last executing test programs: 24.749353656s ago: executing program 3 (id=494): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, 0x0, 0x8040) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) syz_open_procfs(0x0, &(0x7f0000000100)='map_files\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r4, 0x0, 0x0, 0x810) 24.501047752s ago: executing program 2 (id=495): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 21.886416397s ago: executing program 2 (id=498): openat$ttynull(0xffffffffffffff9c, &(0x7f00000001c0), 0x82084, 0x0) syz_extract_tcp_res(0x0, 0x6, 0x5) syz_emit_ethernet(0x30f, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaabb7fc9bb68d1df88a82b008100190008004ebd02f900680000082f9078ac1414bbac1414bb868700000000020f1ad9a4cd3bdbed2faeb6ca28ae0005d46a11634e2c62aedc01037b07101f3462d0fcfe0f647f6c28f4d157000da3e23df9148913333cd499051188f763d72d71cddf89e9be603984f006102784755e41ecd35e59b6d313b83e060b25974a58669da2a4dd0612d2d2d1fb3c6dd4e8eb9ff1ef232c6e64020f3fa96b73c2e7a272a2a3fe3dd044183430000000050000000600000005000000030000000344447bb1e00000010000000be000000200008ad86401010000000000e000000200000fffac141442000000066401010000000004ac1414aa00000008ffffffff0000000c000c21880b00fa00009b2047b600aa02605ba2d4d43ad536c3ead7ecc4c480adbcded174c7e91ced0004c8936012c776402e558872da2b52513290220f56811c8f0d6c4fe271892546669ae20a60d7fe38ac933428f50c85503e657d3ca40dcafb3bfbb37423ae8ffdc4ea9f64a6594bf2c3f7b76c81b92525c50e59300aa2ab958d6b1ffd656b7dd1eebbfc6441b800e7a0377b8fafcd2c7cc5cb8674aac57676cc96cabf92d356c8ed183430e3698919935602bf2ad8e0e85cf6e40a86319fae1029657f6ffd4a8ce88980d3d9daef15a657b15de657d35463966a87f5ca546f9c070075761f0808cdf8eaa9dc067e9a2b30c4f0a3984999a8ed973c94c680f20147040008000001f03291972cf310546effe1f556d9d152d80955de9d24d23fb9bfa475a0e616af1f1f9b6cd0732715dc32d1d89417bd000086dde044262c7deb71f3ad2075f421a376502d21fd380f95c20320016eeb637396877d86bdbfa381a12be1f2a916d96a47f188305bbc11e07e3f513e8e101d800aa43d698e1ddcd56577d52b69281987db802118b7053664a527c42a860918ce097b09b7827124778233f8dad66f080088be00000003100125040100000000000005080022eb0000000321803a"], &(0x7f0000000640)={0x0, 0x2, [0x4a1, 0xc34, 0xf62, 0x4b]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0xc5, &(0x7f0000000300)={0x0, 0x10f211, 0x4, 0x2002, 0x40001c, 0x0, r0}, &(0x7f00000007c0), &(0x7f00000000c0), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000800)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0x43}, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000680)="92ca3a839be8e27fc536b372000000a296de0d0ffc1741a765bf3f5ca07596cc2ff87ba8aa859a112c04aa9d4840d1624f0a5ae2c074a946be21e2009392db2023965d125247f55fa1bce029e1f40492d9ba71aa7890683c202b50c75f3f955b63ac5826dcdd7d524ff2f656bbfb50275d4b85a96e994dc2746067c63fd67838d6a82cf356296db4e3165011257bc44151dc994f1efde4b8fe73e132d8e94795bc9adc5875f4867021a6d8453cf1ee42700e19f5bb6f58b649e0f75abb081224b04953ecf70e88f0d81c9921efe756ab560100000000000000391e5051d7f5adbadc308cdcd00a51f0f0111213572bcf82fe894f9c12d43b8b860cf06bb97e505d74", 0x102}], 0x1}}, {{&(0x7f0000000580)={0xa, 0x4e24, 0x81, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xb}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000005c0)='j', 0x1}], 0x1}}], 0x2, 0x14) shutdown(r2, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="d8000000180081054e81f782db4cb904021d0800fe00fe05e8fe55a10a0015000600142603600e1208000f007f370301a8001600a40002400f000100035c0461c1d67f6f94007134cf6edb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090014d6d9", 0x6c}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x58}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004095) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040), 0x10) setsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) 15.613697253s ago: executing program 2 (id=504): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') writev(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x30, 0x8008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000f00)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0xfffffffffffffdb6}}, @common=@inet=@hashlimit1={{0x58}, {'nr0\x00', {0x61, 0x7, 0x4, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x2b8, 0x2e8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5cc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = memfd_create(&(0x7f0000000000)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\x1c\xe4\xd8\xb58\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Nc\xdd\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\x00\b\x00\x00X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31\xb0\x87O\xc3\xa3AW\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]~\xfc1\xe5w\"\xa3\x8d\xe7\xd4x\xb3\xfa(\xc9\xc2bb\xb1\xa8\xe1\xc2\xec\xca\x7f\xe1\x1e\xb9\xd4\x80-6L\x91\x9b\xad\x85`\xf2+\xfbN+\x0e\xa6\xc4M\xda\xfc\xa1gZ)STB\xd1\xd1\xf1', 0x8) ftruncate(r4, 0x7) finit_module(r4, 0x0, 0x7) prlimit64(0x0, 0xe, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) r5 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000ffc000/0x4000)=nil) shmat(0x0, &(0x7f0000000000/0x2000)=nil, 0x3800) shmctl$SHM_LOCK(r5, 0xb) io_uring_setup(0x1111, 0x0) shmctl$SHM_UNLOCK(r5, 0xc) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f0000019300)={0x0, 0x0, 0x3, 0x0, 0x132, 0x3}) 13.732018509s ago: executing program 1 (id=507): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000003380)='system.posix_acl_access\x00', &(0x7f0000000900)=ANY=[@ANYBLOB="02000000010003000000000002000200", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="02000700", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="02000700", @ANYRES32=0x0, @ANYBLOB="040000000000000008000300", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000400", @ANYRES32=0x0, @ANYBLOB="00080500000000002000000000000000"], 0x64, 0x2) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000000)=""/196, 0xc4}, {&(0x7f0000000200)=""/42, 0x2a}], 0x2, 0xa3, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r5, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_LISTDEF(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010c2abd7000fcdbdf250600000006000b000300000000"], 0x1c}, 0x1, 0x0, 0x0, 0xd4}, 0x20004000) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRES64, @ANYRES64=r1], 0x50) r8 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000007c0)={r8, 0x20, &(0x7f0000000780)={&(0x7f0000000480)=""/99, 0x63, 0x0, &(0x7f0000000680)=""/218, 0xda}}, 0x10) 13.664163641s ago: executing program 3 (id=508): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x34d403) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x2c00c014) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x22020400) r7 = memfd_create(0x0, 0x0) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r8 = dup(r6) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000180)={0xa, 0x4e24, 0x0, @loopback, 0xa}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=0x0], 0x20}}], 0x1, 0x1000) epoll_pwait(r2, &(0x7f00000000c0)=[{}, {}], 0x2, 0xfe, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="440000001000010404000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="38410000440b00002400128009000100626f6e640000000014000280050001000100000008000200", @ANYBLOB="f7"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x10000001}) 13.560718664s ago: executing program 2 (id=509): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r2, 0x388, 0x41d9fda7) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) syz_open_procfs(0x0, &(0x7f0000000100)='map_files\x00') r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r3, 0x0, 0x0, 0x810) 12.473209081s ago: executing program 1 (id=510): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911040000000000000003c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62458c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b1", 0x7c}, {&(0x7f00000025c0)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}, {&(0x7f00000006c0)="97b13f5cf9f584c87e0e637d2ff483a311bb412cb3b03c3d9e97e435f2fceb58ff0402ed7b96244b43386c222917662028d7a01206a1990722ccef1d8f39f7c8ae242e58359217b1c6161ea741445cf16b0c48eb18a6c72174dfb7cd1bd0f409dad5a432bed4afb470da3656dd30d70769e229dc91037321d618e1eff4a176ea46d5cd4d5da97f80356e46d9e8166bf2d97210b631654ece218a2a204a1786ab5a60a881a7a294cd2f92438350e6e3ec4439ebe06133ff65b1e32b809ba0482783b563ec8e5778285da5211e5821135433053a7921319c544d5e797f", 0xdc}, {&(0x7f00000007c0)="75c37714a0bada8343bceb64ccb6d95a2a37b020e0bf1f6a1de4584223a2f285aaca30a9554cd5cdc1659cb9fec462cc5c2220a7cd891ec3bad99fe3c06e15a109ec0fdb6aeeee5ef8e4bfc28e17984a3860b907d549492d47a447782b7357ea72f4b2c26512a6a33c0247b730a6182ea5a99aee25fcee07f9cb0a80595cd5f744fa6898fdffda5b34b19474b8e853467329e4aea36cfd0e00735d37beb0f895c5688259a8935194eefd3a96d55707133a08f03e14da563160a545396b93341f41c161c93687e28a", 0xc8}, {&(0x7f0000000b00)="1b080b7a30aec939ce8e26e0cbbe37fc064ceef965fd5e3b6739c966492dbdf71c04423d8a403e56dfd224e4e55918a5e31e683fec5cc9460882a0d1628d02d51a8da997073f856e2cd00586c6e8c89c71cf8be6121b0b3a85d597a1afb0cc311f30cc26183c8e594ce5ff62661c9e32cbc9dd9a72985e9857f3bddb52382b6c27ca85d5774cf17b92e2d2097f12a8687e70f90d46381a47706a9124a2cf61b84f26aae22fd4da84ae35b93f7be9fdfdfbf33c59f5c657e9f7e81b81b786082f88af4de07808ff3c954bae", 0xcb}], 0x8, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r4, &(0x7f0000001140)={0x0, 0x2, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1}, 0x40000100) socket(0x2a, 0x2, 0x0) 12.426183632s ago: executing program 0 (id=511): getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r0, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000280), 0x200, 0x102) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r2, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x200, 0x807c2, 0x41414770, 0x32314152, 0x425, 0x10004, 0x3, 0x2, 0xfeedcafe, 0x3, 0x2, 0x1}}) 11.195440152s ago: executing program 1 (id=512): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000240), &(0x7f00000008c0)='./file1\x00', 0x800010, &(0x7f0000000940)=ANY=[@ANYBLOB="646d61736b3d30303030303030303030303030303030303030303030302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c726f6469722c666d61736b3d30303030303030303030303030303030e3a513334f6f9a6a6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c648bb5e16f733178666c6f7070792c726f6469722c756e695f786c6174653d312c71756965742c0016a3b6cfc30a6b6ea8fea18cfc48fdd94c0591b42f43fe4be411b5eba2b809955bea57e386f8294c57f39de988284b07250e04596d1625907104c7f7796ae6f91c4a546cb460e8b2c9f6166ae1ff7a5e66800828d764d89a7151af89d574fa143d4284ea55977cb7d4b018aee77791a5e50d85c1613c85812975fd5e3d04fd210f76395f7105bf864c063699d12dd45cc1460e03464dc0d782ea786b15ba648d54b57be073d0eeb56c7d2c5af204a735e18b4d736bf0c43c8c9a9778e1e7952cc6c38049d08f73b01e70c6b5c24fea92b569adeb26efdef668541efc1e32038bd2498b929710e0be39045a86e3f654705943bcaecd1cf6a32d51da0a12de44dd93c1cc98711ac512d7dade70b92f7c4e34d987f0c5af374a9baaa8644fa97bc143ea5a761e234dcf880549870e770adf64caa7cc4cf759c182820600000000"], 0xf5, 0x2f4, &(0x7f0000001000)="$eJzs3ctrE1scwPFf3kl7e9PF5XK5qBwqiCIdmoA7FxZpQQwobSNYQZjaqYZMk5IJhYjYLgS3rl104VIEEdy5EXHbjX+Br1033VmwODKZmXSajmla6dPvZ9Gczvn95pyZc6aP02Zm5eKT2fKMpX234xLUL1GJeeVFOfd+6dPJ8Xd/uZ8rNTo8kcsrFRWRWw9eDLyt9954/feblCz3315ZzX9dPjEh8mPinkRVyVIV27ZtNVWt1iNO8nTJKmtKXTcN3TJUqWIZtbrSm/X6lGmoGbM6N9dQemW6r2euZliW0isNVTYaql5V9VpD6Xf1UkVpmqb6egTNwfJFt9RFOiUWn6/Ztqw6A5RaFNu2Q6IX/ULCe039XmdxmLSNf8fYLZMjtpc9w35Ys+Ot8U9uM/44ftzr//PTbq5/HD/jNyevDhcKI2NKpUVmH88X54vuq1v/sVdKYoohS2PnJ9fFmSMeiTgfR68URoZUU7+cmV3w8hfmi+43h+EZLz8nWefnlEC++Pk5N19tzk9ITzA/L1n5Jzw/7+dLNJCflLOnA/maZOXDHamKKdPi5G7kP8wpdflaoa39TDMOAAAAAAAAAICjSFMtG+v3kdafejOalmr+x0erPuNsduLcgNb6+pBkZT18fX4odH0/Lv/HD/DAAQAAAAD4g1iN+2XdNI3a3hRizzIdmkiIiFMQeTTgdKbjDv/1etxd68lTYQcY69zEpkLmgruDl2Nex2QvT9QuC1ERCW5x36yRdM7lKz8mI2Hp0R1NgMFk6JlP7+shSzfBkt7dxE51PbXaC5F1f8t/oTF2ZPv92LqZcLf4F+Z2rV/a0eXwy0K6/UQNfnH3a3b4ovGttcQHAAAA4AgJ/OIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyK5uHubft39zlXiPiN96S7b258Rz338AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh9DPAAAA///EKa42") sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0xa, 0x4, &(0x7f0000000700)=ANY=[@ANYRES16=r0], 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x8}, 0x94) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) socket$packet(0x11, 0x3, 0x300) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="04021d"], 0x20) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newsa={0x148, 0x10, 0x1b020ba487bfd163, 0x0, 0x0, {{@in6=@mcast1, @in6=@local}, {@in6=@private1, 0x0, 0x33}, @in6=@empty, {0x7, 0x0, 0x4, 0x1, 0xb, 0x0, 0xffffffffffffffff}, {}, {}, 0x3, 0x0, 0xa}, [@algo_auth={0x56, 0x1, {{'cmac(aes)\x00'}, 0x70, "f76c53a22efbe5b37da0debc7f83"}}]}, 0x148}, 0x1, 0x0, 0x0, 0x40000}, 0x4004) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x5b8, 0x0, 0x0, 0x428, 0x428, 0x428, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) ioctl$TIOCSTI(r6, 0x5412, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) 9.580066272s ago: executing program 1 (id=513): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0xfffffffffffffffc, 0x78dbf62b75df37d8) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @loopback}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000940)={[{}, {@usrquota}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}]}, 0x3, 0x447, &(0x7f0000000380)="$eJzs28tvG0UYAPBv10lKX8SU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlW0IFSOqBJ3xIEDEn8BJ7gg4ITEFe6oUoV6aeFktPZuYjt2mocTF/z7SdvO7M5q5vPu2DM72QD61kj2TxKxKyJ+j4jhera5wEj9v1s3Lk7/fePidBLV6lt/JbVyN29cnC6KFuftzDOjaUT6aRIH2tQ7f/7C6alKZfZcnh9fOPP++Pz5C8+eOjN1cvbk7NnJY8eOHpl44fnJ57oSZ9amm/s/mju477V3rr4xffzquz9/mxTxt8TRJSMrHXyiWu1ydb21uyGdDPSwIaxJKSKyyzVY6//DUYqlizccr37S08YBm6parVZ3dj58uQr8jyXR6xYAvVH80Gfz32LboqHHHeH6S/UJUBb3rXyrHxmINC8z2DK/7aaRiDh++Z8vsy025zkEAECT77PxzzPtxn9p3N9Q7u58bagcEfdExJ6IuDci9kbEfRG1sg9ExINrrL91kWT5+Ce9tq7AVikb/72Yr201j/+K0V+US3ludy3+weTEqcrs4fwzGY3BbVl+YoU6fnjlt887HWsc/2VbVn8xFszbcW1gW/M5M1MLUxuJudH1jyP2D7SLP1lcCUgiYl9E7F9nHaee+uZgp2O3j38FXVhnqn4V8WT9+l+OlvgLycrrk+N3RWX28HhxVyz3y69X3uxU/4bi74Ls+u9oe/8vxl9OGtdr59dex5U/Pus4p1nd/V+91HhOdv8PJW/X0kP5vg+nFhbOTUQMJa/XG924f3Lp3CJflM/iHz3Uvv/viaVP4kBEZDfxQxHxcEQ8krf90Yh4LCIOrRD/Ty8//t76499cWfwza7r+S4mhaN3TPlE6/eN3TZWW1xJ/dv2P1lKj+Z7VfP+tpl3ru5sBAADgvyeNiF2RpGOL6TQdG6v/vfze2JFW5uYXnj4x98HZmfo7AuUYTIsnXcMNz0Mn8ml9kZ+M+LoxfyR/bvxFaXstPzY9V5npdfDQ53Z26P+ZP0u9bh2w6byvBf1L/4f+pf9D/9L/oX+16f/be9EOYOu1+/2/1IN2AFuvpf9b9oM+Yv4P/Uv/h/6l/0Nfmt8et39JXkJiWSLSO6IZEt1JpBHRtGf5d0W5F19QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG/RvAAAA//831udB") lsetxattr$trusted_overlay_upper(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[], 0x50) syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES32=0x0], 0x47, 0xc11, &(0x7f0000000d00)="$eJzs3V1oXOl5B/DnnSOtRto00WYTb9Jm04GUxCi18VdsBZcgZxW1AccbIit0r6LRh51h5ZGR5MabtkFtSQu9Cd2b0psimi4t5KJX3V5WabaQUAol5CK9KAiaLHvRC10ECi0bhXPmHWlky7ayXlvS7u+3zP7PnHnO+P0YnzkCvzoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAER89nOXTp1OB90KAOBxujL5pVNnff8DwLvKVT//AwAAAAAAAAAAAADAYZeiiGORYujVzTRdPe+oX261b92eGp/Y+7DBFClqUVT15aN++szZc586f2G0m/c//u324Xh+8uqlxnOLN24uzS8vz881ptqt2cW5+X2/w8Mef6eRagAaN168NXft2nLjzMmzu16+Pfz6wJPHhi9eOHF+tFs7NT4xMdlT09f/lv/0u9xrhccTUUQzUrw5/EZqRkQtHn4sHvDZedQGq06MVJ2YGp+oOrLQarZXyhdTLVfVIho9B411x+gxzMVDGYtYLZtfNnik7N7kzeZSc2ZhvvHF5tJKa6W12E61TmvL/jSiFqMpYi0iNgbufrv+KOKjkeLlU5tpJiKK7jh8sloY/OD21B5BH/ehbGejP2KtdgTm7BAbiCKuRIqfvXY8Zssxy4/4eMQXynw14pUyPxORyg/GuYif7vE54mjqiyL+PVIsps00V50PuueVy19ufL59bbGntnteOfLfD4/TIT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25HiT579vWpdcVTr0t93cfQ9L/x275rxZx7wPmXtyYhYre1vTW5/XjqcauV/j6Bj7Es9ivhGXv/3RwfdGAAAAAAAAAAAAAAAAAAAgHe1Il6IFF85cTytRe89xVvt642rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzDsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KBbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIk5Fi/YV69XytFnE1In6+tbXVfUTEZpkP66D7CgAAAAAAAAAAAAAAAAAAAIdWKuJjkeLp/9tMjYi4Pfz6wJPHhi9eOHF+tIgiUlnSW//85NVLjecWb9xcml9enp9rTLVbs4tz8/v94+qXW+1bt6fGJx5JZx5o8BG3f7D+3OLNl5Za17+6sufrQ/VLM8srS83ZvV+OwahFTPfuGakaPDU+UTV6odVsV4em2j0aWIsY229nAAAAAAAAAAAAAAAAAAAAODSGUhGfixQ/+a9zqbtuvK+z5v9XOs+K7dpX/mDndwEs3JFdvb8/YD/bab8NHakW3jemxicmJnt29/XfXVq2KaUinokUn3j5Q9V6+BRDe66NL+veW9bdOJfrhn+trFvdVVUfmRqfaFxZbJ+4tLCwONtcac4szDcmbzZn9/2LAwAAAAAAAAAAAAAAAAAAAOA+hlIRP4oU//P3/5G6953P6//7Os961v//VrWEvlJPu3Nbtbb/vdXa/s72+y6ODn302XvtfxTr/8s2pVTENyPF2R99qLqffnf9//QdtWXdn0WKN579SK6rPVHWNbvd6bzjtdbC/Kmy9q8jxa+/2a2NqvZ6rn16p/Z0WTsYKf5yc3ftV3PtB3Zqz5S1xyPF9/5779oP7tSeLWt/Ein+6e8a3dqhsvb3c+2xndqTs4sLcw8a1nL+vxMp/vbK76Run+85/z2//2H1jtx215zff/vtmv/hnn2reV7/NM9/8wHzfz5SfKf+kVzXGfuZ/PpT1f935v8TkeI//2137bVc+/6d2tP77dZBK+f/25Hiu3/14+0+5/nPI7szQ73z/6t9u3P7U3JA8/9Uz77h3K7ZX3Is3o2WX/r6i82FhfklGzZs2NjeOOgzE49D+f3/55Hi/48VqXsdk7//39N5tnP997/f2Pn+v3hHbjug7//39+y7mK9a+vsi6is3bvY/E1FffunrJ1o3mtfnr8+3z5w+9elPnz996vT5/ie6F3c7W/seu3eCcv5/ECl++A8/3P45Zvf1397X/0N35LYDmv+ne/u067pm30PxrlTO/99Eiqc+++Ptnzfvd/3f/fn/+Md25/bfvwOa/w/07BvO7Wr9kmMBAAAAAAAAAABwlAylIv4iUvzuH/9m6q4h2s+//5u7I7cd0L//Otazb+4xrWvY9yADABwi5fXfByPFP299f3st9+7rv/iNbm3v9d+9HIb7/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFGXoog/jBRDr26m9YHyeUf9cqt96/bU+MTehw2mSFGLoqovH/XTZ86e+9T5C6PdvP/xb7cPx/OTVy81nlu8cXNpfnl5fq4x1W7NLs7N7/sdHvb4O41UA9C48eKtuWvXlhtnTp7d9fLt4dcHnjw2fPHCifOj3dqp8YmJyZ6avv63/KffJd1j/xNRxPcjxZvDb6TvDkTU4uHH4gGfnUdtsOrESNWJqfGJqiMLrWZ7pXwx1XJVLaLRc9BYd4wew1w8lLGI1bL5ZYNHyu5N3mwuNWcW5htfbC6ttFZai+1U67S27E8jajGaItYiYmPg7rfrjyK+GSlePrWZ/mUgouiOwyevTH7p1NkHt6f2CPq4D2U7G/0Ra7UjMGeH2EAU8Y+R4mevHY/vDUT0RecRH4/4QpmvRrxS5mciUvnBOBfx0z0+RxxNfVHEuUixmDbTawPl+aB7Xrn85cbn29cWe2q755Uj//3wOB3yc1M9ivhBdcbfTP/q7zUAAAAAAAAAAAAAAADAIVLEWqT4yonjqVofvL2muNW+3rjanFnoLOvrrv3rrpne2traaqROjuWczrmacy3nes6NnFHLx+ccyzmdczXnWs71nBs5o8jH5xzLOZ1zNedazvWcGzmjLx+fcyzndM7VnGs513Nu5IxDsnYPAAAAAAAAAAAAAAAAAAB4Z6lFUd3F/Vtf20xbA537S09HJ9fdD/Qd7xcBAAD//0kCdPc=") setrlimit(0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r4, &(0x7f0000001b80)=[{&(0x7f0000000140)=""/105, 0x69}, {&(0x7f0000000500)=""/101, 0x65}], 0x2, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x6c00}, 0x0) 9.496505604s ago: executing program 0 (id=514): mkdirat(0xffffffffffffff9c, &(0x7f00000000a0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000a0)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x5, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x0, @random='\x00\x00\x00\x00\x00\a'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab58baeda525e1a8deffafde25"}) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x100000000000000) openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyGS0\x00', 0x2, 0x0) 8.190820507s ago: executing program 0 (id=515): write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) add_key$keyring(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0xfffffffffffffffa) write(r0, &(0x7f0000000100)="d3f76ed5711d1a90b4a64994feeb0525b5a62c4faba3fbdafde38545312abcebecea155fce80eafafe6de81b328b709c70a4e0c7", 0x34) socket$inet6(0xa, 0x80002, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, 0x0, 0x0, 0x2, 0x9}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x0, 0x0, 0x4007}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f000001fcc0)={'syztnl1\x00', &(0x7f000001fc40)={'ip6gre0\x00', r2, 0x2f, 0x6, 0x74, 0x101, 0x40, @dev={0xfe, 0x80, '\x00', 0x42}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x8000, 0x8, 0x401}}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000080) read$FUSE(r0, 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000040)='binder\x00', 0x320081a, 0x0) r4 = syz_open_procfs(0x0, 0x0) pread64(r4, &(0x7f0000002240)=""/237, 0xed, 0x4eb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$netlink(0x10, 0x3, 0x8000000004) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x13, 0x0, 0x0) 6.901933109s ago: executing program 3 (id=516): openat$tun(0xffffffffffffff9c, 0x0, 0x125000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000ac0)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e20, 0x487, @dev={0xfe, 0x80, '\x00', 0x23}, 0x6}, 0x1c) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x3, @empty}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b0f, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) chdir(&(0x7f0000000000)='./cgroup\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r5, 0xfffffffffffffffe, 0x29) ioctl(r4, 0x8b32, 0x0) 6.821157431s ago: executing program 0 (id=517): setns(0xc9, 0x0) socket(0x8, 0x5, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000900)=[@in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x1c) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={r5, 0x6}, 0x8) syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000100)='./file1\x00', 0x8000, &(0x7f0000000200)=ANY=[@ANYBLOB='discard,keep_last_dots,iocharset=cp1251,utf8,errors=remount-ro,dmask=00000000000000000000010,iocharset=cp1250,sys_tz,uid=', @ANYRESHEX=0x0, @ANYBLOB=',gid=', @ANYRESHEX=0x0, @ANYBLOB='6\x00'], 0x2, 0x1548, &(0x7f0000000380)="$eJzs3AuYTdX7OPD3XWvtMSSdJrkMa613c5LLMkmSS5JckiRJktwSkib5SkJiyC1pSEJyGZLLEJLLxKRxv98vCU2SJklCckvW/1H8fftVv++lvl/P85v38zz7sd6z9rv22vOeM2fvdZz5psvQmo1rVWtIRPCn4C//JAFALAAMBIBrACAAgHJx5eIu9OeUmPTnDsL+Wg+lXukZsCuJ65+9cf2zN65/9sb1z964/tkb1z974/pnb1x/xrKzzdMLXstb9t14/T874/f//0OySo/9Ym3p67sCxPyzKVz/7I3r/39W8M/sxPXP3rj+2VXslZ4A+yvN/vfS+PWfHeT4wx6uf/bG9WcsO/t5HTgnXPF16Cu1QSR7fwZypZ9/jDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcayh9P+MgUAl9pXel6MMcYYY4wxxhj76/gcV3oGjDHGGGOMMcYY+89DECBBQQAxkANiISfkAgEAV0MeuAYicC3EwXWQF66HfJAfCkBBiIdCUBg0GLBAEEIRKApRuAGKwY1QHEpASSgFDkpDAtwEZeBmKAu3QDm4FcrDbVABKkIlqAy3QxW4A6rCnVAN7oLqUANqQi24G2rDPVAH7oW6cB/Ug/uhPjwADeBBaAgPQSN4GBrDI9AEHoWm0AyaQwto+W/lvwA94EXoCb0gCXpDH3gJ+kI/6A8DYCC8DIPgFRgMr0IyDIGh8BoMg9dhOLwBI2AkjII3YTS8BWNgLIyD8ZACE2AivA2T4B2YDFNgKkyDVJgOM+BdmAmzYDa8B3PgfZgL82A+LIA0+AAWwiJIhw9hMXwEGbAElsIyWA4rYCWsgtWwBtbCuh/7wgbYCJtgM2yBrbANtsMO2Akfwy74BHbDntfnAUAmfPZH+bD+d/NPXcqHvfApZEJXBAQUKFChwhiMwViMxVyYC3NjbsyDeTCCEYzDOMyLeTEf5sMCWADjMR4LY2E0aJCQsAgWwShGsRgWw+JYHEtiSXToMAETsAzejGWxLJbDclgey2MFrIgVsTJWxipYBatiVayG1bA6VseaWBPvxruxN9bBOlgX62I9rHdpeQobYkNshI2wMTbGJtgEm2JTbI7NsSW2xFbYCltja2yLbbEdtsP22B4TMRE7YAfsiB2xE3bCztgZu2AX7IrdsFvWCzkAX8QXsRdWF72xD/bBvpicoz8OwAH4Mg7CV/AVfBWTcQgOxdfwNXwdh+NJHIEjcRSOwiriLRyDY5HEeEzBFJyIE3ESTsLJOAWn4DRMxek4A2fgTJyFs/A9nIPv4/s4D+fhAkzDNFyIizAd03ExnsIMXIJLcRkuxxW4HFfhalyFa3EdrsUNuAE34SbcgltwG27DHbgDP0YFgJ/gHtyDyZiJmbgP9+F+3I8H8ABmYRYexIN4CA/hYTyMR/AIHsVjeByP4Qk8gSfxFJ7G03gWz+I5fC7+q0Yfl1iTDOICJZSIETEiVsSKXCKXyC1yizwij4iIiIgTcSKvyCvyiXyigCgg4kW8KCwKCyOMIBHGAICIiqgoJoqJ4qK4KClKCiecSBAJoowoI8qKsqKcuFWUF7eJCqKiaOMqi8qiimjrqoo7RTVRTVQXNURNUUvUErVFbVFH1BF1RV1RT9QT9cUDooHojf3xIXGhMo3FEGwihmJT0UzIi7/BWonh2Fq0EW3FE2IkjsD2opVLFE+LDmIMdhR/E2PxWdFZjMcu4nnRVXQT3cULoodo7XqKXmIy9hZ9xDTsK/qJ/mKAmIk1xHs4J2dN8apIFkPEUPGaWICvi+HiDTFCjBSjxJtitHhLjBFjxTgxXqSICWKieFtMEu+IyWKKmCqmiVQxXcwQ74qZYpaYLd4Tc8T7Yq6YJ+aLBSJNfCAWikUiXXwoFouPRIZYIpaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdoqPxS7xidgt9oi94lORKT4T+8TnYr/4QhwQX4os8ZU4KL4Wh8Q34rD4VhwR34mj4pg4Lr4XJ8QP4qQ4JU6LM+Ks+FGcEz+J88ILkCiFlFLJQMbIHDJW5pS55FUytwwu/nSvlXHyOplXXi/zyfyygCwo42UhWVhqaaSVJENZRBaVUXmDLCZvlMVlCVlSlpJOlpYJ8iZZRt4sy8pbZDl5qywvb5MVZEVZSVaWt8sq8g4JkV+OUV3WkDVlLXm3TIJ7ZB15r6wr75P15P2yvnxANpAPyobyIdlIPiwby0dkE/mobCqbyeayhWwpH5Ot5OOytWwj28onZDv5pGwvn5KJ8mnZQfqLT5FnZWf5nOwin5ddZTfZXf4kz0sve8peEnqD7CNfkn1lP9lfDpAD5ctykHxFDpavymQ5RA6Vr8lh8nU5XL4hR8iRcpR8U46Wb8kxcqwcJ8fLFDlBTpRvy0nyHTlZTpFT5TSZKqfL/hdHmi3lP8x/+3fyB/989E1ys9wit8ptcrvcIXfKj+UuuUvulrvlXrlXZspMuU/uk/vlfnlAHpBZMkselAflIXlIHpaH5RF5RB6Vx+QZ+b08IX+QJ+UpeUqekWflWXnu4s8AFCqhpFIqUDEqh4pVOVUudZXKra5WedQ1KqKuVXHqOpVXXa/yqfyqgCqo4lUhVVhpZZRVpEJVRBVVUXUDXnzCqJKqlHKqtEpQN/0r+aqYulEVVyV+lX9pfkl/ML+WqqVqpVqp1qq1aqvaqnaqnWqv2qtElag6qA6qo+qoOqlOqrPqrLqoLqqr6qq6q+6qh+qheqqeKkklqT7qJdVX9VP91QA1UL2sBqlBarAarJJVshqqhqphapgaroarEWqEGqVGqdFqtBqjxqhxapxKUSlqopqoJqlJarKarKaqqSpVpaoZaoaaqWaq2Wq2mqPmqLlqrpqv5qs0laYWqoUqXaWrxWqxylBL1BK1TC1TK9QKtUqtUmvUGrVOrVMb1AaVoTarzWqr2qq2q+1qp9qpdqldarfarfaqvSpTZap9ap/ar/arA+qAylJZ6qA6qA6pQ+qwOqyOqCPqqDqqjqvj6oQ6oU6qk+q0Oq3OqrPqnDqnzqvzFy77AhGIQAUqiAligtggNsgV5ApyB7mDPEGeIBJEgrggLsgbXB/kC/IHBYKCQXxQKCgc6MAENhAXix4NbgiKBTcGxYMSQcmgVOCC0kFCzMXO4JagXHBrUD64LagQVAwqBZWD24MqwR1B1eDOoFpwV1A9qBHUDGoFdwe1g3uCOsG9Qd3gvqBecH9QP3ggaBA8GDQMHgoaBQ8HjYNHgibBo0HToFnQPGgRtAxuDsr+ZeN7fzL/466n7qWTdG/dR7+k++p+ur8eoAfql/Ug/YoerF/VyXqIHqpf08P063q4fkOP0CP1KP2mHq3f0mP0WD1Oj9cpeoKeqN/Wk/Q7erKeoqfqaTpVT9cz9Lt6pp6lZ+v39Bz9vp6r5+n5eoFO0x/ohXqRTtcf6sX6I52hl+ileplerlfolXqVXq3X6LV6nV6vN+iNepPerLforXqb3q536J36Y71Lf6J36z16r/5UZ+rP9D79ud6vv9AH9Jc6S3+lD+qv9SH9jT6sv9VH9Hf6qD6mj+vv9Qn9gz6pT+nT+ow+q3/U5/RP+rz2Fy7uL7y9G2WUiTExJtbEmlwml8ltcps8Jo+JmIiJM3Emr8lr8pl8poApYOJNvClsCpsLyJApYoqYqImaYqaYKW6Km5KmpHHGmQSTYMqYMqasKWvKmXKmvClvKpgKppKpZG43t5s7zB3mTnOnucvcZWqYGqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkGpvGpolpYpqapqa5aW5ampamlWllWpvWpq1pa9qZdqa9aW8STaLpYDqYjqaj6WQ6mc6ms+liupiupqvpbrqbHqaH6Wl6miSTZPqYPqav6Wv6m/5moBloBplBZrAZbJJNshlqhpphZpgZboabEWakGXXhQtW8ZcaYsWacGW9STIqZaCaaSWaSmWwmm6lmqkk1qWaGmWFmmplmtplt5pg5Zq6Za+ab+SbNpJmFZqFJN+lmsVlsMkyGWWqWmuVmuVlpVprVZrVZa9aa9bDebDQbzWaz2Ww1W812s93sNDvNLrPL7Da7zV6z12SaTLPP7DP7zX5zwBwwWSbLHDQHzSFzyBw2h80Rc8QcNUfNcXPcnDAnzElz0pw2p81Zk//i+6U3sTanzWWvsrnt1TaPvcb+z7iALWjjbSFb2Gqbz+b/VWystcVtCVvSlrLOlrYJ9qbfxBVsRVvJVra32yr2Dlv1N3Fte4+tY++1de19tpa9+1dxPXu/rW8fsQ0QAWwz28i2sI3tI7aJfdQ2tc1sc9vCtrNP2vb2KZton7Yd7DO/iRfaRXa1XWPX2nV2t91jT9sz9pD9xp61P9qetpcdaF+2g+wrdrB91SbbIb+JR9k37Wj7lh1jx9pxdvxv4ql2mk210+0M+66daWf9Jk6zH9g5Nt3OtfPsfLvg5/jCnNLth3ax/chm2ACW2mV2uV1hV9pV/3+uy+wGu9FusrvsJ3ar3Wa32x1256ULYbvH7rWf2kz7mT1ov7b77Rf2gD1ss+xXP8cXzu+w/dYesd/Zo/aYPW6/tyfsD+pS9oVz/97+ZM9bb4GQgCQpCiiGclAs5aRcdBXlpqspD11DEbqW4ug6ykvXUz7KTwWoIMVTISpMmgxZIgqpCBWlKN1Al6ZXkkqRo9KUQDdRGbqZytItVI5upfJ0G1WgilSJKtPtVIXuoKp0J1Wju6g61aCaVIvuptp0D9Whe6ku3Uf16H6qTw9QA3qQGtJD1Igepsb0CDWhR6kpNaPm1IJa0mPUih6n1tSG2tIT1I6epPb0FCXS09SBnqGO9DfqRM9SZ3qOutDz1JW6UXd6gXrQi9STelES9aY+9BL1pX7UnwbQQHqZBtErNJhepWQaQkPpNRpGr9NweoNG0EgaRW/SaHqLxtBYGkfjKYUm0ER6mybROzSZptBUmkapNJ1m0Ls0k2bRbHqP5tD7NJfm0XxaQGn0AS2kRZROH9Ji+ogyaAktpWW0nFbQSlpFq2kNraV1tJ420EbaRJtpC22lbbSddtBO+ph20Se0m/bQXvqUMukz2kef0376gg7Ql5RFX9FB+poO0Td0mL71veg7OkrH6Dh9TyfoBzpJp+g0naGz9COdo5/oPHmCEEMRylCFQRgT5ghjw5xhrvCqMHd4dZgnvCaMhNeGceF1Yd7w+jBfmD8sEBYM48NCYeFQhya0IYVhWCQsGkbDG8Ji4Y1h8bBEWDIsFbqwdJgQ3hSWCW8Oy4a3hOXCW8Py4W1hhbBi+Mh9lcPbwyrhHWHV8M6wWnhXWD2sEdYMa4V3h7XDe8I64b1h3fC+sGx4f1g/fCBsED4YNgwfChuFD4eNw0fCJuGjYdOwWdg8bBG2DB8LW4WPh63DNmHb8ImwXfhk2D58KkwMnw47hM/83H//oj/uTwp7h33Cl8KXQu/vlfOjC6Jp0Q+iC6OLounRD6OLox9FM6JLokujy6LLoyuiK6Oroquja6Jro+ui66Mbohujm6Le18oBDp1w0ikXuBiXw8W6nC6Xu8rldle7PO4aF3HXujh3ncvrrnf5XH5XwBV08a6QK+y0M846cqEr4oq6qLvBFXM3uuKuhCvpSjnnSrsE18K1dC1dK/e4a+3auLbuCfeEe9I96Z5yT7mnXQf3jOvo/uY6uWddZ/ece84977q6bq67e8H1cBPy/PKaTHJ9XB/X1/V1/V1/N9ANdIPcIDfYDXbJLtkNdUPdMDfMDXfD3Qg3wo1yo9xoN9qNcWPcODfOpbgUN9FNdJPcJDfZTXZT3VSX6lLdDDfDzXQzXZVZvxxlrpvr5rv5Ls2luYXuwjVjulvsFrsMl+GWuqVuuVvuVrqVbrVb7da6tW69W+82uo1us9vstrqtbrvb7na6nW6X2+V2+2t+GdRlun1un9vv9rsD7kuX5b5yB93X7pD7xh1237oj7jt31B1zx9337oT7wZ10p9xpd8addT+6c+4nd955lxKZEJkYeTsyKfJOZHJkSmRqZFokNTI9MiPybmRmZFZkduS9yJzI+5G5kXmR+ZEFkbTIB5GFkUWR9MiHkcWRjyIZkSWRpZFlkeWRFRHvC20NfRFf1Ef9Db6Yv9EX9yV8SV/KO1/aJ/ibfBl/sy/rb/Hl/K2+vL/NV/AVfSX/qG/qm/nmvoVv6R/zrfzjvrVv49v6J3w7/6Rv75/yif5p38E/4zv6v/lO/lnf2T/nu/jnfVffzXf3L/ge/kXf0/fySb637+Nf8n19P9/fD/AD/ct+kH/FD/av+mQ/xA/1r/lh/nU/3L/hR/iRflTMm370pVtkGO9T/AQ/0b/tJ/l3/GQ/xU/103yqn+5n+Hf9TD/Lz/bv+Tn+fT/Xz/Pz/QKf5j/wC/0in+4/9Iv9Rz7DL7m0qOxX+lV+tV/j1/p1fr3f4Df6TX6z3+K3+m1+u9/hd/qP/S7/id/t9/i9/lOf6T/z+/znfr//wh/wX/os/5U/6L/2h/w3/rD/1h/x3/mj/pg/7r/3J/wP/qQ/5U/7M/6s/9Gf8z/58/ydNcYYY4yxf8qEy03x655flvN7/06O+Lud+wDA1dsKZv19/4UryvX5fmn3E/HtIgDwdK8uD13aqldPSkq6uG+GhKDoPIBLnwRd8POy8cV4CbSFJyER2kCZ351/P9HtLP2D8aO3AuT6u5xYuBxfHv9zAEz6nfEfe2LUwvLh6bj/Zfx5AMWLXs7JCZfjJdD25/WVNlD2D+afv9U/mH/OL1IAWv9dTm64HF+efwI8Ds9A4q/2ZIwxxhhjjDHGftFPVOp06f7z0v/4/L3783h1OScHXI7/0f05Y4wxxhhjjDHGrrxnu3V/6rFL39x7LDGxTaefH/lnGlX/lZ3/9UYT+E+NzI3fbXgPcOkRBQB/ckCACw353zyLLf+VYyVffLX8z67lZ3wA3Ytd/NLjX3fQ2D9fi3+ncaV+IzHGGGOMMcb+Uy5f9P/6cXWlJsQYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjGVD/40/J3alz5ExxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi70v5fAAAA//8XnvpB") syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40000100, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 5.588010241s ago: executing program 3 (id=518): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) sendmmsg$inet(r2, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000340)}}], 0x1, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) close(r2) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16) ppoll(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}, 0x0, 0x2d}) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1}, &(0x7f0000000240)=""/186, 0xba, &(0x7f0000000440)={0x0, &(0x7f00000003c0)}) 4.232933065s ago: executing program 0 (id=519): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 3.507796673s ago: executing program 2 (id=520): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r3, &(0x7f0000006440)={0x0, 0x0, &(0x7f0000006400)={&(0x7f0000006380)={0x10, 0x140b, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000) ioprio_get$uid(0x3, 0x0) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) capget(&(0x7f0000000180)={0x19980330, r0}, &(0x7f00000001c0)={0x1, 0x8, 0x5, 0x1, 0x3}) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}]}) openat$dir(0xffffff9c, &(0x7f0000000340)='./file0/file1\x00', 0x40, 0x2e) lsetxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), &(0x7f0000000300), 0x2, 0x1) 2.927990407s ago: executing program 1 (id=521): syz_open_dev$video(0x0, 0x485, 0x40000) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_J1939_PROMISC(0xffffffffffffffff, 0x6b, 0x2, &(0x7f0000000200)=0x1, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000141000001c00128009000100626f6e64000000000c00028005001f"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r2, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/205, 0xcd}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)=ANY=[], 0x6a) 2.861175189s ago: executing program 3 (id=522): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r1, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000280), 0x200, 0x102) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r3, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x200, 0x807c2, 0x41414770, 0x32314152, 0x425, 0x10004, 0x3, 0x2, 0xfeedcafe, 0x3, 0x2, 0x1}}) 2.620173485s ago: executing program 0 (id=523): unshare(0x28000600) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d40)=ANY=[@ANYBLOB="2c0000000104010200000000000000000a000001080004400000000005000100010000000800034000000200"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x8080) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) write$cgroup_pid(r4, &(0x7f0000000000), 0xffffff98) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, 0x0) write(r2, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$NL80211_CMD_SET_MPATH(0xffffffffffffffff, 0x0, 0x40050) socket$kcm(0x2, 0xa, 0x2) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000300)=@nat={'nat\x00', 0x670, 0x5, 0x498, 0x100, 0x328, 0xfeffffff, 0x328, 0x328, 0x400, 0x400, 0xffffffff, 0x400, 0x400, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'caif0\x00', {}, {}, 0x6}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@devgroup={{0x38}, {0x5, 0x0, 0x0, 0x5, 0x48}}, @common=@inet=@tcp={{0x30}, {[], [0x4e20], 0x0, 0x0, 0x2}}]}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x300, 0x300]}}}, @common=@set={{0x40}, {{0x0, [0x5, 0x3, 0x1]}}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @initdev={0xac, 0x1e, 0x3, 0x0}, @remote, @icmp_id}}}}, {{@uncond, 0x0, 0xc8, 0x100, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'veth0_to_team\x00', {0x44, 0xd6ff, 0x2, 0x8, 0x0, 0x28, 0x6, 0x40, 0x20}, {0x1}}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x10, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'veth0\x00', 'wlan0\x00'}, 0x0, 0x90, 0xd8, 0x0, {}, [@common=@socket0={{0x20}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@private2, @ipv4=@dev, @port, @gre_key}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4f8) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xec, 0x21, 0x1, 0x4, 0x0, {{@in=@multicast2, @in6=@private2, 0x4e23, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x9c, 0x11, [{@in=@loopback, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@private2, @in=@multicast1, 0x6c, 0x0, 0x0, 0x2, 0x2, 0xa}, {@in=@loopback, @in=@loopback, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x2}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40000}, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r5, 0x0, 0x2d, &(0x7f0000000280)={0x6, {{0x2, 0x4e22, @private=0xa010100}}}, 0x88) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001f80)=@newtaction={0xf20, 0x30, 0x51b, 0x0, 0x0, {}, [{0xf0c, 0x1, [@m_pedit={0xf08, 0x5, 0x0, 0x0, {{0xa}, {0xe84, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe80, 0x2, {{{0x400, 0x5eac, 0x10000000, 0x3, 0x3a6}, 0x5, 0xff, [{0x1, 0x9, 0xfffffffd, 0xc, 0x4, 0x8}, {0x763553b1, 0x70, 0x2, 0x22, 0x8}, {0x4, 0x9, 0xffffffff, 0x1, 0x4, 0x7fff}, {0xc, 0xd90, 0x2, 0x3, 0x1, 0x400}]}, [{0x8, 0x7fffffff, 0x5, 0x10001, 0x49d7, 0x9981}, {0x7fffffff, 0xffff8001, 0x2, 0x58, 0x2, 0x123f}, {0x89, 0x9, 0x4, 0x4, 0x2, 0x7}, {0x3, 0x80000, 0xfffffe77, 0x3, 0x9, 0x1}, {0x2d, 0x6, 0x2, 0x9b, 0x92d, 0x7}, {0x26, 0x9, 0x6, 0x3, 0x2, 0x8}, {0x0, 0x0, 0x7, 0x9, 0x200, 0x9}, {0x8, 0xfffffffa, 0x1ff, 0x3, 0x2, 0x1}, {0x3, 0x5, 0x1, 0x80000000, 0x101, 0x8}, {0xfffffff8, 0x200, 0x9, 0x2, 0x5, 0xffff}, {0x80000, 0x10, 0x1, 0x5, 0xffff, 0x9}, {0xe7d5, 0x7fffffff, 0x40, 0xc, 0x3, 0xe20e}, {0x3, 0x1, 0x9, 0xfffffffd, 0x2, 0x80000001}, {0xeb, 0x15, 0x7fffffff, 0x10000, 0x9, 0x2}, {0xe9e, 0x6, 0x4, 0x2, 0x5, 0x8}, {0xd, 0x4, 0x8, 0xdd9, 0x1, 0xffffff81}, {0xfffffffa, 0x4, 0x0, 0x7, 0x2, 0x3}, {0x57, 0x2, 0x6, 0x3, 0x8, 0x9c}, {0x80000000, 0xdf5, 0x5, 0x6, 0xb3, 0x8}, {0x970, 0x200, 0x96, 0x298c, 0x3, 0x10001}, {0x80, 0x9cf1, 0xcf, 0x0, 0x2, 0x8}, {0x200, 0x3, 0x28f, 0x2, 0x7, 0x4}, {0x5, 0xfffffffb, 0x5, 0x0, 0x0, 0x4}, {0x9, 0x6, 0xd, 0xa, 0x5, 0x2}, {0x7, 0x200, 0x1, 0x4, 0x9, 0x2}, {0x1, 0x9, 0x1, 0x8, 0x100, 0x10000}, {0x4, 0xe, 0xd69, 0x1c, 0x5, 0x8}, {0x4, 0x8, 0x8, 0xb, 0x6, 0x5}, {0xfffffffb, 0xd, 0x0, 0xe, 0x100, 0x5}, {0x8, 0x80000001, 0x8, 0x1, 0x3d, 0xf}, {0x3, 0xffff, 0x3, 0x800, 0x6, 0x5}, {0x6b2, 0x1, 0x5, 0x2, 0x1000, 0x75}, {0x7, 0x80, 0x0, 0x9, 0x64f8e7cc, 0x5}, {0x9, 0x7, 0x0, 0xc9bb, 0x99, 0x1}, {0x4, 0x0, 0x6, 0x7, 0xfff, 0x54d}, {0x9, 0x172, 0x8000, 0x3, 0xc, 0x4aa}, {0x3, 0xc, 0xa, 0x7f, 0xe, 0x80000001}, {0x5eb, 0x9, 0x10000, 0xffffffff, 0xc6a, 0x3f}, {0x8, 0x81, 0xc, 0x0, 0x4, 0x8}, {0x5, 0x6, 0x8001, 0x74, 0x101, 0x1}, {0x5, 0x3, 0x38dd, 0x8000, 0x0, 0x54f4}, {0x7d000000, 0x3, 0x8, 0x6, 0x4, 0x4}, {0x80000001, 0x80, 0x9, 0x0, 0x6, 0x7}, {0x0, 0x6068, 0x6e, 0x694, 0x7, 0xe000000}, {0xfff, 0xfffffffb, 0x80000000, 0x1, 0x400, 0x200}, {0xfff, 0x2, 0x1a000000, 0x10, 0x6, 0xc0}, {0x1, 0x10000, 0xffff, 0x0, 0x0, 0x9}, {0x9b, 0xf78f, 0x62, 0xc, 0x0, 0x9}, {0xfffffff9, 0x4, 0x5, 0x67, 0x6, 0x7}, {0x10, 0xa, 0x18be, 0x80000001, 0x9, 0x3}, {0x3, 0x8, 0x0, 0x7, 0x5, 0xe3}, {0x7, 0x5, 0x1, 0xffff0001, 0xfffffff7, 0x5653}, {0x4, 0x7, 0x9, 0x1, 0x4, 0x8000}, {0x7, 0x0, 0x16b, 0x0, 0x401, 0x6}, {0x6, 0x100, 0x0, 0x3, 0x1, 0x6}, {0xce12, 0x739f, 0x401, 0x100, 0x4, 0x5}, {0xd, 0x3ff, 0x3, 0x7, 0x4, 0x6}, {0x3, 0x81, 0x25, 0x2, 0x2, 0x100}, {0xfffffff8, 0x1, 0x101, 0x2, 0x8, 0x7fffffff}, {0xa, 0x1, 0x7, 0x52, 0x8, 0x7}, {0x1, 0x8000, 0x7, 0x8, 0x608, 0x40}, {0x6, 0x0, 0x5, 0xc, 0x8, 0x7ff}, {0x28ff4eb9, 0x9, 0x1ff, 0x0, 0x8, 0x3}, {0x7, 0xc1ce, 0x17a, 0xd, 0x9, 0x5}, {0x80, 0x5, 0x7, 0x0, 0x4, 0x800}, {0x8000, 0xa, 0x101, 0x7, 0x605c, 0xffff}, {0x100, 0x2, 0x2, 0xa4f, 0x7ff, 0xf}, {0x3, 0x6, 0x3, 0x2, 0x34, 0xfffffff8}, {0x1ff, 0x80000000, 0xe8b4, 0x3ff, 0x101, 0x18}, {0x932e, 0xffff8000, 0x7f, 0xffffffff, 0x7, 0x8ea9}, {0x3bab, 0x6, 0x7, 0x9a0}, {0x1, 0x81, 0x871, 0x25a, 0x8, 0xf}, {0x3, 0x8001, 0x7, 0x1, 0x6}, {0x40, 0x9, 0xd696, 0x4, 0x2, 0x2}, {0x1, 0x3ff, 0x401, 0x6, 0x598348f2, 0xff}, {0x0, 0x5, 0x1, 0x8, 0x8bd2, 0xbb}, {0x9e, 0x7, 0x200, 0x40, 0x5, 0x5}, {0x2, 0xd, 0x18000000, 0xffff8001, 0x9, 0x4}, {0x8, 0x2, 0xadc6, 0x80000001, 0x6, 0x1}, {0x0, 0xe7b9b5f, 0x800, 0x3, 0x8, 0x1}, {0x0, 0x1000, 0x3, 0x7f0, 0x9, 0x4}, {0x0, 0x2, 0x0, 0x80, 0x0, 0x9}, {0x1, 0xbf7, 0x3d67, 0x2e, 0x7fffffff, 0x1a}, {0x2e, 0xe, 0x9, 0x4, 0x8, 0x1}, {0x84, 0xffff, 0x3, 0x1ff, 0x2ecf, 0xffffffff}, {0xa0, 0x5, 0x6810d5c, 0x5, 0x1, 0x5}, {0xe, 0x6, 0x1, 0x6, 0x7, 0x4}, {0x1, 0xff, 0x5, 0x6, 0xd, 0x2}, {0x5, 0x7, 0x6, 0x7ff, 0xc8f, 0x1}, {0xa79ee2e4, 0xffffffff, 0x5, 0x10, 0xfffff94d}, {0xfffffffe, 0x3ff, 0x2, 0x6, 0x3, 0x23a18014}, {0x3, 0xe00, 0x400, 0xfffffffb, 0x4, 0xe}, {0x3, 0x3, 0xd, 0x6, 0x6, 0x7}, {0x3, 0x3, 0x96, 0x81, 0x0, 0x9}, {0xdb, 0x3, 0x0, 0x5b3, 0x0, 0x8}, {0x8b, 0x0, 0xfffffff9, 0x1, 0x8, 0x5}, {0x0, 0x7, 0x206, 0x80000000, 0x1000, 0xdde}, {0x3, 0x0, 0x4, 0x5, 0xba0, 0x7fffffff}, {0xffffffff, 0xcf, 0x3, 0x6, 0x80000000, 0xb}, {0x2, 0x100, 0x4, 0x9, 0x0, 0x9f69}, {0x4, 0x8, 0x1, 0x6, 0xfffffc00, 0x40004}, {0x6a, 0x6, 0x3, 0x9, 0x6, 0x8}, {0x5, 0x0, 0x71c, 0xf7, 0xff, 0x2}, {0x8, 0x1a, 0x5, 0x3, 0xa59, 0x7ff}, {0x9, 0x3ff, 0x2, 0x0, 0x200, 0x1}, {0x3, 0x2, 0x1, 0xd8fa, 0x5, 0x7}, {0x29, 0x4, 0x0, 0x5, 0x4f5}, {0xb7, 0x2, 0x7, 0xe, 0x4, 0x401}, {0x8000, 0x5, 0xfffffa02, 0x5, 0xe, 0xfe75}, {0x0, 0x10, 0x8, 0xf8, 0x0, 0x3}, {0x81, 0x7, 0x81b4, 0x7, 0x9, 0x6}, {0x3, 0x8, 0x0, 0x3, 0x8000, 0x4dbe}, {0xbc, 0x1, 0x1, 0x2, 0xce7}, {0x3, 0x81, 0x3b8a, 0x6, 0x10001, 0x1}, {0x81, 0x7c7, 0x3, 0x3ff, 0x2, 0x4}, {0x5, 0x10000, 0xa, 0x1, 0x4, 0x3}, {0x0, 0xf, 0x5, 0xffff, 0x0, 0xb}, {0x0, 0xe, 0x7, 0xfffffeff, 0x5, 0x5}, {0x7, 0x9a, 0x8, 0x9, 0xffffff01, 0xff}, {0x7fffffff, 0x3, 0x10000, 0x5, 0x4, 0x8}, {0x0, 0xfff, 0xb3, 0x2, 0x1, 0xcb}, {0x0, 0x4, 0x8, 0x3e5924ab, 0x0, 0x3}, {0x5, 0x8, 0x26e7, 0x8, 0x1000, 0x9}, {0x10001, 0x1a62, 0x675e0ded, 0xb, 0x80, 0x80000001}, {0xff, 0x0, 0xb, 0x7f, 0x40}, {0xf044, 0xffff, 0xf50, 0x14, 0x9c, 0xfffffff7}, {0x5, 0x2, 0x0, 0x5, 0x3, 0x7f}, {0x7d, 0x1, 0x5, 0x2, 0x1, 0xffffffff}], [{0x2, 0x1}, {0x3}, {0x3}, {0x2, 0x1}, {0x3, 0x1}, {0x3}, {0x5}, {}, {0x2}, {0x5}, {0x4}, {0x0, 0x1}, {0x0, 0x1}, {0x1}, {0x5, 0x1}, {0x3}, {0x10eeaebdfd45ee6a}, {0x1}, {0x5}, {0x1, 0x1}, {0x3, 0x1}, {0x1}, {}, {0x5, 0x1}, {0x2, 0x1}, {0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x1}, {}, {0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2}, {0x4}, {0x3}, {}, {0x5}, {0x5}, {0x5}, {0x3}, {0x4, 0x1}, {0x1, 0x1}, {0x4}, {0x2}, {0x3}, {0x4, 0x1}, {0x1, 0x1}, {0x2}, {}, {0x4, 0x1}, {}, {0x0, 0x1}, {0x3, 0x1}, {0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3}, {0x6}, {0x1}, {0x5783f585e0569d00}, {0xd76b55381db620f2}, {0x4, 0x1}, {0x5}, {0x2, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {}, {0x5, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x4}, {}, {0x0, 0x1}, {0x0, 0x24e5743a4ff49bc3}, {0x2}, {0x4, 0x1}, {0x4, 0x1}, {0x2}, {0x2, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x5, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x2}, {0x1, 0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x2}, {0x5}, {0x3}, {0x1}, {}, {0xfc087c22b0dc0e54}, {0x5, 0x1}, {0x1}, {0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x5}, {0x0, 0x1}, {0x3, 0x1}, {0x3}, {0x7, 0x1}, {}, {0x4}, {0x5, 0x1}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x4}, {0x4}, {0x5, 0x1}, {0x1}, {0x5, 0x1}, {}, {}, {}, {0x0, 0x1}], 0x1}}]}, {0x5b, 0x6, "b4c83d5918fe2254224d4acb7e2c8ec818f267aca3e229f07da56cee8a566f45c0b1a41a150e9bdc1b3d098cc490a069b291797ffdbfb2207fe7e6cba463af3eaa47bf282d8f0569bc522c11e475ff3d4b419147767105"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xf20}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x200080c4) 756.222711ms ago: executing program 2 (id=524): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) accept$alg(r3, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='./file0\x00') sendmsg$nl_xfrm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010001000000000000007f0000010000000000000000000000000000000000000000fe8000000000000000000000000000bbffffffff000000000000000000000000ffffffff0000000000000000000000004e2100", @ANYRES16=0x0, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB='\x00'/95], 0x1ac}}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x6b35e9d94325c671, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r5, r7, 0x25, 0x0, @void}, 0x10) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) 63.491549ms ago: executing program 3 (id=525): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x70, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0xffffffffffffffdc) keyctl$clear(0x3, 0xfffffffffffffffd) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) socket$inet6(0xa, 0x1, 0xffd) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r5, 0xc0040d07, &(0x7f0000000040)=0x122) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000070605000800000000000000010000020500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r6, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) ioctl$VIDIOC_G_FMT(r4, 0xc0d05604, &(0x7f0000000340)={0x6, @sliced={0x2, [0x3, 0x1, 0xa, 0xffff, 0x9, 0x0, 0x0, 0x3, 0x4, 0x8001, 0x8, 0x4a9e, 0x9, 0x9, 0x0, 0x100, 0x1, 0x7d, 0x401, 0x5, 0xfff, 0xe, 0x8, 0x3, 0x6, 0xc, 0x7f, 0x0, 0x7f, 0xfffc, 0x5, 0x1, 0x4, 0x5, 0x4, 0x2, 0x96, 0x7, 0x2, 0xa, 0xff5f, 0xfffa, 0x80, 0x688e, 0x79, 0x400, 0xe, 0xc], 0x6}}) close(r4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="018d008dffff"}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x28, 0x2, 0xfd, 0x5ae9}, {0x20, 0x7f, 0x4, 0xffeff038}, {0x6, 0x0, 0x8, 0x7}]}, 0x10) 0s ago: executing program 1 (id=526): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = dup(0xffffffffffffffff) write$binfmt_elf32(r3, &(0x7f0000000bc0)=ANY=[], 0x58) finit_module(r3, 0x0, 0x3) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket(0xa, 0x5, 0x0) getsockopt$bt_hci(r4, 0x84, 0x1, 0x0, &(0x7f0000000000)) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000540)={0x2, @pix={0x3, 0x401, 0x3132564e, 0x1, 0x3, 0x3, 0xc, 0x7, 0x0, 0x0, 0x0, 0x3}}) openat$null(0xffffffffffffff9c, &(0x7f0000002840), 0x101101, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000050000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000008500000072000000b7080000000000007b8af8ff00000000b7080000d50000007b8af0ff00000000bfa10000", @ANYRES32, @ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='romfs\x00', 0x200000, 0x0) kernel console output (not intermixed with test programs): : batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.927781][ T5771] hsr_slave_0: entered promiscuous mode [ 77.934921][ T5771] hsr_slave_1: entered promiscuous mode [ 77.941712][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.950394][ T5771] Cannot create hsr debugfs directory [ 77.958974][ T5768] team0: Port device team_slave_0 added [ 77.971030][ T5770] hsr_slave_0: entered promiscuous mode [ 77.977285][ T5770] hsr_slave_1: entered promiscuous mode [ 77.983820][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.991805][ T5770] Cannot create hsr debugfs directory [ 78.001858][ T5768] team0: Port device team_slave_1 added [ 78.123007][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.130106][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.156994][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.194037][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.200293][ T5085] Bluetooth: hci1: command tx timeout [ 78.201928][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.232583][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.279621][ T5085] Bluetooth: hci0: command tx timeout [ 78.283507][ T5777] Bluetooth: hci3: command tx timeout [ 78.285302][ T5085] Bluetooth: hci2: command tx timeout [ 78.407842][ T5768] hsr_slave_0: entered promiscuous mode [ 78.414108][ T5768] hsr_slave_1: entered promiscuous mode [ 78.420755][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.428330][ T5768] Cannot create hsr debugfs directory [ 78.566492][ T5770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.578884][ T5770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.597453][ T5770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.606543][ T5770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.728907][ T5769] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.745892][ T5769] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.755894][ T5769] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.767709][ T5769] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.856079][ T5771] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.867009][ T5771] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.894921][ T5771] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.907328][ T5771] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.958332][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.976870][ T5768] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.986908][ T5768] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.020783][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.028654][ T5768] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.044484][ T5768] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.076548][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.083841][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.113182][ T2932] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.120365][ T2932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.206263][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.238842][ T5769] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.277647][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.284862][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.338278][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.345479][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.422091][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.463069][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.511818][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.525643][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.574665][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.581878][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.597729][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.604857][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.617573][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.624709][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.657468][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.664668][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.774583][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.802052][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.906115][ T5770] veth0_vlan: entered promiscuous mode [ 79.952421][ T5770] veth1_vlan: entered promiscuous mode [ 79.978474][ T5769] veth0_vlan: entered promiscuous mode [ 80.017958][ T5769] veth1_vlan: entered promiscuous mode [ 80.093629][ T5770] veth0_macvtap: entered promiscuous mode [ 80.115404][ T5770] veth1_macvtap: entered promiscuous mode [ 80.153090][ T5769] veth0_macvtap: entered promiscuous mode [ 80.196210][ T5769] veth1_macvtap: entered promiscuous mode [ 80.218660][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.254082][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.265490][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.279373][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.280272][ T5085] Bluetooth: hci1: command tx timeout [ 80.288239][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.308766][ T5769] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.321255][ T5769] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.330354][ T5769] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.339073][ T5769] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.355352][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.359537][ T5085] Bluetooth: hci2: command tx timeout [ 80.366735][ T5777] Bluetooth: hci3: command tx timeout [ 80.371281][ T5085] Bluetooth: hci0: command tx timeout [ 80.376717][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.395511][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.413014][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.424013][ T5770] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.433531][ T5770] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.443667][ T5770] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.453198][ T5770] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.475071][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.635779][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.644939][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.682565][ T5771] veth0_vlan: entered promiscuous mode [ 80.695908][ T4797] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.704420][ T4797] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.723011][ T5768] veth0_vlan: entered promiscuous mode [ 80.736541][ T5771] veth1_vlan: entered promiscuous mode [ 80.766210][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.775552][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.792599][ T5768] veth1_vlan: entered promiscuous mode [ 80.880093][ T4797] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.899360][ T4797] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.907192][ T5768] veth0_macvtap: entered promiscuous mode [ 80.916358][ T5771] veth0_macvtap: entered promiscuous mode [ 80.961664][ T5771] veth1_macvtap: entered promiscuous mode [ 80.983700][ T5768] veth1_macvtap: entered promiscuous mode [ 81.024373][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.046398][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.057857][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.070522][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.091015][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.117645][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.134154][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.144592][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.162034][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.176444][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.188534][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.211019][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.288069][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.354654][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.468448][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.608277][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.757186][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.832480][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.883653][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.899042][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.910935][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.926914][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.948403][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.960211][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.073385][ T5771] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.084308][ T5771] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.100408][ T5771] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.109354][ T5771] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.122319][ T5768] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.131374][ T5768] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.140700][ T5768] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.149863][ T5768] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.422643][ T5085] Bluetooth: hci1: command tx timeout [ 82.439906][ T5085] Bluetooth: hci0: command tx timeout [ 82.452770][ T5777] Bluetooth: hci2: command tx timeout [ 82.510614][ T5085] Bluetooth: hci3: command tx timeout [ 83.756453][ T3529] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.773507][ T4797] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.789411][ T3529] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.807237][ T4797] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.952660][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.679414][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.711287][ T1095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.719143][ T1095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.729495][ T5780] Bluetooth: hci2: command tx timeout [ 84.734942][ T5780] Bluetooth: hci0: command tx timeout [ 84.740528][ T5777] Bluetooth: hci3: command tx timeout [ 84.745957][ T5085] Bluetooth: hci1: command tx timeout [ 85.041230][ T5861] syz.3.8[5861]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 85.125106][ T5861] loop3: detected capacity change from 0 to 256 [ 85.243451][ T5866] overlayfs: missing 'lowerdir' [ 86.445426][ T5874] process 'syz.3.8' launched './file0' with NULL argv: empty string added [ 86.594465][ T5872] loop2: detected capacity change from 0 to 512 [ 86.815145][ T5872] ======================================================= [ 86.815145][ T5872] WARNING: The mand mount option has been deprecated and [ 86.815145][ T5872] and is ignored by this kernel. Remove the mand [ 86.815145][ T5872] option from the mount to silence this warning. [ 86.815145][ T5872] ======================================================= [ 87.878392][ T5872] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 87.904661][ T5872] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (45506!=33349) [ 87.961531][ T5872] EXT4-fs error (device loop2): __ext4_get_inode_loc:4497: comm syz.2.3: Invalid inode table block 1 in block_group 0 [ 88.209917][ T5872] EXT4-fs (loop2): get root inode failed [ 88.215660][ T5872] EXT4-fs (loop2): mount failed [ 88.433934][ T5774] Bluetooth: hci0: unexpected event 0x03 length: 12 > 11 [ 88.933256][ T5888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12'. [ 90.723664][ T5896] tipc: Started in network mode [ 90.728702][ T5896] tipc: Node identity 4, cluster identity 4711 [ 90.735027][ T5896] tipc: Node number set to 4 [ 92.678242][ T9] cfg80211: failed to load regulatory.db [ 92.735292][ T5910] loop2: detected capacity change from 0 to 128 [ 92.746691][ T5910] UDF-fs: bad mount option "18446744073709551615ÿ" or missing value [ 93.889311][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.013361][ T5914] sched: RT throttling activated [ 94.027632][ T5916] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'. [ 94.252033][ T5916] syz.0.18 (5916) used greatest stack depth: 16840 bytes left [ 97.272601][ T5959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.24'. [ 97.353825][ T5963] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 97.363739][ T5963] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 97.372741][ T5963] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 97.540469][ T5967] tipc: Started in network mode [ 97.546051][ T5967] tipc: Node identity 4, cluster identity 4711 [ 97.552430][ T5967] tipc: Node number set to 4 [ 99.446100][ T5971] loop1: detected capacity change from 0 to 164 [ 107.467714][ T6018] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 110.046963][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 110.074045][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 110.081650][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.091736][ T5774] Workqueue: hci3 hci_rx_work [ 110.096486][ T5774] Call Trace: [ 110.099790][ T5774] [ 110.102744][ T5774] dump_stack_lvl+0x18c/0x250 [ 110.102851][ T6047] netlink: 8 bytes leftover after parsing attributes in process `syz.1.43'. [ 110.107428][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 110.116270][ T6047] netlink: 4 bytes leftover after parsing attributes in process `syz.1.43'. [ 110.121738][ T5774] ? show_regs_print_info+0x20/0x20 [ 110.121768][ T5774] ? load_image+0x420/0x420 [ 110.121794][ T5774] ? sysfs_create_dir_ns+0x243/0x2a0 [ 110.121819][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 110.150535][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 110.155557][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 110.160228][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 110.165425][ T5774] kobject_add_internal+0x617/0xc90 [ 110.170636][ T5774] kobject_add+0x164/0x240 [ 110.175105][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 110.180506][ T5774] ? kobject_init+0x1d0/0x1d0 [ 110.185206][ T5774] ? get_device_parent+0x366/0x390 [ 110.190311][ T5774] device_add+0x3fa/0xc40 [ 110.194631][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 110.199559][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 110.204840][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 110.211074][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 110.216700][ T5774] ? mutex_unlock+0x10/0x10 [ 110.221202][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 110.225876][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 110.231427][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 110.237493][ T5774] hci_event_packet+0x7b4/0x1280 [ 110.242427][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 110.248054][ T5774] ? bis_list+0x290/0x290 [ 110.252375][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 110.257480][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 110.262689][ T5774] hci_rx_work+0x43a/0xd60 [ 110.267101][ T5774] ? process_scheduled_works+0x975/0x1600 [ 110.272821][ T5774] process_scheduled_works+0xa60/0x1600 [ 110.278392][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 110.283881][ T5774] ? assign_work+0x3cc/0x5d0 [ 110.288470][ T5774] worker_thread+0xa5e/0xfe0 [ 110.293076][ T5774] kthread+0x2fa/0x390 [ 110.297138][ T5774] ? pr_cont_work+0x550/0x550 [ 110.301807][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 110.306408][ T5774] ret_from_fork+0x48/0x80 [ 110.310824][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 110.315406][ T5774] ret_from_fork_asm+0x11/0x20 [ 110.320180][ T5774] [ 110.377326][ T5774] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 110.489305][ T5774] Bluetooth: hci3: failed to register connection device [ 110.754192][ T6047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.821103][ T6047] bond1: (slave bond0): making interface the new active one [ 110.832354][ T6047] bond1: (slave bond0): Enslaving as an active interface with an up link [ 110.855570][ T6049] netlink: 'syz.1.43': attribute type 4 has an invalid length. [ 110.892346][ T6049] netlink: 152 bytes leftover after parsing attributes in process `syz.1.43'. [ 111.029551][ T6049] .`: renamed from bond0 (while UP) [ 112.519335][ T5085] Bluetooth: hci3: command tx timeout [ 114.289557][ T6084] netlink: 8 bytes leftover after parsing attributes in process `syz.1.50'. [ 114.375160][ T6089] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 114.383827][ T6089] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 114.392437][ T6089] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 119.764567][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 119.774685][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 119.782276][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.792362][ T5085] Workqueue: hci0 hci_rx_work [ 119.797110][ T5085] Call Trace: [ 119.800408][ T5085] [ 119.803356][ T5085] dump_stack_lvl+0x18c/0x250 [ 119.808042][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 119.813720][ T5085] ? show_regs_print_info+0x20/0x20 [ 119.818945][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 119.824602][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 119.829723][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 119.834751][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 119.839437][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 119.844644][ T5085] kobject_add_internal+0x617/0xc90 [ 119.849878][ T5085] kobject_add+0x164/0x240 [ 119.854306][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 119.859698][ T5085] ? kobject_init+0x1d0/0x1d0 [ 119.864388][ T5085] ? get_device_parent+0x366/0x390 [ 119.869508][ T5085] device_add+0x3fa/0xc40 [ 119.873856][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 119.878830][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 119.884208][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 119.890481][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 119.896149][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 119.901376][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 119.906103][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 119.911684][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 119.917773][ T5085] hci_event_packet+0x7b4/0x1280 [ 119.922735][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 119.927769][ T5085] ? lock_chain_count+0x20/0x20 [ 119.932624][ T5085] ? bis_list+0x290/0x290 [ 119.936959][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 119.942164][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 119.947424][ T5085] hci_rx_work+0x43a/0xd60 [ 119.951852][ T5085] ? process_scheduled_works+0x975/0x1600 [ 119.957582][ T5085] process_scheduled_works+0xa60/0x1600 [ 119.963153][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 119.968629][ T5085] ? assign_work+0x3cc/0x5d0 [ 119.973234][ T5085] worker_thread+0xa5e/0xfe0 [ 119.977839][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 119.982696][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 119.987644][ T5085] kthread+0x2fa/0x390 [ 119.991716][ T5085] ? pr_cont_work+0x550/0x550 [ 119.996395][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 120.000993][ T5085] ret_from_fork+0x48/0x80 [ 120.005425][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 120.010018][ T5085] ret_from_fork_asm+0x11/0x20 [ 120.014798][ T5085] [ 120.022698][ T5085] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 120.037128][ T5085] Bluetooth: hci0: failed to register connection device [ 121.713529][ T6139] loop2: detected capacity change from 0 to 16 [ 121.727244][ T6139] erofs: Unknown parameter '€' [ 122.049714][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 122.471655][ T5762] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 122.684706][ T5085] Bluetooth: hci0: command tx timeout [ 123.985323][ T6158] bridge_slave_1: left allmulticast mode [ 124.018802][ T6158] bridge_slave_1: left promiscuous mode [ 124.151515][ T6158] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.546538][ T6158] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 124.744248][ T6163] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 125.179972][ T6175] Bluetooth: MGMT ver 1.22 [ 127.926345][ T6196] Zero length message leads to an empty skb [ 128.384508][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 128.471246][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 128.478865][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 128.488955][ T5085] Workqueue: hci1 hci_rx_work [ 128.493672][ T5085] Call Trace: [ 128.497021][ T5085] [ 128.499984][ T5085] dump_stack_lvl+0x18c/0x250 [ 128.504698][ T5085] ? show_regs_print_info+0x20/0x20 [ 128.509935][ T5085] ? load_image+0x420/0x420 [ 128.514499][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 128.519647][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 128.524804][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 128.529521][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 128.534769][ T5085] kobject_add_internal+0x617/0xc90 [ 128.539997][ T5085] kobject_add+0x164/0x240 [ 128.544432][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 128.549806][ T5085] ? kobject_init+0x1d0/0x1d0 [ 128.554480][ T5085] ? get_device_parent+0x366/0x390 [ 128.559585][ T5085] device_add+0x3fa/0xc40 [ 128.563909][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 128.568847][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 128.574156][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 128.580394][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 128.586029][ T5085] ? mutex_unlock+0x10/0x10 [ 128.590535][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 128.595211][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 128.600755][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 128.606845][ T5085] hci_event_packet+0x7b4/0x1280 [ 128.611778][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 128.616793][ T5085] ? lock_chain_count+0x20/0x20 [ 128.621631][ T5085] ? bis_list+0x290/0x290 [ 128.625954][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 128.631142][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 128.636333][ T5085] hci_rx_work+0x43a/0xd60 [ 128.640772][ T5085] ? process_scheduled_works+0x975/0x1600 [ 128.646511][ T5085] process_scheduled_works+0xa60/0x1600 [ 128.652076][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 128.657532][ T5085] ? assign_work+0x3cc/0x5d0 [ 128.662114][ T5085] worker_thread+0xa5e/0xfe0 [ 128.666704][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 128.671570][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 128.676517][ T5085] kthread+0x2fa/0x390 [ 128.680581][ T5085] ? pr_cont_work+0x550/0x550 [ 128.685275][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 128.689869][ T5085] ret_from_fork+0x48/0x80 [ 128.694277][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 128.698862][ T5085] ret_from_fork_asm+0x11/0x20 [ 128.703630][ T5085] [ 128.706733][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.727088][ T5085] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 128.747456][ T5085] Bluetooth: hci1: failed to register connection device [ 129.037210][ T6206] nvmet: adding nsid 1 to subsystem testnqn [ 129.068477][ T6206] nvmet_rdma: enabling port 1 (127.0.0.1:442) [ 129.085057][ T28] audit: type=1800 audit(1786178041.347:2): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="attr_allow_any_host" dev="configfs" ino=8724 res=0 errno=0 [ 129.201114][ T6209] overlayfs: failed to resolve './file0': -2 [ 129.430078][ T28] audit: type=1800 audit(1786178041.357:3): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="device_path" dev="configfs" ino=8726 res=0 errno=0 [ 129.469436][ T28] audit: type=1800 audit(1786178041.357:4): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="enable" dev="configfs" ino=8727 res=0 errno=0 [ 129.521513][ T28] audit: type=1800 audit(1786178041.367:5): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="addr_trtype" dev="configfs" ino=8733 res=0 errno=0 [ 129.571166][ T28] audit: type=1800 audit(1786178041.367:6): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="addr_adrfam" dev="configfs" ino=8734 res=0 errno=0 [ 129.980248][ T28] audit: type=1800 audit(1786178041.367:7): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="addr_traddr" dev="configfs" ino=8735 res=0 errno=0 [ 130.065953][ T28] audit: type=1800 audit(1786178041.377:8): pid=6206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.69" name="addr_trsvcid" dev="configfs" ino=8736 res=0 errno=0 [ 130.286453][ T6217] IPVS: wrr: SCTP 172.20.20.187:0 - no destination available [ 130.304643][ T5868] IPVS: starting estimator thread 0... [ 130.342930][ T6217] sctp: [Deprecated]: syz.1.71 (pid 6217) Use of int in max_burst socket option. [ 130.342930][ T6217] Use struct sctp_assoc_value instead [ 130.560482][ T6220] IPVS: using max 22 ests per chain, 52800 per kthread [ 131.245363][ T5774] Bluetooth: hci1: command tx timeout [ 133.100599][ T6243] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.579978][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.596639][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.395229][ T5774] Bluetooth: hci3: link tx timeout [ 135.402022][ T5774] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.862288][ T6260] syz.1.81: attempt to access beyond end of device [ 136.862288][ T6260] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 137.101112][ T6284] loop2: detected capacity change from 0 to 128 [ 137.799781][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 138.831939][ T6284] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 139.031704][ T6295] loop0: detected capacity change from 0 to 128 [ 139.047923][ T6284] ext4 filesystem being mounted at /15/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 139.081273][ T6295] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 139.111256][ T6295] ext4 filesystem being mounted at /29/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 139.457061][ T6306] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 140.541541][ T5771] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 142.996695][ T5769] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 148.276031][ T6348] Process accounting resumed [ 148.626430][ T6355] loop0: detected capacity change from 0 to 128 [ 148.712456][ T6355] FAT-fs (loop0): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 148.880501][ T5762] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 149.891478][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 150.128552][ T5774] Bluetooth: hci3: link tx timeout [ 150.498606][ T6361] syz.3.101: attempt to access beyond end of device [ 150.498606][ T6361] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 150.650964][ T6377] loop2: detected capacity change from 0 to 4096 [ 150.742045][ T6377] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 150.893430][ T6377] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 153.060912][ T5771] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 157.276397][ T6433] No such timeout policy "syz1" [ 157.378796][ T28] audit: type=1326 audit(1786178067.654:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.0.114" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5e78b9e0d9 code=0x0 [ 157.435601][ T5774] Bluetooth: hci3: link tx timeout [ 157.441788][ T5774] Bluetooth: hci3: link tx timeout [ 157.449844][ T5774] Bluetooth: hci3: link tx timeout [ 157.455124][ T5774] Bluetooth: hci3: link tx timeout [ 157.460435][ T5774] Bluetooth: hci3: link tx timeout [ 157.653050][ T5774] Bluetooth: hci3: link tx timeout [ 158.261545][ T6437] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd2": -EINTR [ 160.674307][ T5774] Bluetooth: hci3: link tx timeout [ 160.921867][ T6461] syz.2.122: attempt to access beyond end of device [ 160.921867][ T6461] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 161.980917][ T6475] loop0: detected capacity change from 0 to 512 [ 162.131754][ T6475] EXT4-fs: Ignoring removed nomblk_io_submit option [ 162.614648][ T6475] ext4: Unknown parameter 'fscontext' [ 162.685370][ T6478] No such timeout policy "syz1" [ 163.320597][ T6487] loop0: detected capacity change from 0 to 2048 [ 164.051980][ T6493] loop1: detected capacity change from 0 to 1024 [ 164.065545][ T6493] EXT4-fs: Ignoring removed mblk_io_submit option [ 164.072385][ T6493] EXT4-fs: inline encryption not supported [ 164.502149][ T6493] EXT4-fs (loop1): can't mount with data_err=abort, fs mounted w/o journal [ 165.308274][ T28] audit: type=1326 audit(1786178075.008:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6482 comm="syz.1.128" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53b3f9e0d9 code=0x7fc00000 [ 168.273375][ T6512] No such timeout policy "syz1" [ 168.287893][ T5774] Bluetooth: hci3: link tx timeout [ 168.293547][ T5774] Bluetooth: hci3: link tx timeout [ 168.298871][ T5774] Bluetooth: hci3: link tx timeout [ 168.305404][ T5774] Bluetooth: hci3: link tx timeout [ 168.311478][ T5774] Bluetooth: hci3: link tx timeout [ 168.323293][ T5774] Bluetooth: hci3: link tx timeout [ 168.332311][ T5774] Bluetooth: hci3: link tx timeout [ 168.337735][ T5774] Bluetooth: hci3: link tx timeout [ 168.344533][ T5774] Bluetooth: hci3: link tx timeout [ 168.352177][ T5774] Bluetooth: hci3: link tx timeout [ 168.357479][ T5774] Bluetooth: hci3: link tx timeout [ 168.362884][ T5774] Bluetooth: hci3: link tx timeout [ 168.368341][ T5774] Bluetooth: hci3: link tx timeout [ 168.389126][ T5774] Bluetooth: hci3: link tx timeout [ 168.394705][ T5774] Bluetooth: hci3: link tx timeout [ 168.401274][ T5774] Bluetooth: hci3: link tx timeout [ 168.406707][ T5774] Bluetooth: hci3: link tx timeout [ 168.421574][ T5774] Bluetooth: hci3: link tx timeout [ 168.427602][ T5774] Bluetooth: hci3: link tx timeout [ 168.432855][ T5774] Bluetooth: hci3: link tx timeout [ 168.438214][ T5774] Bluetooth: hci3: link tx timeout [ 168.443603][ T5774] Bluetooth: hci3: link tx timeout [ 168.448939][ T5774] Bluetooth: hci3: link tx timeout [ 168.457908][ T5774] Bluetooth: hci3: link tx timeout [ 168.466560][ T5774] Bluetooth: hci3: link tx timeout [ 168.475034][ T5774] Bluetooth: hci3: link tx timeout [ 168.480347][ T5774] Bluetooth: hci3: link tx timeout [ 168.485618][ T5774] Bluetooth: hci3: link tx timeout [ 168.491051][ T5774] Bluetooth: hci3: link tx timeout [ 168.499606][ T5774] Bluetooth: hci3: link tx timeout [ 168.510577][ T5774] Bluetooth: hci3: link tx timeout [ 168.793964][ T6521] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd3": -EINTR [ 168.867478][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 169.137597][ T6532] Bluetooth: hci0: invalid length 0, exp 2 for type 12 [ 169.755681][ T6534] workqueue: Failed to create a rescuer kthread for wq "xfs-blockgc/nbd2": -EINTR [ 172.498355][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 173.904114][ T6564] No such timeout policy "syz1" [ 174.110226][ T6567] netlink: 'syz.2.145': attribute type 1 has an invalid length. [ 176.574756][ T5774] Bluetooth: hci3: link tx timeout [ 176.580331][ T5774] Bluetooth: hci3: link tx timeout [ 176.588736][ T5774] Bluetooth: hci3: link tx timeout [ 176.594125][ T5774] Bluetooth: hci3: link tx timeout [ 176.600820][ T5774] Bluetooth: hci3: link tx timeout [ 176.607401][ T5774] Bluetooth: hci3: link tx timeout [ 176.612695][ T5774] Bluetooth: hci3: link tx timeout [ 176.619856][ T5774] Bluetooth: hci3: link tx timeout [ 176.625129][ T5774] Bluetooth: hci3: link tx timeout [ 176.662751][ T5774] Bluetooth: hci3: link tx timeout [ 176.668069][ T5774] Bluetooth: hci3: link tx timeout [ 176.675204][ T5774] Bluetooth: hci3: link tx timeout [ 176.683175][ T5774] Bluetooth: hci3: link tx timeout [ 176.688578][ T5774] Bluetooth: hci3: link tx timeout [ 176.696912][ T5774] Bluetooth: hci3: link tx timeout [ 176.717336][ T5774] Bluetooth: hci3: link tx timeout [ 176.722621][ T5774] Bluetooth: hci3: link tx timeout [ 176.729974][ T5774] Bluetooth: hci3: link tx timeout [ 176.735457][ T5774] Bluetooth: hci3: link tx timeout [ 176.741298][ T5774] Bluetooth: hci3: link tx timeout [ 176.748005][ T5774] Bluetooth: hci3: link tx timeout [ 176.753269][ T5774] Bluetooth: hci3: link tx timeout [ 176.759905][ T5774] Bluetooth: hci3: link tx timeout [ 176.809131][ T6584] syz.2.149: attempt to access beyond end of device [ 176.809131][ T6584] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 178.127232][ T6596] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 179.521035][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 180.224915][ T6609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.155'. [ 180.838375][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.147'. [ 181.017293][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.147'. [ 181.179005][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.147'. [ 181.190460][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.3.147'. [ 182.049619][ T6610] comedi comedi3: pcl816: I/O port conflict (0x100,16) [ 183.412851][ T6621] No such timeout policy "syz1" [ 184.291414][ T6630] loop3: detected capacity change from 0 to 4096 [ 185.518107][ T5774] Bluetooth: hci3: link tx timeout [ 185.693855][ T6643] workqueue: Failed to create a rescuer kthread for wq "xfs-conv/nbd1": -EINTR [ 185.787977][ T6630] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 186.168989][ T6630] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 186.879726][ T5774] Bluetooth: hci3: link tx timeout [ 186.885598][ T5774] Bluetooth: hci3: link tx timeout [ 186.890967][ T5774] Bluetooth: hci3: link tx timeout [ 186.896260][ T5774] Bluetooth: hci3: link tx timeout [ 186.901888][ T5774] Bluetooth: hci3: link tx timeout [ 186.907151][ T5774] Bluetooth: hci3: link tx timeout [ 186.912589][ T5774] Bluetooth: hci3: link tx timeout [ 186.917946][ T5774] Bluetooth: hci3: link tx timeout [ 186.923579][ T5774] Bluetooth: hci3: link tx timeout [ 186.928916][ T5774] Bluetooth: hci3: link tx timeout [ 186.969238][ T5774] Bluetooth: hci3: link tx timeout [ 186.974515][ T5774] Bluetooth: hci3: link tx timeout [ 186.980227][ T5774] Bluetooth: hci3: link tx timeout [ 186.985463][ T5774] Bluetooth: hci3: link tx timeout [ 186.993836][ T5774] Bluetooth: hci3: link tx timeout [ 186.999235][ T5774] Bluetooth: hci3: link tx timeout [ 187.004721][ T5774] Bluetooth: hci3: link tx timeout [ 187.012718][ T5774] Bluetooth: hci3: link tx timeout [ 187.018155][ T5774] Bluetooth: hci3: link tx timeout [ 187.023521][ T5774] Bluetooth: hci3: link tx timeout [ 187.031969][ T5774] Bluetooth: hci3: link tx timeout [ 187.037202][ T5774] Bluetooth: hci3: link tx timeout [ 187.050976][ T5774] Bluetooth: hci3: link tx timeout [ 187.057650][ T5774] Bluetooth: hci3: link tx timeout [ 187.066163][ T5774] Bluetooth: hci3: link tx timeout [ 187.075351][ T5774] Bluetooth: hci3: link tx timeout [ 187.080626][ T5774] Bluetooth: hci3: link tx timeout [ 187.089159][ T5774] Bluetooth: hci3: link tx timeout [ 187.519086][ T6664] workqueue: Failed to create a rescuer kthread for wq "xfs-blockgc/nbd1": -EINTR [ 187.637645][ T6663] loop2: detected capacity change from 0 to 4096 [ 188.578030][ T6679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 190.074869][ T6694] netlink: 4 bytes leftover after parsing attributes in process `syz.2.169'. [ 192.581442][ T6705] syz.2.173: attempt to access beyond end of device [ 192.581442][ T6705] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 193.623904][ T5774] Bluetooth: hci3: link tx timeout [ 193.703653][ T6721] syz.1.175: attempt to access beyond end of device [ 193.703653][ T6721] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 194.314412][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 196.148582][ T6749] netlink: 830 bytes leftover after parsing attributes in process `syz.3.179'. [ 196.997678][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 197.500179][ T6757] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 197.516589][ T6757] cramfs: wrong magic [ 197.543247][ T6757] netlink: 88 bytes leftover after parsing attributes in process `syz.1.181'. [ 199.261488][ T6767] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nbd0": -EINTR [ 199.544878][ T28] audit: type=1800 audit(1786178106.610:11): pid=6786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.187" name="in_ports" dev="configfs" ino=10393 res=0 errno=0 [ 199.994443][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 200.000916][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.037642][ T6787] netlink: 4 bytes leftover after parsing attributes in process `syz.0.188'. [ 200.103964][ T5809] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 200.780713][ T5085] Bluetooth: hci3: link tx timeout [ 200.785983][ T5085] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 200.794942][ T5085] Bluetooth: hci3: link tx timeout [ 200.802454][ T5809] usb 1-1: Dual-Role OTG device on HNP port [ 200.815927][ T5809] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 200.851808][ T5809] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.238868][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 201.248599][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 201.256141][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 201.266193][ T5085] Workqueue: hci2 hci_rx_work [ 201.270874][ T5085] Call Trace: [ 201.274145][ T5085] [ 201.277067][ T5085] dump_stack_lvl+0x18c/0x250 [ 201.281738][ T5085] ? show_regs_print_info+0x20/0x20 [ 201.286927][ T5085] ? load_image+0x420/0x420 [ 201.291429][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 201.296541][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 201.301560][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 201.306243][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 201.311467][ T5085] kobject_add_internal+0x617/0xc90 [ 201.316669][ T5085] kobject_add+0x164/0x240 [ 201.321081][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 201.326447][ T5085] ? kobject_init+0x1d0/0x1d0 [ 201.331120][ T5085] ? get_device_parent+0x366/0x390 [ 201.336223][ T5085] device_add+0x3fa/0xc40 [ 201.340549][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 201.345478][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 201.350762][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 201.356997][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 201.362621][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 201.367811][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 201.372480][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 201.378022][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 201.384189][ T5085] hci_event_packet+0x7b4/0x1280 [ 201.389122][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 201.394749][ T5085] ? bis_list+0x290/0x290 [ 201.399073][ T5085] ? kcov_remote_start+0x1b5/0x7e0 [ 201.404193][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 201.409398][ T5085] hci_rx_work+0x43a/0xd60 [ 201.413829][ T5085] ? process_scheduled_works+0x975/0x1600 [ 201.419542][ T5085] process_scheduled_works+0xa60/0x1600 [ 201.425098][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 201.430565][ T5085] ? assign_work+0x3cc/0x5d0 [ 201.435146][ T5085] worker_thread+0xa5e/0xfe0 [ 201.439732][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 201.444570][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 201.449503][ T5085] kthread+0x2fa/0x390 [ 201.453580][ T5085] ? pr_cont_work+0x550/0x550 [ 201.458268][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 201.462844][ T5085] ret_from_fork+0x48/0x80 [ 201.467250][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 201.471849][ T5085] ret_from_fork_asm+0x11/0x20 [ 201.476614][ T5085] [ 201.488048][ T5085] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 201.502905][ T5085] Bluetooth: hci2: failed to register connection device [ 201.520296][ T5809] gspca_main: spca501-2.14.0 probing 0000:0000 [ 201.528054][ T5809] gspca_spca501: reg write: error -32 [ 201.538524][ T5809] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 201.563520][ T5809] spca501: probe of 1-1:1.0 failed with error -22 [ 201.601285][ T5809] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 201.621395][ T6806] syz.3.191: attempt to access beyond end of device [ 201.621395][ T6806] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 201.717097][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 203.006439][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 203.712586][ T5085] Bluetooth: hci2: command tx timeout [ 204.011265][ T6822] netlink: 830 bytes leftover after parsing attributes in process `syz.2.193'. [ 206.509296][ T6840] syz.2.196: attempt to access beyond end of device [ 206.509296][ T6840] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 206.951615][ T6855] syz.3.198 uses obsolete (PF_INET,SOCK_PACKET) [ 207.588663][ T6861] netlink: 48 bytes leftover after parsing attributes in process `syz.1.199'. [ 207.869597][ T5778] Bluetooth: hci1: command 0x0406 tx timeout [ 207.873413][ T5777] Bluetooth: hci2: command 0x0406 tx timeout [ 207.875795][ T5778] Bluetooth: hci0: command 0x0406 tx timeout [ 209.435687][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 209.445277][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 209.452855][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.462939][ T5085] Workqueue: hci1 hci_rx_work [ 209.467651][ T5085] Call Trace: [ 209.470955][ T5085] [ 209.473911][ T5085] dump_stack_lvl+0x18c/0x250 [ 209.478628][ T5085] ? show_regs_print_info+0x20/0x20 [ 209.483863][ T5085] ? load_image+0x420/0x420 [ 209.488422][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 209.493575][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 209.498635][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 209.503343][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 209.508567][ T5085] kobject_add_internal+0x617/0xc90 [ 209.513812][ T5085] kobject_add+0x164/0x240 [ 209.518293][ T5085] ? kobject_init+0x1d0/0x1d0 [ 209.522980][ T5085] ? get_device_parent+0x366/0x390 [ 209.528113][ T5085] device_add+0x3fa/0xc40 [ 209.532441][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 209.537389][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 209.542693][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 209.548932][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 209.554563][ T5085] ? mutex_unlock+0x10/0x10 [ 209.559056][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 209.563750][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 209.569323][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 209.575386][ T5085] hci_event_packet+0x7b4/0x1280 [ 209.580321][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 209.585955][ T5085] ? bis_list+0x290/0x290 [ 209.590283][ T5085] ? kcov_remote_start+0x1b5/0x7e0 [ 209.595388][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 209.600588][ T5085] hci_rx_work+0x43a/0xd60 [ 209.605019][ T5085] ? process_scheduled_works+0x975/0x1600 [ 209.610738][ T5085] process_scheduled_works+0xa60/0x1600 [ 209.616294][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 209.621772][ T5085] ? assign_work+0x3cc/0x5d0 [ 209.626372][ T5085] worker_thread+0xa5e/0xfe0 [ 209.630960][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 209.635809][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 209.640760][ T5085] kthread+0x2fa/0x390 [ 209.644825][ T5085] ? pr_cont_work+0x550/0x550 [ 209.649495][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 209.654077][ T5085] ret_from_fork+0x48/0x80 [ 209.658488][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 209.663074][ T5085] ret_from_fork_asm+0x11/0x20 [ 209.667840][ T5085] [ 209.687175][ T5085] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 209.701632][ T5085] Bluetooth: hci1: failed to register connection device [ 210.508502][ T6884] syz.1.204: attempt to access beyond end of device [ 210.508502][ T6884] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 211.944773][ T5085] Bluetooth: hci1: command 0x0406 tx timeout [ 212.030465][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 213.301650][ T6905] loop3: detected capacity change from 0 to 128 [ 213.314868][ T6905] FAT-fs (loop3): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 213.358923][ T6823] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 215.589414][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 215.772294][ T6936] syz.1.212: attempt to access beyond end of device [ 215.772294][ T6936] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 216.445248][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 217.127830][ T6952] syz.2.215: attempt to access beyond end of device [ 217.127830][ T6952] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 219.137744][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 219.772046][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 219.781797][ T5774] CPU: 1 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 219.789378][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 219.799464][ T5774] Workqueue: hci0 hci_rx_work [ 219.804180][ T5774] Call Trace: [ 219.807480][ T5774] [ 219.810426][ T5774] dump_stack_lvl+0x18c/0x250 [ 219.815112][ T5774] ? show_regs_print_info+0x20/0x20 [ 219.820304][ T5774] ? load_image+0x420/0x420 [ 219.824809][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 219.829930][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 219.834952][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 219.839621][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 219.844837][ T5774] kobject_add_internal+0x617/0xc90 [ 219.850034][ T5774] kobject_add+0x164/0x240 [ 219.854444][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 219.859838][ T5774] ? kobject_init+0x1d0/0x1d0 [ 219.864522][ T5774] ? get_device_parent+0x366/0x390 [ 219.869682][ T5774] device_add+0x3fa/0xc40 [ 219.874055][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 219.878996][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 219.884311][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 219.890551][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 219.896188][ T5774] ? mutex_unlock+0x10/0x10 [ 219.900686][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 219.905382][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 219.910949][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 219.917047][ T5774] hci_event_packet+0x7b4/0x1280 [ 219.922006][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 219.927653][ T5774] ? bis_list+0x290/0x290 [ 219.932005][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 219.937212][ T5774] hci_rx_work+0x43a/0xd60 [ 219.941633][ T5774] ? process_scheduled_works+0x975/0x1600 [ 219.947360][ T5774] process_scheduled_works+0xa60/0x1600 [ 219.952931][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 219.958397][ T5774] ? assign_work+0x3cc/0x5d0 [ 219.962991][ T5774] worker_thread+0xa5e/0xfe0 [ 219.967600][ T5774] kthread+0x2fa/0x390 [ 219.971666][ T5774] ? pr_cont_work+0x550/0x550 [ 219.976362][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 219.980954][ T5774] ret_from_fork+0x48/0x80 [ 219.985365][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 219.989961][ T5774] ret_from_fork_asm+0x11/0x20 [ 219.994733][ T5774] [ 220.059376][ T5774] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 220.080177][ T5774] Bluetooth: hci0: failed to register connection device [ 221.398312][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 221.606886][ T6990] netlink: 8 bytes leftover after parsing attributes in process `syz.1.223'. [ 221.623732][ T6993] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 221.682621][ T6996] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 221.691141][ T6996] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 221.700032][ T6996] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 223.633246][ T6995] No such timeout policy "syz1" [ 223.643190][ T5774] Bluetooth: hci0: command 0x0406 tx timeout [ 223.782367][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 223.818810][ T7001] netlink: 12 bytes leftover after parsing attributes in process `syz.0.224'. [ 226.682125][ T7012] syz.1.227: attempt to access beyond end of device [ 226.682125][ T7012] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 228.550204][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 228.630755][ T7022] workqueue: Failed to create a rescuer kthread for wq "xfs-blockgc/nbd3": -EINTR [ 230.998678][ T7040] No such timeout policy "syz1" [ 231.359897][ T7052] netlink: 8 bytes leftover after parsing attributes in process `syz.1.236'. [ 231.395143][ T7048] No such timeout policy "syz1" [ 231.494944][ T7054] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 231.503423][ T7054] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 231.512076][ T7054] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 234.749818][ T7065] comedi comedi3: pcl711: I/O port conflict (0x100,16) [ 236.066950][ T7067] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 236.686965][ T7083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.241'. [ 236.975791][ T7087] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 236.984482][ T7087] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 236.993159][ T7087] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 239.204671][ T7093] netlink: 24 bytes leftover after parsing attributes in process `syz.1.243'. [ 240.303608][ T7094] netlink: 12 bytes leftover after parsing attributes in process `syz.3.246'. [ 242.053420][ T7099] No such timeout policy "syz1" [ 244.422860][ T7115] 9pnet_virtio: no channels available for device syz [ 245.635339][ T7130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.255'. [ 245.716249][ T7133] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 245.724983][ T7133] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 245.733599][ T7133] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 246.108222][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 247.185988][ T7131] syz.0.254: attempt to access beyond end of device [ 247.185988][ T7131] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 247.511365][ T7144] netlink: 4 bytes leftover after parsing attributes in process `syz.2.256'. [ 247.577059][ T7145] loop2: detected capacity change from 0 to 256 [ 247.885888][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 248.742731][ T7153] loop0: detected capacity change from 0 to 2048 [ 248.792776][ T7153] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 248.860510][ T28] audit: type=1800 audit(1786178152.108:12): pid=7153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.259" name="bus" dev="loop0" ino=1367 res=0 errno=0 [ 248.881023][ T7155] netlink: 20 bytes leftover after parsing attributes in process `syz.2.260'. [ 251.194218][ T7166] No such timeout policy "syz1" [ 251.210219][ T7155] team0 (unregistering): Port device team_slave_0 removed [ 251.267250][ T7155] team0 (unregistering): Port device team_slave_1 removed [ 251.323343][ T7168] mmap: syz.3.263 (7168) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 253.553163][ T7180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.266'. [ 254.459056][ T7184] capability: warning: `syz.1.268' uses 32-bit capabilities (legacy support in use) [ 254.483606][ T7188] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 254.510480][ T7188] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 254.519088][ T7188] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 259.219697][ T7227] No such timeout policy "syz1" [ 260.270421][ T7232] netlink: 8 bytes leftover after parsing attributes in process `syz.2.278'. [ 260.450697][ T7237] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 260.459429][ T7237] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 260.467978][ T7237] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 264.852650][ T7255] netlink: 'syz.3.284': attribute type 11 has an invalid length. [ 264.936645][ T7255] netlink: 44 bytes leftover after parsing attributes in process `syz.3.284'. [ 264.946575][ T7257] comedi comedi3: pcl816: I/O port conflict (0x100,16) [ 265.143871][ T7255] ip6erspan0: entered allmulticast mode [ 265.162272][ T7256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.283'. [ 265.565884][ T7255] ALSA: mixer_oss: invalid OSS volume '' [ 266.164925][ T7264] No such timeout policy "syz1" [ 266.562601][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 266.619791][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 266.626388][ T28] audit: type=1107 audit(1786178168.468:13): pid=7262 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='f‹lPH]‰€x»ôµî®@' [ 268.585891][ T7291] tipc: Started in network mode [ 268.590881][ T7291] tipc: Node identity ac14140f, cluster identity 4711 [ 268.598505][ T7291] tipc: New replicast peer: 255.255.255.255 [ 268.605639][ T7291] tipc: Enabled bearer , priority 10 [ 268.616268][ T7291] netlink: 8 bytes leftover after parsing attributes in process `syz.3.292'. [ 269.181544][ T7293] loop1: detected capacity change from 0 to 256 [ 269.202363][ T7293] FAT-fs (loop1): Unrecognized mount option "shortnameepage=862" or missing value [ 269.568394][ T7295] No such timeout policy "syz1" [ 269.935538][ T2180] tipc: Node number set to 2886997007 [ 271.984174][ T7311] loop2: detected capacity change from 0 to 2048 [ 272.015696][ T7311] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 272.153945][ T28] audit: type=1800 audit(1786178173.607:14): pid=7311 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.297" name="bus" dev="loop2" ino=1367 res=0 errno=0 [ 272.181504][ T7313] No such timeout policy "syz1" [ 275.046945][ T7324] netlink: 20 bytes leftover after parsing attributes in process `syz.1.301'. [ 278.395679][ T7324] team0 (unregistering): Port device team_slave_0 removed [ 278.935341][ T7324] team0 (unregistering): Port device team_slave_1 removed [ 281.522124][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 281.531817][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 281.539491][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 281.549574][ T5085] Workqueue: hci3 hci_rx_work [ 281.554313][ T5085] Call Trace: [ 281.557604][ T5085] [ 281.560543][ T5085] dump_stack_lvl+0x18c/0x250 [ 281.565217][ T5085] ? show_regs_print_info+0x20/0x20 [ 281.570426][ T5085] ? load_image+0x420/0x420 [ 281.574932][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 281.580036][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 281.585074][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 281.589739][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 281.594933][ T5085] kobject_add_internal+0x617/0xc90 [ 281.600135][ T5085] kobject_add+0x164/0x240 [ 281.604549][ T5085] ? kobject_init+0x1d0/0x1d0 [ 281.609238][ T5085] ? get_device_parent+0x366/0x390 [ 281.614358][ T5085] device_add+0x3fa/0xc40 [ 281.618696][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 281.623637][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 281.628921][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 281.635152][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 281.640775][ T5085] ? mutex_unlock+0x10/0x10 [ 281.645280][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 281.649971][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 281.655528][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 281.661591][ T5085] hci_event_packet+0x7b4/0x1280 [ 281.666523][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 281.672163][ T5085] ? bis_list+0x290/0x290 [ 281.676487][ T5085] ? kcov_remote_start+0x1b5/0x7e0 [ 281.681591][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 281.686781][ T5085] hci_rx_work+0x43a/0xd60 [ 281.691192][ T5085] ? process_scheduled_works+0x975/0x1600 [ 281.696903][ T5085] process_scheduled_works+0xa60/0x1600 [ 281.702456][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 281.707906][ T5085] ? assign_work+0x3cc/0x5d0 [ 281.712506][ T5085] worker_thread+0xa5e/0xfe0 [ 281.717094][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 281.721935][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 281.726877][ T5085] kthread+0x2fa/0x390 [ 281.730932][ T5085] ? pr_cont_work+0x550/0x550 [ 281.735615][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 281.740204][ T5085] ret_from_fork+0x48/0x80 [ 281.744618][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 281.749198][ T5085] ret_from_fork_asm+0x11/0x20 [ 281.753966][ T5085] [ 281.763867][ T5085] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 281.785320][ T5085] Bluetooth: hci3: failed to register connection device [ 281.890759][ T7345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.307'. [ 281.977398][ T7346] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 281.985760][ T7346] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 281.994709][ T7346] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 283.986343][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 284.680875][ T7354] No such timeout policy "syz1" [ 287.950249][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 287.960072][ T5774] CPU: 1 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 287.967648][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 287.977713][ T5774] Workqueue: hci2 hci_rx_work [ 287.982396][ T5774] Call Trace: [ 287.985689][ T5774] [ 287.988639][ T5774] dump_stack_lvl+0x18c/0x250 [ 287.993336][ T5774] ? show_regs_print_info+0x20/0x20 [ 287.998539][ T5774] ? load_image+0x420/0x420 [ 288.003091][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 288.008225][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 288.013257][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 288.017961][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 288.023192][ T5774] kobject_add_internal+0x617/0xc90 [ 288.028438][ T5774] kobject_add+0x164/0x240 [ 288.032875][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 288.038267][ T5774] ? kobject_init+0x1d0/0x1d0 [ 288.042973][ T5774] ? get_device_parent+0x366/0x390 [ 288.048114][ T5774] device_add+0x3fa/0xc40 [ 288.052464][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 288.057420][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 288.062723][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 288.068982][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 288.074666][ T5774] ? mutex_unlock+0x10/0x10 [ 288.079176][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 288.083858][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 288.089422][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 288.095517][ T5774] hci_event_packet+0x7b4/0x1280 [ 288.100472][ T5774] ? bis_list+0x290/0x290 [ 288.104811][ T5774] ? kasan_check_range+0x89/0x290 [ 288.109843][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 288.115058][ T5774] hci_rx_work+0x43a/0xd60 [ 288.119506][ T5774] ? process_scheduled_works+0x975/0x1600 [ 288.125235][ T5774] process_scheduled_works+0xa60/0x1600 [ 288.130847][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 288.136325][ T5774] ? assign_work+0x3cc/0x5d0 [ 288.140939][ T5774] worker_thread+0xa5e/0xfe0 [ 288.145566][ T5774] kthread+0x2fa/0x390 [ 288.149668][ T5774] ? pr_cont_work+0x550/0x550 [ 288.154376][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 288.158989][ T5774] ret_from_fork+0x48/0x80 [ 288.163421][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 288.168022][ T5774] ret_from_fork_asm+0x11/0x20 [ 288.172832][ T5774] [ 288.177790][ T5774] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 288.198882][ T5774] Bluetooth: hci2: failed to register connection device [ 288.794213][ T7387] loop2: detected capacity change from 0 to 164 [ 288.854563][ T6631] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 289.070319][ T7387] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5771] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[7387] [ 289.258446][ C0] hrtimer: interrupt took 38390 ns [ 290.631903][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 292.590063][ T7412] netlink: 20 bytes leftover after parsing attributes in process `syz.0.323'. [ 292.836845][ T7412] team0 (unregistering): Port device team_slave_0 removed [ 294.589503][ T7412] team0 (unregistering): Port device team_slave_1 removed [ 297.045813][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 297.056834][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 297.064433][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.074513][ T5085] Workqueue: hci3 hci_rx_work [ 297.079226][ T5085] Call Trace: [ 297.082524][ T5085] [ 297.085480][ T5085] dump_stack_lvl+0x18c/0x250 [ 297.090190][ T5085] ? show_regs_print_info+0x20/0x20 [ 297.095410][ T5085] ? load_image+0x420/0x420 [ 297.099956][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 297.105097][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 297.110157][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 297.114864][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 297.120098][ T5085] kobject_add_internal+0x617/0xc90 [ 297.125362][ T5085] kobject_add+0x164/0x240 [ 297.129838][ T5085] ? kobject_init+0x1d0/0x1d0 [ 297.134604][ T5085] ? get_device_parent+0x366/0x390 [ 297.139771][ T5085] device_add+0x3fa/0xc40 [ 297.144129][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 297.149108][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 297.154461][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 297.160743][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 297.166415][ T5085] ? mutex_unlock+0x10/0x10 [ 297.170940][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 297.175640][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 297.181214][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 297.187316][ T5085] hci_event_packet+0x7b4/0x1280 [ 297.192288][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 297.197343][ T5085] ? lock_chain_count+0x20/0x20 [ 297.202221][ T5085] ? bis_list+0x290/0x290 [ 297.206592][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 297.211821][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 297.217049][ T5085] hci_rx_work+0x43a/0xd60 [ 297.221499][ T5085] ? process_scheduled_works+0x975/0x1600 [ 297.227243][ T5085] process_scheduled_works+0xa60/0x1600 [ 297.232852][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 297.238348][ T5085] ? assign_work+0x3cc/0x5d0 [ 297.242974][ T5085] worker_thread+0xa5e/0xfe0 [ 297.247611][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 297.252493][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 297.257468][ T5085] kthread+0x2fa/0x390 [ 297.261555][ T5085] ? pr_cont_work+0x550/0x550 [ 297.266260][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 297.270874][ T5085] ret_from_fork+0x48/0x80 [ 297.275315][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 297.279933][ T5085] ret_from_fork_asm+0x11/0x20 [ 297.284740][ T5085] [ 297.293899][ T7437] damon-dbgfs: DAMON debugfs interface is deprecated, so users should move to DAMON_SYSFS. If you cannot, please report your usecase to damon@lists.linux.dev and linux-mm@kvack.org. [ 297.416492][ T5085] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 297.432031][ T5085] Bluetooth: hci3: failed to register connection device [ 298.677015][ T7451] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.685218][ T7451] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.167633][ T7449] No such timeout policy "syz1" [ 299.679322][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 301.319235][ T7460] loop2: detected capacity change from 0 to 32768 [ 301.384025][ T7460] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 302.537724][ T7460] XFS (loop2): Ending clean mount [ 302.558423][ T7460] XFS (loop2): Quotacheck needed: Please wait. [ 302.622079][ T7483] pim6reg: entered allmulticast mode [ 302.744442][ T7460] XFS (loop2): Quotacheck: Done. [ 303.523864][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 303.533534][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 303.541115][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.551194][ T5774] Workqueue: hci0 hci_rx_work [ 303.555909][ T5774] Call Trace: [ 303.559210][ T5774] [ 303.562159][ T5774] dump_stack_lvl+0x18c/0x250 [ 303.566868][ T5774] ? show_regs_print_info+0x20/0x20 [ 303.572093][ T5774] ? load_image+0x420/0x420 [ 303.576640][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 303.581778][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 303.586885][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 303.591593][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 303.596851][ T5774] kobject_add_internal+0x617/0xc90 [ 303.602095][ T5774] kobject_add+0x164/0x240 [ 303.606554][ T5774] ? kobject_init+0x1d0/0x1d0 [ 303.611270][ T5774] ? get_device_parent+0x366/0x390 [ 303.616414][ T5774] device_add+0x3fa/0xc40 [ 303.620784][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 303.625764][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 303.631088][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 303.637366][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 303.643031][ T5774] ? mutex_unlock+0x10/0x10 [ 303.647560][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 303.652275][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 303.656757][ T28] audit: type=1800 audit(1786178202.193:15): pid=7488 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.336" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=4429 res=0 errno=0 [ 303.657824][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 303.705537][ T5774] hci_event_packet+0x7b4/0x1280 [ 303.710524][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 303.716198][ T5774] ? bis_list+0x290/0x290 [ 303.720572][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 303.725720][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 303.730962][ T5774] hci_rx_work+0x43a/0xd60 [ 303.735422][ T5774] ? process_scheduled_works+0x975/0x1600 [ 303.741162][ T5774] process_scheduled_works+0xa60/0x1600 [ 303.746774][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 303.752244][ T5774] ? assign_work+0x3cc/0x5d0 [ 303.756842][ T5774] worker_thread+0xa5e/0xfe0 [ 303.761465][ T5774] kthread+0x2fa/0x390 [ 303.765531][ T5774] ? pr_cont_work+0x550/0x550 [ 303.770208][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 303.774815][ T5774] ret_from_fork+0x48/0x80 [ 303.779246][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 303.783850][ T5774] ret_from_fork_asm+0x11/0x20 [ 303.788636][ T5774] [ 304.302510][ T5774] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 304.316828][ T5774] Bluetooth: hci0: failed to register connection device [ 304.460661][ T5771] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 304.723531][ T7497] loop1: detected capacity change from 0 to 8 [ 304.739353][ T7497] SQUASHFS error: lzo decompression failed, data probably corrupt [ 304.747515][ T7497] SQUASHFS error: Failed to read block 0x91: -5 [ 304.753851][ T7497] SQUASHFS error: Unable to read metadata cache entry [8f] [ 304.775281][ T7497] SQUASHFS error: Unable to read inode 0x11f [ 306.998558][ T5774] Bluetooth: hci0: command 0x0406 tx timeout [ 307.076965][ T6631] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 307.842364][ T7510] workqueue: Failed to create a rescuer kthread for wq "xfs-blockgc/nbd0": -EINTR [ 309.637907][ T7518] No such timeout policy "syz1" [ 309.661767][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 310.268545][ T7526] loop2: detected capacity change from 0 to 512 [ 310.275657][ T7526] EXT4-fs: Ignoring removed nomblk_io_submit option [ 310.283046][ T7526] ext4: Unknown parameter 'fscontext' [ 310.517540][ T6631] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 310.549163][ T7519] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nbd1": -EINTR [ 310.722088][ T7533] loop2: detected capacity change from 0 to 2048 [ 310.875147][ T5774] Bluetooth: hci3: unexpected event for opcode 0x2027 [ 311.369651][ T7538] loop0: detected capacity change from 0 to 1024 [ 311.406300][ T7538] EXT4-fs (loop0): couldn't mount as ext3 due to feature incompatibilities [ 312.692606][ T7545] 9pnet_fd: Insufficient options for proto=fd [ 314.046862][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 314.056826][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 314.064402][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 314.074454][ T5085] Workqueue: hci2 hci_rx_work [ 314.079138][ T5085] Call Trace: [ 314.082424][ T5085] [ 314.085351][ T5085] dump_stack_lvl+0x18c/0x250 [ 314.090028][ T5085] ? show_regs_print_info+0x20/0x20 [ 314.095220][ T5085] ? load_image+0x420/0x420 [ 314.099730][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 314.104839][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 314.109859][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 314.114537][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 314.119740][ T5085] kobject_add_internal+0x617/0xc90 [ 314.124944][ T5085] kobject_add+0x164/0x240 [ 314.129372][ T5085] ? kobject_init+0x1d0/0x1d0 [ 314.134047][ T5085] ? get_device_parent+0x366/0x390 [ 314.139160][ T5085] device_add+0x3fa/0xc40 [ 314.143486][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 314.148430][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 314.153724][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 314.159960][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 314.165591][ T5085] ? mutex_unlock+0x10/0x10 [ 314.170087][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 314.174762][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 314.180308][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 314.186379][ T5085] hci_event_packet+0x7b4/0x1280 [ 314.191316][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 314.196336][ T5085] ? lock_chain_count+0x20/0x20 [ 314.201187][ T5085] ? bis_list+0x290/0x290 [ 314.205516][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 314.210716][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 314.215911][ T5085] hci_rx_work+0x43a/0xd60 [ 314.220329][ T5085] ? process_scheduled_works+0x975/0x1600 [ 314.226048][ T5085] process_scheduled_works+0xa60/0x1600 [ 314.231613][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 314.237073][ T5085] ? assign_work+0x3cc/0x5d0 [ 314.241668][ T5085] worker_thread+0xa5e/0xfe0 [ 314.246262][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 314.251112][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 314.256084][ T5085] kthread+0x2fa/0x390 [ 314.260149][ T5085] ? pr_cont_work+0x550/0x550 [ 314.264825][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 314.269408][ T5085] ret_from_fork+0x48/0x80 [ 314.273824][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 314.278408][ T5085] ret_from_fork_asm+0x11/0x20 [ 314.283180][ T5085] [ 314.292085][ T5085] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 314.343367][ T5085] Bluetooth: hci2: failed to register connection device [ 314.472041][ T7552] Console: switching to colour VGA+ 80x25 [ 314.640278][ T7555] syz.2.350 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 314.657087][ T7555] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 315.363062][ T7560] ..@ÿ: renamed from bond_slave_0 (while UP) [ 315.465121][ T7563] loop3: detected capacity change from 0 to 16 [ 315.649959][ T7563] erofs: Unknown parameter 'pim6reg0' [ 316.269343][ T7569] netlink: 8 bytes leftover after parsing attributes in process `syz.1.356'. [ 316.423368][ T7572] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 316.432011][ T7572] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 316.450835][ T7572] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 316.586183][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 317.299229][ T7577] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nbd2": -EINTR [ 318.359668][ T7592] loop3: detected capacity change from 0 to 64 [ 319.431977][ T7604] netlink: 20 bytes leftover after parsing attributes in process `syz.2.359'. [ 319.443103][ T7604] warning: `syz.2.359' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 319.553227][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 320.427634][ T7607] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 320.436392][ T7607] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 320.445421][ T7607] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 321.115012][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 321.158980][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 321.166590][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 321.176663][ T5085] Workqueue: hci2 hci_rx_work [ 321.181341][ T5085] Call Trace: [ 321.184627][ T5085] [ 321.187582][ T5085] dump_stack_lvl+0x18c/0x250 [ 321.192288][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 321.197954][ T5085] ? show_regs_print_info+0x20/0x20 [ 321.203186][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 321.208871][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 321.214017][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 321.219070][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 321.223747][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 321.228949][ T5085] kobject_add_internal+0x617/0xc90 [ 321.234167][ T5085] kobject_add+0x164/0x240 [ 321.238580][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 321.243968][ T5085] ? kobject_init+0x1d0/0x1d0 [ 321.248653][ T5085] ? get_device_parent+0x366/0x390 [ 321.253763][ T5085] device_add+0x3fa/0xc40 [ 321.258091][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 321.263037][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 321.268331][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 321.274574][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 321.280215][ T5085] ? mutex_unlock+0x10/0x10 [ 321.284714][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 321.289395][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 321.294947][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 321.301015][ T5085] hci_event_packet+0x7b4/0x1280 [ 321.305961][ T5085] ? bis_list+0x290/0x290 [ 321.310294][ T5085] ? kasan_check_range+0x89/0x290 [ 321.315323][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 321.320522][ T5085] hci_rx_work+0x43a/0xd60 [ 321.324948][ T5085] ? process_scheduled_works+0x975/0x1600 [ 321.330687][ T5085] process_scheduled_works+0xa60/0x1600 [ 321.336255][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 321.341714][ T5085] ? assign_work+0x3cc/0x5d0 [ 321.346305][ T5085] worker_thread+0xa5e/0xfe0 [ 321.350902][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 321.355755][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 321.360698][ T5085] kthread+0x2fa/0x390 [ 321.364764][ T5085] ? pr_cont_work+0x550/0x550 [ 321.369437][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 321.374019][ T5085] ret_from_fork+0x48/0x80 [ 321.378452][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 321.383051][ T5085] ret_from_fork_asm+0x11/0x20 [ 321.387845][ T5085] [ 321.392192][ T5085] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 321.406325][ T5085] Bluetooth: hci2: failed to register connection device [ 323.609344][ T5774] Bluetooth: hci2: command 0x0406 tx timeout [ 324.541422][ T7623] syz.0.363: attempt to access beyond end of device [ 324.541422][ T7623] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 324.736328][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 325.237190][ T7645] syz.1.367: attempt to access beyond end of device [ 325.237190][ T7645] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 325.331424][ T7654] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5771] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[7654] [ 325.898390][ T7660] ..@ÿ: renamed from bond_slave_0 (while UP) [ 326.405642][ T7663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.368'. [ 326.486908][ T7666] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 326.496576][ T7664] loop1: detected capacity change from 0 to 16 [ 326.520900][ T7664] erofs: Unknown parameter 'pim6reg0' [ 326.536889][ T7666] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 326.545409][ T7666] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 326.969070][ T7671] No such timeout policy "syz1" [ 328.296619][ T7675] loop0: detected capacity change from 0 to 32768 [ 328.481366][ T7675] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 328.542114][ T7675] XFS (loop0): Ending clean mount [ 328.679574][ T7675] XFS (loop0): Quotacheck needed: Please wait. [ 328.771144][ T7693] IPVS: set_ctl: invalid protocol: 58 224.0.0.2:0 [ 328.984321][ T7675] XFS (loop0): Quotacheck: Done. [ 329.810943][ T28] audit: type=1800 audit(1786178226.460:16): pid=7699 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.371" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop0" ino=4429 res=0 errno=0 [ 329.894686][ T5769] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 330.010821][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 330.020620][ T5774] CPU: 1 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 330.028195][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 330.038254][ T5774] Workqueue: hci0 hci_rx_work [ 330.042955][ T5774] Call Trace: [ 330.046233][ T5774] [ 330.049162][ T5774] dump_stack_lvl+0x18c/0x250 [ 330.053858][ T5774] ? show_regs_print_info+0x20/0x20 [ 330.059087][ T5774] ? load_image+0x420/0x420 [ 330.063611][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 330.068728][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 330.073756][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 330.078433][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 330.083646][ T5774] kobject_add_internal+0x617/0xc90 [ 330.088852][ T5774] kobject_add+0x164/0x240 [ 330.093285][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 330.098659][ T5774] ? kobject_init+0x1d0/0x1d0 [ 330.103348][ T5774] ? get_device_parent+0x366/0x390 [ 330.108464][ T5774] device_add+0x3fa/0xc40 [ 330.112802][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 330.117749][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 330.123049][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 330.129298][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 330.134940][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 330.140144][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 330.145771][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 330.151858][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 330.157414][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 330.163486][ T5774] hci_event_packet+0x7b4/0x1280 [ 330.168430][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 330.173453][ T5774] ? lock_chain_count+0x20/0x20 [ 330.178301][ T5774] ? bis_list+0x290/0x290 [ 330.182632][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 330.187831][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 330.193047][ T5774] hci_rx_work+0x43a/0xd60 [ 330.197468][ T5774] ? process_scheduled_works+0x975/0x1600 [ 330.203193][ T5774] process_scheduled_works+0xa60/0x1600 [ 330.208762][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 330.214225][ T5774] ? assign_work+0x3cc/0x5d0 [ 330.218827][ T5774] worker_thread+0xa5e/0xfe0 [ 330.223441][ T5774] kthread+0x2fa/0x390 [ 330.227529][ T5774] ? pr_cont_work+0x550/0x550 [ 330.232214][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 330.236808][ T5774] ret_from_fork+0x48/0x80 [ 330.241220][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 330.245807][ T5774] ret_from_fork_asm+0x11/0x20 [ 330.250589][ T5774] [ 330.322451][ T5774] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 330.337348][ T5774] Bluetooth: hci0: failed to register connection device [ 332.481910][ T7714] No such timeout policy "syz1" [ 332.533446][ T7712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.379'. [ 332.542684][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 333.150777][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 333.157208][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 333.406930][ T7712] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 333.415406][ T7712] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 333.424222][ T7712] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 334.427742][ T7724] workqueue: Failed to create a rescuer kthread for wq "xfs-conv/nbd3": -EINTR [ 335.995413][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 336.040021][ T7739] ieee802154 phy0 wpan0: encryption failed: -22 [ 336.287039][ T7745] syz.0.376: attempt to access beyond end of device [ 336.287039][ T7745] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 336.711256][ T7753] loop1: detected capacity change from 0 to 32768 [ 337.017381][ T7753] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 337.533474][ T7753] XFS (loop1): Ending clean mount [ 337.545322][ T7753] XFS (loop1): Quotacheck needed: Please wait. [ 337.900048][ T7753] XFS (loop1): Quotacheck: Done. [ 338.021373][ T3529] Bluetooth: (null): Invalid header checksum [ 338.149557][ T7771] netlink: 8 bytes leftover after parsing attributes in process `syz.3.386'. [ 338.238795][ T7773] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 338.247423][ T7773] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 338.292328][ T7773] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 338.348317][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 341.025332][ T28] audit: type=1800 audit(1786178234.607:17): pid=7774 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.385" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=4429 res=0 errno=0 [ 341.178663][ T3529] Bluetooth: (null): Invalid header checksum [ 341.244026][ T5768] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 341.635313][ T7784] befs: (nbd2): No write support. Marking filesystem read-only [ 341.693649][ T7784] syz.2.389: attempt to access beyond end of device [ 341.693649][ T7784] nbd2: rw=0, sector=0, nr_sectors = 2 limit=0 [ 341.997655][ T7789] loop3: detected capacity change from 0 to 512 [ 342.315624][ T7792] loop0: detected capacity change from 0 to 256 [ 342.323256][ T7792] exfat: Deprecated parameter 'utf8' [ 342.359034][ T174] IPVS: starting estimator thread 0... [ 342.388245][ T7789] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 342.401373][ T7789] EXT4-fs error (device loop3): ext4_get_journal_inode:5820: comm syz.3.390: inode #1792: comm syz.3.390: iget: illegal inode # [ 342.447695][ T7792] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe3865569, utbl_chksum : 0xe619d30d) [ 342.522467][ T7793] IPVS: using max 22 ests per chain, 52800 per kthread [ 342.556887][ T7789] EXT4-fs (loop3): Remounting filesystem read-only [ 342.563602][ T7789] EXT4-fs (loop3): no journal found [ 342.569041][ T7789] EXT4-fs (loop3): can't get journal size [ 342.601609][ T7789] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 342.616685][ T7789] EXT4-fs (loop3): failed to initialize system zone (-22) [ 342.624538][ T7789] EXT4-fs (loop3): mount failed [ 344.678874][ T7806] workqueue: Failed to create a rescuer kthread for wq "xfs-blockgc/nbd1": -EINTR [ 345.545274][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 347.570040][ T7821] loop0: detected capacity change from 0 to 128 [ 349.815264][ T7826] netlink: 8 bytes leftover after parsing attributes in process `syz.1.398'. [ 349.885826][ T7830] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 349.894246][ T7830] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 349.902883][ T7830] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 349.977272][ T7827] hub 8-0:1.0: USB hub found [ 349.987018][ T7827] hub 8-0:1.0: 1 port detected [ 351.402569][ T7829] loop3: detected capacity change from 0 to 32768 [ 352.055329][ T7829] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 352.476073][ T7829] XFS (loop3): Ending clean mount [ 352.516971][ T7829] XFS (loop3): Quotacheck needed: Please wait. [ 352.777169][ T7829] XFS (loop3): Quotacheck: Done. [ 352.933741][ T5770] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 356.470937][ T3529] Bluetooth: (null): Invalid header checksum [ 356.477036][ T3529] Bluetooth: (null): Invalid header checksum [ 356.590601][ T5946] Bluetooth: (null): Invalid header checksum [ 356.800052][ T7854] loop3: detected capacity change from 0 to 4096 [ 356.846225][ T7854] ntfs: (device loop3): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 356.915616][ T7854] ntfs: (device loop3): read_ntfs_boot_sector(): Hot-fix: Recovering invalid primary boot sector from backup copy. [ 356.942225][ T7854] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 356.956697][ T7854] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 357.150493][ T7854] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 357.184397][ T7854] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 357.551443][ T7854] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 357.627994][ T7854] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 357.849828][ T7854] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 357.895736][ T7854] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 358.008546][ T7854] ntfs: volume version 3.1. [ 359.193378][ T7871] bridge0: port 3(syz_tun) entered blocking state [ 359.201365][ T7871] bridge0: port 3(syz_tun) entered disabled state [ 359.208386][ T7871] syz_tun: entered allmulticast mode [ 359.219869][ T7871] syz_tun: entered promiscuous mode [ 361.102793][ T7875] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd1": -EINTR [ 362.651325][ T7888] loop3: detected capacity change from 0 to 128 [ 363.352624][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 363.554264][ T7893] netlink: 8 bytes leftover after parsing attributes in process `syz.2.410'. [ 363.629752][ T7894] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 363.639802][ T7894] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 363.648399][ T7894] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 364.514999][ T7891] Bluetooth: hci0: unsupported parameter 255 [ 364.521048][ T7891] Bluetooth: hci0: unsupported parameter 255 [ 365.629631][ T7905] 9pnet_fd: Insufficient options for proto=fd [ 366.104609][ T7907] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 366.585665][ T7902] netlink: 8 bytes leftover after parsing attributes in process `syz.1.414'. [ 368.454726][ T7916] loop0: detected capacity change from 0 to 512 [ 368.511641][ T7916] EXT4-fs: Ignoring removed nomblk_io_submit option [ 370.279623][ T7916] ext4: Unknown parameter 'fscontext' [ 370.663291][ T7919] loop1: detected capacity change from 0 to 32768 [ 370.977308][ T5085] Bluetooth: hci1: unexpected event for opcode 0x2027 [ 372.057791][ T5948] read_mapping_page failed! [ 372.062716][ T5948] ERROR: (device loop1): txCommit: [ 372.062716][ T5948] [ 372.335946][ T5948] jfs_write_inode: jfs_commit_inode failed! [ 375.065410][ T7944] loop1: detected capacity change from 0 to 128 [ 376.877173][ T7951] sock: sock_timestamping_bind_phc: sock not bind to device [ 376.944736][ T7951] zram0: detected capacity change from 0 to 8 [ 382.082794][ T7972] loop3: detected capacity change from 0 to 512 [ 382.122315][ T7972] EXT4-fs: Ignoring removed nomblk_io_submit option [ 382.131075][ T7972] ext4: Unknown parameter 'fscontext' [ 382.926063][ T5774] Bluetooth: hci0: unexpected event for opcode 0x2027 [ 383.368331][ T7976] CIFS: Attempting to mount //127.0.0.1/share [ 383.987014][ T5774] Bluetooth: hci0: adv larger than maximum supported [ 383.987167][ T5774] Bluetooth: hci0: Malformed LE Event: 0x0d [ 384.481900][ T7976] CIFS: VFS: Error connecting to socket. Aborting operation. [ 384.499883][ T7976] CIFS: VFS: cifs_mount failed w/return code = -4 [ 386.413571][ T8003] loop3: detected capacity change from 0 to 512 [ 386.524439][ T8003] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 386.594287][ T8003] EXT4-fs (loop3): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 386.665776][ T8003] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 386.677333][ T8003] [EXT4 FS bs=4096, gc=2, bpg=35, ipg=32, mo=e040e01c, mo2=0000] [ 386.690285][ T8003] EXT4-fs (loop3): failed to initialize system zone (-117) [ 386.698088][ T8003] EXT4-fs (loop3): mount failed [ 389.358659][ T8019] Mass Storage Function, version: 2009/09/11 [ 389.366052][ T8019] LUN: removable file: (no medium) [ 389.484448][ T8019] LUN: removable file: (no medium) [ 391.481643][ T8025] No such timeout policy "syz1" [ 392.564847][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 392.580404][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 392.588001][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 392.598069][ T5774] Workqueue: hci0 hci_rx_work [ 392.602765][ T5774] Call Trace: [ 392.606061][ T5774] [ 392.609013][ T5774] dump_stack_lvl+0x18c/0x250 [ 392.613727][ T5774] ? show_regs_print_info+0x20/0x20 [ 392.618966][ T5774] ? load_image+0x420/0x420 [ 392.623521][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 392.628654][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 392.633671][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 392.638349][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 392.643548][ T5774] kobject_add_internal+0x617/0xc90 [ 392.648751][ T5774] kobject_add+0x164/0x240 [ 392.653163][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 392.658536][ T5774] ? kobject_init+0x1d0/0x1d0 [ 392.663210][ T5774] ? get_device_parent+0x366/0x390 [ 392.668316][ T5774] device_add+0x3fa/0xc40 [ 392.672642][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 392.677572][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 392.682855][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 392.689090][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 392.694749][ T5774] ? mutex_unlock+0x10/0x10 [ 392.699255][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 392.703930][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 392.709474][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 392.715538][ T5774] hci_event_packet+0x7b4/0x1280 [ 392.720474][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 392.726131][ T5774] ? bis_list+0x290/0x290 [ 392.730462][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 392.735580][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 392.740776][ T5774] hci_rx_work+0x43a/0xd60 [ 392.745196][ T5774] ? process_scheduled_works+0x975/0x1600 [ 392.750915][ T5774] process_scheduled_works+0xa60/0x1600 [ 392.756479][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 392.761970][ T5774] ? assign_work+0x3cc/0x5d0 [ 392.766563][ T5774] worker_thread+0xa5e/0xfe0 [ 392.771161][ T5774] kthread+0x2fa/0x390 [ 392.775220][ T5774] ? pr_cont_work+0x550/0x550 [ 392.779893][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 392.784474][ T5774] ret_from_fork+0x48/0x80 [ 392.788883][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 392.793466][ T5774] ret_from_fork_asm+0x11/0x20 [ 392.798253][ T5774] [ 392.816418][ T5774] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 392.830894][ T5774] Bluetooth: hci0: failed to register connection device [ 395.052142][ T5774] Bluetooth: hci0: command 0x0406 tx timeout [ 396.161498][ T8046] syz.3.447: attempt to access beyond end of device [ 396.161498][ T8046] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 397.368677][ T8056] Cannot find del_set index 0 as target [ 398.270845][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 398.276420][ T8060] loop0: detected capacity change from 0 to 256 [ 398.356388][ T8061] loop3: detected capacity change from 0 to 512 [ 398.378454][ T8060] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 399.753711][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 399.766341][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 401.038105][ T8061] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 401.062153][ T8061] ext4 filesystem being mounted at /114/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 402.640222][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 403.878806][ T8079] No such timeout policy "syz1" [ 406.120440][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 406.130213][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 406.137787][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 406.147863][ T5085] Workqueue: hci1 hci_rx_work [ 406.152540][ T5085] Call Trace: [ 406.155828][ T5085] [ 406.158808][ T5085] dump_stack_lvl+0x18c/0x250 [ 406.163498][ T5085] ? show_regs_print_info+0x20/0x20 [ 406.168704][ T5085] ? load_image+0x420/0x420 [ 406.173246][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 406.178378][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 406.183414][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 406.188117][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 406.193316][ T5085] kobject_add_internal+0x617/0xc90 [ 406.198532][ T5085] kobject_add+0x164/0x240 [ 406.202960][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 406.208357][ T5085] ? kobject_init+0x1d0/0x1d0 [ 406.213046][ T5085] ? get_device_parent+0x366/0x390 [ 406.218163][ T5085] device_add+0x3fa/0xc40 [ 406.222491][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 406.227444][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 406.232729][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 406.238986][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 406.244637][ T5085] ? mutex_unlock+0x10/0x10 [ 406.249142][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 406.253827][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 406.259403][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 406.265505][ T5085] hci_event_packet+0x7b4/0x1280 [ 406.270461][ T5085] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 406.276099][ T5085] ? bis_list+0x290/0x290 [ 406.280460][ T5085] ? kcov_remote_start+0x1b5/0x7e0 [ 406.285589][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 406.290782][ T5085] hci_rx_work+0x43a/0xd60 [ 406.295214][ T5085] ? process_scheduled_works+0x975/0x1600 [ 406.300953][ T5085] process_scheduled_works+0xa60/0x1600 [ 406.306562][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 406.312042][ T5085] ? assign_work+0x3cc/0x5d0 [ 406.316663][ T5085] worker_thread+0xa5e/0xfe0 [ 406.321281][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 406.326129][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 406.331098][ T5085] kthread+0x2fa/0x390 [ 406.335189][ T5085] ? pr_cont_work+0x550/0x550 [ 406.339866][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 406.344458][ T5085] ret_from_fork+0x48/0x80 [ 406.348880][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 406.353482][ T5085] ret_from_fork_asm+0x11/0x20 [ 406.358280][ T5085] [ 406.363688][ T5085] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 406.378023][ T5085] Bluetooth: hci1: failed to register connection device [ 406.616067][ T8094] loop2: detected capacity change from 0 to 512 [ 406.623604][ T8094] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 406.728293][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 406.740296][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 406.747990][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 406.758076][ T5085] Workqueue: hci2 hci_rx_work [ 406.762791][ T5085] Call Trace: [ 406.766079][ T5085] [ 406.769013][ T5085] dump_stack_lvl+0x18c/0x250 [ 406.773696][ T5085] ? show_regs_print_info+0x20/0x20 [ 406.778908][ T5085] ? load_image+0x420/0x420 [ 406.783426][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 406.788533][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 406.793563][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 406.798259][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 406.803466][ T5085] kobject_add_internal+0x617/0xc90 [ 406.808699][ T5085] kobject_add+0x164/0x240 [ 406.813148][ T5085] ? kobject_init+0x1d0/0x1d0 [ 406.817836][ T5085] ? get_device_parent+0x366/0x390 [ 406.822953][ T5085] device_add+0x3fa/0xc40 [ 406.827292][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 406.832240][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 406.837550][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 406.843802][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 406.849442][ T5085] ? mutex_unlock+0x10/0x10 [ 406.853947][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 406.858638][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 406.864187][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 406.870265][ T5085] hci_event_packet+0x7b4/0x1280 [ 406.875247][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 406.880274][ T5085] ? lock_chain_count+0x20/0x20 [ 406.885124][ T5085] ? bis_list+0x290/0x290 [ 406.889487][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 406.894691][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 406.899897][ T5085] hci_rx_work+0x43a/0xd60 [ 406.904337][ T5085] ? process_scheduled_works+0x975/0x1600 [ 406.910073][ T5085] process_scheduled_works+0xa60/0x1600 [ 406.915657][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 406.921139][ T5085] ? assign_work+0x3cc/0x5d0 [ 406.925744][ T5085] worker_thread+0xa5e/0xfe0 [ 406.930352][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 406.935206][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 406.940158][ T5085] kthread+0x2fa/0x390 [ 406.944233][ T5085] ? pr_cont_work+0x550/0x550 [ 406.948919][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 406.953509][ T5085] ret_from_fork+0x48/0x80 [ 406.957923][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 406.962510][ T5085] ret_from_fork_asm+0x11/0x20 [ 406.967295][ T5085] [ 406.973967][ T5085] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 406.988819][ T5085] Bluetooth: hci2: failed to register connection device [ 408.546988][ T8106] syz.3.457: attempt to access beyond end of device [ 408.546988][ T8106] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 409.010775][ T5085] Bluetooth: hci1: command 0x0406 tx timeout [ 409.251815][ T8116] comedi comedi2: dt2814: I/O port conflict (0xfffffffffffffff9,2) [ 409.265635][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 410.046798][ T8121] netlink: 48 bytes leftover after parsing attributes in process `syz.1.461'. [ 410.243480][ T8125] netlink: 16 bytes leftover after parsing attributes in process `syz.3.462'. [ 410.322065][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 412.267828][ T8136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.464'. [ 412.296133][ T8136] 9pnet_virtio: no channels available for device syz [ 413.339516][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 413.432550][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 413.440160][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 413.450241][ T5085] Workqueue: hci0 hci_rx_work [ 413.454951][ T5085] Call Trace: [ 413.458249][ T5085] [ 413.461195][ T5085] dump_stack_lvl+0x18c/0x250 [ 413.465913][ T5085] ? show_regs_print_info+0x20/0x20 [ 413.471128][ T5085] ? load_image+0x420/0x420 [ 413.475656][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 413.480789][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 413.485818][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 413.490491][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 413.495702][ T5085] kobject_add_internal+0x617/0xc90 [ 413.500916][ T5085] kobject_add+0x164/0x240 [ 413.505341][ T5085] ? kobject_init+0x1d0/0x1d0 [ 413.510047][ T5085] ? get_device_parent+0x366/0x390 [ 413.515179][ T5085] device_add+0x3fa/0xc40 [ 413.519517][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 413.524465][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 413.529766][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 413.536036][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 413.541700][ T5085] ? mutex_unlock+0x10/0x10 [ 413.546224][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 413.550927][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 413.556499][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 413.562592][ T5085] hci_event_packet+0x7b4/0x1280 [ 413.567563][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 413.572606][ T5085] ? lock_chain_count+0x20/0x20 [ 413.577485][ T5085] ? bis_list+0x290/0x290 [ 413.581842][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 413.587074][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 413.592303][ T5085] hci_rx_work+0x43a/0xd60 [ 413.596751][ T5085] ? process_scheduled_works+0x975/0x1600 [ 413.602502][ T5085] process_scheduled_works+0xa60/0x1600 [ 413.608104][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 413.613594][ T5085] ? assign_work+0x3cc/0x5d0 [ 413.618211][ T5085] worker_thread+0xa5e/0xfe0 [ 413.622838][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 413.627718][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 413.632682][ T5085] kthread+0x2fa/0x390 [ 413.636766][ T5085] ? pr_cont_work+0x550/0x550 [ 413.641463][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 413.646074][ T5085] ret_from_fork+0x48/0x80 [ 413.650510][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 413.655121][ T5085] ret_from_fork_asm+0x11/0x20 [ 413.659925][ T5085] [ 413.666557][ T5085] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 413.682100][ T5085] Bluetooth: hci0: failed to register connection device [ 414.024201][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 414.082644][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 414.090243][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 414.100298][ T5774] Workqueue: hci2 hci_rx_work [ 414.104979][ T5774] Call Trace: [ 414.108254][ T5774] [ 414.111182][ T5774] dump_stack_lvl+0x18c/0x250 [ 414.115859][ T5774] ? show_regs_print_info+0x20/0x20 [ 414.121055][ T5774] ? load_image+0x420/0x420 [ 414.125565][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 414.130676][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 414.135707][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 414.140388][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 414.145589][ T5774] kobject_add_internal+0x617/0xc90 [ 414.150796][ T5774] kobject_add+0x164/0x240 [ 414.155223][ T5774] ? kobject_init+0x1d0/0x1d0 [ 414.159903][ T5774] ? get_device_parent+0x366/0x390 [ 414.165009][ T5774] device_add+0x3fa/0xc40 [ 414.169335][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 414.174268][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 414.179567][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 414.185811][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 414.191440][ T5774] ? mutex_unlock+0x10/0x10 [ 414.195935][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 414.200607][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 414.206156][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 414.212222][ T5774] hci_event_packet+0x7b4/0x1280 [ 414.217162][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 414.222211][ T5774] ? lock_chain_count+0x20/0x20 [ 414.227054][ T5774] ? bis_list+0x290/0x290 [ 414.232096][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 414.237308][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 414.242523][ T5774] hci_rx_work+0x43a/0xd60 [ 414.246991][ T5774] ? process_scheduled_works+0x975/0x1600 [ 414.252758][ T5774] process_scheduled_works+0xa60/0x1600 [ 414.258358][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 414.263838][ T5774] ? assign_work+0x3cc/0x5d0 [ 414.268442][ T5774] worker_thread+0xa5e/0xfe0 [ 414.273059][ T5774] kthread+0x2fa/0x390 [ 414.277125][ T5774] ? pr_cont_work+0x550/0x550 [ 414.281800][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 414.286389][ T5774] ret_from_fork+0x48/0x80 [ 414.290809][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 414.295392][ T5774] ret_from_fork_asm+0x11/0x20 [ 414.300164][ T5774] [ 414.440211][ T5774] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 414.454376][ T5774] Bluetooth: hci2: failed to register connection device [ 416.943989][ T5774] Bluetooth: hci0: command 0x0406 tx timeout [ 416.951205][ T5774] Bluetooth: hci2: command 0x0406 tx timeout [ 417.123948][ T28] kauditd_printk_skb: 10 callbacks suppressed [ 417.123962][ T28] audit: type=1800 audit(1786178307.362:19): pid=8162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.472" name="idProduct" dev="configfs" ino=13377 res=0 errno=0 [ 417.130071][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 417.130157][ T5085] CPU: 0 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 417.130177][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 417.130188][ T5085] Workqueue: hci2 hci_rx_work [ 417.130211][ T5085] Call Trace: [ 417.130218][ T5085] [ 417.130225][ T5085] dump_stack_lvl+0x18c/0x250 [ 417.130251][ T5085] ? show_regs_print_info+0x20/0x20 [ 417.130274][ T5085] ? load_image+0x420/0x420 [ 417.130316][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 417.130336][ T5085] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 417.130364][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 417.130389][ T5085] ? kobject_add_internal+0x602/0xc90 [ 417.130423][ T5085] kobject_add_internal+0x617/0xc90 [ 417.130454][ T5085] kobject_add+0x164/0x240 [ 417.130484][ T5085] ? kobject_init+0x1d0/0x1d0 [ 417.130515][ T5085] ? get_device_parent+0x366/0x390 [ 417.130542][ T5085] device_add+0x3fa/0xc40 [ 417.130568][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 417.130602][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 417.130635][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 417.130662][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 417.130690][ T5085] ? mutex_unlock+0x10/0x10 [ 417.130711][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 417.130738][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 417.130766][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 417.130792][ T5085] hci_event_packet+0x7b4/0x1280 [ 417.130821][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 417.130843][ T5085] ? lock_chain_count+0x20/0x20 [ 417.130865][ T5085] ? bis_list+0x290/0x290 [ 417.130891][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 417.130918][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 417.130944][ T5085] hci_rx_work+0x43a/0xd60 [ 417.130973][ T5085] ? process_scheduled_works+0x975/0x1600 [ 417.130998][ T5085] process_scheduled_works+0xa60/0x1600 [ 417.131051][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 417.131080][ T5085] ? assign_work+0x3cc/0x5d0 [ 417.131110][ T5085] worker_thread+0xa5e/0xfe0 [ 417.131147][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 417.131170][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 417.131198][ T5085] kthread+0x2fa/0x390 [ 417.366361][ T5085] ? pr_cont_work+0x550/0x550 [ 417.371033][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 417.375609][ T5085] ret_from_fork+0x48/0x80 [ 417.380010][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 417.384584][ T5085] ret_from_fork_asm+0x11/0x20 [ 417.389345][ T5085] [ 417.452117][ T5085] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 417.466630][ T5085] Bluetooth: hci2: failed to register connection device [ 417.643774][ T28] audit: type=1800 audit(1786178307.759:20): pid=8162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.472" name="ep_name" dev="configfs" ino=13389 res=0 errno=0 [ 418.167617][ T28] audit: type=1800 audit(1786178307.796:21): pid=8162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.472" name="direction" dev="configfs" ino=13390 res=0 errno=0 [ 418.896170][ T28] audit: type=1800 audit(1786178307.814:22): pid=8162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.472" name="name" dev="configfs" ino=13391 res=0 errno=0 [ 419.674928][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 420.098872][ T8179] loop0: detected capacity change from 0 to 128 [ 420.112199][ T8179] FAT-fs (loop0): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 421.195937][ T8174] netlink: 8 bytes leftover after parsing attributes in process `syz.3.475'. [ 421.315097][ T8189] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 421.324157][ T8189] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 421.332801][ T8189] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 421.714193][ T8167] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 422.581143][ T5774] Bluetooth: hci3: command 0x0406 tx timeout [ 423.065249][ T8199] can0: slcan on ttyS3. [ 423.968607][ T8195] can0 (unregistered): slcan off ttyS3. [ 424.797259][ T8207] loop1: detected capacity change from 0 to 128 [ 424.841477][ T8207] EXT4-fs (loop1): VFS: Found ext4 filesystem with unknown checksum algorithm. [ 425.360563][ T8212] @0Ù: renamed from dummy0 (while UP) [ 426.111051][ T6823] udevd[6823]: incorrect ext4 checksum on /dev/loop1 [ 426.552145][ T8222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.484'. [ 428.714594][ T8229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.487'. [ 429.210815][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 429.243018][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 429.250614][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.260675][ T5774] Workqueue: hci3 hci_rx_work [ 429.265360][ T5774] Call Trace: [ 429.268637][ T5774] [ 429.271566][ T5774] dump_stack_lvl+0x18c/0x250 [ 429.276244][ T5774] ? show_regs_print_info+0x20/0x20 [ 429.281442][ T5774] ? load_image+0x420/0x420 [ 429.285956][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 429.291064][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 429.296084][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 429.300759][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 429.305956][ T5774] kobject_add_internal+0x617/0xc90 [ 429.311167][ T5774] kobject_add+0x164/0x240 [ 429.315584][ T5774] ? kobject_init+0x1d0/0x1d0 [ 429.320263][ T5774] ? get_device_parent+0x366/0x390 [ 429.325370][ T5774] device_add+0x3fa/0xc40 [ 429.329696][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 429.334635][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 429.339929][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 429.346175][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 429.351808][ T5774] ? mutex_unlock+0x10/0x10 [ 429.356307][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 429.360985][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 429.366535][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 429.372601][ T5774] hci_event_packet+0x7b4/0x1280 [ 429.377539][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 429.382558][ T5774] ? lock_chain_count+0x20/0x20 [ 429.387400][ T5774] ? bis_list+0x290/0x290 [ 429.391730][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 429.396942][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 429.402134][ T5774] hci_rx_work+0x43a/0xd60 [ 429.406552][ T5774] ? process_scheduled_works+0x975/0x1600 [ 429.412268][ T5774] process_scheduled_works+0xa60/0x1600 [ 429.417832][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 429.423385][ T5774] ? assign_work+0x3cc/0x5d0 [ 429.427977][ T5774] worker_thread+0xa5e/0xfe0 [ 429.432584][ T5774] kthread+0x2fa/0x390 [ 429.436643][ T5774] ? pr_cont_work+0x550/0x550 [ 429.441320][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 429.445902][ T5774] ret_from_fork+0x48/0x80 [ 429.450323][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 429.454920][ T5774] ret_from_fork_asm+0x11/0x20 [ 429.459694][ T5774] [ 431.086832][ T5774] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 431.101195][ T5774] Bluetooth: hci3: failed to register connection device [ 431.612043][ T8252] loop3: detected capacity change from 0 to 512 [ 432.241806][ T8252] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 432.381772][ T8252] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 432.459353][ T8252] EXT4-fs error (device loop3): ext4_orphan_get:1430: comm syz.3.492: bad orphan inode 131083 [ 432.558694][ T8252] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 433.147529][ T8241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.276325][ T8271] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 13: comm syz.3.492: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 433.280105][ T8241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.362969][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 433.682890][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 434.790587][ T8287] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 434.799004][ T8287] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 434.807516][ T8287] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 436.391193][ T8302] vlan2: entered allmulticast mode [ 436.396377][ T8302] veth0_vlan: entered allmulticast mode [ 437.023292][ T8302] 8021q: adding VLAN 0 to HW filter on device .` [ 437.032421][ T8302] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 437.819225][ T8309] netlink: 12 bytes leftover after parsing attributes in process `syz.2.498'. [ 438.312350][ T8315] netlink: 8 bytes leftover after parsing attributes in process `syz.0.499'. [ 444.785575][ T8347] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 444.793915][ T8347] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 444.803337][ T8347] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 447.302141][ T8372] loop1: detected capacity change from 0 to 128 [ 447.309769][ T8372] FAT-fs (loop1): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 448.853101][ T8380] workqueue: Failed to create a rescuer kthread for wq "xfs-conv/nbd0": -EINTR [ 449.760669][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 453.225768][ T8406] loop0: detected capacity change from 0 to 256 [ 453.233160][ T8406] exfat: Deprecated parameter 'utf8' [ 454.007777][ T8406] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xabf88b1f, utbl_chksum : 0xe619d30d) [ 454.239147][ T8409] loop1: detected capacity change from 0 to 512 [ 454.294976][ T8409] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 454.505152][ T8409] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2855: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 454.787851][ T8409] EXT4-fs (loop1): 1 truncate cleaned up [ 454.844299][ T8409] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 454.895142][ T8415] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 454.903621][ T8415] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 454.912422][ T8415] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 455.140627][ T5085] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 455.150315][ T5085] CPU: 1 PID: 5085 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 455.157882][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 455.167952][ T5085] Workqueue: hci0 hci_rx_work [ 455.172630][ T5085] Call Trace: [ 455.175909][ T5085] [ 455.178851][ T5085] dump_stack_lvl+0x18c/0x250 [ 455.183555][ T5085] ? show_regs_print_info+0x20/0x20 [ 455.188757][ T5085] ? load_image+0x420/0x420 [ 455.193324][ T5085] sysfs_create_dir_ns+0x26e/0x2a0 [ 455.198459][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 455.203489][ T5085] ? sysfs_warn_dup+0xa0/0xa0 [ 455.208187][ T5085] ? do_raw_spin_unlock+0x121/0x230 [ 455.213508][ T5085] kobject_add_internal+0x617/0xc90 [ 455.218733][ T5085] kobject_add+0x164/0x240 [ 455.223173][ T5085] ? kobject_init+0x1d0/0x1d0 [ 455.227868][ T5085] ? get_device_parent+0x366/0x390 [ 455.233013][ T5085] device_add+0x3fa/0xc40 [ 455.237372][ T5085] hci_conn_add_sysfs+0xd5/0x1e0 [ 455.242335][ T5085] le_conn_complete_evt+0xe9f/0x1480 [ 455.247656][ T5085] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 455.253929][ T5085] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 455.259588][ T5085] ? mutex_unlock+0x10/0x10 [ 455.264123][ T5085] ? skb_pull_data+0xf0/0x1f0 [ 455.268832][ T5085] hci_le_conn_complete_evt+0x187/0x440 [ 455.274402][ T5085] ? hci_remote_host_features_evt+0x150/0x150 [ 455.280534][ T5085] hci_event_packet+0x7b4/0x1280 [ 455.285495][ T5085] ? __lock_acquire+0x7d80/0x7d80 [ 455.290528][ T5085] ? lock_chain_count+0x20/0x20 [ 455.295387][ T5085] ? bis_list+0x290/0x290 [ 455.299726][ T5085] ? lockdep_hardirqs_on+0x98/0x150 [ 455.304939][ T5085] ? hci_send_to_monitor+0xd7/0x4f0 [ 455.310146][ T5085] hci_rx_work+0x43a/0xd60 [ 455.314563][ T5085] ? process_scheduled_works+0x975/0x1600 [ 455.320289][ T5085] process_scheduled_works+0xa60/0x1600 [ 455.325860][ T5085] ? worker_attach_to_pool+0x370/0x370 [ 455.331339][ T5085] ? assign_work+0x3cc/0x5d0 [ 455.335933][ T5085] worker_thread+0xa5e/0xfe0 [ 455.340538][ T5085] ? _raw_spin_unlock+0x40/0x40 [ 455.345392][ T5085] ? __kthread_parkme+0x71/0x1c0 [ 455.350341][ T5085] kthread+0x2fa/0x390 [ 455.354411][ T5085] ? pr_cont_work+0x550/0x550 [ 455.359096][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 455.363679][ T5085] ret_from_fork+0x48/0x80 [ 455.368107][ T5085] ? kthread_blkcg+0xd0/0xd0 [ 455.372696][ T5085] ret_from_fork_asm+0x11/0x20 [ 455.377503][ T5085] [ 455.382275][ T5085] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 455.440516][ T5085] Bluetooth: hci0: failed to register connection device [ 455.539348][ T5768] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 457.181409][ T8428] netlink: 8 bytes leftover after parsing attributes in process `syz.1.521'. [ 457.191658][ T8428] netlink: 12 bytes leftover after parsing attributes in process `syz.1.521'. [ 457.653133][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 458.221219][ T8440] syz.3.522: attempt to access beyond end of device [ 458.221219][ T8440] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 459.145620][ T8451] netlink: 132 bytes leftover after parsing attributes in process `syz.2.524'. [ 459.220166][ T8452] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 459.230974][ T8452] VFS: Can't find a romfs filesystem on dev nullb0. [ 459.230974][ T8452] [ 459.854245][ C1] ------------[ cut here ]------------ [ 459.860209][ C1] WARNING: CPU: 1 PID: 8458 at net/mac80211/tx.c:5048 __ieee80211_beacon_get+0x1141/0x1520 [ 459.870307][ C1] Modules linked in: [ 459.874243][ C1] CPU: 1 PID: 8458 Comm: syz.1.526 Not tainted syzkaller #0 [ 459.881540][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 459.891653][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 459.898067][ C1] Code: f7 4c 89 ef e8 70 5b ba f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 ab 6f 7c f7 0f 0b e9 61 f8 ff ff e8 9f 6f 7c f7 <0f> 0b e9 85 fb ff ff e8 93 6f 7c f7 48 c7 c7 60 bd 65 8e 4c 89 e6 [ 459.917745][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 459.923831][ C1] RAX: ffffffff8a0b01e1 RBX: dffffc0000000000 RCX: ffff88802bc83c00 [ 459.931854][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 459.939870][ C1] RBP: 0000000000000000 R08: ffff88802bc83c00 R09: 0000000000000003 [ 459.947883][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805db5e440 [ 459.955863][ C1] R13: ffff88805e43c824 R14: ffff88805db5e930 R15: ffff88805e43c800 [ 459.963889][ C1] FS: 00007f53b1db26c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 459.972872][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 459.979469][ C1] CR2: 00007ffdec0c7f49 CR3: 0000000075cc8000 CR4: 00000000003506e0 [ 459.987486][ C1] Call Trace: [ 459.990777][ C1] [ 459.993664][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 459.999250][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 460.004774][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 460.011575][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 460.017184][ C1] __iterate_interfaces+0x225/0x4c0 [ 460.022399][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 460.028692][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 460.035937][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 460.042204][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 460.049280][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 460.054496][ C1] ? hw_scan_work+0xf10/0xf10 [ 460.059221][ C1] __hrtimer_run_queues+0x525/0xc10 [ 460.064459][ C1] ? hrtimer_interrupt+0x980/0x980 [ 460.069613][ C1] ? read_tsc+0x9/0x20 [ 460.073709][ C1] hrtimer_run_softirq+0x177/0x290 [ 460.078876][ C1] handle_softirqs+0x27d/0x820 [ 460.083655][ C1] ? read_tsc+0x9/0x20 [ 460.087741][ C1] ? ktime_get+0x24b/0x280 [ 460.092212][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 460.097001][ C1] ? do_softirq+0x1a0/0x1a0 [ 460.101567][ C1] __irq_exit_rcu+0xd3/0x190 [ 460.106175][ C1] ? irq_exit_rcu+0x20/0x20 [ 460.110732][ C1] irq_exit_rcu+0x9/0x20 [ 460.114992][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 460.120668][ C1] [ 460.123647][ C1] [ 460.126592][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 460.132636][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 460.137951][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 460.139970][ T3529] ------------[ cut here ]------------ [ 460.157609][ C1] RSP: 0000:ffffc90019cae980 EFLAGS: 00000206 [ 460.157652][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 4ec9ed4143616e00 [ 460.157668][ C1] RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 460.157684][ C1] RBP: ffffc90019caeaa0 R08: dffffc0000000000 R09: 1ffffffff223d6a2 [ 460.157701][ C1] R10: dffffc0000000000 R11: fffffbfff223d6a3 R12: 1ffff92003395d3c [ 460.157717][ C1] R13: ffffffff8d216e40 R14: 0000000000000246 R15: dffffc0000000000 [ 460.157765][ C1] ? read_lock_is_recursive+0x20/0x20 [ 460.157799][ C1] ? mark_lock+0x94/0x320 [ 460.157821][ C1] ? verify_lock_unused+0x140/0x140 [ 460.157847][ C1] fs_reclaim_acquire+0x71/0x100 [ 460.157863][ C1] ? prepare_alloc_pages+0x156/0x5b0 [ 460.157881][ C1] prepare_alloc_pages+0x156/0x5b0 [ 460.157907][ C1] __alloc_pages+0x134/0x460 [ 460.157931][ C1] ? zone_statistics+0x170/0x170 [ 460.157975][ C1] __folio_alloc+0x10/0x20 [ 460.157992][ C1] vma_alloc_folio+0x474/0x8f0 [ 460.163732][ T3529] WARNING: CPU: 0 PID: 3529 at net/mac80211/chan.c:92 ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 460.169724][ C1] ? mpol_shared_policy_lookup+0x14b/0x1e0 [ 460.169755][ C1] shmem_alloc_folio+0x1a9/0x2a0 [ 460.169782][ C1] ? folio_put+0xd0/0xd0 [ 460.169826][ C1] ? shmem_alloc_and_acct_folio+0xd4/0x6c0 [ 460.177909][ T3529] Modules linked in: [ 460.185774][ C1] shmem_alloc_and_acct_folio+0x1cb/0x6c0 [ 460.185807][ C1] ? put_swap_device+0x230/0x230 [ 460.185836][ C1] ? xas_load+0x11d/0x140 [ 460.185855][ C1] ? filemap_get_entry+0xce/0x3f0 [ 460.185875][ C1] ? filemap_get_entry+0xce/0x3f0 [ 460.185894][ C1] ? filemap_get_entry+0x375/0x3f0 [ 460.185915][ C1] ? page_cache_prev_miss+0x390/0x390 [ 460.185952][ C1] shmem_get_folio_gfp+0xe1d/0x2b40 [ 460.186007][ C1] shmem_write_begin+0xf2/0x430 [ 460.186037][ C1] generic_perform_write+0x2fe/0x5c0 [ 460.186077][ C1] ? generic_file_direct_write+0x3e0/0x3e0 [ 460.186100][ C1] ? down_write+0x16e/0x200 [ 460.186136][ C1] ? file_update_time+0x98/0x1a0 [ 460.186164][ C1] shmem_file_write_iter+0xfb/0x120 [ 460.186193][ C1] __kernel_write_iter+0x29f/0x6d0 [ 460.186268][ C1] ? vfs_read+0x990/0x990 [ 460.194515][ T3529] [ 460.202217][ C1] ? get_dump_page+0x156/0x200 [ 460.202258][ C1] ? __asan_memset+0x22/0x40 [ 460.202287][ C1] ? iov_iter_bvec+0xd4/0x1b0 [ 460.202319][ C1] dump_user_range+0x418/0x840 [ 460.210412][ T3529] CPU: 0 PID: 3529 Comm: kworker/u4:8 Not tainted syzkaller #0 [ 460.215662][ C1] ? dump_skip+0x40/0x40 [ 460.215686][ C1] ? dump_emit+0x78/0xe0 [ 460.215724][ C1] ? dump_emit+0xa6/0xe0 [ 460.215743][ C1] ? elf_core_dump+0x2dbb/0x37c0 [ 460.220152][ T3529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 460.225255][ C1] elf_core_dump+0x320e/0x37c0 [ 460.225307][ C1] ? load_elf_binary+0x2850/0x2850 [ 460.230337][ T3529] Workqueue: phy8 ieee80211_csa_finalize_work [ 460.235536][ C1] ? verify_lock_unused+0x140/0x140 [ 460.235566][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 460.235591][ C1] ? mas_next_slot+0x94c/0x980 [ 460.235647][ C1] ? rcu_read_lock_any_held+0xb4/0x140 [ 460.240831][ T3529] [ 460.245314][ C1] ? 0xffffffffff600000 [ 460.245363][ C1] do_coredump+0x1791/0x24a0 [ 460.245411][ C1] ? nfs_stat_to_errno+0x170/0x170 [ 460.250395][ T3529] RIP: 0010:ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 460.254757][ C1] ? lock_chain_count+0x20/0x20 [ 460.254790][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 460.259623][ T3529] Code: 48 89 df e8 d4 44 d0 f7 e9 d6 fc ff ff e8 7a c2 77 f7 eb 24 e8 73 c2 77 f7 c7 04 24 f4 ff ff ff e9 cc f5 ff ff e8 62 c2 77 f7 <0f> 0b 0f 0b e9 b7 f5 ff ff e8 54 c2 77 f7 48 8b 7c 24 08 4c 8b 74 [ 460.270487][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 460.270521][ C1] get_signal+0x10da/0x1390 [ 460.270568][ C1] arch_do_signal_or_restart+0xc2/0x7b0 [ 460.270605][ C1] ? get_sigframe_size+0x20/0x20 [ 460.270633][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 460.270670][ C1] ? exit_to_user_mode_loop+0x3b/0x110 [ 460.276576][ T3529] RSP: 0018:ffffc9000c6af9c0 EFLAGS: 00010293 [ 460.281393][ C1] exit_to_user_mode_loop+0x70/0x110 [ 460.281427][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 460.281458][ C1] irqentry_exit_to_user_mode+0x9/0x30 [ 460.285796][ T3529] [ 460.291505][ C1] exc_page_fault+0x8c/0x100 [ 460.291539][ C1] asm_exc_page_fault+0x26/0x30 [ 460.291563][ C1] RIP: 0033:0x7f53b3f9e0d9 [ 460.291587][ C1] Code: Unable to access opcode bytes at 0x7f53b3f9e0af. [ 460.291598][ C1] RSP: 002b:00007f53b1db1fd8 EFLAGS: 00010246 [ 460.295578][ T3529] RAX: ffffffff8a0fab12 RBX: 0000000000000001 RCX: ffff88802e4a5a00 [ 460.301202][ C1] RAX: 0000000000000000 RBX: 00007f53b4226270 RCX: 00007f53b3f9e0d9 [ 460.301220][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 460.301234][ C1] RBP: 00007f53b4035024 R08: 0000000000000000 R09: 0000000000000000 [ 460.301252][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 460.301265][ C1] R13: 00007f53b4226308 R14: 00007f53b4226270 R15: 00007ffdec0c5a18 [ 460.301299][ C1] [ 460.301314][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 460.301323][ C1] CPU: 1 PID: 8458 Comm: syz.1.526 Not tainted syzkaller #0 [ 460.301338][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 460.301348][ C1] Call Trace: [ 460.301355][ C1] [ 460.301361][ C1] dump_stack_lvl+0x18c/0x250 [ 460.301386][ C1] ? show_regs_print_info+0x20/0x20 [ 460.301404][ C1] ? load_image+0x420/0x420 [ 460.301446][ C1] panic+0x2ca/0x720 [ 460.301474][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 460.301515][ C1] __warn+0x2e0/0x470 [ 460.301538][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301570][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301597][ C1] report_bug+0x2be/0x4f0 [ 460.301619][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301646][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301674][ C1] ? __ieee80211_beacon_get+0x1143/0x1520 [ 460.301700][ C1] handle_bug+0xcf/0x120 [ 460.301723][ C1] exc_invalid_op+0x1a/0x50 [ 460.301742][ C1] asm_exc_invalid_op+0x1a/0x20 [ 460.301760][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 460.301788][ C1] Code: f7 4c 89 ef e8 70 5b ba f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 ab 6f 7c f7 0f 0b e9 61 f8 ff ff e8 9f 6f 7c f7 <0f> 0b e9 85 fb ff ff e8 93 6f 7c f7 48 c7 c7 60 bd 65 8e 4c 89 e6 [ 460.301802][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 460.301819][ C1] RAX: ffffffff8a0b01e1 RBX: dffffc0000000000 RCX: ffff88802bc83c00 [ 460.301833][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 460.301845][ C1] RBP: 0000000000000000 R08: ffff88802bc83c00 R09: 0000000000000003 [ 460.301857][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805db5e440 [ 460.301869][ C1] R13: ffff88805e43c824 R14: ffff88805db5e930 R15: ffff88805e43c800 [ 460.301890][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301921][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 460.301946][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 460.301988][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 460.302017][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 460.302054][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 460.302084][ C1] __iterate_interfaces+0x225/0x4c0 [ 460.302103][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 460.302126][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 460.302148][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 460.302171][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 460.302197][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 460.302216][ C1] ? hw_scan_work+0xf10/0xf10 [ 460.302236][ C1] __hrtimer_run_queues+0x525/0xc10 [ 460.302275][ C1] ? hrtimer_interrupt+0x980/0x980 [ 460.302294][ C1] ? read_tsc+0x9/0x20 [ 460.302322][ C1] hrtimer_run_softirq+0x177/0x290 [ 460.302349][ C1] handle_softirqs+0x27d/0x820 [ 460.302367][ C1] ? read_tsc+0x9/0x20 [ 460.302387][ C1] ? ktime_get+0x24b/0x280 [ 460.302411][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 460.302434][ C1] ? do_softirq+0x1a0/0x1a0 [ 460.302462][ C1] __irq_exit_rcu+0xd3/0x190 [ 460.302482][ C1] ? irq_exit_rcu+0x20/0x20 [ 460.302509][ C1] irq_exit_rcu+0x9/0x20 [ 460.302525][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 460.302550][ C1] [ 460.302556][ C1] [ 460.302563][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 460.302583][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 460.302604][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 460.302619][ C1] RSP: 0000:ffffc90019cae980 EFLAGS: 00000206 [ 460.302634][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 4ec9ed4143616e00 [ 460.302646][ C1] RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 460.302659][ C1] RBP: ffffc90019caeaa0 R08: dffffc0000000000 R09: 1ffffffff223d6a2 [ 460.302672][ C1] R10: dffffc0000000000 R11: fffffbfff223d6a3 R12: 1ffff92003395d3c [ 460.302686][ C1] R13: ffffffff8d216e40 R14: 0000000000000246 R15: dffffc0000000000 [ 460.302724][ C1] ? read_lock_is_recursive+0x20/0x20 [ 460.302751][ C1] ? mark_lock+0x94/0x320 [ 460.302771][ C1] ? verify_lock_unused+0x140/0x140 [ 460.302798][ C1] fs_reclaim_acquire+0x71/0x100 [ 460.302815][ C1] ? prepare_alloc_pages+0x156/0x5b0 [ 460.302833][ C1] prepare_alloc_pages+0x156/0x5b0 [ 460.302859][ C1] __alloc_pages+0x134/0x460 [ 460.302880][ C1] ? zone_statistics+0x170/0x170 [ 460.302915][ C1] __folio_alloc+0x10/0x20 [ 460.302932][ C1] vma_alloc_folio+0x474/0x8f0 [ 460.302960][ C1] ? mpol_shared_policy_lookup+0x14b/0x1e0 [ 460.302983][ C1] shmem_alloc_folio+0x1a9/0x2a0 [ 460.303008][ C1] ? folio_put+0xd0/0xd0 [ 460.303049][ C1] ? shmem_alloc_and_acct_folio+0xd4/0x6c0 [ 460.303076][ C1] shmem_alloc_and_acct_folio+0x1cb/0x6c0 [ 460.303102][ C1] ? put_swap_device+0x230/0x230 [ 460.303127][ C1] ? xas_load+0x11d/0x140 [ 460.303142][ C1] ? filemap_get_entry+0xce/0x3f0 [ 460.303160][ C1] ? filemap_get_entry+0xce/0x3f0 [ 460.303182][ C1] ? filemap_get_entry+0x375/0x3f0 [ 460.303204][ C1] ? page_cache_prev_miss+0x390/0x390 [ 460.303240][ C1] shmem_get_folio_gfp+0xe1d/0x2b40 [ 460.303287][ C1] shmem_write_begin+0xf2/0x430 [ 460.303315][ C1] generic_perform_write+0x2fe/0x5c0 [ 460.303350][ C1] ? generic_file_direct_write+0x3e0/0x3e0 [ 460.303370][ C1] ? down_write+0x16e/0x200 [ 460.303402][ C1] ? file_update_time+0x98/0x1a0 [ 460.303426][ C1] shmem_file_write_iter+0xfb/0x120 [ 460.303451][ C1] __kernel_write_iter+0x29f/0x6d0 [ 460.303482][ C1] ? vfs_read+0x990/0x990 [ 460.303504][ C1] ? get_dump_page+0x156/0x200 [ 460.303534][ C1] ? __asan_memset+0x22/0x40 [ 460.303559][ C1] ? iov_iter_bvec+0xd4/0x1b0 [ 460.303587][ C1] dump_user_range+0x418/0x840 [ 460.303619][ C1] ? dump_skip+0x40/0x40 [ 460.303635][ C1] ? dump_emit+0x78/0xe0 [ 460.303668][ C1] ? dump_emit+0xa6/0xe0 [ 460.303685][ C1] ? elf_core_dump+0x2dbb/0x37c0 [ 460.303714][ C1] elf_core_dump+0x320e/0x37c0 [ 460.303755][ C1] ? load_elf_binary+0x2850/0x2850 [ 460.303787][ C1] ? verify_lock_unused+0x140/0x140 [ 460.303810][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 460.303832][ C1] ? mas_next_slot+0x94c/0x980 [ 460.303884][ C1] ? rcu_read_lock_any_held+0xb4/0x140 [ 460.303906][ C1] ? 0xffffffffff600000 [ 460.303933][ C1] do_coredump+0x1791/0x24a0 [ 460.303976][ C1] ? nfs_stat_to_errno+0x170/0x170 [ 460.304016][ C1] ? lock_chain_count+0x20/0x20 [ 460.304043][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 460.304069][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 460.304096][ C1] get_signal+0x10da/0x1390 [ 460.304135][ C1] arch_do_signal_or_restart+0xc2/0x7b0 [ 460.304166][ C1] ? get_sigframe_size+0x20/0x20 [ 460.304195][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 460.304229][ C1] ? exit_to_user_mode_loop+0x3b/0x110 [ 460.304257][ C1] exit_to_user_mode_loop+0x70/0x110 [ 460.304284][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 460.304311][ C1] irqentry_exit_to_user_mode+0x9/0x30 [ 460.304336][ C1] exc_page_fault+0x8c/0x100 [ 460.304361][ C1] asm_exc_page_fault+0x26/0x30 [ 460.304379][ C1] RIP: 0033:0x7f53b3f9e0d9 [ 460.304398][ C1] Code: Unable to access opcode bytes at 0x7f53b3f9e0af. [ 460.304407][ C1] RSP: 002b:00007f53b1db1fd8 EFLAGS: 00010246 [ 460.304422][ C1] RAX: 0000000000000000 RBX: 00007f53b4226270 RCX: 00007f53b3f9e0d9 [ 460.304435][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 460.304445][ C1] RBP: 00007f53b4035024 R08: 0000000000000000 R09: 0000000000000000 [ 460.304456][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 460.304467][ C1] R13: 00007f53b4226308 R14: 00007f53b4226270 R15: 00007ffdec0c5a18 [ 460.304495][ C1] [ 460.306881][ C1] Kernel Offset: disabled