5 error -117 [ 211.885279][ T7722] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 211.994878][ T4399] 8021q: adding VLAN 0 to HW filter on device eth8 [ 212.176295][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.272244][ T7735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.759'. [ 212.631655][ T7755] EXT4-fs: Ignoring removed nomblk_io_submit option [ 212.652549][ T7755] EXT4-fs (loop2): can't mount with both data=journal and dax [ 212.685780][ T7640] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.714173][ T7640] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.714414][ T7640] bridge_slave_0: entered allmulticast mode [ 212.714916][ T7640] bridge_slave_0: entered promiscuous mode [ 212.728052][ T7640] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.728101][ T7640] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.728216][ T7640] bridge_slave_1: entered allmulticast mode [ 212.732747][ T7640] bridge_slave_1: entered promiscuous mode [ 212.752059][ T7640] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.801530][ T7640] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.853045][ T7640] team0: Port device team_slave_0 added [ 212.875254][ T7640] team0: Port device team_slave_1 added [ 212.993647][ T7640] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.995052][ T7640] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 213.001869][ T7640] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 213.004839][ T7640] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 213.013286][ T7640] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 213.185533][ T7640] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 213.255677][ T4724] Bluetooth: hci0: command tx timeout [ 213.366918][ T7640] hsr_slave_0: entered promiscuous mode [ 213.369152][ T7640] hsr_slave_1: entered promiscuous mode [ 213.372759][ T7640] debugfs: 'hsr0' already exists in 'hsr' [ 213.375254][ T7640] Cannot create hsr debugfs directory [ 213.708224][ T4399] 8021q: adding VLAN 0 to HW filter on device eth9 [ 214.455303][ T7640] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 214.468077][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 214.471601][ T7640] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 214.479467][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 214.485483][ T7640] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 214.495552][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 214.497359][ T7640] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 214.509873][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 214.674467][ T7640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 214.705590][ T7640] 8021q: adding VLAN 0 to HW filter on device team0 [ 214.720888][ T5382] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.720933][ T5382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 214.983801][ T7640] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 215.020054][ T7640] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 215.036011][ T5378] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.036055][ T5378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.941517][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.941559][ C0] bridge0: topology change detected, propagating [ 215.941701][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.941714][ C0] bridge0: topology change detected, propagating [ 216.137140][ T4724] Bluetooth: hci0: command tx timeout [ 216.272307][ T7842] netlink: 'syz.2.778': attribute type 3 has an invalid length. [ 216.272339][ T7842] netlink: 200 bytes leftover after parsing attributes in process `syz.2.778'. [ 216.296127][ T7844] netlink: 'syz.5.779': attribute type 10 has an invalid length. [ 216.358411][ T7844] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.359396][ T7844] bond0: (slave team0): Enslaving as an active interface with an up link [ 216.854665][ T7640] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 217.001647][ T7882] set_capacity_and_notify: 2 callbacks suppressed [ 217.004126][ T7882] loop3: detected capacity change from 0 to 1024 [ 217.005860][ T7882] EXT4-fs: Ignoring removed i_version option [ 217.011975][ T7880] netlink: 4 bytes leftover after parsing attributes in process `syz.5.789'. [ 217.027897][ T7882] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 217.048278][ T7882] EXT4-fs error (device loop3): ext4_xattr_block_get:597: inode #15: comm syz.3.790: corrupted xattr block 128: overlapping e_value [ 217.059401][ T7882] EXT4-fs error (device loop3): ext4_xattr_block_get:597: inode #15: comm syz.3.790: corrupted xattr block 128: overlapping e_value [ 217.063329][ T7882] EXT4-fs error (device loop3): ext4_xattr_block_get:597: inode #15: comm syz.3.790: corrupted xattr block 128: overlapping e_value [ 217.193652][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 217.390092][ T7894] ptrace attach of "ci-upstream-gce-arm64/syz-executor exec"[4710] was attempted by "ci-upstream-gce-arm64/syz-executor exec"[7894] [ 217.519025][ T7899] loop3: detected capacity change from 0 to 256 [ 217.528906][ T7899] FAT-fs (loop3): data area starts beyond volume (274 > 64) [ 217.530495][ T7899] FAT-fs (loop3): Can't find a valid FAT filesystem [ 217.581641][ T7640] veth0_vlan: entered promiscuous mode [ 217.595627][ T7903] loop2: detected capacity change from 0 to 128 [ 217.597879][ T7640] veth1_vlan: entered promiscuous mode [ 217.624937][ T7903] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 217.661945][ T7640] veth0_macvtap: entered promiscuous mode [ 217.677987][ T7640] veth1_macvtap: entered promiscuous mode [ 217.706101][ T7899] loop3: detected capacity change from 0 to 8192 [ 217.719992][ T7640] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 217.722163][ T4719] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 217.741455][ T7640] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 217.779223][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.779432][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.779514][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.779697][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 217.949342][ T7918] loop3: detected capacity change from 0 to 256 [ 217.950810][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 217.950842][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.960101][ T7918] FAT-fs (loop3): Directory bread(block 1285) failed [ 217.962007][ T7918] FAT-fs (loop3): Directory bread(block 1286) failed [ 217.962042][ T7918] FAT-fs (loop3): Directory bread(block 1287) failed [ 217.962093][ T7918] FAT-fs (loop3): Directory bread(block 1288) failed [ 218.236703][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 218.236737][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 218.581703][ T4724] Bluetooth: hci0: command tx timeout [ 219.278140][ T7944] netlink: 'syz.4.805': attribute type 18 has an invalid length. [ 219.284989][ T7944] netlink: 4 bytes leftover after parsing attributes in process `syz.4.805'. [ 219.287170][ T7944] netlink: 'syz.4.805': attribute type 18 has an invalid length. [ 219.289049][ T7944] netlink: 4 bytes leftover after parsing attributes in process `syz.4.805'. [ 219.524857][ T7951] netlink: 44 bytes leftover after parsing attributes in process `syz.3.806'. [ 219.566293][ T7954] loop4: detected capacity change from 0 to 256 [ 220.309926][ T7981] loop2: detected capacity change from 0 to 512 [ 220.326620][ T7981] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.361770][ T7981] EXT4-fs (loop2): shut down requested (1) [ 220.387642][ T7985] Soft offlining pfn 0x139aa4 at process virtual address 0x20000000 [ 220.391235][ T7985] Soft offlining pfn 0x13e331 at process virtual address 0x20001000 [ 220.397746][ T7985] Soft offlining pfn 0x13e330 at process virtual address 0x20002000 [ 220.408852][ T7985] Soft offlining pfn 0x13e69b at process virtual address 0x20003000 [ 220.408954][ T7985] Soft offlining pfn 0x13e69a at process virtual address 0x20004000 [ 220.409074][ T7985] Soft offlining pfn 0x13e699 at process virtual address 0x20005000 [ 220.409275][ T7985] Soft offlining pfn 0x13e698 at process virtual address 0x20006000 [ 220.417571][ T7985] Soft offlining pfn 0x13bf0f at process virtual address 0x20007000 [ 220.420522][ T7985] Soft offlining pfn 0x13bf0e at process virtual address 0x20008000 [ 220.428881][ T7985] Soft offlining pfn 0x13bf0d at process virtual address 0x20009000 [ 220.428992][ T7985] Soft offlining pfn 0x13bf0c at process virtual address 0x2000a000 [ 220.429077][ T7985] Soft offlining pfn 0x13a6af at process virtual address 0x2000b000 [ 220.429196][ T7985] Soft offlining pfn 0x13a6ae at process virtual address 0x2000c000 [ 220.429398][ T7985] Soft offlining pfn 0x13a6ad at process virtual address 0x2000d000 [ 220.448760][ T7985] Soft offlining pfn 0x13a6ac at process virtual address 0x2000e000 [ 220.513025][ T7985] Soft offlining pfn 0x1356a7 at process virtual address 0x2000f000 [ 220.513150][ T7985] Soft offlining pfn 0x1356a6 at process virtual address 0x20010000 [ 220.513252][ T7985] Soft offlining pfn 0x1356a5 at process virtual address 0x20011000 [ 220.513403][ T7985] Soft offlining pfn 0x1356a4 at process virtual address 0x20012000 [ 220.513665][ T7985] Soft offlining pfn 0x13e4e3 at process virtual address 0x20013000 [ 220.514209][ T7985] Soft offlining pfn 0x13e4e2 at process virtual address 0x20014000 [ 220.515012][ T7985] Soft offlining pfn 0x13e4e1 at process virtual address 0x20015000 [ 220.515784][ T7985] Soft offlining pfn 0x13e4e0 at process virtual address 0x20016000 [ 220.516555][ T7985] Soft offlining pfn 0x13e4ff at process virtual address 0x20017000 [ 220.517326][ T7985] Soft offlining pfn 0x13e4fe at process virtual address 0x20018000 [ 220.518081][ T7985] Soft offlining pfn 0x13e4fd at process virtual address 0x20019000 [ 220.518818][ T7985] Soft offlining pfn 0x13e4fc at process virtual address 0x2001a000 [ 220.519554][ T7985] Soft offlining pfn 0x13e30f at process virtual address 0x2001b000 [ 220.520297][ T7985] Soft offlining pfn 0x13e30e at process virtual address 0x2001c000 [ 220.569899][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.679081][ T7989] netlink: 280 bytes leftover after parsing attributes in process `syz.3.816'. [ 220.698437][ T7985] Soft offlining pfn 0x13e30d at process virtual address 0x2001d000 [ 220.700262][ T7985] Soft offlining pfn 0x13e30c at process virtual address 0x2001e000 [ 220.702197][ T7985] Soft offlining pfn 0x13e327 at process virtual address 0x2001f000 [ 220.704062][ T7985] Soft offlining pfn 0x13e326 at process virtual address 0x20020000 [ 220.706249][ T7985] Soft offlining pfn 0x13e325 at process virtual address 0x20021000 [ 220.720062][ T7985] Soft offlining pfn 0x13e324 at process virtual address 0x20022000 [ 220.722834][ T7985] Soft offlining pfn 0x13e533 at process virtual address 0x20023000 [ 220.759111][ T7985] Soft offlining pfn 0x13e532 at process virtual address 0x20024000 [ 220.766304][ T7985] Soft offlining pfn 0x13e531 at process virtual address 0x20025000 [ 220.766407][ T7985] Soft offlining pfn 0x13e530 at process virtual address 0x20026000 [ 220.766525][ T7985] Soft offlining pfn 0x13e54b at process virtual address 0x20027000 [ 220.766719][ T7985] Soft offlining pfn 0x13e54a at process virtual address 0x20028000 [ 220.767082][ T7985] Soft offlining pfn 0x13e549 at process virtual address 0x20029000 [ 220.767791][ T7985] Soft offlining pfn 0x13e548 at process virtual address 0x2002a000 [ 220.863432][ T7985] Soft offlining pfn 0x13e55f at process virtual address 0x2002b000 [ 220.863529][ T7985] Soft offlining pfn 0x13e55e at process virtual address 0x2002c000 [ 220.863645][ T7985] Soft offlining pfn 0x13e55d at process virtual address 0x2002d000 [ 220.863793][ T7985] Soft offlining pfn 0x13e55c at process virtual address 0x2002e000 [ 220.864082][ T7985] Soft offlining pfn 0x13e7e3 at process virtual address 0x2002f000 [ 220.864643][ T7985] Soft offlining pfn 0x13e7e2 at process virtual address 0x20030000 [ 220.865441][ T7985] Soft offlining pfn 0x13e7e1 at process virtual address 0x20031000 [ 220.866236][ T7985] Soft offlining pfn 0x13e7e0 at process virtual address 0x20032000 [ 220.867034][ T7985] Soft offlining pfn 0x138a8f at process virtual address 0x20033000 [ 220.965262][ T7985] Soft offlining pfn 0x138a8e at process virtual address 0x20034000 [ 220.967179][ T7985] Soft offlining pfn 0x138a8d at process virtual address 0x20035000 [ 220.975464][ T7985] Soft offlining pfn 0x138a8c at process virtual address 0x20036000 [ 220.978200][ T7985] Soft offlining pfn 0x134fcf at process virtual address 0x20037000 [ 221.001618][ T7985] Soft offlining pfn 0x134fce at process virtual address 0x20038000 [ 221.001708][ T7985] Soft offlining pfn 0x134fcd at process virtual address 0x20039000 [ 221.001806][ T7985] Soft offlining pfn 0x134fcc at process virtual address 0x2003a000 [ 221.001972][ T7985] Soft offlining pfn 0x133bef at process virtual address 0x2003b000 [ 221.002282][ T7985] Soft offlining pfn 0x133bee at process virtual address 0x2003c000 [ 221.002888][ T7985] Soft offlining pfn 0x133bed at process virtual address 0x2003d000 [ 221.003697][ T7985] Soft offlining pfn 0x133bec at process virtual address 0x2003e000 [ 221.004504][ T7985] Soft offlining pfn 0x13bf28 at process virtual address 0x2003f000 [ 221.097624][ T7985] Soft offlining pfn 0x13b1a7 at process virtual address 0x20040000 [ 221.098903][ T7985] Soft offlining pfn 0x13b1a6 at process virtual address 0x20041000 [ 221.107499][ T7985] Soft offlining pfn 0x13b1a5 at process virtual address 0x20042000 [ 221.109530][ T7985] Soft offlining pfn 0x13b1a4 at process virtual address 0x20043000 [ 221.111389][ T7985] Soft offlining pfn 0x13b1b7 at process virtual address 0x20044000 [ 221.113087][ T7985] Soft offlining pfn 0x13b1b6 at process virtual address 0x20045000 [ 221.114984][ T7985] Soft offlining pfn 0x13b1b5 at process virtual address 0x20046000 [ 221.121264][ T7985] Soft offlining pfn 0x13b1b4 at process virtual address 0x20047000 [ 221.144298][ T7985] Soft offlining pfn 0x13bcc3 at process virtual address 0x20048000 [ 221.144409][ T7985] Soft offlining pfn 0x13bcc2 at process virtual address 0x20049000 [ 221.144513][ T7985] Soft offlining pfn 0x13bcc1 at process virtual address 0x2004a000 [ 221.144670][ T7985] Soft offlining pfn 0x13e5fc at process virtual address 0x2004b000 [ 221.144962][ T7985] Soft offlining pfn 0x13e5f8 at process virtual address 0x2004c000 [ 221.145542][ T7985] Soft offlining pfn 0x13e5f3 at process virtual address 0x2004d000 [ 221.146366][ T7985] Soft offlining pfn 0x13e5f5 at process virtual address 0x2004e000 [ 221.147208][ T7985] Soft offlining pfn 0x13e5f6 at process virtual address 0x2004f000 [ 221.148022][ T7985] Soft offlining pfn 0x11f63a at process virtual address 0x20050000 [ 221.148836][ T7985] Soft offlining pfn 0x11f63d at process virtual address 0x20051000 [ 221.149651][ T7985] Soft offlining pfn 0x13881d at process virtual address 0x20052000 [ 221.187501][ T8022] netlink: 5 bytes leftover after parsing attributes in process `syz.4.824'. [ 221.189396][ T8022] 0{X功: renamed from gretap0 (while UP) [ 221.201562][ T8022] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 221.291743][ T7985] Soft offline: 0x13881d: page migration failed 1, type 0x5ffc0000002101c(referenced|uptodate|dirty|arch_1|swapbacked|node=0|zone=2|lastcpupid=0x7ff) [ 221.329903][ T8031] loop4: detected capacity change from 0 to 8 [ 221.337028][ T8031] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 221.339356][ T8031] unable to read xattr id index table [ 221.587043][ T8016] infiniband syz1: set active [ 221.587080][ T8016] infiniband syz1: added syz_tun [ 221.653497][ T8016] RDS/IB: syz1: added [ 221.654694][ T8016] smc: adding ib device syz1 with port count 1 [ 221.661766][ T8016] smc: ib device syz1 port 1 has no pnetid [ 221.749405][ T8043] loop3: detected capacity change from 0 to 256 [ 222.168395][ T8046] loop5: detected capacity change from 0 to 256 [ 222.170521][ T8046] vfat: Unknown parameter 'ioKharset' [ 222.210244][ T8046] netlink: 20 bytes leftover after parsing attributes in process `syz.5.828'. [ 225.126440][ T8065] set_capacity_and_notify: 1 callbacks suppressed [ 225.126482][ T8065] loop3: detected capacity change from 0 to 512 [ 226.089704][ T8073] netlink: 'syz.4.835': attribute type 7 has an invalid length. [ 226.092202][ T8073] netlink: 'syz.4.835': attribute type 5 has an invalid length. [ 226.094021][ T8073] netlink: 17 bytes leftover after parsing attributes in process `syz.4.835'. [ 226.269154][ T8078] loop5: detected capacity change from 0 to 512 [ 226.281280][ T8078] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 226.281307][ T8078] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 226.281348][ T8078] System zones: 0-1, 15-15, 18-18, 34-34 [ 226.281494][ T8078] EXT4-fs (loop5): orphan cleanup on readonly fs [ 226.281531][ T8078] Quota error (device loop5): v2_read_header: Failed header read: expected=8 got=0 [ 226.281570][ T8078] EXT4-fs warning (device loop5): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 226.281586][ T8078] EXT4-fs (loop5): Cannot turn on quotas: error -22 [ 226.297795][ T8078] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.836: bg 0: block 40: padding at end of block bitmap is not set [ 226.297823][ T8078] loop5: lost filesystem error report for type 5 error -117 [ 226.302080][ T8078] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 226.302115][ T8078] loop5: lost filesystem error report for type 5 error -117 [ 226.306132][ T8078] EXT4-fs (loop5): 1 truncate cleaned up [ 226.374567][ T8078] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 226.375445][ T8078] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.416062][ T8089] loop4: detected capacity change from 0 to 256 [ 226.537567][ T8094] netlink: 'syz.5.841': attribute type 1 has an invalid length. [ 226.549750][ T8096] FAULT_INJECTION: forcing a failure. [ 226.549750][ T8096] name failslab, interval 1, probability 0, space 0, times 0 [ 226.552719][ T8096] CPU: 0 UID: 0 PID: 8096 Comm: syz.3.842 Tainted: G L syzkaller #0 PREEMPT [ 226.552741][ T8096] Tainted: [L]=SOFTLOCKUP [ 226.552745][ T8096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 226.552751][ T8096] Call trace: [ 226.552754][ T8096] show_stack+0x2c/0x3c (C) [ 226.552776][ T8096] __dump_stack+0x30/0x40 [ 226.552787][ T8096] dump_stack_lvl+0xd8/0x12c [ 226.552797][ T8096] dump_stack+0x1c/0x28 [ 226.552807][ T8096] should_fail_ex+0x41c/0x590 [ 226.552815][ T8096] should_failslab+0xc4/0x120 [ 226.552824][ T8096] __kmalloc_noprof+0x108/0x6b8 [ 226.552837][ T8096] vb2_core_allocated_buffers_storage+0x70/0x188 [ 226.552849][ T8096] vb2_core_reqbufs+0x580/0xe0c [ 226.552857][ T8096] __vb2_init_fileio+0x2b8/0xe84 [ 226.552866][ T8096] __vb2_perform_fileio+0x228/0x1504 [ 226.552875][ T8096] vb2_write+0x4c/0x64 [ 226.552883][ T8096] vb2_fop_write+0x1bc/0x2b0 [ 226.552891][ T8096] v4l2_write+0x150/0x250 [ 226.552900][ T8096] do_loop_readv_writev+0x24c/0x3dc [ 226.552908][ T8096] vfs_writev+0x2c8/0x630 [ 226.552915][ T8096] do_pwritev+0x11c/0x224 [ 226.552922][ T8096] __arm64_sys_pwritev2+0xe4/0x118 [ 226.552929][ T8096] invoke_syscall+0x98/0x244 [ 226.552940][ T8096] el0_svc_common+0xec/0x23c [ 226.552949][ T8096] do_el0_svc+0x4c/0x5c [ 226.552959][ T8096] el0_svc+0x64/0x260 [ 226.552968][ T8096] el0t_64_sync_handler+0x44/0x104 [ 226.552976][ T8096] el0t_64_sync+0x198/0x19c [ 226.790359][ T8094] bond1: entered promiscuous mode [ 226.790516][ T8094] 8021q: adding VLAN 0 to HW filter on device bond1 [ 226.878998][ T8102] veth1_to_hsr: entered promiscuous mode [ 226.940036][ T8101] veth1_to_hsr: left promiscuous mode [ 227.339460][ T8114] netlink: 16 bytes leftover after parsing attributes in process `syz.3.845'. [ 227.340659][ T8114] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 227.606857][ T8126] netlink: 5 bytes leftover after parsing attributes in process `syz.4.848'. [ 227.610899][ T8126] 1{X功: renamed from 30{X功 (while UP) [ 227.646073][ T8126] A link change request failed with some changes committed already. Interface 31{X功 may have been left with an inconsistent configuration, please check. [ 227.753140][ T8132] SET target dimension over the limit! [ 227.979570][ T8140] netlink: 'syz.4.851': attribute type 3 has an invalid length. [ 227.979602][ T8140] netlink: 16 bytes leftover after parsing attributes in process `syz.4.851'. [ 228.213366][ T8152] loop6: detected capacity change from 0 to 512 [ 228.224460][ T8148] loop4: detected capacity change from 0 to 512 [ 228.226852][ T8148] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 228.230706][ T8148] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:483: comm syz.4.854: Invalid block bitmap block 0 in block_group 0 [ 228.233625][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.234500][ T8148] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 228.234534][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.235973][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 228.235989][ C0] EXT4-fs (loop4): initial error at time 221: ext4_read_block_bitmap_nowait:483 [ 228.236001][ C0] EXT4-fs (loop4): last error at time 221: ext4_mb_clear_bb:6679 [ 228.245007][ T8148] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #11: comm syz.4.854: attempt to clear invalid blocks 983261 len 1 [ 228.245047][ T8148] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 228.247933][ T8148] EXT4-fs error (device loop4): __ext4_get_inode_loc:4886: comm syz.4.854: Invalid inode table block 0 in block_group 0 [ 228.247969][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.253230][ T8152] FAT-fs (loop6): bogus number of FAT sectors [ 228.253261][ T8152] FAT-fs (loop6): Can't find a valid FAT filesystem [ 228.265097][ T8148] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 228.265137][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.272032][ T8148] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 228.272061][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.279449][ T8148] EXT4-fs error (device loop4): __ext4_get_inode_loc:4886: comm syz.4.854: Invalid inode table block 0 in block_group 0 [ 228.279487][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.283433][ T8148] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 228.283469][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.287102][ T8148] EXT4-fs error (device loop4): ext4_truncate:4691: inode #11: comm syz.4.854: mark_inode_dirty error [ 228.287121][ T8148] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 228.290968][ T8148] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 228.291001][ T8148] loop4: lost filesystem error report for type 5 error -117 [ 228.291187][ T8148] EXT4-fs error (device loop4): __ext4_get_inode_loc:4886: comm syz.4.854: Invalid inode table block 0 in block_group 0 [ 228.298321][ T8148] EXT4-fs (loop4): 1 truncate cleaned up [ 228.311893][ T8148] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 228.373276][ T8148] EXT4-fs error (device loop4): ext4_read_inode_bitmap:141: comm syz.4.854: Invalid inode bitmap blk 0 in block_group 0 [ 228.446107][ T8163] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 229.550661][ T8180] FAULT_INJECTION: forcing a failure. [ 229.550661][ T8180] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.550700][ T8180] CPU: 0 UID: 0 PID: 8180 Comm: syz.3.860 Tainted: G L syzkaller #0 PREEMPT [ 229.550719][ T8180] Tainted: [L]=SOFTLOCKUP [ 229.550722][ T8180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 229.550727][ T8180] Call trace: [ 229.550730][ T8180] show_stack+0x2c/0x3c (C) [ 229.550750][ T8180] __dump_stack+0x30/0x40 [ 229.550763][ T8180] dump_stack_lvl+0xd8/0x12c [ 229.550773][ T8180] dump_stack+0x1c/0x28 [ 229.550783][ T8180] should_fail_ex+0x41c/0x590 [ 229.550791][ T8180] should_fail+0x14/0x24 [ 229.550797][ T8180] should_fail_usercopy+0x20/0x30 [ 229.550805][ T8180] _inline_copy_from_user+0x3c/0x174 [ 229.550816][ T8180] copy_msghdr_from_user+0xb8/0x194 [ 229.550826][ T8180] ___sys_sendmsg+0x14c/0x224 [ 229.550841][ T8180] __sys_sendmmsg+0x204/0x580 [ 229.550850][ T8180] __arm64_sys_sendmmsg+0xac/0xc8 [ 229.550860][ T8180] invoke_syscall+0x98/0x244 [ 229.550871][ T8180] el0_svc_common+0xec/0x23c [ 229.550881][ T8180] do_el0_svc+0x4c/0x5c [ 229.550890][ T8180] el0_svc+0x64/0x260 [ 229.550900][ T8180] el0t_64_sync_handler+0x44/0x104 [ 229.550909][ T8180] el0t_64_sync+0x198/0x19c [ 229.610238][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 229.682011][ T8186] trusted_key: encrypted_key: key user:syz not found [ 229.696239][ T8186] loop2: detected capacity change from 0 to 1024 [ 229.705988][ T8186] EXT4-fs (loop2): unsupported inode size: 16384 [ 229.708781][ T8186] EXT4-fs (loop2): blocksize: 1024 [ 229.714328][ T8188] loop6: detected capacity change from 0 to 256 [ 229.718526][ T8188] FAT-fs (loop6): Directory bread(block 1285) failed [ 229.720795][ T8188] FAT-fs (loop6): Directory bread(block 1286) failed [ 229.720824][ T8188] FAT-fs (loop6): Directory bread(block 1287) failed [ 229.720881][ T8188] FAT-fs (loop6): Directory bread(block 1288) failed [ 229.800087][ T8189] netlink: 280 bytes leftover after parsing attributes in process `syz.3.862'. [ 230.122216][ T8200] FAULT_INJECTION: forcing a failure. [ 230.122216][ T8200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.125194][ T8200] CPU: 0 UID: 0 PID: 8200 Comm: syz.4.868 Tainted: G L syzkaller #0 PREEMPT [ 230.125224][ T8200] Tainted: [L]=SOFTLOCKUP [ 230.125228][ T8200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 230.125234][ T8200] Call trace: [ 230.125237][ T8200] show_stack+0x2c/0x3c (C) [ 230.125261][ T8200] __dump_stack+0x30/0x40 [ 230.125273][ T8200] dump_stack_lvl+0xd8/0x12c [ 230.125283][ T8200] dump_stack+0x1c/0x28 [ 230.125293][ T8200] should_fail_ex+0x41c/0x590 [ 230.125301][ T8200] should_fail+0x14/0x24 [ 230.125307][ T8200] should_fail_usercopy+0x20/0x30 [ 230.125315][ T8200] _copy_from_iter+0x188/0x1064 [ 230.125324][ T8200] netlink_sendmsg+0x570/0x948 [ 230.125334][ T8200] __sock_sendmsg+0xc8/0x17c [ 230.125343][ T8200] ____sys_sendmsg+0x3d0/0x6c8 [ 230.125352][ T8200] ___sys_sendmsg+0x198/0x224 [ 230.125361][ T8200] __sys_sendmsg+0x158/0x204 [ 230.125371][ T8200] __arm64_sys_sendmsg+0x88/0x9c [ 230.125380][ T8200] invoke_syscall+0x98/0x244 [ 230.125390][ T8200] el0_svc_common+0xec/0x23c [ 230.125400][ T8200] do_el0_svc+0x4c/0x5c [ 230.125409][ T8200] el0_svc+0x64/0x260 [ 230.125419][ T8200] el0t_64_sync_handler+0x44/0x104 [ 230.125427][ T8200] el0t_64_sync+0x198/0x19c [ 230.259376][ T8203] Invalid logical block size (1073741824) [ 231.091001][ T8207] loop4: detected capacity change from 0 to 256 [ 231.453709][ T8211] loop3: detected capacity change from 0 to 512 [ 231.477750][ T8215] loop6: detected capacity change from 0 to 512 [ 231.492748][ T8215] EXT4-fs error (device loop6): ext4_iget_extra_inode:5180: inode #15: comm syz.6.872: corrupted in-inode xattr: invalid ea_ino [ 231.495467][ T8215] loop6: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 231.495841][ T8215] EXT4-fs error (device loop6): ext4_orphan_get:1404: comm syz.6.872: couldn't read orphan inode 15 (err -117) [ 231.497799][ C0] EXT4-fs (loop6): error count since last fsck: 1 [ 231.497811][ C0] EXT4-fs (loop6): initial error at time 224: ext4_iget_extra_inode:5180: inode 15 [ 231.497827][ C0] EXT4-fs (loop6): last error at time 224: ext4_iget_extra_inode:5180: inode 15 [ 231.508713][ T8215] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 231.530201][ T8215] EXT4-fs (loop6): shut down requested (2) [ 231.577265][ T7640] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.643549][ T8222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.876'. [ 231.732363][ T8229] loop5: detected capacity change from 0 to 512 [ 231.748551][ T8229] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 231.748586][ T8229] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 231.748637][ T8229] System zones: 0-1, 15-15, 18-18, 34-34 [ 231.748803][ T8229] EXT4-fs (loop5): orphan cleanup on readonly fs [ 231.748842][ T8229] Quota error (device loop5): v2_read_header: Failed header read: expected=8 got=0 [ 231.748882][ T8229] EXT4-fs warning (device loop5): ext4_enable_quotas:7276: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 231.748899][ T8229] EXT4-fs (loop5): Cannot turn on quotas: error -22 [ 231.766750][ T8229] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.879: bg 0: block 40: padding at end of block bitmap is not set [ 231.767228][ T8229] fserror_report: 2 callbacks suppressed [ 231.767248][ T8229] loop5: lost filesystem error report for type 5 error -117 [ 231.772646][ T8229] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 231.772679][ T8229] loop5: lost filesystem error report for type 5 error -117 [ 231.777016][ T8229] EXT4-fs (loop5): 1 truncate cleaned up [ 231.777510][ T8229] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 231.790512][ T8229] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.817203][ T8235] netlink: 20 bytes leftover after parsing attributes in process `syz.2.882'. [ 231.864019][ T8233] loop6: detected capacity change from 0 to 256 [ 231.868116][ T8233] vfat: Unknown parameter 'ioKharset' [ 231.885261][ T8233] netlink: 20 bytes leftover after parsing attributes in process `syz.6.880'. [ 231.924945][ T8241] overlay: filesystem on ./bus not supported as upperdir [ 231.925189][ T8240] netlink: 24 bytes leftover after parsing attributes in process `syz.5.883'. [ 231.938416][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938502][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938566][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938624][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938675][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938726][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938782][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938836][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938889][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 231.938937][ T8243] overlayfs: failed lookup in lower (newroot/208, name='bus', err=-40): overlapping layers [ 232.048568][ T8240] netlink: 4 bytes leftover after parsing attributes in process `syz.5.883'. [ 232.055277][ T8240] loop9: detected capacity change from 0 to 7 [ 232.063338][ T8248] FAULT_INJECTION: forcing a failure. [ 232.063338][ T8248] name failslab, interval 1, probability 0, space 0, times 0 [ 232.063371][ T8248] CPU: 0 UID: 0 PID: 8248 Comm: syz.6.886 Tainted: G L syzkaller #0 PREEMPT [ 232.063387][ T8248] Tainted: [L]=SOFTLOCKUP [ 232.063390][ T8248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 232.063395][ T8248] Call trace: [ 232.063398][ T8248] show_stack+0x2c/0x3c (C) [ 232.063418][ T8248] __dump_stack+0x30/0x40 [ 232.063429][ T8248] dump_stack_lvl+0xd8/0x12c [ 232.063439][ T8248] dump_stack+0x1c/0x28 [ 232.063448][ T8248] should_fail_ex+0x41c/0x590 [ 232.063456][ T8248] should_failslab+0xc4/0x120 [ 232.063465][ T8248] __kmalloc_noprof+0x108/0x6b8 [ 232.063473][ T8248] tomoyo_realpath_from_path+0xbc/0x4dc [ 232.063483][ T8248] tomoyo_path_number_perm+0x1f0/0x500 [ 232.063490][ T8248] tomoyo_file_ioctl+0x2c/0x3c [ 232.063499][ T8248] security_file_ioctl+0xdc/0x2b0 [ 232.063507][ T8248] __arm64_sys_ioctl+0xb0/0x1cc [ 232.063518][ T8248] invoke_syscall+0x98/0x244 [ 232.063527][ T8248] el0_svc_common+0xec/0x23c [ 232.063537][ T8248] do_el0_svc+0x4c/0x5c [ 232.063547][ T8248] el0_svc+0x64/0x260 [ 232.063556][ T8248] el0t_64_sync_handler+0x44/0x104 [ 232.063564][ T8248] el0t_64_sync+0x198/0x19c [ 232.063583][ T8248] ERROR: Out of memory at tomoyo_realpath_from_path. [ 232.118105][ T8240] Dev loop9: unable to read RDB block 7 [ 232.118144][ T8240] loop9: unable to read partition table [ 232.118228][ T8240] loop9: partition table beyond EOD, truncated [ 232.118249][ T8240] loop_reread_partitions: partition scan of loop9 () failed (rc=-5) [ 232.136661][ T8250] loop4: detected capacity change from 0 to 256 [ 232.144870][ T8250] FAT-fs (loop4): error, allocated dir entry found after end-of-directory marker (i_pos 1) [ 232.144904][ T8250] FAT-fs (loop4): Filesystem has been set read-only [ 232.194379][ T8254] binder: BINDER_SET_CONTEXT_MGR already set [ 232.194403][ T8254] binder: 8253:8254 ioctl 4018620d 0 returned -16 [ 232.194704][ T8254] binder: 8253:8254 got transaction to invalid handle, 1 [ 232.194721][ T8254] binder: 8253:8254 cannot find target node [ 232.194740][ T8254] binder: 8253:8254 transaction call to 0:0 failed 18/29201/-22, code 0 size 104-24 line 3252 [ 232.194914][ T1038] binder: undelivered TRANSACTION_ERROR: 29201 [ 232.227737][ T8256] netlink: 280 bytes leftover after parsing attributes in process `syz.2.890'. [ 232.298703][ T8260] netlink: 'syz.4.892': attribute type 5 has an invalid length. [ 232.348031][ T8267] netlink: 4 bytes leftover after parsing attributes in process `syz.5.895'. [ 232.362880][ T8265] gadgetfs: bound to dummy_udc driver [ 232.403982][ T8267] team0: Port device team_slave_0 removed [ 232.433436][ T8270] loop4: detected capacity change from 0 to 256 [ 232.450485][ T8274] loop6: detected capacity change from 0 to 512 [ 232.522187][ T8274] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 232.522265][ T8274] System zones: 1-12 [ 232.528163][ T8274] EXT4-fs error (device loop6): ext4_xattr_inode_iget:441: inode #12: comm syz.6.898: missing EA_INODE flag [ 232.528188][ T8274] loop6: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 232.533565][ T8274] EXT4-fs error (device loop6): ext4_xattr_inode_iget:446: comm syz.6.898: error while reading EA inode 12 err=-117 [ 232.538006][ C0] EXT4-fs (loop6): error count since last fsck: 1 [ 232.538021][ C0] EXT4-fs (loop6): initial error at time 225: ext4_xattr_inode_iget:441: inode 12 [ 232.538040][ C0] EXT4-fs (loop6): last error at time 225: ext4_xattr_inode_iget:441: inode 12 [ 232.548156][ T8274] loop6: lost filesystem error report for type 5 error -117 [ 232.558035][ T8274] EXT4-fs (loop6): 1 orphan inode deleted [ 232.558525][ T8274] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 232.912585][ T7640] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.251085][ T8296] loop5: detected capacity change from 0 to 512 [ 233.266747][ T8296] EXT4-fs (loop5): Test dummy encryption mode enabled [ 233.278037][ T8296] EXT4-fs error (device loop5): ext4_orphan_get:1399: inode #15: comm syz.5.905: inode has both inline data and extents flags [ 233.278080][ T8296] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 233.280843][ T8296] EXT4-fs error (device loop5): ext4_orphan_get:1404: comm syz.5.905: couldn't read orphan inode 15 (err -117) [ 233.280877][ T8296] loop5: lost filesystem error report for type 5 error -117 [ 233.285329][ C0] EXT4-fs (loop5): error count since last fsck: 2 [ 233.285348][ C0] EXT4-fs (loop5): initial error at time 227: ext4_orphan_get:1399: inode 15 [ 233.285377][ C0] EXT4-fs (loop5): last error at time 227: ext4_orphan_get:1404 [ 233.292923][ T8296] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 233.432762][ T8328] netlink: 280 bytes leftover after parsing attributes in process `syz.2.906'. [ 233.860005][ T8340] EXT4-fs (loop2): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 233.904874][ T8340] EXT4-fs error (device loop2): ext4_map_blocks:791: inode #3: block 2: comm syz.2.908: lblock 2 mapped to illegal pblock 2 (length 1) [ 233.904917][ T8340] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 233.908516][ T8340] EXT4-fs (loop2): Remounting filesystem read-only [ 233.908554][ T8340] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 233.908590][ T8340] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 233.908649][ T8340] EXT4-fs (loop2): 1 orphan inode deleted [ 233.909135][ T8340] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 233.921991][ T8340] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 234.310369][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 234.329844][ T8349] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 234.340699][ T8349] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 234.343296][ T8349] FAT-fs (loop4): Filesystem has been set read-only [ 234.446947][ T8357] vfat: Unknown parameter 'ioKharset' [ 234.461342][ T8357] netlink: 20 bytes leftover after parsing attributes in process `syz.5.915'. [ 234.558665][ T8363] No such timeout policy "syz1" [ 234.760911][ T8360] netlink: 36 bytes leftover after parsing attributes in process `syz.3.916'. [ 234.760950][ T8360] netlink: 24 bytes leftover after parsing attributes in process `syz.3.916'. [ 235.502206][ T8377] netlink: 8 bytes leftover after parsing attributes in process `syz.2.923'. [ 235.511335][ T8375] netlink: 140 bytes leftover after parsing attributes in process `syz.3.921'. [ 235.513192][ T8375] vfat: Unknown parameter 'ioKharset' [ 235.526451][ T8375] netlink: 20 bytes leftover after parsing attributes in process `syz.3.921'. [ 235.701464][ T10] page_pool_release_retry() stalled pool shutdown: id 58, 1 inflight 60 sec [ 235.723210][ T8395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.929'. [ 235.834452][ T8398] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 235.834487][ T8398] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 235.834548][ T8398] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 235.834565][ T8398] EXT4-fs (loop2): filesystem has both journal inode and journal device! [ 236.190978][ T8406] netlink: 16 bytes leftover after parsing attributes in process `syz.6.934'. [ 236.191689][ T8406] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 236.233040][ T8409] FAT-fs (loop2): Directory bread(block 1285) failed [ 236.235160][ T8409] FAT-fs (loop2): Directory bread(block 1286) failed [ 236.236957][ T8409] FAT-fs (loop2): Directory bread(block 1287) failed [ 236.238564][ T8409] FAT-fs (loop2): Directory bread(block 1288) failed [ 236.786355][ T8419] Injecting memory failure for pfn 0x15fc01 at process virtual address 0x20001000 [ 236.789411][ T8419] Memory failure: 0x15fc01: recovery action for dirty LRU page: Recovered [ 237.040729][ T8426] netlink: 'syz.5.940': attribute type 5 has an invalid length. [ 237.099605][ T8428] netlink: 28 bytes leftover after parsing attributes in process `syz.4.941'. [ 237.231045][ T8432] SET target dimension over the limit! [ 237.696767][ T8453] set_capacity_and_notify: 8 callbacks suppressed [ 237.696808][ T8453] loop5: detected capacity change from 0 to 512 [ 237.697181][ T8453] EXT4-fs: Ignoring removed oldalloc option [ 237.706484][ T8453] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 237.747723][ T8453] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a846c01c, mo2=0002] [ 237.747791][ T8453] System zones: 0-2, 18-18, 34-34 [ 237.752190][ T8453] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2 [ 237.752220][ T8453] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -2 [ 237.752238][ T8453] EXT4-fs error (device loop5): ext4_orphan_get:1425: comm syz.5.947: bad orphan inode 20829 [ 237.752254][ T8453] loop5: lost filesystem error report for type 5 error -117 [ 237.757373][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 237.757384][ C0] EXT4-fs (loop5): initial error at time 231: ext4_orphan_get:1425 [ 237.757395][ C0] EXT4-fs (loop5): last error at time 231: ext4_orphan_get:1425 [ 237.765313][ T8453] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 237.918477][ T8461] loop2: detected capacity change from 0 to 4096 [ 237.922599][ T8461] EXT4-fs (loop2): Test dummy encryption mode enabled [ 237.931568][ T8461] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 238.797432][ T8467] loop6: detected capacity change from 0 to 256 [ 238.805085][ T8467] vfat: Unknown parameter '閘盓r' [ 238.915071][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 238.951930][ T8478] __nla_validate_parse: 3 callbacks suppressed [ 238.954979][ T8478] netlink: 8 bytes leftover after parsing attributes in process `syz.4.958'. [ 239.086716][ T8484] xt_hashlimit: size too large, truncated to 1048576 [ 239.257101][ T8486] netlink: 16 bytes leftover after parsing attributes in process `syz.2.959'. [ 239.258183][ T8486] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 239.268714][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.346674][ T8485] loop4: detected capacity change from 0 to 4096 [ 239.354528][ T8492] No control pipe specified [ 239.369918][ T8485] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.374006][ T8485] netlink: 'syz.4.963': attribute type 5 has an invalid length. [ 239.375610][ T8485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.963'. [ 239.633378][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.931057][ T8498] tipc: Started in network mode [ 239.931093][ T8498] tipc: Node identity 1000001, cluster identity 4369 [ 239.931118][ T8498] tipc: Node number set to 16777217 [ 239.949653][ T8498] loop6: detected capacity change from 0 to 1024 [ 239.978899][ T8498] EXT4-fs: Ignoring removed orlov option [ 239.986079][ T8503] netlink: 12 bytes leftover after parsing attributes in process `syz.4.966'. [ 240.005839][ T8506] No such timeout policy "syz1" [ 240.021932][ T8498] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 240.070890][ T7640] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.306195][ T8523] loop4: detected capacity change from 0 to 512 [ 241.306542][ T8523] EXT4-fs: Ignoring removed oldalloc option [ 241.351891][ T8523] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 241.410795][ T8529] loop5: detected capacity change from 0 to 4096 [ 241.423271][ T8529] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 241.631083][ T6356] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.719614][ T4710] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.779813][ T8541] netlink: 280 bytes leftover after parsing attributes in process `syz.2.980'. [ 241.901302][ T8549] loop2: detected capacity change from 0 to 4096 [ 241.911587][ T8550] netlink: 8 bytes leftover after parsing attributes in process `syz.5.981'. [ 241.912509][ T8550] bridge0: port 2(bridge_slave_1) entered disabled state [ 241.971546][ T8549] EXT4-fs (loop2): Test dummy encryption mode enabled [ 241.974514][ T8549] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 242.004312][ T8555] loop5: detected capacity change from 0 to 256 [ 242.319043][ T4719] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.394003][ T8560] binder: 8558:8560 tried to acquire reference to desc 0, got 1 instead [ 242.721156][ T8566] netlink: 16 bytes leftover after parsing attributes in process `syz.4.987'. [ 242.722281][ T8566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 242.989420][ T8578] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 243.181438][ T8587] No such timeout policy "syz1" [ 243.185996][ T8588] netlink: 72 bytes leftover after parsing attributes in process `syz.3.997'. [ 243.189315][ T8588] netlink: 4 bytes leftover after parsing attributes in process `syz.3.997'. [ 243.232584][ T8588] team0: Port device team_slave_0 removed [ 243.340596][ T8593] loop5: detected capacity change from 0 to 256 [ 243.432924][ T8594] loop3: detected capacity change from 0 to 4096 [ 243.464050][ T8594] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 243.672085][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 244.124798][ T4724] Bluetooth: hci2: command 0x0406 tx timeout [ 245.214592][ T8613] netlink: 280 bytes leftover after parsing attributes in process `syz.5.1006'. [ 245.662727][ T8631] loop2: detected capacity change from 0 to 256 [ 246.118619][ T8647] netlink: 'syz.3.1019': attribute type 5 has an invalid length. [ 246.120276][ T8647] netlink: 'syz.3.1019': attribute type 9 has an invalid length. [ 246.122683][ T8647] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1019'. [ 246.319750][ T8657] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1023'. [ 246.322021][ T8657] 0{X功: renamed from gretap0 (while UP) [ 246.325145][ T8657] 0{X功: entered allmulticast mode [ 246.326708][ T8657] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 246.334797][ T8654] loop3: detected capacity change from 0 to 512 [ 246.344564][ T8654] ------------[ cut here ]------------ [ 246.344598][ T8654] EA inode 11 i_nlink=0 [ 246.346923][ T8654] WARNING: fs/ext4/xattr.c:1059 at ext4_xattr_inode_update_ref+0x480/0x488, CPU#0: syz.3.1022/8654 [ 246.349498][ T8654] Modules linked in: [ 246.350162][ T8654] CPU: 0 UID: 0 PID: 8654 Comm: syz.3.1022 Tainted: G L syzkaller #0 PREEMPT [ 246.351925][ T8654] Tainted: [L]=SOFTLOCKUP [ 246.352650][ T8654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 246.354300][ T8654] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 246.355610][ T8654] pc : ext4_xattr_inode_update_ref+0x480/0x488 [ 246.356639][ T8654] lr : ext4_xattr_inode_update_ref+0x480/0x488 [ 246.357687][ T8654] sp : ffff800093ef6f40 [ 246.358339][ T8654] x29: ffff800093ef6fe0 x28: 0000000000000000 x27: 1fffe0001ef3b2dd [ 246.359647][ T8654] x26: ffff0000f79d9540 x25: dfff800000000000 x24: ffff800093ef6f60 [ 246.360988][ T8654] x23: ffff7000127dedec x22: ffff80008a19c000 x21: 0000000000000000 [ 246.362347][ T8654] x20: 0000000000000001 x19: ffff0000f79d9500 x18: 1fffe00034bb7428 [ 246.363696][ T8654] x17: 0000000000000003 x16: ffff800088b37000 x15: ffff800088bed220 [ 246.365073][ T8654] x14: ffff0001a5dba14c x13: 0000000000000001 x12: 0000000000000000 [ 246.366445][ T8654] x11: 0000000000000000 x10: 0000000000000003 x9 : cb53cbec544fe800 [ 246.367809][ T8654] x8 : cb53cbec544fe800 x7 : 0000000000000000 x6 : 0000000000000000 [ 246.369152][ T8654] x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000803b70b8 [ 246.370522][ T8654] x2 : 0000000000000001 x1 : ffff0000e1e357c0 x0 : 0000000000000001 [ 246.371934][ T8654] Call trace: [ 246.372460][ T8654] ext4_xattr_inode_update_ref+0x480/0x488 (P) [ 246.373539][ T8654] ext4_xattr_inode_dec_ref_all+0x7f0/0xb84 [ 246.374534][ T8654] ext4_xattr_delete_inode+0x778/0x900 [ 246.375433][ T8654] ext4_evict_inode+0xa0c/0xfb8 [ 246.376279][ T8654] evict+0x4c0/0x74c [ 246.376955][ T8654] iput+0x8f0/0xc2c [ 246.377627][ T8654] ext4_process_orphan+0x24c/0x2c0 [ 246.378474][ T8654] ext4_orphan_cleanup+0x7d4/0xd20 [ 246.379303][ T8654] ext4_fill_super+0x4628/0x4e14 [ 246.380120][ T8654] get_tree_bdev_flags+0x388/0x43c [ 246.380991][ T8654] get_tree_bdev+0x2c/0x3c [ 246.381758][ T8654] ext4_get_tree+0x28/0x38 [ 246.382586][ T8654] vfs_get_tree+0x90/0x28c [ 246.383369][ T8654] fc_mount+0x24/0xac [ 246.384030][ T8654] do_new_mount+0x2a4/0x538 [ 246.384803][ T8654] path_mount+0x5f0/0xa88 [ 246.385557][ T8654] do_mount+0xe8/0x148 [ 246.386274][ T8654] __arm64_sys_mount+0x33c/0x388 [ 246.387127][ T8654] invoke_syscall+0x98/0x244 [ 246.387933][ T8654] el0_svc_common+0xec/0x23c [ 246.388732][ T8654] do_el0_svc+0x4c/0x5c [ 246.389450][ T8654] el0_svc+0x64/0x260 [ 246.390134][ T8654] el0t_64_sync_handler+0x44/0x104 [ 246.390991][ T8654] el0t_64_sync+0x198/0x19c [ 246.391762][ T8654] irq event stamp: 2202 [ 246.392462][ T8654] hardirqs last enabled at (2201): [] finish_task_switch+0x234/0x858 [ 246.394086][ T8654] hardirqs last disabled at (2202): [] el1_brk64+0x20/0x54 [ 246.395568][ T8654] softirqs last enabled at (1750): [] do_sve_acc+0x32c/0x4b8 [ 246.397078][ T8654] softirqs last disabled at (1748): [] do_sve_acc+0x10c/0x4b8 [ 246.398562][ T8654] ---[ end trace 0000000000000000 ]--- [ 246.445281][ T8654] EXT4-fs (loop3): 1 orphan inode deleted [ 246.451774][ T8654] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 246.493645][ T4717] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.