last executing test programs: 7m36.523673052s ago: executing program 1 (id=277): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1a, 0x4, 0x0, 0x1, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) write(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) io_submit(0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd0a, &(0x7f0000000300)) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x40e02, 0x36) write$P9_RREADLINK(r6, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x4c, r1, 0xd55319eec59dfa33, 0xfffffffe, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7, 0x67}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'pim6reg1\x00'}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc804}, 0xc2010) 7m31.072100915s ago: executing program 1 (id=283): syz_emit_ethernet(0x86, &(0x7f00000001c0)={@random="591a1d9a2bdb", @link_local={0x1, 0x80, 0xc2, 0x25}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x29, 0x0, @empty=0x7f00, @local}, {0x0, 0x0, 0x64, 0x0, @wg=@response={0x220, 0x0, 0x3, "bfd8a5dd2002c02142c4391145badd28fd7f0ffc0e896f38da00", "0bb10000085b2e00", {"bb3b2195c4b058706558a70864bef1f0", "524a72fc460b8cd26e095f24ab642591"}}}}}}}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x4, 0x36, &(0x7f0000000280)=ANY=[], 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000004897}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000880)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000028c0)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlockall() openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0xc0803, 0x0) prctl$PR_SCHED_CORE(0x4d, 0x4, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_route(0x10, 0x3, 0x0) mount(&(0x7f0000000040)=@filename='\x00', &(0x7f00000000c0)='.\x00', &(0x7f0000000400)='ubifs\x00', 0x800002, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000500)={r0, r0, 0x206, 0x0, 0x0, 0x2, 0x72, 0x1, 0x3, 0x7, 0x2, 0x8, 'syz1\x00'}) 7m21.113196605s ago: executing program 1 (id=292): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setpriority(0x1, 0xffffffffffffffff, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) creat(&(0x7f0000000080)='./bus\x00', 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, &(0x7f0000000000)=0x2, 0x4) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x50) listen(r2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r3, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r2}, 0x20) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000002c0)=""/48, 0x30}], 0x1}, 0x3}], 0x2, 0x40000062, 0x0) ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000080)={0x10000, "5e5c3446aa0ecd604c893eba3198600b1891109654fe9676d14574be70b6225c", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x51, 0x0, 0xffffffffffffffff}) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x00', 0x400, &(0x7f00000003c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp12500x0}}, {{@in=@multicast2}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, 0x0, 0x2400404e) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) connect$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 7m1.364630079s ago: executing program 3 (id=316): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25fe880000000000000000000000000101ffffffff000000000000000000000000000000004e2400000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000021000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff000000000000000000000000000000000500000000000000000000000020000000000000000000000000000000000000010002020000000044000500e0000001000000000000000000000000000004d632"], 0xfc}, 0x1, 0x0, 0x0, 0x20080004}, 0x0) socket$inet(0x2, 0x3, 0x1) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x64eb2000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) getdents64(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000740)={0x1, 0x0, 0x0, 0x5, @vifc_lcl_addr=@remote, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x20, 0xfc, 0x2, 0x0, @rand_addr=0x1c, @multicast1=0xe0000300}, @info_reply={0x10, 0x0, 0x0, 0x401, 0x7}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) r6 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r6, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) 6m59.287789493s ago: executing program 32 (id=301): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB="400a2e000000c4b333209d5b64dea9fe5603cadbfeebc688397db29a42d1ddbd66b94eb4d1177f18d3ccafa6f5b464"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount(0x0, &(0x7f0000000200)='./dev\x00', 0x0, 0x0, 0x0) syz_io_uring_setup(0x44f6, &(0x7f0000000440)={0x0, 0xb460, 0x1, 0x805, 0x4}, &(0x7f0000000040), &(0x7f0000000280), &(0x7f0000000110)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0xa, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@private1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, 0x0, 0x2400404e) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) connect$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 6m55.719509377s ago: executing program 3 (id=323): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) 6m47.458874028s ago: executing program 3 (id=328): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000140)={[{@test_dummy_encryption_v1}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}]}, 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x20020c0, 0x0, 0x1, 0x0, &(0x7f0000001a00)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0xffe0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x22, 0x0, 0x0) write$binfmt_misc(r3, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000040)={[{@nomblk_io_submit}, {@nombcache}]}, 0x1, 0x4dd, &(0x7f0000001040)="$eJzs3U1vG1sZAODXk8/m5t6kUIkPAS2lpaCqduK2UdUFKhsQqiohKlYs2pC4URQ7jmKnNCGL9D8gUYkV/AQWSCyQumLPDnYIqSyQCkSgBomF0diTNkltE0pqV/HzSKOZM+OZ95y6c87kdeITwMC6EBE7ETEaEQ8jYirbn8uWuNNa0te92t1e2NvdXsjFaNz/W655PN0XB85JfZRdczwivvftiB/m3o5b29xamS+XS+tZuVCvrBVqm1t/Wq7ML5WWSqvF4tzs3Myt6zeLJ9bW85VfvvzW8t3v/+bXX3zxu52v/zit1mR27GA7Dpo+3qWHOh1oNX3kdZzUcETc/V8q/gEbytoz2u+K8E6SiPhURFxM7/9Gv2sDAPRCozEVjamDZQDgtEuaObBcks9yAZORJPl8K4d3LiaScrVWv/qourG62MqVTcdI8mi5XJrJcoXTMZJLy7NZrmy/XDxSvh4RZyPiJ2NnmuX8QrW82M8HHwAYYB8dGf//OdYa/wGAU2683xUAAHrO+A8Ag8f4DwCDx/gPAIPH+A8Ag8f4DwCDx/gPAAPlu/fupUtjL/v+68XHmxsr1cfXFku1lXxlYyG/UF1fyy9Vq0vN7+yp/LfrlavVtdkbsfGkUC/V6oXa5taDSnVjtf6g+b3eD0ojPWkVANDN2fPP/5CLiJ3bZ5pLHJjLwVgNp1vS7woAfdNx4irg1BvudwWAvvEzPtBmit7XRrr9itCzrqcBH7Arn5P/h0El/w+DS/4fBpf8PwyuRiNnzn8AGDBy/EC3z//j3T7/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgFNvsrnkknw2F/hkJEk+H/FxREzHSO7Rcrk0ExGfRMTvx0bG0vJseuJov2sOALy75C+5bP6vK1OXJo8eHc39ayyy4f5HP7v/0yfz9fr6bLr/72NnstfUn2X7i10DmWoQAPpkf5zeH8f3vdrdXpjc3V5I172sz8tvtiYXTePuZUvryHAMN9fjzQeHiX/ksnJL+rwydALxd55GxGdb8V8dan+umRuZzmY+PRo/jf1xT+Mnh+InzWOtdfpv8ekTqAsMmudp/3On3f2XxIXmuv39P97sof5/+/3f3lv9X/K6/xvq0P9dOG6MG7/9TsdjTyM+P9wufi7rXscvf6ND/EvHjP/HL3zp4uEz32j8POJKtI1/6IxCvbJWqG1uXVuuzC+VlkqrxeLc7NzMres3i4Vmjrqwn6l+219vX/2kW/snOsRvvfPjzfjt2n/5mO3/xb8f/uDLXeJ/7Svt3/9zXeKnY+JXjxl/fuJXHafvTuMvtm9/dk7n9l89ZvwXf95aPOZLAYAeqG1urcyXy6V1Gz3bSJ/dPoBq2OjbRvo/4CSu85n3WNV+90zA+/bmpu93TQAAAAAAAAAAAAAAgE568QdP/W4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9d/AgAA//+9GtUM") 6m39.977338648s ago: executing program 3 (id=335): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) syz_io_uring_setup(0x10, &(0x7f0000000040)={0x0, 0xb45d, 0x0, 0x0, 0x4}, &(0x7f0000000100), &(0x7f0000000108), &(0x7f0000000110)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0xa, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@private1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@initdev}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r3) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/vlan/config\x00') pread64(r4, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_emit_vhci(&(0x7f0000000200)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}}}, 0xd) 6m36.755949257s ago: executing program 3 (id=338): syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') io_submit(0x0, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000088a82e0081003c00080045000028000000000006907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYBLOB="ec771f225c41a3ee584ee920e4202845dd1a42cc4c2ae10a666a3c2993763b9d94e750e568259a3b3d47b39c34faad38df748ce48338ec260538301d09088d1893855fc5a5db304fafb033779b028b0d6b7ee1a3091be9c5f7"], 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_clone3(&(0x7f0000000400)={0x80400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1a}, &(0x7f0000000240)=""/182, 0xb6, 0x0, &(0x7f00000003c0), 0x0, {r2}}, 0x58) ioprio_set$pid(0x3, 0x0, 0x4004) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x39163000) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setns(0xc9, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000078c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="240000001a00010040bd70000000000700201400ff0000070024000008000100e0000001"], 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0xea5bc50b4199d7ae) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x7fff}, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregs(0xd, r4, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") 6m35.297978632s ago: executing program 3 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x400, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/events/kmem/kmalloc/filter\x00', 0x2, 0x0) write(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) r3 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x30, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000280)={0x100, r5}, 0x0) close(r5) close(r4) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 6m29.493599261s ago: executing program 2 (id=342): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000140)={[{@test_dummy_encryption_v1}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}]}, 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x20020c0, 0x0, 0x1, 0x0, &(0x7f0000001a00)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0xffe0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x22, 0x0, 0x0) write$binfmt_misc(r3, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000040)={[{@nomblk_io_submit}, {@nombcache}]}, 0x1, 0x4dd, &(0x7f0000001040)="$eJzs3U1vG1sZAODXk8/m5t6kUIkPAS2lpaCqduK2UdUFKhsQqiohKlYs2pC4URQ7jmKnNCGL9D8gUYkV/AQWSCyQumLPDnYIqSyQCkSgBomF0diTNkltE0pqV/HzSKOZM+OZ95y6c87kdeITwMC6EBE7ETEaEQ8jYirbn8uWuNNa0te92t1e2NvdXsjFaNz/W655PN0XB85JfZRdczwivvftiB/m3o5b29xamS+XS+tZuVCvrBVqm1t/Wq7ML5WWSqvF4tzs3Myt6zeLJ9bW85VfvvzW8t3v/+bXX3zxu52v/zit1mR27GA7Dpo+3qWHOh1oNX3kdZzUcETc/V8q/gEbytoz2u+K8E6SiPhURFxM7/9Gv2sDAPRCozEVjamDZQDgtEuaObBcks9yAZORJPl8K4d3LiaScrVWv/qourG62MqVTcdI8mi5XJrJcoXTMZJLy7NZrmy/XDxSvh4RZyPiJ2NnmuX8QrW82M8HHwAYYB8dGf//OdYa/wGAU2683xUAAHrO+A8Ag8f4DwCDx/gPAIPH+A8Ag8f4DwCDx/gPAAPlu/fupUtjL/v+68XHmxsr1cfXFku1lXxlYyG/UF1fyy9Vq0vN7+yp/LfrlavVtdkbsfGkUC/V6oXa5taDSnVjtf6g+b3eD0ojPWkVANDN2fPP/5CLiJ3bZ5pLHJjLwVgNp1vS7woAfdNx4irg1BvudwWAvvEzPtBmit7XRrr9itCzrqcBH7Arn5P/h0El/w+DS/4fBpf8PwyuRiNnzn8AGDBy/EC3z//j3T7/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgFNvsrnkknw2F/hkJEk+H/FxREzHSO7Rcrk0ExGfRMTvx0bG0vJseuJov2sOALy75C+5bP6vK1OXJo8eHc39ayyy4f5HP7v/0yfz9fr6bLr/72NnstfUn2X7i10DmWoQAPpkf5zeH8f3vdrdXpjc3V5I172sz8tvtiYXTePuZUvryHAMN9fjzQeHiX/ksnJL+rwydALxd55GxGdb8V8dan+umRuZzmY+PRo/jf1xT+Mnh+InzWOtdfpv8ekTqAsMmudp/3On3f2XxIXmuv39P97sof5/+/3f3lv9X/K6/xvq0P9dOG6MG7/9TsdjTyM+P9wufi7rXscvf6ND/EvHjP/HL3zp4uEz32j8POJKtI1/6IxCvbJWqG1uXVuuzC+VlkqrxeLc7NzMres3i4Vmjrqwn6l+219vX/2kW/snOsRvvfPjzfjt2n/5mO3/xb8f/uDLXeJ/7Svt3/9zXeKnY+JXjxl/fuJXHafvTuMvtm9/dk7n9l89ZvwXf95aPOZLAYAeqG1urcyXy6V1Gz3bSJ/dPoBq2OjbRvo/4CSu85n3WNV+90zA+/bmpu93TQAAAAAAAAAAAAAAgE568QdP/W4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9d/AgAA//+9GtUM") 6m25.845805585s ago: executing program 2 (id=345): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) 6m24.744284132s ago: executing program 2 (id=346): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x129242, 0x30) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) capget(&(0x7f0000000780)={0x19980330}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) truncate(0x0, 0x20fffffffc) write$tcp_congestion(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) r5 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) unshare(0x22020600) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x480d0) epoll_pwait2(r0, &(0x7f0000000480), 0x0, 0x0, &(0x7f0000000080)={[0x17]}, 0x8) ioctl$XFS_IOC_FD_TO_HANDLE(r6, 0xc038586a, &(0x7f00000002c0)={r5, 0x0, 0x103000, &(0x7f0000000180)={@_ha_fsid={[0x7fffffff, 0x8]}, {0x84, 0x5, 0x1000007}}, 0x0, 0x0, &(0x7f0000000280)=0x8f}) ioctl$NBD_SET_SOCK(r7, 0xab00, r0) 6m20.570374059s ago: executing program 2 (id=353): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1f00000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) syz_open_dev$sndctrl(0x0, 0x458, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x4000, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$sndctrl(0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x2, 0x0, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000001a00)={'pcmmio\x00', [0x2000, 0x20, 0x4, 0x20000001, 0x25, 0x0, 0x400, 0x2, 0x54c6cff3, 0xfd, 0x2, 0x3, 0xfffffff7, 0x400001, 0x6, 0x8, 0x0, 0x7f, 0x3, 0x40000003, 0x200089, 0x2, 0x4, 0x30001e5b, 0x3, 0x7, 0x3, 0x6, 0x4006, 0x0, 0x3]}) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0xc804, &(0x7f0000000500)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000240)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x1) chdir(&(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}}, 0x0) 6m19.613622824s ago: executing program 33 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x400, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/events/kmem/kmalloc/filter\x00', 0x2, 0x0) write(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) r3 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x30, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000280)={0x100, r5}, 0x0) close(r5) close(r4) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 6m13.021421816s ago: executing program 2 (id=361): syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') io_submit(0x0, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000088a82e0081003c00080045000028000000000006907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYBLOB="ec771f225c41a3ee584ee920e4202845dd1a42cc4c2ae10a666a3c2993763b9d94e750e568259a3b3d47b39c34faad38df748ce48338ec260538301d09088d1893855fc5a5db304fafb033779b028b0d6b7ee1a3091be9c5f7"], 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_clone3(&(0x7f0000000400)={0x80400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1a}, &(0x7f0000000240)=""/182, 0xb6, 0x0, &(0x7f00000003c0), 0x0, {r2}}, 0x58) ioprio_set$pid(0x3, 0x0, 0x4004) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x39163000) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setns(0xc9, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000078c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="240000001a00010040bd70000000000700201400ff0000070024000008000100e0000001"], 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0xea5bc50b4199d7ae) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x7fff}, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregs(0xd, r4, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") 6m11.966835694s ago: executing program 2 (id=362): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) read$FUSE(r0, &(0x7f0000000500)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() setrlimit(0xa, &(0x7f00000000c0)={0x9, 0x6}) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) write(r3, &(0x7f0000000000)="5a000300010003", 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r4 = gettid() r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r5, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0x40045304, &(0x7f0000000000)) tkill(r4, 0x7) syz_emit_ethernet(0x4e, &(0x7f0000002540)=ANY=[@ANYBLOB="aaaaaaaaaaaafffff4ffffff86dd600000000018060100000000000000000000000000000000fe800000000000000000000000efffa94e234e22a79d3a61020c4b3aaccb1b165419472786adf0f344ed4235292e6fbbf2cf77b1b414e9b38bb7aa9ee7adac1c6cfa879f42534a94d1aa663bddbf1c991541ffefa03226302d34c365d0175669da9d779a948691158d266003c70e194119bab0710ac144ce047eb821c6fd0dac62fdb0405e32c91923a4afea093281d4b53fca016eadc0993b9308295ba783bfdd277198a921e3f90008472196b8ef37eded04767395b1207ac432a6f50e10c228c0249b34deff4b8b9e0278212d3a8878b90e997cfc6d8b8124d14668", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="68c200009078000003020000"], 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./tracing\x00', 0x0, 0x0, 0x0) openat(r0, 0x0, 0x2, 0x28) 5m56.484546619s ago: executing program 34 (id=362): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) read$FUSE(r0, &(0x7f0000000500)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() setrlimit(0xa, &(0x7f00000000c0)={0x9, 0x6}) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) write(r3, &(0x7f0000000000)="5a000300010003", 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r4 = gettid() r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r5, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0x40045304, &(0x7f0000000000)) tkill(r4, 0x7) syz_emit_ethernet(0x4e, &(0x7f0000002540)=ANY=[@ANYBLOB="aaaaaaaaaaaafffff4ffffff86dd600000000018060100000000000000000000000000000000fe800000000000000000000000efffa94e234e22a79d3a61020c4b3aaccb1b165419472786adf0f344ed4235292e6fbbf2cf77b1b414e9b38bb7aa9ee7adac1c6cfa879f42534a94d1aa663bddbf1c991541ffefa03226302d34c365d0175669da9d779a948691158d266003c70e194119bab0710ac144ce047eb821c6fd0dac62fdb0405e32c91923a4afea093281d4b53fca016eadc0993b9308295ba783bfdd277198a921e3f90008472196b8ef37eded04767395b1207ac432a6f50e10c228c0249b34deff4b8b9e0278212d3a8878b90e997cfc6d8b8124d14668", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="68c200009078000003020000"], 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./tracing\x00', 0x0, 0x0, 0x0) openat(r0, 0x0, 0x2, 0x28) 3m54.375315751s ago: executing program 6 (id=847): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x10, 0x3}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) 3m54.037085141s ago: executing program 6 (id=852): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000003c0)="a6", 0x1, 0x2404c081, &(0x7f0000000300)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='highspeed', 0x9) shutdown(r0, 0x1) 3m53.53057618s ago: executing program 6 (id=855): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x3, 0xc8c, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x84}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r1, 0x0, 0x0, 0x1, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x1d4) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, 0x0}) 3m53.369738198s ago: executing program 6 (id=857): socket$inet(0x2, 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x200000, &(0x7f0000000100), 0x1, 0x50d, &(0x7f0000001bc0)="$eJzs3c9vI1cdAPDveGPHyaZNWnoABO3SFha0WifxtlHVA5QTQqgSokeQtiHxRlHsOIqd0oQ9pGckTkhU4gRH/gDOPSFx5ILgxqUckPgRgRokDkYzHqdO1t5NyQ+n8ecjzc5787z+vrfZeS/+JvYLYGzdioj9iChFxNsRMZtfT/Ij3uge6eM+Oni4cnjwcCWJTuetfyRZe3ot+v5O6mb+nOWI+N63In6YPBq3tbu3sVyv17bz+ny7sTXf2t27u95YXqut1Tar1aXFpYXX7r1aPbexvtAo5aUvfvj7/a/9OO3WTH6lfxznqTv04lGc1EREfOcigo3AjXw8pVF3hP9LISKejYgXs/t/Nm5kX00A4DrrdGajM9tfP5IcrwIA10Uhy4ElhUqeC5iJQqFS6ebwnovpQr3Zat950NzZXO3myuaiWHiwXq8t5LnCuSgmaX0xK39cr56o34uIZyLiZ5NTWb2y0qyvjvIbHwAYYzdPrP//nuyu/wDANVcedQcAgEtn/QeA8WP9B4DxY/0HgPHTXf+nRt0NAOASef0PAOPH+g8AY+W7b76ZHp3D/POvV9/Z3dlovnN3tdbaqDR2Viorze2tylqzuZZ9Zk/jSc9Xbza3Fl+JnXfnvr7Vas+3dvfuN5o7m+372ed6368Vs0ftX8LIAIBhnnnhgz8l6Yr8+lR2RN9eDsWR9gy4aIVRdwAYmRuj7gAwMnb7gvF1htf4xYifShHAp9rvsj8HbNF7THnQG4Q6nU7noroFXLjbn5P/h3HVl//3W8AwZuT/YXzJ/8P46nSS027yH6d9IABwtcnxA0N+/v9sfv51/sOBH6yefMT7F9krAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNp6+/9W8r3AZ6JQqFQinoqIuSgmD9brtYWIeDoi/jhZnEzriyPuMwBwVoW/Jvn+X7dnX5451vT8zaNiKSJ+9Iu3fv7ucru9/YeIUvLPyd719vv59eonClw6rxEAAI/XW6ezc98L+Y8OHq70jsvsz9++GRHlbvzDg1IcHsWfiInsXI5iREz/K8nrXUlf7uIs9t+LiM8OGn8SM1kOpLvz6cn4aeynLjV+4Vj8QtbWPaf/Fp85h77AuPkgnX/eGHT/FeJWdh58/5ezGers8vkvfaqVw2wO/Dh+b/67MWT+u3XaGK/89tvd0tSjbe9FfH4iohf7sG/+6cVPhsR/+ZTx//yF518c1tb5ZcTtGBy/P9Z8u7E139rdu7veWF6rrdU2q9WlxaWF1+69Wp3PctTzw1eDv79+5+lhben4p4fELz9h/F8+5fh/9d+3v/+lx8T/6kuD4hfiucfET9fEr5wy/vL0b8rD2tL4q0PG/6Sv/51Txv/wL3uPbBsOAIxOa3dvY7ler20rKFz9Qvpf9gp0Y2DhG5cVqxSDm37yUveePtHU+97/E8YaNmOcR9YNuAqObvqI+M+oOwMAAAAAAAAAAAAAAAx0Ge9YGvUYAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuL7+FwAA//87osfs") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r1 = syz_open_dev$loop(&(0x7f00000002c0), 0x1a33, 0x40901) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) 3m52.958920515s ago: executing program 6 (id=862): syz_mount_image$reiserfs(&(0x7f0000000140), &(0x7f0000001140)='./file6\x00', 0x98, &(0x7f0000000280), 0x1, 0x10ef, &(0x7f00000022c0)="$eJzs2DGLE0EYBuB3dg/kqshcvx5oYSHHHfEPXKGQxsLaLljZmUrJz/HnyFX2R3pTBOyVTQwJEhDJYuB4Hlh252Vmvp1yvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDvLPlekosmqdusSVKSrrubLJJ02/zx17ZJydv3k9mrj+PXs8209FmT0q9aj+vN01rHdVxv6suL22d19unzh3avZEmX+9V8ev5mOehR+trtoDsCAADAw/DzaKMT1wcAAAD+ZrBGAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAA6vajSVKSrrubLJJ0p/0tAAAA4EglTd6NDuWbNsDOi3wblZRHu+RH6edc58uB9QAAAMC/KXv38ec5z5O9/DJnubrajH+/srxN2iTXf+xzv5pP18/lfFr+5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgF/swLEAAAAAgDB/6zQ6NgAAAAAAAAAAAAAAAGCqAAAA//9TGNII") openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x100) truncate(&(0x7f0000000080)='./file0\x00', 0x3a6800) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x20c01, 0x0) symlinkat(&(0x7f0000000040)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') write$binfmt_format(r0, &(0x7f0000000180)='-1\x00', 0x3) writev(r0, &(0x7f0000000200)=[{&(0x7f00000003c0)='n', 0xfdef}], 0x1) 3m50.646571209s ago: executing program 6 (id=877): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x20000400) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001200), 0xc0e00, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f00000000c0)=r1) 3m50.458523803s ago: executing program 35 (id=877): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x20000400) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001200), 0xc0e00, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f00000000c0)=r1) 3m20.959325927s ago: executing program 7 (id=1063): openat$dma_heap(0xffffffffffffff9c, 0x0, 0x50880, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f0000006e80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) statx(0xffffffffffffff9c, &(0x7f0000002040)='./file0/file0\x00', 0x100, 0x88c, 0x0) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x1400001, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000000000)="03684a7b99a4fde940f3ec0d105ea2c8267323117153aa4a4f099c3835a607cd5cbd77b83cc33d13bbb6c6bcae59db739af84a4b5d34bffc145f3cc27ed3d4f9d9b3103699a1e1cc4ddfb6c1afd07ddfc18e358cd62649479724ce867fefc0a15041bee9f6084842fb982d5c2cf1488d668b741c64f0a6fd2643e729ac5a56462a6b64d5a0a751fda4fadf63ba0dc2fd14ecbf546918db77095545b41ab170e5d6e8ec8bf9ce9b8d53b832e90c701fe52af7999f8fd509577ead1be27891ada8564167f2c7d2eea1c1c9c65d8e151c58ddee43ec34e74d330ec50cbbb2bb21892c7ca995066e3cbea8a69d94dc6bcef5f3c0ef630e774d092ea58627f3e09c66a9c7d1abcf4f8f8af87f4269df288aca9bbf758275ce9695256e764d185a91a7570fca3aab16c75ecaff6b8dda371c3226d6ec6e55c5c4d8cfc5c33892bacc956a3613bcfa849da1b5e070a7911d7488b3e628d9339718e8b821f1bb5d5c45f0316bb563d0a442801412dfd5a4d61ca657e04d6686f7d5863d57954400aeee8e79be8f3cc4cbb3d4b91269df039c3d3543e500b90a2bdc6eb60cc7afab7b5187d88fbd76e6212ea29e872b73f925287bdc808b4a4f8ec7f8aa08bc90b29e217c3eef69d8deae4141f4f9bd110b7bde9320e7b45f422e9a6111bcaf99c9911e46e219d3bab477926bd5d2e78d4cd0eca133c232b1e863fd7799dbf609f3670b323e5518e8f4bd36e9b3da2c68a28eaec9cac688b4dd0b73adc24a8c7acc264399b7facbc2f43e8e40b6cae9f8e956d1dbfe259f12bae75ad362c354050ffdd6e954f2d7615fafce888bd6f672a81c9fd4318caba765069c0a425e898bf7611b77f0fe61c27d318159dba42f011900246c64557d27b77aef928ab04a147baca37863cf998a2ac30b903c0314449ddb218887c309ec7184c8c733f5d4e7b2d79516e9531c9a5becf8294d6ccd777f285b13160e1c949d3069c6c66c0daa62bac679bc9b69825398d1c290d765e882fa2c8708b20ccec885ab6785dc22696b61c109ff84bc5407932c3e5bf12069a68b8e3333a26d3dd390ef9bc01b86013fbcb5c28a1f4d2b8084f1502fccc4027a124c3629d8f4a8befd14b597cebda5f94f36050a31b95087cbac347788a71a90e87f2187fae600aa42719c05c2859cb30ae0fd58a7bba681f7a6027a00583071def2c9a94456e5d9acb9fd2d11fdea524582489c02377bf7f590948985c769b3822cb6366681d79113c6a6c752f2475caba77b7b2e8f293d7fd9b991f63e254c98dec94f4f3def4fee9cdb56ff3ba7fe6a718cbe9a7f04710e257ea8a49d6605266048fc122d4f3173d4b04b3e282bd3c5198d7fcb72ec38e0b07dd8a541b2807e601e5a0a01f07a281e0e1a261c65977088a54597efd0997c59647aeebb2605a89705eeff3ec780e302e24b23a0cbe4f81367c3f118545f01328d22eb8e802667389143166a9db9477c9b58eb5c76a19b8f8b2692b0d356003f08ae54dfc820d8e357ecbf91fb7e212cbef1262171abaf2f613a5bb59b783cad476fec50d16ca0ac13c08a59a3097e6e3fde700a4b987d10311fc22d4aa210956cd859799f78010e4c0f25b715876aa253df15009490f71be3b0022875161f537c70b14bdb9e2d87a5a11b414a1198533c7de6fc4d22228133bc26b19d9f1e7627b14c72e3c39d3fa2186a42e50a0d1867dc312f94c7209d51475ed4aa80b2ccb0557a40422bf7317de2fdf3296727723a2d23babd5e23f7c3edf4942bb485b95a122e6aba41b8f80f684f84605462448d5a4fd66dfe9bbf80590b9999b4780d4f4f189a20f4400b2975df85b584c8c8f9fa3095f13aede1f52dac98be358b0a0d72bed4df71cd23973e326179580268c4e5d1be4b2ae2e1e2dba913998faa6088af128fc8fd3ae26203a898882b67d86d63f6ee8f8e216337330db6d928facf9d0ca273845ee5b33a0a136aeb48b7c52d3b95fe73efaf06197ec8753ee0349f19db8730917d0f18a2de9602d3b887bc583ff64dfee67e2bdf4d5cc1c341b89acd3dd5176d2c15ec2a77120b8a49591ca438ae36c52845e5dca550e539da9ba2a2eda49be316f3d6d4b7c83666bd4759940347c29dedd273adac722630a940e104316b4806553ded47132be4e31a50600f5a4dd56825b245b7aae853f56f79e0ec31f7b5db945ee3bb92865acb0d8828598e77446ee50ecd8bf5e7ccbd963445a09e3be215709b0b3bff2e9d12e6549924338f236b4ff973682e2e03fbf6b167e3b3a0f8c3f3c1e8d0e21a71937c918cabab50dd74c011a1a5531cfcf88a5df5fa58f17715f7c7b3a64d9dab6f20a596288969191420ed71daccbae7c1ec88bf74811b5e1f4bd306f3d810c4f3600df2903ffdf8db40ac7153fd93327a1065cf2c4590c8ba9f9391eb6aa600cb42aff8793e4721afeb3d470beda45dad9adfc6f4fdb24eafc63792f5015c656ca37cee82b7ee382bda31d786d6e03d4c8611c4ca464e2360ca747815c9eebd38c8fc7d5eea2db96b29d771a96dc5c884029077125bcc31980564555d21ecce5d0388e1bc1e618c7dfb31b02b1a6730db7eda387dd4ceb96f65178bb088e81133e5086f73c458f84139685ef930945a51979faeab539e4964244709dcb8b38f575d3a3ec1328a0df65fb34241db7cb3250b8ae0dbc44670d2b5cc3a1785d8d281c05256ef2beee3b202d8bce053e55ce1fb2bb208e65d488ae24484b00c2e343fc3544ca546406688022db6e29ceca9539ec095a2a2cfc5f516230f75fc961c5de1e8d33222331f57db02cac5f9208029c6114d041bb1cc7f959f77511f5790a564600c018afc253e5ecd5010bd769b45a04296ca09e87fb63bf3d3b51dd8b3f6d4426a03c0944d09dff654c5718ab1fef063caba34029be6811502e8bb785011dd1e34b0c192915adeeb40faad0725a8f9a62acf61b944a271d20567f350cdee22d76e3cc5966ba742d9c43823af19ba74c60da0df0c5f4e7e26af7224147774a1f8ae09f929066e1769ffb3c40ba9fed13d2670b9e865a155426ed5c83648c0ad34e46f5308b455e0835730fe529668b606f3f52b0d04534d0e14bc0ff0f742359550e6980ac9978455adb3de0f292af12a3700453e035a49eafe98fc0d7f26e42a6c41f380448607b7c96291f98fa6bbd7e32c249a49171f8fa81762a490a1ce5c39d66d35c6ed6c0679440c06197c2e24d48e1de81c711164c02820816afb5393d3d6c801c3c062ac46d1494f52c45ca36faf94894eec9d71e1be6c7256f4aee8dc080156b28623c821ef8d1826ebf0a41332620f42589270e142561374c825e828e2bd9ae41fd34959db48319d54ffe7a1b58ae8f7361cbaee8e26e0e7e1b7f125f8cd99788825efd01c38ec987904190a0ad52bc20cd36cc7209f9269ac87b2fa44d2456661d3056d893cf912c69ae6b2b83d0c781a6d6c33df1910867b71257ab74e244e3ebbac07445069418fe2e440a384e16feedf8e3165676e67866430eb6a8a5334620d8c2cda15b0328bb0c50630886353f95241cf4f3b647a4ff812c70e1b074c4befdc70fbfdbf868bcc81652034b5bfa831f1b686724046dcd17ac91ace83711e9ec7465d14c9d508bce93676a58ef7dae37221436865ad34ac2fd691e3b3e12aee6736dbdeec9b1c05fcedf8b9ced547259a1a40471ebe8b4bfda69d2f884da025e2809fb9f159150bbcb331ca3c502012a7fe76b4fc2771976aeb624ad7f2d72c707f5f19d8ded84581ac5afa697ff99d27d88c9588fe769839c9cc9d6786a0f814667527c53b6253b1825bfe17e7d734d96d61da0ae7349d0922774fa9b4baf332a4568e32cafa417ec659c4ad72cd656a1e2c59c8dee38890ed3acd8b4f8657de41f670106c38c38ba1a553f0f589a57c61f5105d70e0c0953459383cb9337ca972cda1d2cd3056eb07f21c1f5b995a04997fecf501bb201c67fd2afe4d44fedea595969b6b3706087b0f59d2ddbb099d60436a94f0ba33282b29f6e914fe92add4b33cf70b680b905cfa2b2ccb00b9967f99806e8d69783fd35a2d7fbb424e9fde2647609aecb0208bc3864bf95f05e50ba12123edaca8de927b338dfcb3cc597947c606c08315061a7fec98c48f480e2febd26fcc8dc12289aeb0adefa2c2be1766a5bc74ef1aab6c2cdbdfbf1810d956bc889c8e614b7b933ff6e336bb208db5b592775fe71c3ebfad5f47e0d074e1c0cb36761481ec677794f23c3698bd35875719f242e3fc939bc3668f9723f31effe189dabdf4ebbed073eab952c88f13059eee22230bc7724d7266b15726a0b0898cdd274e3e56d0a356166b5d16456249e9e92e84e39f61c0ecdf99ec2cd230440c03fd21cf68f27306628d35ea47367775f39d20a07f3959b38d49e3674061fc1018b647047ad39f77027878badd29927c5806f95aebde5f070fed28ed34052550678d3c6b677a3b5a46f76a98264c42206bf62caa95df5437092b68e025ee9ce2ad733b6db3ec97fd33cdc3b2f77ee90dd86d8bd289ae1a437c86f4153ddcff5e846347bfecc1499bb42980e4fa91790faee1b1991dfead5d7c460348631f0469b2b9e8f65207a00985511e0c41f441d9a3154f5a0298c172fd7135d4bf95c11cdf1769db1cc55f392aec309037599327a7c53c10a56d1ace8ad19186a2fc75dfa9d657c114eae99c1c1a6b4a58440718bea82290bd1c2a67048938c381648ea2b2c7110d748c9c8d782f20430b1427b51d7036e55b0997c6f75717db67a82c88d3647ee036b49392f0467d6010b32f9de3e5e79ef082c5bb975d11d2bf76a97f7159c11a7753db8a065d3126ccda9abbebd2c54374e389942c24b27435868fadb45bb060d3c1084b211e2afa8dfaa2d8dab8dc47fe10e6c32afece7c4976176a7c66d704125c0948c238c843b41b0246be1f50f8e07884cfe7ae8885ca06339a339c8d5978b079e0eb78facfa1dc67ca70733dfefc6c868ca149e0661b70e0134870a3107c8c46711fed14f892d6fc66d95306838688f13b19e904416a8d161cc33527878b38ad10b1c08db21457b2075608be7300d39748e4fcebe02b190f3e8ed32a0ef734b11ca43a21f5f809bba795f5aa0ea01050021d0f5213620af5b08fda6421a42b7c82804a20a6ef6d471babf76f46538327f943476d1d109a3f0dc531233d6f93d8dc27f4745735085f92adf63d617b373fba24f289035710e69eb80da12d36e8eaec22620ffaabadfb824bd5fc309a2c74959505856b5b890bba8f22bc571a9d87e93ba3b9aba6dcf26f7076c0c2e271641835ea25fd49d96c69d4fb8bb8731bd2cbc75146aed10d269f9060462339cde8830b535920be3dbf143eace0f1ea9469b95a64fbd7e5057eb880d4422cbf97cfc3f7140251d4923580ca2113f345cf24a66499ceffd2e39dc4fd74cf448638962957b409f0d218c165c13ffe107aa1dd1d9a02092cd46cf2b353dd2d2ca7b8a7ae8eda0ee18bba269bbffed0c7d400497aee4da0896cf6329d76ccea098fbef9075412d1c2a3644cf0f202b884303d204314ae92c56217b2feb5e7c1e15a99fbdd655fb8f6bbc3ab1259bf03b2ee17c5b7e9443695177ec5040eeff3fc36ceafe143393d76a3d735cfe6c9b632e52dbe64dc1265961e8a27ee9f76c0add9e0581e474d7678214f5b64c932903715befc6b766611f1d7e495573b9a3e009cfcb0ffef7ac57c3561badbfa41c119e541180aa2364de61a601699cd1bf3de01d15794b728e1444efd6ffa1e57d95489c8df91fbc057b66dd6d9f3a01b19f36bc99f0b54ed1f9905067dd1608bce47f5ff1981a25184aacd39e331d8ff3dfa7c012d7e667a69249cb4803b23f7eeaab8ed29c69ba3d2a1b88821ffefc5825650c53b6364f38e0a178312f5d29d5375423cceabc8e1c4e51a566ba3f9b176b858c8860440ff8ebdde725640d2dff6b9160bb69f188755b0ff766b410704cda4c33e1ae2c73b5799a00d2f55de73109728b350302b64df2ce3eaf2e0c6561009b60c2701ac493076305e97ed20c3b42f40b2bc7f13bba4ab8181e2085b07930c6f5579205dff696902be824e65ddc774e886e8d261fe74712a31e406b0f7725b4559d7ad0f27a1a870261aa5bb8a720e7c89ba933770d48821416de070df1abcc6eee1147c20bda090d940aeee2bd48c0f3d94675d9b9cf1a62ba50e31a7af0714dd8325d5fb7142e88c4d22ddb8f0278ee6ba88e361524e291b6d000f6523ad4188b021da9ef4a634ed09eb2002b9c726746c9ffc32f261edb448106aa1e2daaed865255fd1d296fedbbb2de3f7c1f15935e52006492b632ad125aa1e000c9d71bdb945792668e16b26122a3fd7cba1a40db8083068c5c48fd2aaa621c87d9f5621bba442fc26839030dbe4e37fda4046d6503bb03e0f928de25d4cd4e2a40ec93c9021dfcbb25f6e2c943cc85eba8123340d6364949581e8c8c2913d59dafe4297672c0b9e7418485f00cbcf672a588904beb3c074bebf339815b91c7c374ceed5a701e1ade8f5d87ca536120116307ac259577a8e12958425317c482d2c7089bf3d83e12318d1526107a050f3c094492de7255b22e18ca2ff261b3ed197f2f8e67b71b1c5a6a04b99158b58e9baad75201aabe13254617d0de0a9073af62491c67fc18d1ccbf7686a85a99b39e9d7d9c85a0777e47c9fd0e10c932c20f13ef287b44b9b706ec818aa0c48a10caac58a9b8355e84bc820698c2501f0c12e1b67df701cfcbe72dc47a2c87d43753ebfdb24cc838507e241d9fcd3d4955a373209ccda903a3ffced05e4232f2cca9bba197fdba8a9357cb1d6da6d9b4095027dc03e17d59ebc2d358e171da0044df102b193c79390ebcb58023b40c621df71e064b0056bfcf1eaee1eca85357cd1ac78feaa54bbbd85596977ba85003ea60d8685f4e3b756e4f81453077396590fa214f672929e81569442023667b798c24e06ee20dbf64cfccb51b2bca4e2a5b0df137bb37ab3e2854dc7e1b879866a72a5809b563596cc9fd3e53abdbccfd5dbc60662252ddc5c290d72230d79b7504b40fdb45ded2f02e926652c1e04ea4c1c488025ad1098adeebe98e385ab1caec4b9eb4d3bbd5ef3ddf1fd0d72784604a989558fd37f6d4fee20609090b3331e254fec98414a2c54589ee01c9429b7cb574b9167efede1d966a227bf2a8e422f38680d77d3c555cf1117e7d7e804ad730c36a78b7846473d6481bd0839bd3e6982ed47246c370a90b76e5b88de202346fb20b8b6b5ecb6a90b8478d17b175a1821df75b48ecc34866fe5c8960bf64d5ff92831bb9357474bec65e0dd1699b0f0340ee5ac5e9e9d3df66edca20201371fc21ad80aacd49c6b0abcfee9c876c15edcfccde823b55b61cb7b254487ef8c8781a22043f4adaf25df34580a6b3904fd014b50c59fa90eff75fa5fd32aaec9aa10df8a2b9b824952e475c964533942bbe30f4167a11fc15d548e0a31f911030569722f0c67e79e90483f6f0bee1c7f80face1a1b0f940c891be688cb16394f6c07fd29b5f248c211d1f76ec1292755d8bd963e191b3a8851472fbbd2cb732f4fd9fef3a8fb29aea097328173fdeaf56fa2279e86fb954306b040c960d0b601b3a741c96cf1f0bd1172f848585cb3b57d7d2e2a84914526f5a6f9895cf5aa4425b4dbf9f59037756a0321bba204a737e36277e86fd268f6047921f4f8fab69dfee137c07874f12f89084e7117e2c9221690a27f880f17d08d56f9dbc96ffef3920b55fb773dde72e1ba35f3e0c9872e339508281426ab04941df4885f7e0293149f1642c2573e2b6594b8fd953ae2468cf917cdaa0692cf461e3628860935def39af78af5e1540147ab1c70c3ab7f7c76abea0d8541feb43e632d7a2cc7bef15a4700304048ecf135968d0a9644ce899aad05b186a2224bab3836248cc6137472203ebceb29b3e87610df12417ee722f309c54b2e65591d8b929440f3ec43ee9ff8f7b7710668e4312610d1591303d5270394da0ab61e4515af5215dc81137f0dc90f951972731f8d98ceb8b4ea38da7d8dc153ccbae5068781eaf9a4a7b11b4319090261b61aa65a8536292eb5392020eb285b2db07f81e7f764d65037050f1e3748593474c6c1dc11cfcb56e1c916157280098a437265e1c682cbfed717e7275bc6c3bb6c6ef7f0f9fdd19ef82ff2c82284c3a061f57b21d3705aff97710108a7d1217a7ea3feda021d20f1fdca94bbef67e0aeaa3db6ccc2d060f7b33707fe19cb2d0232f1239373bb38e666cbbbf3a697c6d0e957ec6730f56034440e789a7a37304d09eb742f21019a77c608cf578162a55d0aea113c051b110b5281ed8b6638d2b31604e965cb019f2f106bc4e96d1313c70612f1ff18afdce7926270dd242c49cc53792f160d1e143e04d7eb3ca40828b153fac466bc53a084281987b47b806a4ef668859eb9035ef68e9c20bd6bb790fdf6f921569b4e97fae5b7edc761b4944c1d6d90f4df40bc3203ed838d4c61cdeb7a9bbb68d59b2cc00125eecaf06b759ac1b9dd68028225d0a60efa499e4436962362727011eef6cc55962dd4ffe2fd3892907e837045883cc9ba8892ab265a31924f3055d4dee68feff05d9f10ebdf1e8c1c1e7001b5b02a7fe26b9c0641e054ae37854187fb1bb6e9fae05b09e85a1e0e14bc801f2d8b9a178a9a72b147e137e0d83192664a88a3aca4fb6a4f0c5787b20c31bc5975dfbc8bcff8987573bd14b1ca434d93452e67ed01c60be99e535bb3f848888d224520b61cfc1de2d6b2ebef9f24674c31aada52784a0b7b60f351653c71d546cf951e6b4a0d917ac6afd0a713f41833f9f74a3a7d3c19b523299666da2b48676ca7aafebadef05b3bbf4b6b62834046f51d3d4582fb4c9de27a3f5e992853368e4f17f9dba27c8c4438307fc7405f53fb27cc81c1521452a1a5edb0cabdf7a73b1cab0675b619fd5a0fadb7147776e74695c042d9d8bfda045bcef7542b42249f34c7590605d0201a762390f2fee5f3cdb488426609c663c9fc4dc2a5277f3f589a14e6dcc202dfcd89bb148a368ff1792d230c19934143d2c260dbdfb334af863b856e415febd22fba01c568d8f48dba6d92f493cd1164a376f006d55db609cc2c9532a9f56da3b06e3db2a05f797eed57892e2fb677541324bcd763cf4669e7a871e322d0cc6e21befe3c767976f058dbe7a059d673c94c7ac5d49178bf19d32907b6fe66a92cc8ea30a858da43f74354390d6e97021da50812c59a78915e5b33221531bfa054c594ce3a2300e5a7d712773181901dfcf6922e980566fa62b1f2b669a27fbecce29e9be6d22058463e350163f33d18ce92a72d1b470857b6a37998aec5672521a8f0d66ab2bd01de516036ec47d1f63b95b437dc6d5a0168189d5a963cb0a80a9a5f20b03515396e3525f0ab13b0c1e5dd051b4c930da6d57ab6f7dd94ab3e689e0355af0b34871296152a76cce170d7b14d471ee4d9daa93de4ed755f30d45344f724288c17e4b22583158f1305ff55fecf7d526e207fa609886e14c9a168bf364b049409f63590f18a5515de8c1fd8c5a9710b6e33d2ecd01466b799f14be787612b8f17df0c05483a16097c0a504880249e28f1e067663c640a550a8c7ad9d090f7b2e902c5c20936869a5f3d3a014817f90babf847b43cf67ec23f120ae4abc63a418d1d99f359fc2c33a5bb34e1f5780576111a88c5ede834bc41e498548ddd128f9e884f4cd3e1bf1aaa1204079ce74e709306f38f2d6859128fc35d3a74c534ff1dccadfc8fe41f1be9510349af8710eb6d2dbc758be12b65622dad1cf48abc2fc409f5ed6a3af8d0b6548643c46dfba9db4e5827475e6e317c9c018a4dd5de391cc9cca85ec527537e26949e5091baca4f0b563d4c3969f15115e5ccdeb9e40788fe12f9d32d9488a70ae53b819726e4483ea6bbcb76f99775ca5e4f93c76edae462c08d596209f985aa55ef5e786701edcee8d831dd6dc0fee9ad01b6bdd63e886a5e55bdc593390c81e18dfd8c685b81306bad6b7a19a86b2bab5cbf4754708422e99f8f2497d798b3db565e709bcbba4c376c1c60b22b994fe8fdcb25215d505511cc1927f6a35344023d5da0a3ac0830e6aa80f5f7f0d94a67c99c6b22717078aecba2a599daa2acc054cda25e3965172e5fef464ec19aa71de5e84b6de30cc673fbab8c441ea37bfb3fc321a504371bc0996702e9be38db762e339ad7ad66dc2caa887e4ab60272d7963f85b14c941d31e545b85c640427302efe7142f0e0897a8c623ce57da213fbc2d1f90677142fd48cafca0b2934e572833ed6473218d0513dd1f6ecc578e5a1109ddae552b3be0cfe7246d7682a59fe9ae783a0f318d1800d5c466c80c5fd3facd0340f455f081068dd2cda5cda744018d902217152b6c05d37c090f8348b0471053152c2a4570fbab3f6dc30c8e49a63b88a00b3aac75180a633692e35ea976821694e133eb8bb4d31237d002fce1dd2ce55528dafcef2f0e00690562d144bb0e19576ce6ab72deac22067d8edac916b1b07e4eb57ff0b885b1b79f37dcf88135eedc17ffd948b61e4df4985033bcf891dd5b1448c8668947a271d93d03ce31216810a6bb45a6c5a12e290d97a60ad4b5c7384cf19421ac1ca64d346b50771e0b50e5caf1d9dfe056e8da247aa502ff04c8e29ca810a1d3ec7a89bc17dba2936f03a80228171f7999b3f2768617970efe57b14011c80666ac4999a568ebef74e2ca14df0ff6f0fcd47c538be96aaca1e65b53b98447101e49672b48167c0afc1afffe669b0f9718bd3305805c292db9738740b362564e4691cbdf061db1ed3f9db1f8bed82939f835d14f46818e3eb4e25f7a8d77d9d0d7913c45d8a81115c1a5e37b1d3bd1b7b5e6afaaefc81d9700bf83506fbf15457bc0f59f7008cc803efdcb6d39e388f6b28e80d47134265cc5438804b12d50e61a489da829dca05792d2ac182ba747331e88a7118f7dd38067f7d38f37be362260effacbc33863bb47aeebbadeae648a1090718266eedd2ed5a2c23f168759198aa92b2ac45c2a68ff212f29260e641a38541b066d39df4e95cd1c8e7e6ffae1b8017e6f629db3910b07496c8a81e4e66ac2321fd9e7ebfecf5bf6e922d7a79fb710a2d42dad1916c9b186c2c50c818fdb1afa19be867d943ee98f732fe3a01364281c0f6d0eb64a278721dc7bff5316256b0f4251abbd9b8ba7c7c12a3bf02a1fbc9ca94b965588fbc82343d07df8e06eaa5ed2137fec129351d80a9048a7d78b31ffaf2e388864a763c4af7aa53000e0bb2eb8ac0e4272cbb79dc6a7d65890f125c523c7cfddacdedbe87938aca915c92c807dab26be7d748827d4e3188676312ef1ac8460b29e8e715f4075e33104ce82e6785aadf17a7cf82d2a705e9f2d0fd25810ba33d76e54b48eda3effc01f37c89db38af81922fadc8c3361fe74ed51eac5e4437108106ffdedb339b406c082d62a8bf718989846d23f966e1ea39103010f767b3a6f0a0a2041b1dafcb787e69ffad75ed2a0081b92a4136ad5ae557c55a4b6219a390103428181ab36f329ad182a92957495c", 0x2000, &(0x7f0000006dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002240)={0x90, 0x0, 0x5, {0x3, 0xffffffffffffffff, 0x5, 0x1ffffffffffff, 0xe5, 0xc, {0x3, 0x9, 0x2, 0x1, 0xffffffffffff77fc, 0x4, 0x8, 0x123, 0x3, 0x4000, 0x0, 0x0, r2, 0x5, 0x2000fffb}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r0, &(0x7f0000004540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002200)={0x10, 0xffffffffffffffda, r3}, 0x10) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) 3m20.717782804s ago: executing program 7 (id=1064): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = fsopen(0x0, 0x1) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x5}, @hci_rp_le_read_num_supported_adv_sets={{0x36}, {0x8, 0x6}}}}, 0x8) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x4e22, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x20}, 0x4000) pipe(0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r1, &(0x7f0000000040)={0x0, 0x1, 0x80, 0x1, 0x1}, 0x8) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000200), 0x35c, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xe, 0x810, r2, 0xadb59000) fsmount(r0, 0x0, 0x0) 3m19.259785847s ago: executing program 7 (id=1074): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="5299"], 0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000100), 0x4) 3m16.31316265s ago: executing program 7 (id=1085): openat(0xffffffffffffff9c, 0x0, 0x80940, 0xd2) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x57) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0xb}}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast=0xffff0011}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 3m16.176145293s ago: executing program 7 (id=1086): socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1f7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000001600)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3m16.021399519s ago: executing program 7 (id=1088): mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/msi_bus\x00', 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000180)={0x2, 0xa3f1, 0xfffffffffffffff9, 0x50ff, 0x9, 0x8}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) 3m0.798058713s ago: executing program 36 (id=1088): mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/msi_bus\x00', 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000180)={0x2, 0xa3f1, 0xfffffffffffffff9, 0x50ff, 0x9, 0x8}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) 18.527184459s ago: executing program 5 (id=1474): prlimit64(0x0, 0xe, &(0x7f0000001080)={0x80000000, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x8) write$binfmt_aout(r2, 0x0, 0x6a) vmsplice(r2, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/110, 0x6e}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4040800) 17.647622696s ago: executing program 5 (id=1478): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000180)='port0\x00', 0x0, r3) 9.30647592s ago: executing program 0 (id=1490): syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6}]}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000140)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef21161fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccf43f1ff0e916b6c691bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a870000000000000000", 0xfc) 5.576273518s ago: executing program 5 (id=1502): syz_usb_connect(0x6, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) setns(0xc9, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f00000005c0)={'broute\x00', 0x6000000, 0x4, 0x0, [0x0, 0x400004, 0x9, 0x8, 0x377, 0x8], 0x0, 0x0, 0x0}, &(0x7f0000000580)=0x78) 5.041280503s ago: executing program 8 (id=1504): syz_usb_connect(0x6, 0x24, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) setns(0xc9, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000005c0)={'broute\x00', 0x6000000, 0x4, 0x0, [0x0, 0x400004, 0x9, 0x8, 0x377, 0x8], 0x0, 0x0, 0x0}, &(0x7f0000000580)=0x78) 5.006673411s ago: executing program 4 (id=1505): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 4.873019653s ago: executing program 4 (id=1506): prlimit64(0x0, 0xe, &(0x7f0000001080)={0x80000000, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x8) write$binfmt_aout(r2, 0x0, 0x6a) vmsplice(r2, &(0x7f0000000040)=[{&(0x7f0000000300)='`', 0x1}], 0x1, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/110, 0x6e}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4040800) 4.742306194s ago: executing program 0 (id=1507): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 4.669724421s ago: executing program 4 (id=1508): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000180)='port0\x00', 0x0, r3) 4.308903745s ago: executing program 5 (id=1509): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, 0x0, 0x0, r3) 4.300405727s ago: executing program 0 (id=1510): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6}]}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000140)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef21161fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccf43f1ff0e916b6c691bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a8700", 0xf5) 2.782188575s ago: executing program 4 (id=1511): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, 0x0, 0x0, r3) 2.650304756s ago: executing program 5 (id=1512): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000180)='port0\x00', 0x0, r3) 2.641952248s ago: executing program 0 (id=1513): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x80) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000001440), 0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x80003, 0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0}, &(0x7f0000000840), &(0x7f0000000880)=r1}, 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x86dd, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0xff, 0x0, @multicast2}}}}}, 0x0) 1.839619477s ago: executing program 0 (id=1514): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000180)='port0\x00', 0x0, r3) 1.595731874s ago: executing program 8 (id=1515): socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x40086607, 0x0) 1.309763771s ago: executing program 4 (id=1516): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xa) capset(&(0x7f0000000000)={0x20080522}, 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000180)='port0\x00', 0x0, r3) 1.276444649s ago: executing program 8 (id=1517): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6}]}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000140)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef21161fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccf43f1ff0e916b6c691bd0734babc7c3f2eeb00d43dd16b17e583df150c", 0xbd) 259.021599ms ago: executing program 8 (id=1518): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x33}}, @in6=@empty, 0x0, 0x0, 0x0, 0xc9c, 0xa, 0x10, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x7f, 0x6, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x0, 0x5}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x84811}, 0x80) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={0x0}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) 125.39882ms ago: executing program 8 (id=1519): r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c000280080001"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) 24.010194ms ago: executing program 5 (id=1520): syz_usb_connect(0x6, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) setns(0xc9, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000005c0)={'broute\x00', 0x6000000, 0x4, 0x0, [0x0, 0x400004, 0x9, 0x8, 0x377, 0x8], 0x0, 0x0, 0x0}, &(0x7f0000000580)=0x78) 15.142907ms ago: executing program 0 (id=1521): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getegid() r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x15, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x1000, r3}, 0x38) 11.721637ms ago: executing program 8 (id=1522): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'user:'}, 0x1b, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) 0s ago: executing program 4 (id=1523): syz_usb_connect(0x6, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, 0x0, 0x0) setns(0xc9, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000005c0)={'broute\x00', 0x6000000, 0x4, 0x0, [0x0, 0x400004, 0x9, 0x8, 0x377, 0x8], 0x0, 0x0, 0x0}, &(0x7f0000000580)=0x78) kernel console output (not intermixed with test programs): ock : 7, err : -5) [ 183.630299][ T6444] exFAT-fs (loop2): error, invalid access to exfat cache (entry 0x00000000) [ 194.948306][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.954657][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.051017][ T6514] process 'syz.0.161' launched './file0' with NULL argv: empty string added [ 202.285744][ T5789] Bluetooth: hci1: command 0x0406 tx timeout [ 202.291894][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 202.291914][ T5785] Bluetooth: hci0: command 0x0406 tx timeout [ 205.569394][ T6558] loop1: detected capacity change from 0 to 512 [ 205.609138][ T6558] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities [ 207.485026][ T6563] loop0: detected capacity change from 0 to 32768 [ 207.550002][ T6563] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 207.713055][ T6563] XFS (loop0): Ending clean mount [ 207.744494][ T6563] XFS (loop0): Quotacheck needed: Please wait. [ 207.828046][ T6563] XFS (loop0): Quotacheck: Done. [ 208.414189][ T6575] loop3: detected capacity change from 0 to 512 [ 208.612127][ T5775] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 208.744752][ T6575] EXT4-fs (loop3): Test dummy encryption mode enabled [ 208.751748][ T6575] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 208.765013][ T6575] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 208.786779][ T6575] EXT4-fs (loop3): 1 truncate cleaned up [ 208.793940][ T6575] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 209.397678][ T6586] loop1: detected capacity change from 0 to 32768 [ 209.553324][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 209.586154][ T6586] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 209.666316][ T6586] XFS (loop1): Ending clean mount [ 209.684552][ T6586] XFS (loop1): Quotacheck needed: Please wait. [ 209.765021][ T6586] XFS (loop1): Quotacheck: Done. [ 211.022867][ T6602] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 211.990909][ T5776] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 224.624014][ T6147] libceph: connect (1)[c::]:6789 error -101 [ 224.633668][ T6147] libceph: mon0 (1)[c::]:6789 connect error [ 224.641399][ T6652] ceph: No mds server is up or the cluster is laggy [ 225.555978][ T6658] usb usb8: usbfs: process 6658 (syz.2.192) did not claim interface 0 before use [ 227.623548][ T6669] syzkaller0: entered promiscuous mode [ 227.629225][ T6669] syzkaller0: entered allmulticast mode [ 227.649147][ T6669] tipc: Started in network mode [ 227.654145][ T6669] tipc: Node identity f2905bcb27a2, cluster identity 4711 [ 227.670645][ T6669] tipc: Enabled bearer , priority 0 [ 227.703223][ T6669] tipc: Resetting bearer [ 227.739146][ T6668] tipc: Resetting bearer [ 227.795373][ T6668] tipc: Disabling bearer [ 229.431471][ T6678] MTRR 1 not used [ 231.238053][ T6686] loop2: detected capacity change from 0 to 512 [ 231.276038][ T6686] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 232.497944][ T6686] System zones: 1-12 [ 232.510445][ T6686] EXT4-fs error (device loop2): ext4_xattr_inode_iget:441: inode #12: comm syz.2.198: missing EA_INODE flag [ 232.558207][ T6686] EXT4-fs error (device loop2): ext4_xattr_inode_iget:446: comm syz.2.198: error while reading EA inode 12 err=-117 [ 232.612579][ T6686] EXT4-fs (loop2): 1 orphan inode deleted [ 232.634385][ T6686] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.663928][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.340382][ T6753] loop2: detected capacity change from 0 to 512 [ 242.390488][ T6753] EXT4-fs (loop2): bad s_min_extra_isize: 544 [ 245.045320][ T6766] 9pnet_virtio: no channels available for device syz [ 245.936962][ T6776] loop3: detected capacity change from 0 to 256 [ 248.318024][ T6147] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 248.382159][ T6776] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010895, chksum : 0x816c887a, utbl_chksum : 0xe619d30d) [ 248.394702][ T6776] exFAT-fs (loop3): failed to load alloc-bitmap [ 248.401169][ T6776] exFAT-fs (loop3): failed to recognize exfat type [ 252.258968][ T6794] netlink: 8 bytes leftover after parsing attributes in process `syz.3.220'. [ 253.713534][ T6798] loop2: detected capacity change from 0 to 512 [ 253.769952][ T6799] syz.3.221 uses obsolete (PF_INET,SOCK_PACKET) [ 253.826935][ T6798] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 253.867999][ T6798] ext4 filesystem being mounted at /56/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 254.495003][ T6808] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 255.073057][ T28] audit: type=1800 audit(1790325238.405:6): pid=6811 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.223" name=08 dev="sda1" ino=2043 res=0 errno=0 [ 255.913948][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.920379][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.018382][ T6820] loop0: detected capacity change from 0 to 4096 [ 256.030122][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 257.848742][ T6832] loop1: detected capacity change from 0 to 1024 [ 257.864680][ T6832] EXT4-fs: Ignoring removed bh option [ 257.993967][ T6834] loop0: detected capacity change from 0 to 1024 [ 258.436094][ T6832] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 258.509419][ T6832] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 258.968184][ T6843] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 3: comm syz.1.228: lblock 3 mapped to illegal pblock 3 (length 3) [ 259.184911][ T6843] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 259.197327][ T6843] EXT4-fs (loop1): This should not happen!! Data will be lost [ 259.197327][ T6843] [ 259.428704][ T3453] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:10: lblock 8 mapped to illegal pblock 8 (length 8) [ 259.456134][ T3453] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 259.469720][ T3453] EXT4-fs (loop1): This should not happen!! Data will be lost [ 259.469720][ T3453] [ 259.487397][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 259.760683][ T789] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 260.062649][ T789] usb 3-1: Using ep0 maxpacket: 8 [ 260.182997][ T789] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 260.313016][ T789] usb 3-1: too many endpoints for config 0 interface 0 altsetting 5: 34, using maximum allowed: 30 [ 260.388107][ T789] usb 3-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 34 [ 260.422538][ T789] usb 3-1: config 0 interface 0 has no altsetting 0 [ 260.438906][ T789] usb 3-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 260.467557][ T789] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.537521][ T789] usb 3-1: config 0 descriptor?? [ 260.636751][ T6857] UDC core: g1: couldn't find an available UDC or it's busy [ 261.414375][ T6868] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 262.339134][ T6879] sctp: [Deprecated]: syz.0.236 (pid 6879) Use of struct sctp_assoc_value in delayed_ack socket option. [ 262.339134][ T6879] Use struct sctp_sack_info instead [ 262.697542][ T6884] loop3: detected capacity change from 0 to 32768 [ 262.745480][ T6884] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.237 (6884) [ 262.813914][ T6884] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 262.824920][ T6884] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 262.833812][ T6884] BTRFS info (device loop3): use zlib compression, level 3 [ 262.841097][ T6884] BTRFS info (device loop3): turning on sync discard [ 262.849780][ T6884] BTRFS info (device loop3): using free space tree [ 263.010332][ T6884] BTRFS info (device loop3): enabling ssd optimizations [ 263.183936][ T789] usb 3-1: string descriptor 0 read error: -71 [ 263.254827][ T789] hub 3-1:0.0: bad descriptor, ignoring hub [ 263.311906][ T789] hub: probe of 3-1:0.0 failed with error -5 [ 264.136584][ T789] usb 3-1: USB disconnect, device number 3 [ 266.177680][ T6927] Failed to get privilege flags for destination (handle=0x2:0x0) [ 268.137838][ T6939] capability: warning: `syz.1.245' uses deprecated v2 capabilities in a way that may be insecure [ 268.932814][ T6938] loop0: detected capacity change from 0 to 16 [ 268.945469][ T6938] erofs: (device loop0): mounted with root inode @ nid 36. [ 270.414618][ T6959] loop2: detected capacity change from 0 to 256 [ 270.473950][ T6959] exFAT-fs (loop2): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 270.547339][ T28] audit: type=1800 audit(1790325254.385:7): pid=6961 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.249" name=08 dev="sda1" ino=2043 res=0 errno=0 [ 270.729849][ T6962] Zero length message leads to an empty skb [ 271.495327][ T6965] nvmet: adding nsid 1 to subsystem testsubsys [ 271.564175][ T6965] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 273.174176][ T5778] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 273.234049][ T6973] nvmet: transport type 0 not supported [ 274.936922][ T6985] loop0: detected capacity change from 0 to 1024 [ 275.188276][ T6985] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 275.424225][ T6985] JBD2: no valid journal superblock found [ 276.154323][ T6985] EXT4-fs (loop0): Could not load journal inode [ 280.959707][ T7022] loop0: detected capacity change from 0 to 128 [ 281.042914][ T7022] EXT4-fs (loop0): Test dummy encryption mode enabled [ 281.253055][ T7022] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 281.387656][ T7022] ext4 filesystem being mounted at /73/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 282.901888][ T7022] fscrypt (loop0): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 283.374623][ T7039] loop3: detected capacity change from 0 to 512 [ 283.462965][ T5775] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 283.583352][ T7044] loop1: detected capacity change from 0 to 1024 [ 283.891372][ T7044] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 284.041275][ T7054] 9pnet_fd: Insufficient options for proto=fd [ 284.602509][ T7044] JBD2: no valid journal superblock found [ 284.620051][ T7044] EXT4-fs (loop1): Could not load journal inode [ 291.612885][ T7069] syz.1.269 (7069): drop_caches: 2 [ 293.031525][ T7080] loop3: detected capacity change from 0 to 512 [ 293.523775][ T7080] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 293.532928][ T7080] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 293.559420][ T7080] EXT4-fs (loop3): warning: mounting unchecked fs, running e2fsck is recommended [ 293.569026][ T7080] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 293.577082][ T7080] System zones: 0-2, 18-18, 34-35 [ 293.586309][ T7080] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 293.600936][ T7080] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 293.649949][ T7085] loop2: detected capacity change from 0 to 8 [ 293.675477][ T7085] squashfs: Unknown parameter 'Ž_Y¦…' [ 293.712515][ T7073] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 294.019812][ T7089] loop1: detected capacity change from 0 to 1024 [ 294.122977][ T7089] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 294.176244][ T7089] ext4 filesystem being mounted at /64/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 294.262612][ T7089] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 3: comm syz.1.272: lblock 3 mapped to illegal pblock 3 (length 3) [ 294.566604][ T7089] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 294.838043][ T7089] EXT4-fs (loop1): This should not happen!! Data will be lost [ 294.838043][ T7089] [ 296.484149][ T3453] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:10: lblock 8 mapped to illegal pblock 8 (length 8) [ 296.584606][ T3453] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 296.647944][ T3453] EXT4-fs (loop1): This should not happen!! Data will be lost [ 296.647944][ T3453] [ 296.670670][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 296.833301][ T7102] loop1: detected capacity change from 0 to 512 [ 298.826369][ T7110] netlink: 40 bytes leftover after parsing attributes in process `syz.0.278'. [ 298.878664][ T7110] netlink: 4 bytes leftover after parsing attributes in process `syz.0.278'. [ 298.950564][ T5787] Bluetooth: hci2: command 0x0401 tx timeout [ 303.211817][ T28] audit: type=1326 audit(1790325287.065:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7132 comm="syz.1.277" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f40c879e159 code=0x0 [ 305.579619][ T7146] capability: warning: `syz.0.286' uses 32-bit capabilities (legacy support in use) [ 307.510208][ T5788] Bluetooth: hci2: command 0x0401 tx timeout [ 309.086263][ T7156] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 309.095210][ T7156] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 309.106429][ T7156] udc dummy_udc.0: failed to start g1: -22 [ 309.112520][ T7156] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 309.120863][ T7156] UDC core: g1: couldn't find an available UDC or it's busy [ 311.587307][ T7169] UBIFS error (pid: 7169): cannot open "", error -22 [ 311.987984][ T5788] Bluetooth: hci2: command 0x0401 tx timeout [ 314.727396][ T7185] loop1: detected capacity change from 0 to 4096 [ 314.738976][ T7183] use of bytesused == 0 is deprecated and will be removed in the future, [ 314.747888][ T7183] use the actual size instead. [ 315.738053][ T7180] rtc_cmos 00:00: Alarms can be up to one day in the future [ 316.681576][ T7172] I/O error, dev loop1, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 317.218997][ T7188] sctp: [Deprecated]: syz.0.287 (pid 7188) Use of struct sctp_assoc_value in delayed_ack socket option. [ 317.218997][ T7188] Use struct sctp_sack_info instead [ 317.353580][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.360091][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.593238][ T7216] loop3: detected capacity change from 0 to 8 [ 318.926945][ T7216] SQUASHFS error: Failed to read block 0x6de: -5 [ 318.933783][ T7216] SQUASHFS error: Unable to read metadata cache entry [6dc] [ 318.941326][ T7216] SQUASHFS error: Unable to read directory block [26067d:ffff] [ 319.568189][ T7203] x86/PAT: syz.1.296:7203 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 319.577632][ T7203] x86/PAT: syz.1.296:7203 freeing invalid memtype [mem 0xfe005000-0xfe005fff] [ 324.459516][ T7239] loop0: detected capacity change from 0 to 512 [ 324.890711][ T7240] loop0: detected capacity change from 0 to 256 [ 325.478569][ T7240] exFAT-fs (loop0): failed to load upcase table (idx : 0x00012153, chksum : 0xc9bffc20, utbl_chksum : 0xe619d30d) [ 325.964188][ T7245] loop2: detected capacity change from 0 to 164 [ 326.223270][ T7246] iso9660: Corrupted directory entry in block 4 of inode 1792 [ 326.242638][ T7245] iso9660: Corrupted directory entry in block 4 of inode 1792 [ 330.592504][ T7268] Cannot find set identified by id 0 to match [ 335.647480][ T7286] tipc: MTU too low for tipc bearer [ 336.139025][ T7289] netlink: 'syz.2.318': attribute type 1 has an invalid length. [ 336.147202][ T7289] netlink: 'syz.2.318': attribute type 2 has an invalid length. [ 336.225166][ T7289] syzkaller0: entered promiscuous mode [ 336.243654][ T7289] syzkaller0: entered allmulticast mode [ 336.315080][ T7292] Bluetooth: ISO socket layer initialized [ 336.337115][ T5788] Bluetooth: hci0: unexpected event for opcode 0x2003 [ 337.759680][ T5787] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 337.779040][ T5787] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 337.787578][ T5787] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 337.822077][ T5787] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 337.843690][ T5787] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 337.852205][ T5787] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 338.052751][ T7304] netlink: 68 bytes leftover after parsing attributes in process `syz.3.316'. [ 339.907876][ T5788] Bluetooth: hci4: command tx timeout [ 341.155141][ T7310] null_blk: disk nullb1 created [ 341.472065][ T49] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.513505][ T7313] netlink: 8 bytes leftover after parsing attributes in process `syz.0.322'. [ 341.579033][ T7313] macsec0: entered promiscuous mode [ 341.955014][ T49] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.989194][ T5788] Bluetooth: hci4: command tx timeout [ 343.002479][ T49] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.067906][ T5788] Bluetooth: hci4: command tx timeout [ 344.241209][ T49] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.418070][ T7295] chnl_net:caif_netlink_parms(): no params data found [ 346.150288][ T5788] Bluetooth: hci4: command tx timeout [ 346.552827][ T7295] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.583890][ T7295] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.190488][ T7295] bridge_slave_0: entered allmulticast mode [ 347.222111][ T7295] bridge_slave_0: entered promiscuous mode [ 347.286430][ T7295] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.689745][ T7295] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.777948][ T7295] bridge_slave_1: entered allmulticast mode [ 347.785272][ T7295] bridge_slave_1: entered promiscuous mode [ 347.793276][ T49] tipc: Left network mode [ 347.862281][ T7333] kvm_intel: kvm [7332]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x2 [ 347.880420][ T7295] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.924132][ T7333] kvm: kvm [7332]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x81 [ 347.948005][ T7333] kvm: kvm [7332]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 348.009981][ T7333] kvm: kvm [7332]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x1 [ 348.626757][ T7295] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 350.293940][ T7295] team0: Port device team_slave_0 added [ 350.796822][ T7295] team0: Port device team_slave_1 added [ 351.502997][ T7361] file system registered [ 351.692626][ T7295] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 351.699989][ T7295] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.727778][ T7295] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 351.811716][ T7295] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 351.837990][ T7295] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.927915][ T7295] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 351.946985][ T5775] ffs_data_put(): freeing [ 352.223789][ T7376] loop3: detected capacity change from 0 to 128 [ 352.244687][ T7295] hsr_slave_0: entered promiscuous mode [ 353.208131][ T7376] EXT4-fs (loop3): Test dummy encryption mode enabled [ 353.229014][ T7295] hsr_slave_1: entered promiscuous mode [ 353.257964][ T7295] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 353.287273][ T7376] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 353.299724][ T7295] Cannot create hsr debugfs directory [ 353.334837][ T7376] ext4 filesystem being mounted at /75/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 353.638132][ T7376] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 354.846650][ T5778] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 355.241896][ T49] hsr_slave_0: left promiscuous mode [ 355.294335][ T49] hsr_slave_1: left promiscuous mode [ 355.329411][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 355.336916][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 355.397296][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 356.231332][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 356.317648][ T49] bridge_slave_1: left allmulticast mode [ 356.466238][ T49] bridge_slave_1: left promiscuous mode [ 356.519880][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.650647][ T49] bridge_slave_0: left allmulticast mode [ 356.699964][ T49] bridge_slave_0: left promiscuous mode [ 356.746698][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.144294][ T49] veth1_macvtap: left promiscuous mode [ 357.174251][ T49] veth0_macvtap: left promiscuous mode [ 357.193453][ T49] veth1_vlan: left promiscuous mode [ 357.199952][ T49] veth0_vlan: left promiscuous mode [ 358.452912][ T5788] Bluetooth: hci3: command 0x0406 tx timeout [ 358.863989][ T7424] netlink: 20 bytes leftover after parsing attributes in process `syz.0.344'. [ 359.448261][ T7420] x86/PAT: syz.3.338:7420 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 359.752947][ T7372] udevd[7372]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 359.771220][ T7374] udevd[7374]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 359.938233][ T49] team0 (unregistering): Port device team_slave_1 removed [ 360.050238][ T49] team0 (unregistering): Port device team_slave_0 removed [ 360.180232][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 360.278157][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 360.357581][ T7433] kvm_intel: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x2 [ 360.380055][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x81 [ 360.398210][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 360.418327][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x1 [ 360.440334][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x1 [ 360.479609][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x1 [ 360.501481][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 360.525085][ T7433] kvm_intel: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x81 [ 360.549247][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x81 [ 360.568221][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 360.589909][ T7433] kvm_intel: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x81 [ 360.618140][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x1 [ 360.635790][ T7433] kvm: kvm [7432]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 361.067329][ T49] bond0 (unregistering): Released all slaves [ 361.259416][ T7437] futex_wake_op: syz.2.340 tries to shift op by 144; fix this program [ 362.331351][ T7295] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 362.588511][ T7295] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 362.903984][ T7295] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 363.120362][ T7295] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 363.591500][ T7295] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.478615][ T7295] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.701129][ T7237] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.708336][ T7237] bridge0: port 1(bridge_slave_0) entered forwarding state [ 364.970234][ T7237] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.977399][ T7237] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.790686][ T7464] loop2: detected capacity change from 0 to 128 [ 365.821302][ T7464] EXT4-fs (loop2): Test dummy encryption mode enabled [ 366.605575][ T7464] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 366.683209][ T7464] ext4 filesystem being mounted at /90/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 366.937126][ T7295] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 368.341835][ T7295] veth0_vlan: entered promiscuous mode [ 368.385018][ T7295] veth1_vlan: entered promiscuous mode [ 368.544987][ T7295] veth0_macvtap: entered promiscuous mode [ 368.648432][ T7295] veth1_macvtap: entered promiscuous mode [ 368.744845][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 368.822467][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 368.877820][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 368.917786][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 368.927644][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 369.002042][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 369.051605][ T7295] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 369.096505][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 369.121238][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 369.186829][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 369.218152][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 369.240052][ T7295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 369.255378][ T7295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 369.266932][ T7295] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 369.286593][ T7295] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.300126][ T7295] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.311763][ T7295] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.324745][ T7295] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.375446][ T5777] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 370.515090][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.538182][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.620797][ T1098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.658023][ T1098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.707911][ T7530] sctp: [Deprecated]: syz.4.348 (pid 7530) Use of struct sctp_assoc_value in delayed_ack socket option. [ 372.707911][ T7530] Use struct sctp_sack_info instead [ 376.871452][ T5788] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 376.891075][ T5788] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 376.899588][ T5788] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 376.907372][ T5788] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 376.915382][ T5788] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 376.923561][ T5788] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 377.291025][ T1134] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.767503][ T1134] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.798408][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.805066][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.863324][ T7585] fuse: Bad value for 'fd' [ 378.947829][ T5788] Bluetooth: hci2: command tx timeout [ 379.804516][ T7579] netlink: 8 bytes leftover after parsing attributes in process `syz.0.365'. [ 380.186722][ T1134] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 380.936460][ T1134] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.037932][ T5788] Bluetooth: hci2: command tx timeout [ 381.748874][ T7590] genirq: Flags mismatch irq 32. 00000000 (pcmmio) vs. 00000000 (virtio1-output.0) [ 382.083402][ T7567] chnl_net:caif_netlink_parms(): no params data found [ 382.274772][ T1134] netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.556099][ T7567] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.608620][ T7567] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.642371][ T7567] bridge_slave_0: entered allmulticast mode [ 382.658807][ T7567] bridge_slave_0: entered promiscuous mode [ 382.755018][ T7567] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.788885][ T7567] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.814434][ T7567] bridge_slave_1: entered allmulticast mode [ 382.846807][ T7567] bridge_slave_1: entered promiscuous mode [ 383.004746][ T7567] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.069937][ T7567] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 383.107919][ T5788] Bluetooth: hci2: command tx timeout [ 383.345284][ T7623] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 383.454180][ T7567] team0: Port device team_slave_0 added [ 383.465517][ T7619] FAULT_INJECTION: forcing a failure. [ 383.465517][ T7619] name failslab, interval 1, probability 0, space 0, times 0 [ 383.497364][ T7619] CPU: 1 PID: 7619 Comm: syz.4.359 Not tainted syzkaller #0 [ 383.504702][ T7619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 383.514796][ T7619] Call Trace: [ 383.518164][ T7619] [ 383.521165][ T7619] dump_stack_lvl+0x18c/0x250 [ 383.525986][ T7619] ? show_regs_print_info+0x20/0x20 [ 383.531260][ T7619] ? load_image+0x420/0x420 [ 383.535818][ T7619] ? __might_sleep+0xe0/0xe0 [ 383.540435][ T7619] ? __lock_acquire+0x7d80/0x7d80 [ 383.545494][ T7619] should_fail_ex+0x394/0x4c0 [ 383.550245][ T7619] should_failslab+0x9/0x20 [ 383.554823][ T7619] slab_pre_alloc_hook+0x59/0x300 [ 383.559914][ T7619] ? verify_lock_unused+0x140/0x140 [ 383.565139][ T7619] ? __get_vm_area_node+0x125/0x370 [ 383.570357][ T7619] __kmem_cache_alloc_node+0x53/0x250 [ 383.575729][ T7619] ? __get_vm_area_node+0x125/0x370 [ 383.580931][ T7619] kmalloc_node_trace+0x26/0xe0 [ 383.585794][ T7619] __get_vm_area_node+0x125/0x370 [ 383.590810][ T7619] __vmalloc_node_range+0x36f/0x1320 [ 383.596082][ T7619] ? kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 383.602350][ T7619] ? stack_trace_snprint+0xf0/0xf0 [ 383.607466][ T7619] ? __mutex_trylock_common+0x160/0x270 [ 383.613003][ T7619] ? kasan_set_track+0x5f/0x70 [ 383.617760][ T7619] ? trace_contention_end+0x39/0xe0 [ 383.622948][ T7619] ? __mutex_lock+0x30d/0xc80 [ 383.627712][ T7619] ? free_vm_area+0x50/0x50 [ 383.632215][ T7619] ? kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 383.638438][ T7619] __vmalloc+0x7a/0x90 [ 383.642495][ T7619] ? kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 383.648740][ T7619] kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 383.654799][ T7619] kvm_set_memslot+0x5f8/0x1200 [ 383.659663][ T7619] __kvm_set_memory_region+0x6cd/0x850 [ 383.665118][ T7619] kvm_vm_ioctl_set_memory_region+0x6f/0xa0 [ 383.670998][ T7619] kvm_vm_ioctl+0x916/0xb10 [ 383.675488][ T7619] ? kvm_device_release+0x1f0/0x1f0 [ 383.680673][ T7619] ? __kmem_cache_free+0xba/0x1f0 [ 383.685687][ T7619] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 383.691335][ T7619] ? tomoyo_path_number_perm+0x217/0x5e0 [ 383.696978][ T7619] ? __fget_files+0x28/0x460 [ 383.701584][ T7619] ? bpf_lsm_file_ioctl+0x9/0x10 [ 383.706523][ T7619] ? security_file_ioctl+0x80/0xa0 [ 383.711636][ T7619] ? kvm_device_release+0x1f0/0x1f0 [ 383.716822][ T7619] __se_sys_ioctl+0xfd/0x170 [ 383.721404][ T7619] do_syscall_64+0x55/0xb0 [ 383.725812][ T7619] ? clear_bhb_loop+0x40/0x90 [ 383.730566][ T7619] ? clear_bhb_loop+0x40/0x90 [ 383.735229][ T7619] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 383.741116][ T7619] RIP: 0033:0x7f6ccaf9ddeb [ 383.745570][ T7619] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 383.765204][ T7619] RSP: 002b:00007f6ccbe1e450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 383.773605][ T7619] RAX: ffffffffffffffda RBX: 0000200000fe8000 RCX: 00007f6ccaf9ddeb [ 383.781559][ T7619] RDX: 00007f6ccbe1ebd0 RSI: 000000004020ae46 RDI: 0000000000000005 [ 383.789528][ T7619] RBP: 0000000000000005 R08: 0000000000000001 R09: 00000000000000d2 [ 383.797479][ T7619] R10: 0000000000000005 R11: 0000000000000246 R12: 00000000fec00000 [ 383.805436][ T7619] R13: 00007f6ccbe1ebd0 R14: 0000200000ff3000 R15: 000000000000000b [ 383.813401][ T7619] [ 383.853744][ T7619] syz.4.359: vmalloc error: size 4, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0-1 [ 383.919494][ T7619] CPU: 0 PID: 7619 Comm: syz.4.359 Not tainted syzkaller #0 [ 383.926834][ T7619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 383.936914][ T7619] Call Trace: [ 383.940214][ T7619] [ 383.943163][ T7619] dump_stack_lvl+0x18c/0x250 [ 383.947880][ T7619] ? show_regs_print_info+0x20/0x20 [ 383.953112][ T7619] ? load_image+0x420/0x420 [ 383.957652][ T7619] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 383.964093][ T7619] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 383.970663][ T7619] warn_alloc+0x246/0x340 [ 383.975015][ T7619] ? __get_vm_area_node+0x125/0x370 [ 383.980248][ T7619] ? zone_watermark_ok_safe+0x230/0x230 [ 383.985817][ T7619] ? rcu_is_watching+0x15/0xb0 [ 383.990615][ T7619] ? __get_vm_area_node+0x356/0x370 [ 383.995860][ T7619] __vmalloc_node_range+0x394/0x1320 [ 384.001177][ T7619] ? stack_trace_snprint+0xf0/0xf0 [ 384.006317][ T7619] ? __mutex_trylock_common+0x160/0x270 [ 384.011891][ T7619] ? kasan_set_track+0x5f/0x70 [ 384.016689][ T7619] ? trace_contention_end+0x39/0xe0 [ 384.021911][ T7619] ? __mutex_lock+0x30d/0xc80 [ 384.026611][ T7619] ? free_vm_area+0x50/0x50 [ 384.031165][ T7619] ? kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 384.037435][ T7619] __vmalloc+0x7a/0x90 [ 384.041537][ T7619] ? kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 384.047805][ T7619] kvm_arch_prepare_memory_region+0x2a9/0xdd0 [ 384.053922][ T7619] kvm_set_memslot+0x5f8/0x1200 [ 384.058840][ T7619] __kvm_set_memory_region+0x6cd/0x850 [ 384.064355][ T7619] kvm_vm_ioctl_set_memory_region+0x6f/0xa0 [ 384.070283][ T7619] kvm_vm_ioctl+0x916/0xb10 [ 384.074820][ T7619] ? kvm_device_release+0x1f0/0x1f0 [ 384.080051][ T7619] ? __kmem_cache_free+0xba/0x1f0 [ 384.085123][ T7619] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 384.090801][ T7619] ? tomoyo_path_number_perm+0x217/0x5e0 [ 384.096513][ T7619] ? __fget_files+0x28/0x460 [ 384.101158][ T7619] ? bpf_lsm_file_ioctl+0x9/0x10 [ 384.106131][ T7619] ? security_file_ioctl+0x80/0xa0 [ 384.111280][ T7619] ? kvm_device_release+0x1f0/0x1f0 [ 384.116506][ T7619] __se_sys_ioctl+0xfd/0x170 [ 384.121139][ T7619] do_syscall_64+0x55/0xb0 [ 384.125595][ T7619] ? clear_bhb_loop+0x40/0x90 [ 384.130310][ T7619] ? clear_bhb_loop+0x40/0x90 [ 384.135008][ T7619] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 384.140906][ T7619] RIP: 0033:0x7f6ccaf9ddeb [ 384.145319][ T7619] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 384.164921][ T7619] RSP: 002b:00007f6ccbe1e450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 384.173331][ T7619] RAX: ffffffffffffffda RBX: 0000200000fe8000 RCX: 00007f6ccaf9ddeb [ 384.181294][ T7619] RDX: 00007f6ccbe1ebd0 RSI: 000000004020ae46 RDI: 0000000000000005 [ 384.189271][ T7619] RBP: 0000000000000005 R08: 0000000000000001 R09: 00000000000000d2 [ 384.197262][ T7619] R10: 0000000000000005 R11: 0000000000000246 R12: 00000000fec00000 [ 384.205245][ T7619] R13: 00007f6ccbe1ebd0 R14: 0000200000ff3000 R15: 000000000000000b [ 384.213239][ T7619] [ 384.262095][ T7567] team0: Port device team_slave_1 added [ 384.316621][ T7619] Mem-Info: [ 384.325571][ T7619] active_anon:25131 inactive_anon:0 isolated_anon:0 [ 384.325571][ T7619] active_file:8355 inactive_file:50563 isolated_file:0 [ 384.325571][ T7619] unevictable:768 dirty:238 writeback:0 [ 384.325571][ T7619] slab_reclaimable:6125 slab_unreclaimable:93784 [ 384.325571][ T7619] mapped:24442 shmem:20630 pagetables:588 [ 384.325571][ T7619] sec_pagetables:3 bounce:0 [ 384.325571][ T7619] kernel_misc_reclaimable:0 [ 384.325571][ T7619] free:1330537 free_pcp:7574 free_cma:0 [ 384.403033][ T7619] Node 0 active_anon:97924kB inactive_anon:0kB active_file:33420kB inactive_file:202048kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97768kB dirty:948kB writeback:0kB shmem:78384kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11192kB pagetables:2352kB sec_pagetables:12kB all_unreclaimable? no [ 384.439240][ T7619] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 384.488836][ T7619] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 384.541436][ T7567] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 384.544457][ T7619] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 384.564616][ T7619] Node 0 DMA32 free:1431068kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:89784kB inactive_anon:0kB active_file:33420kB inactive_file:201224kB unevictable:1536kB writepending:944kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:2256kB local_pcp:1092kB free_cma:0kB [ 384.577725][ T7567] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 384.633181][ T7619] lowmem_reserve[]: 0 0 0 0 0 [ 384.641643][ T7619] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:4kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 384.672606][ T7619] lowmem_reserve[]: 0 0 0 0 0 [ 384.677972][ T7619] Node 1 Normal free:3898640kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:14540kB local_pcp:7040kB free_cma:0kB [ 384.717763][ T7567] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 384.724027][ T7619] lowmem_reserve[]: 0 0 0 0 0 [ 384.741815][ T7619] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 384.766771][ T7619] Node 0 DMA32: 193*4kB (UME) 461*8kB (UME) 347*16kB (UME) 641*32kB (UME) 248*64kB (UME) 186*128kB (UME) 69*256kB (UME) 37*512kB (UME) 31*1024kB (UME) 21*2048kB (UME) 305*4096kB (M) = 1430844kB [ 384.807101][ T7619] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 384.848735][ T7567] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 384.855702][ T7567] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 384.868787][ T7619] Node 1 Normal: 218*4kB (UME) 61*8kB (UME) 48*16kB (UME) 139*32kB (UME) 44*64kB (UE) 5*128kB (UME) 2*256kB (U) 2*512kB (ME) 2*1024kB (UE) 1*2048kB (E) 948*4096kB (M) = 3898672kB [ 384.927372][ T7619] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 384.944256][ T7567] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 384.960710][ T7619] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 384.971563][ T7619] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 385.023157][ T7619] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 385.051612][ T7619] 69725 total pagecache pages [ 385.056357][ T7619] 3 pages in swap cache [ 385.078130][ T7619] Free swap = 124204kB [ 385.082335][ T7619] Total swap = 124996kB [ 385.086506][ T7619] 2097051 pages RAM [ 385.119211][ T7619] 0 pages HighMem/MovableOnly [ 385.127820][ T7619] 416965 pages reserved [ 385.148097][ T7619] 0 pages cma reserved [ 385.187853][ T5788] Bluetooth: hci2: command tx timeout [ 385.236881][ T7567] hsr_slave_0: entered promiscuous mode [ 385.253155][ T7567] hsr_slave_1: entered promiscuous mode [ 385.260198][ T7567] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 385.283443][ T7567] Cannot create hsr debugfs directory [ 389.197102][ T1134] hsr_slave_0: left promiscuous mode [ 389.228886][ T1134] hsr_slave_1: left promiscuous mode [ 389.239693][ T1134] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 389.247132][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 389.320872][ T1134] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 389.336210][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 389.394602][ T1134] bridge_slave_1: left allmulticast mode [ 389.400403][ T1134] bridge_slave_1: left promiscuous mode [ 389.406210][ T1134] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.444484][ T1134] bridge_slave_0: left allmulticast mode [ 389.450452][ T1134] bridge_slave_0: left promiscuous mode [ 389.456390][ T1134] bridge0: port 1(bridge_slave_0) entered disabled state [ 389.564856][ T1134] veth1_macvtap: left promiscuous mode [ 389.578223][ T1134] veth0_macvtap: left promiscuous mode [ 389.583887][ T1134] veth1_vlan: left promiscuous mode [ 389.608443][ T1134] veth0_vlan: left promiscuous mode [ 390.461418][ T7672] CIFS mount error: No usable UNC path provided in device string! [ 390.461418][ T7672] [ 390.471732][ T7672] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 391.468133][ T7674] loop4: detected capacity change from 0 to 512 [ 394.143215][ T7677] loop4: detected capacity change from 0 to 256 [ 394.588428][ T7677] exFAT-fs (loop4): failed to load upcase table (idx : 0x00012153, chksum : 0xc9bffc20, utbl_chksum : 0xe619d30d) [ 395.037866][ T7682] netlink: 68 bytes leftover after parsing attributes in process `syz.0.371'. [ 398.113057][ T1134] team0 (unregistering): Port device team_slave_1 removed [ 398.182282][ T1134] team0 (unregistering): Port device team_slave_0 removed [ 398.277570][ T1134] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 398.413181][ T1134] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 399.437346][ T5787] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 399.458530][ T5787] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 399.473453][ T5787] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 399.483724][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 399.492435][ T5787] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 399.507979][ T5787] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 399.623685][ T1134] bond0 (unregistering): Released all slaves [ 399.823507][ T7694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.374'. [ 399.832441][ T7694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 399.951724][ T7694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.191243][ T7567] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 400.241507][ T7567] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 400.265312][ T7567] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 400.358606][ T7567] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 400.851594][ T1134] IPVS: stop unused estimator thread 0... [ 401.755210][ T5787] Bluetooth: hci3: command tx timeout [ 401.781280][ T7567] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.812916][ T7696] chnl_net:caif_netlink_parms(): no params data found [ 402.116134][ T1134] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.194933][ T7567] 8021q: adding VLAN 0 to HW filter on device team0 [ 402.285744][ T1134] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.329152][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 402.336331][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 402.520702][ T7728] loop4: detected capacity change from 0 to 16 [ 402.595669][ T7728] erofs: (device loop4): mounted with root inode @ nid 36. [ 402.921199][ T1134] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.213523][ T1098] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.220745][ T1098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.263022][ T7696] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.308798][ T7696] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.315992][ T7696] bridge_slave_0: entered allmulticast mode [ 403.374019][ T7696] bridge_slave_0: entered promiscuous mode [ 403.414294][ T1134] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.345937][ T5787] Bluetooth: hci3: command tx timeout [ 404.470196][ T7696] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.477284][ T7696] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.502138][ T7696] bridge_slave_1: entered allmulticast mode [ 404.512124][ T7696] bridge_slave_1: entered promiscuous mode [ 404.652731][ T7696] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.711764][ T7696] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 404.993216][ T7696] team0: Port device team_slave_0 added [ 405.036854][ T1134] tipc: Left network mode [ 405.075933][ T7696] team0: Port device team_slave_1 added [ 405.423585][ T7696] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 405.540866][ T7763] jffs2: notice: (7763) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 406.247809][ T7696] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 406.448095][ T5787] Bluetooth: hci3: command tx timeout [ 406.787708][ T7696] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 406.997907][ T7696] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 407.004889][ T7696] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 407.105297][ T7696] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 407.511193][ T7776] netlink: 20 bytes leftover after parsing attributes in process `syz.4.382'. [ 408.036494][ T7567] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.788107][ T5787] Bluetooth: hci3: command tx timeout [ 409.063066][ T7696] hsr_slave_0: entered promiscuous mode [ 409.095522][ T7696] hsr_slave_1: entered promiscuous mode [ 409.118223][ T7696] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 409.137912][ T7696] Cannot create hsr debugfs directory [ 410.077074][ T7567] veth0_vlan: entered promiscuous mode [ 410.184681][ T1134] hsr_slave_0: left promiscuous mode [ 410.217089][ T1134] hsr_slave_1: left promiscuous mode [ 410.223614][ T1134] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 410.233709][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 411.018691][ T1134] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 411.026147][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 411.134927][ T1134] bridge_slave_1: left allmulticast mode [ 411.140679][ T1134] bridge_slave_1: left promiscuous mode [ 411.146346][ T1134] bridge0: port 2(bridge_slave_1) entered disabled state [ 411.161305][ T1134] bridge_slave_0: left allmulticast mode [ 411.167223][ T1134] bridge_slave_0: left promiscuous mode [ 411.173057][ T1134] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.247703][ T1134] veth1_macvtap: left promiscuous mode [ 411.260492][ T1134] veth0_macvtap: left promiscuous mode [ 411.268828][ T1134] veth1_vlan: left promiscuous mode [ 411.281685][ T1134] veth0_vlan: left promiscuous mode [ 413.554995][ T1134] team0 (unregistering): Port device team_slave_1 removed [ 413.631784][ T1134] team0 (unregistering): Port device team_slave_0 removed [ 413.687843][ T1134] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.760613][ T1134] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 414.934046][ T1134] bond0 (unregistering): Released all slaves [ 415.134452][ T7696] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 415.149180][ T7696] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 415.161726][ T7696] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 415.172164][ T7696] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 415.252235][ T7696] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.894577][ T7696] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.986173][ T7816] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 415.993712][ T7816] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 416.093184][ T7567] veth1_vlan: entered promiscuous mode [ 416.117125][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.125653][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 416.204060][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.211265][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 416.350609][ T7567] veth0_macvtap: entered promiscuous mode [ 416.379911][ T7696] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 416.420020][ T7567] veth1_macvtap: entered promiscuous mode [ 416.566677][ T7567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.577560][ T7567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.824642][ T7567] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 417.199968][ T7567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.257810][ T7567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.297046][ T7567] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 417.309424][ T7567] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.319234][ T7567] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.328006][ T7567] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.337028][ T7567] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.511385][ T1134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 417.538697][ T1134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.617627][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 417.628645][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.673812][ T7696] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.875736][ T28] audit: type=1800 audit(1790325402.725:9): pid=7866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.356" name="idVendor" dev="configfs" ino=16738 res=0 errno=0 [ 418.928627][ T28] audit: type=1800 audit(1790325402.785:10): pid=7866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.356" name="idProduct" dev="configfs" ino=16037 res=0 errno=0 [ 418.976599][ T28] audit: type=1800 audit(1790325402.785:11): pid=7866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.356" name="max_speed" dev="configfs" ino=16739 res=0 errno=0 [ 419.031187][ T28] audit: type=1800 audit(1790325402.795:12): pid=7866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.356" name="c_sync" dev="configfs" ino=16741 res=0 errno=0 [ 420.165691][ T7696] veth0_vlan: entered promiscuous mode [ 420.205777][ T7696] veth1_vlan: entered promiscuous mode [ 420.676715][ T7696] veth0_macvtap: entered promiscuous mode [ 420.697548][ T7896] loop5: detected capacity change from 0 to 64 [ 421.028526][ T7696] veth1_macvtap: entered promiscuous mode [ 421.350728][ T7696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 421.384552][ T7696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 421.394494][ T7696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 421.405772][ T7696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 421.421713][ T7696] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 422.313564][ T7696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 422.339304][ T7696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 422.437490][ T7696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 422.477730][ T7696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 422.509405][ T7696] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 422.544703][ T7696] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.572755][ T7696] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.612443][ T7696] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.641720][ T7696] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.823278][ T8] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 423.128012][ T8] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 423.250232][ T8] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.507950][ T8] usb 6-1: Product: syz [ 423.514355][ T8] usb 6-1: Manufacturer: syz [ 423.521529][ T8] usb 6-1: SerialNumber: syz [ 423.578901][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 423.586816][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 423.668639][ T7237] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 423.686703][ T7237] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 426.731544][ T8] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 426.887909][ T8] usb 6-1: USB disconnect, device number 2 [ 427.542919][ T8] usblp0: removed [ 427.957064][ T7965] loop6: detected capacity change from 0 to 16 [ 427.974395][ T7965] erofs: (device loop6): mounted with root inode @ nid 36. [ 430.446020][ T7986] block device autoloading is deprecated and will be removed. [ 430.467434][ T7986] bio_check_eod: 58744 callbacks suppressed [ 430.467502][ T7986] syz.6.411: attempt to access beyond end of device [ 430.467502][ T7986] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 430.567492][ T7994] netlink: 20 bytes leftover after parsing attributes in process `syz.5.408'. [ 432.094406][ T7878] udevd[7878]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 433.097785][ T8016] netlink: 4 bytes leftover after parsing attributes in process `syz.6.415'. [ 433.377509][ T8016] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 434.314410][ T8016] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 439.378229][ T8066] netlink: 4 bytes leftover after parsing attributes in process `syz.5.429'. [ 439.387087][ T8066] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 439.600235][ T8066] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 439.661640][ T8070] netlink: 4 bytes leftover after parsing attributes in process `syz.4.432'. [ 439.691020][ T8070] bridge_slave_1: left allmulticast mode [ 439.696706][ T8070] bridge_slave_1: left promiscuous mode [ 439.767508][ T8070] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.818708][ T8070] bridge_slave_0: left allmulticast mode [ 439.824409][ T8070] bridge_slave_0: left promiscuous mode [ 439.848172][ T8070] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.982518][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.989211][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.313496][ T8087] loop6: detected capacity change from 0 to 512 [ 442.353913][ T8087] EXT4-fs (loop6): unable to read superblock [ 442.819757][ T8097] gadgetfs: bound to dummy_udc driver [ 443.994128][ T8115] loop6: detected capacity change from 0 to 256 [ 444.397271][ T8115] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 445.855373][ T8126] netlink: 8 bytes leftover after parsing attributes in process `syz.0.443'. [ 446.041746][ T8136] loop6: detected capacity change from 0 to 256 [ 446.049402][ T8136] FAT-fs (loop6): Unrecognized mount option "shortnaze=lower" or missing value [ 446.193740][ T8130] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 446.476156][ T8144] netlink: 8 bytes leftover after parsing attributes in process `syz.6.444'. [ 446.552936][ T8144] netlink: 8 bytes leftover after parsing attributes in process `syz.6.444'. [ 446.927808][ T8135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 451.088434][ T8216] loop6: detected capacity change from 0 to 32768 [ 451.113025][ T8216] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 451.146549][ T8216] XFS (loop6): Ending clean mount [ 451.163642][ T8216] XFS (loop6): Quotacheck needed: Please wait. [ 451.251170][ T8216] XFS (loop6): Quotacheck: Done. [ 451.513787][ T5788] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 451.523464][ T5788] Bluetooth: hci4: Injecting HCI hardware error event [ 451.532891][ T5788] Bluetooth: hci4: hardware error 0x00 [ 452.153477][ T7696] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 452.556261][ T8255] loop6: detected capacity change from 0 to 256 [ 452.947833][ T5787] Bluetooth: hci0: command 0x0406 tx timeout [ 453.231682][ T8255] FAT-fs (loop6): Directory bread(block 64) failed [ 453.283004][ T8255] FAT-fs (loop6): Directory bread(block 65) failed [ 453.337888][ T8255] FAT-fs (loop6): Directory bread(block 66) failed [ 453.376495][ T8255] FAT-fs (loop6): Directory bread(block 67) failed [ 453.428004][ T8255] FAT-fs (loop6): Directory bread(block 68) failed [ 453.434581][ T8255] FAT-fs (loop6): Directory bread(block 69) failed [ 453.483193][ T8255] FAT-fs (loop6): Directory bread(block 70) failed [ 453.507741][ T8255] FAT-fs (loop6): Directory bread(block 71) failed [ 453.514408][ T8255] FAT-fs (loop6): Directory bread(block 72) failed [ 453.537711][ T8255] FAT-fs (loop6): Directory bread(block 73) failed [ 453.852589][ T8277] loop6: detected capacity change from 0 to 16 [ 453.880239][ T8277] erofs: (device loop6): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 66700) [ 453.907762][ T5788] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 454.088737][ T8284] loop6: detected capacity change from 0 to 4096 [ 454.135157][ T8284] ntfs3: loop6: Primary boot: invalid bytes per MFT record 14336 (7). [ 454.258334][ T8284] ntfs3: loop6: try to read out of volume at offset 0x1ffe00 [ 455.417536][ T8306] loop6: detected capacity change from 0 to 8 [ 455.553674][ T8306] SQUASHFS error: xz decompression failed, data probably corrupt [ 455.601307][ T8306] SQUASHFS error: Failed to read block 0x108: -5 [ 455.622134][ T8306] SQUASHFS error: Unable to read metadata cache entry [106] [ 455.689577][ T8306] SQUASHFS error: Unable to read inode 0x11f [ 456.231415][ T8339] netlink: 40 bytes leftover after parsing attributes in process `syz.6.500'. [ 456.908643][ T8339] netlink: 4 bytes leftover after parsing attributes in process `syz.6.500'. [ 457.118182][ T5788] Bluetooth: hci0: unexpected event for opcode 0x0c5a [ 459.941995][ T8386] netlink: 8 bytes leftover after parsing attributes in process `syz.6.509'. [ 463.133999][ T8421] syz.6.514 (8421): drop_caches: 2 [ 466.227814][ T6147] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 466.307014][ T8482] netlink: 40 bytes leftover after parsing attributes in process `syz.5.529'. [ 466.444022][ T8482] netlink: 4 bytes leftover after parsing attributes in process `syz.5.529'. [ 466.462553][ T6147] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 466.780936][ T5788] Bluetooth: hci0: unexpected event for opcode 0x1408 [ 467.087730][ T6147] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.147337][ T6147] usb 7-1: Product: syz [ 467.185779][ T6147] usb 7-1: Manufacturer: syz [ 467.194012][ T6147] usb 7-1: SerialNumber: syz [ 469.122528][ T8533] netlink: 128 bytes leftover after parsing attributes in process `syz.0.541'. [ 469.171897][ T8533] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 470.331098][ T6147] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 470.364471][ T6147] usb 7-1: USB disconnect, device number 2 [ 470.395136][ T6147] usblp0: removed [ 471.401227][ T8564] loop6: detected capacity change from 0 to 4096 [ 471.462519][ T8567] overlayfs: failed to clone lowerpath [ 471.620984][ T8564] ntfs3: loop6: Mark volume as dirty due to NTFS errors [ 471.718200][ T8564] ntfs3: loop6: mft corrupted [ 471.733212][ T8564] ntfs3: loop6: Failed to load $Extend (-22). [ 471.760548][ T8564] ntfs3: loop6: Failed to initialize $Extend. [ 473.179661][ T8602] syz.6.565 (8602): drop_caches: 2 [ 474.619517][ T8624] loop6: detected capacity change from 0 to 512 [ 474.788743][ T8624] EXT4-fs (loop6): Test dummy encryption mode enabled [ 474.795588][ T8624] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 474.949771][ T8624] EXT4-fs (loop6): 1 truncate cleaned up [ 474.962481][ T8624] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 476.328721][ T8628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.573'. [ 476.359291][ T8628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.573'. [ 476.421257][ T7696] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 476.519635][ T8625] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 477.000987][ T23] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 477.260784][ T23] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 477.277853][ T23] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.296089][ T23] usb 7-1: Product: syz [ 477.314538][ T23] usb 7-1: Manufacturer: syz [ 477.337683][ T23] usb 7-1: SerialNumber: syz [ 477.877298][ T23] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 480.628498][ T8705] netlink: 12 bytes leftover after parsing attributes in process `syz.4.589'. [ 480.762846][ T8712] netlink: 'syz.4.591': attribute type 10 has an invalid length. [ 480.791198][ T5781] usb 7-1: USB disconnect, device number 3 [ 480.814913][ T5781] usblp0: removed [ 480.832271][ T8712] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 480.881692][ T8717] loop6: detected capacity change from 0 to 512 [ 480.940914][ T8717] EXT4-fs error (device loop6): ext4_iget_extra_inode:4752: inode #15: comm syz.6.594: corrupted in-inode xattr: invalid ea_ino [ 480.994406][ T8717] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.594: couldn't read orphan inode 15 (err -117) [ 481.063653][ T8717] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 481.210676][ T7696] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 482.816765][ T8758] syz.6.606 (8758): drop_caches: 2 [ 486.041529][ T8794] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 486.481330][ T5788] Bluetooth: latency 65520 > 499 [ 487.426974][ T8825] netlink: 32 bytes leftover after parsing attributes in process `syz.5.626'. [ 487.683974][ T8844] netlink: 8 bytes leftover after parsing attributes in process `syz.4.625'. [ 487.739135][ T8844] macsec0: entered promiscuous mode [ 487.838176][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.5.632'. [ 487.873374][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.5.632'. [ 487.894617][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.5.632'. [ 487.948648][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.5.632'. [ 488.567995][ T5788] Bluetooth: hci2: command tx timeout [ 489.240432][ T8881] loop6: detected capacity change from 0 to 4096 [ 489.987762][ T5818] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 490.055125][ T8883] overlayfs: failed to resolve './file0': -2 [ 490.327712][ T5818] usb 7-1: Using ep0 maxpacket: 16 [ 490.342316][ T5818] usb 7-1: config 127 has an invalid interface number: 124 but max is 0 [ 490.357689][ T5818] usb 7-1: config 127 has no interface number 0 [ 490.364007][ T5818] usb 7-1: config 127 interface 124 has no altsetting 0 [ 490.916563][ T5818] usb 7-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 490.936394][ T5818] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.944730][ T5818] usb 7-1: Product: syz [ 491.051743][ T5818] usb 7-1: Manufacturer: syz [ 491.056531][ T5818] usb 7-1: SerialNumber: syz [ 491.995346][ T5818] usb 7-1: reset high-speed USB device number 4 using dummy_hcd [ 492.035095][ T8938] netlink: 24 bytes leftover after parsing attributes in process `syz.4.660'. [ 492.404648][ T5818] usb 7-1: failed to restore interface 124 altsetting 11 (error=-71) [ 492.495835][ T5818] usb 7-1: USB disconnect, device number 4 [ 493.778959][ T8976] netlink: 12 bytes leftover after parsing attributes in process `syz.6.671'. [ 493.799111][ T8975] netlink: 'syz.0.672': attribute type 10 has an invalid length. [ 494.651141][ T8975] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 495.191063][ T8998] syz.6.678 (8998): drop_caches: 2 [ 497.396627][ T9020] netlink: 188 bytes leftover after parsing attributes in process `syz.6.685'. [ 498.663998][ T9041] syz.6.688 (9041): drop_caches: 2 [ 499.592762][ T9048] ip_tables: iptables: counters copy to user failed while replacing table [ 500.830111][ T9083] loop6: detected capacity change from 0 to 512 [ 500.852927][ T9083] EXT4-fs: Ignoring removed nomblk_io_submit option [ 501.183158][ T9083] ext4: Unknown parameter 'fsname' [ 501.808286][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.819136][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.927102][ T9093] loop6: detected capacity change from 0 to 512 [ 501.962501][ T9093] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 502.024657][ T9093] EXT4-fs (loop6): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 502.078938][ T9093] EXT4-fs (loop6): orphan cleanup on readonly fs [ 502.116725][ T9093] EXT4-fs error (device loop6): ext4_read_inode_bitmap:140: comm syz.6.701: Invalid inode bitmap blk 0 in block_group 0 [ 502.199072][ T9093] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 502.439940][ T7696] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 502.724362][ T28] audit: type=1800 audit(1790325486.575:13): pid=9128 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.709" name="UDC" dev="configfs" ino=20578 res=0 errno=0 [ 503.117705][ T5818] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 503.307765][ T5818] usb 7-1: Using ep0 maxpacket: 16 [ 503.315726][ T5818] usb 7-1: config 0 interface 0 altsetting 192 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 503.357699][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 503.374887][ T5818] usb 7-1: New USB device found, idVendor=054c, idProduct=0ce6, bcdDevice= 0.00 [ 503.417721][ T5818] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.449916][ T5818] usb 7-1: config 0 descriptor?? [ 503.825668][ T9167] ip_tables: iptables: counters copy to user failed while replacing table [ 503.982098][ T5818] playstation 0003:054C:0CE6.0001: hidraw0: USB HID v80.04 Joystick [HID 054c:0ce6] on usb-dummy_hcd.6-1/input0 [ 504.111572][ T5818] playstation 0003:054C:0CE6.0001: Failed to retrieve feature with reportID 9: -71 [ 504.130117][ T9175] Illegal XDP return value 4294967274 on prog (id 54) dev N/A, expect packet loss! [ 504.163484][ T5818] playstation 0003:054C:0CE6.0001: Failed to retrieve DualSense pairing info: -71 [ 504.198109][ T5818] playstation 0003:054C:0CE6.0001: Failed to get MAC address from DualSense [ 504.227765][ T5818] playstation 0003:054C:0CE6.0001: Failed to create dualsense. [ 504.254017][ T5818] playstation: probe of 0003:054C:0CE6.0001 failed with error -71 [ 504.312090][ T5818] usb 7-1: USB disconnect, device number 5 [ 505.838661][ T9205] GUP no longer grows the stack in syz.0.726 (9205): 200000009000-20000000a000 (200000005000) [ 505.868133][ T9205] CPU: 0 PID: 9205 Comm: syz.0.726 Not tainted syzkaller #0 [ 505.875480][ T9205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 505.885563][ T9205] Call Trace: [ 505.888861][ T9205] [ 505.891807][ T9205] dump_stack_lvl+0x18c/0x250 [ 505.896524][ T9205] ? show_regs_print_info+0x20/0x20 [ 505.901748][ T9205] ? load_image+0x420/0x420 [ 505.906274][ T9205] ? find_vma+0x134/0x1b0 [ 505.910645][ T9205] __get_user_pages+0xfe7/0x1580 [ 505.915636][ T9205] ? populate_vma_page_range+0x380/0x380 [ 505.921298][ T9205] ? __gup_longterm_locked+0x21d8/0x2cb0 [ 505.926961][ T9205] ? down_read_killable+0x1d0/0x340 [ 505.932166][ T9205] __gup_longterm_locked+0x2345/0x2cb0 [ 505.937652][ T9205] ? pin_user_pages_remote+0x220/0x220 [ 505.943117][ T9205] ? mark_lock+0x94/0x320 [ 505.947449][ T9205] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 505.953434][ T9205] ? __lock_acquire+0x7d80/0x7d80 [ 505.958462][ T9205] ? lock_chain_count+0x20/0x20 [ 505.963314][ T9205] ? internal_get_user_pages_fast+0x1f8e/0x27a0 [ 505.969564][ T9205] internal_get_user_pages_fast+0x2174/0x27a0 [ 505.975660][ T9205] ? get_user_pages_fast_only+0xa0/0xa0 [ 505.981381][ T9205] ? trace_contention_end+0x39/0xe0 [ 505.986591][ T9205] ? __mutex_lock+0x30d/0xc80 [ 505.991280][ T9205] ? __lock_acquire+0x7d80/0x7d80 [ 505.996303][ T9205] ? iov_iter_iovec_advance+0x1ef/0x290 [ 506.001856][ T9205] __iov_iter_get_pages_alloc+0x380/0xac0 [ 506.007598][ T9205] iov_iter_get_pages2+0x5f/0xa0 [ 506.012553][ T9205] __se_sys_vmsplice+0x5e5/0x11f0 [ 506.017585][ T9205] ? __x64_sys_vmsplice+0xb0/0xb0 [ 506.022631][ T9205] ? futex_wake_mark+0x150/0x150 [ 506.027608][ T9205] ? fd_install+0x60/0x4e0 [ 506.032054][ T9205] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 506.038052][ T9205] ? lockdep_hardirqs_on+0x98/0x150 [ 506.043334][ T9205] do_syscall_64+0x55/0xb0 [ 506.047756][ T9205] ? clear_bhb_loop+0x40/0x90 [ 506.052442][ T9205] ? clear_bhb_loop+0x40/0x90 [ 506.057129][ T9205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 506.063021][ T9205] RIP: 0033:0x7fc56659e159 [ 506.067434][ T9205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.087046][ T9205] RSP: 002b:00007fc567458028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 506.095475][ T9205] RAX: ffffffffffffffda RBX: 00007fc566825fa0 RCX: 00007fc56659e159 [ 506.103445][ T9205] RDX: 0000000000000002 RSI: 0000200000000280 RDI: 0000000000000004 [ 506.111415][ T9205] RBP: 00007fc56663506b R08: 0000000000000000 R09: 0000000000000000 [ 506.119385][ T9205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 506.127350][ T9205] R13: 00007fc566826038 R14: 00007fc566825fa0 R15: 00007ffeadd5d7e8 [ 506.135331][ T9205] [ 506.750685][ T9230] syzkaller1: entered promiscuous mode [ 506.756230][ T9230] syzkaller1: entered allmulticast mode [ 507.936256][ T9259] loop6: detected capacity change from 0 to 1024 [ 507.962273][ T9259] EXT4-fs: Ignoring removed nobh option [ 508.006496][ T9259] EXT4-fs: Ignoring removed orlov option [ 508.026114][ T9259] EXT4-fs (loop6): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 508.068771][ T9259] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 508.180415][ T9272] overlayfs: failed to clone upperpath [ 508.867980][ T5787] Bluetooth: hci2: command 0x0406 tx timeout [ 508.994684][ T9259] overlayfs: failed index dir cleanup (-512) [ 509.017948][ T9259] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 509.171738][ T7696] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 509.434978][ T9299] loop6: detected capacity change from 0 to 512 [ 509.466321][ T9299] EXT4-fs: Ignoring removed nomblk_io_submit option [ 509.489523][ T9299] ext4: Unknown parameter 'fsname' [ 510.839315][ T9336] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 512.375310][ T9379] bridge0: port 3(syz_tun) entered blocking state [ 512.382214][ T9379] bridge0: port 3(syz_tun) entered disabled state [ 512.390249][ T9379] syz_tun: entered allmulticast mode [ 512.397097][ T9379] syz_tun: entered promiscuous mode [ 512.403341][ T9379] bridge0: port 3(syz_tun) entered blocking state [ 512.409958][ T9379] bridge0: port 3(syz_tun) entered forwarding state [ 512.498866][ T9384] FAULT_INJECTION: forcing a failure. [ 512.498866][ T9384] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 512.513110][ T9384] CPU: 1 PID: 9384 Comm: syz.6.776 Not tainted syzkaller #0 [ 512.520449][ T9384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 512.530531][ T9384] Call Trace: [ 512.533811][ T9384] [ 512.536736][ T9384] dump_stack_lvl+0x18c/0x250 [ 512.541428][ T9384] ? show_regs_print_info+0x20/0x20 [ 512.546635][ T9384] ? load_image+0x420/0x420 [ 512.551145][ T9384] ? __lock_acquire+0x7d80/0x7d80 [ 512.556180][ T9384] should_fail_ex+0x394/0x4c0 [ 512.560952][ T9384] prepare_alloc_pages+0x1e1/0x5b0 [ 512.566066][ T9384] __alloc_pages+0x134/0x460 [ 512.570658][ T9384] ? zone_statistics+0x170/0x170 [ 512.575600][ T9384] ? alloc_pages+0x4e1/0x740 [ 512.580189][ T9384] ? do_raw_spin_unlock+0x121/0x230 [ 512.585392][ T9384] __get_free_pages+0xc/0x30 [ 512.589979][ T9384] kasan_populate_vmalloc_pte+0x35/0x100 [ 512.595618][ T9384] __apply_to_page_range+0x860/0xdd0 [ 512.600910][ T9384] ? kasan_populate_vmalloc+0x70/0x70 [ 512.606284][ T9384] ? apply_to_page_range+0x50/0x50 [ 512.611480][ T9384] ? do_raw_spin_unlock+0x121/0x230 [ 512.616686][ T9384] alloc_vmap_area+0x1d26/0x1e50 [ 512.621639][ T9384] ? vm_map_ram+0xcf0/0xcf0 [ 512.626149][ T9384] ? rcu_is_watching+0x15/0xb0 [ 512.630917][ T9384] __get_vm_area_node+0x162/0x370 [ 512.635951][ T9384] __vmalloc_node_range+0x36f/0x1320 [ 512.641244][ T9384] ? copy_process+0x5a6/0x3da0 [ 512.646019][ T9384] ? __lock_acquire+0x7d80/0x7d80 [ 512.651049][ T9384] ? free_vm_area+0x50/0x50 [ 512.655553][ T9384] ? arch_dup_task_struct+0x57/0xd0 [ 512.660753][ T9384] ? __asan_memcpy+0x40/0x70 [ 512.665350][ T9384] dup_task_struct+0x3c8/0x800 [ 512.670117][ T9384] ? copy_process+0x5a6/0x3da0 [ 512.674881][ T9384] ? lockdep_hardirqs_on+0x98/0x150 [ 512.680079][ T9384] copy_process+0x5a6/0x3da0 [ 512.684701][ T9384] ? __pidfd_prepare+0x140/0x140 [ 512.689635][ T9384] ? __might_fault+0xaa/0x120 [ 512.694314][ T9384] ? __asan_memset+0x22/0x40 [ 512.698913][ T9384] kernel_clone+0x24b/0x8a0 [ 512.703425][ T9384] ? create_io_thread+0x190/0x190 [ 512.708464][ T9384] __se_sys_clone3+0x334/0x350 [ 512.713238][ T9384] ? __x64_sys_clone3+0x60/0x60 [ 512.718088][ T9384] ? do_futex+0x2ff/0x3e0 [ 512.722462][ T9384] ? lockdep_hardirqs_on+0x98/0x150 [ 512.727691][ T9384] do_syscall_64+0x55/0xb0 [ 512.732139][ T9384] ? clear_bhb_loop+0x40/0x90 [ 512.736823][ T9384] ? clear_bhb_loop+0x40/0x90 [ 512.741526][ T9384] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 512.747461][ T9384] RIP: 0033:0x7f22f139e159 [ 512.751889][ T9384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.771506][ T9384] RSP: 002b:00007f22f226bef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 512.779925][ T9384] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f22f139e159 [ 512.787898][ T9384] RDX: 00007f22f226bf10 RSI: 0000000000000058 RDI: 00007f22f226bf10 [ 512.795865][ T9384] RBP: 00007f22f143506b R08: 0000000000000000 R09: 0000000000000058 [ 512.803838][ T9384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 512.811810][ T9384] R13: 00007f22f1626038 R14: 00007f22f1625fa0 R15: 00007ffff606f568 [ 512.819793][ T9384] [ 512.826583][ T5788] Bluetooth: hci2: command 0x0406 tx timeout [ 512.846580][ T9384] syz.6.776: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz6,mems_allowed=0-1 [ 512.872448][ T9384] CPU: 1 PID: 9384 Comm: syz.6.776 Not tainted syzkaller #0 [ 512.879788][ T9384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 512.889875][ T9384] Call Trace: [ 512.893176][ T9384] [ 512.896129][ T9384] dump_stack_lvl+0x18c/0x250 [ 512.900841][ T9384] ? show_regs_print_info+0x20/0x20 [ 512.906070][ T9384] ? load_image+0x420/0x420 [ 512.910602][ T9384] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 512.917051][ T9384] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 512.923661][ T9384] warn_alloc+0x246/0x340 [ 512.928016][ T9384] ? slab_free_freelist_hook+0x130/0x1a0 [ 512.933675][ T9384] ? zone_watermark_ok_safe+0x230/0x230 [ 512.939238][ T9384] ? __get_vm_area_node+0x17b/0x370 [ 512.944447][ T9384] ? __get_vm_area_node+0x17b/0x370 [ 512.949658][ T9384] __vmalloc_node_range+0x394/0x1320 [ 512.954962][ T9384] ? __lock_acquire+0x7d80/0x7d80 [ 512.959993][ T9384] ? free_vm_area+0x50/0x50 [ 512.964504][ T9384] ? arch_dup_task_struct+0x57/0xd0 [ 512.969707][ T9384] ? __asan_memcpy+0x40/0x70 [ 512.974303][ T9384] dup_task_struct+0x3c8/0x800 [ 512.979069][ T9384] ? copy_process+0x5a6/0x3da0 [ 512.983833][ T9384] ? lockdep_hardirqs_on+0x98/0x150 [ 512.989035][ T9384] copy_process+0x5a6/0x3da0 [ 512.993652][ T9384] ? __pidfd_prepare+0x140/0x140 [ 512.998586][ T9384] ? __might_fault+0xaa/0x120 [ 513.003265][ T9384] ? __asan_memset+0x22/0x40 [ 513.007867][ T9384] kernel_clone+0x24b/0x8a0 [ 513.012375][ T9384] ? create_io_thread+0x190/0x190 [ 513.017407][ T9384] __se_sys_clone3+0x334/0x350 [ 513.022173][ T9384] ? __x64_sys_clone3+0x60/0x60 [ 513.027023][ T9384] ? do_futex+0x2ff/0x3e0 [ 513.031374][ T9384] ? lockdep_hardirqs_on+0x98/0x150 [ 513.036570][ T9384] do_syscall_64+0x55/0xb0 [ 513.040987][ T9384] ? clear_bhb_loop+0x40/0x90 [ 513.045665][ T9384] ? clear_bhb_loop+0x40/0x90 [ 513.050347][ T9384] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 513.056246][ T9384] RIP: 0033:0x7f22f139e159 [ 513.060670][ T9384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.080277][ T9384] RSP: 002b:00007f22f226bef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 513.088702][ T9384] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f22f139e159 [ 513.096670][ T9384] RDX: 00007f22f226bf10 RSI: 0000000000000058 RDI: 00007f22f226bf10 [ 513.104636][ T9384] RBP: 00007f22f143506b R08: 0000000000000000 R09: 0000000000000058 [ 513.112604][ T9384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 513.120583][ T9384] R13: 00007f22f1626038 R14: 00007f22f1625fa0 R15: 00007ffff606f568 [ 513.128578][ T9384] [ 513.139769][ T28] audit: type=1326 audit(1790325503.782:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9385 comm="syz.0.777" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc56659e159 code=0x0 [ 513.163748][ T9384] Mem-Info: [ 513.166960][ T9384] active_anon:19495 inactive_anon:0 isolated_anon:0 [ 513.166960][ T9384] active_file:8372 inactive_file:50648 isolated_file:0 [ 513.166960][ T9384] unevictable:768 dirty:228 writeback:0 [ 513.166960][ T9384] slab_reclaimable:6341 slab_unreclaimable:95383 [ 513.166960][ T9384] mapped:24798 shmem:13474 pagetables:940 [ 513.166960][ T9384] sec_pagetables:0 bounce:0 [ 513.166960][ T9384] kernel_misc_reclaimable:0 [ 513.166960][ T9384] free:1337983 free_pcp:4562 free_cma:0 [ 513.221419][ T9384] Node 0 active_anon:78180kB inactive_anon:0kB active_file:33488kB inactive_file:202388kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:99292kB dirty:912kB writeback:0kB shmem:52360kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11880kB pagetables:3760kB sec_pagetables:0kB all_unreclaimable? no [ 513.268899][ T9384] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 513.311333][ T9384] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 513.349473][ T9384] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 513.398224][ T9384] Node 0 DMA32 free:1433832kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:78040kB inactive_anon:0kB active_file:33488kB inactive_file:201564kB unevictable:1536kB writepending:912kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:7952kB local_pcp:5252kB free_cma:0kB [ 513.457545][ T9384] lowmem_reserve[]: 0 0 0 0 0 [ 513.464946][ T9384] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 513.502212][ T9384] lowmem_reserve[]: 0 0 0 0 0 [ 513.507134][ T9384] Node 1 Normal free:3902492kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:10752kB local_pcp:6304kB free_cma:0kB [ 513.557151][ T9384] lowmem_reserve[]: 0 0 0 0 0 [ 513.562345][ T9384] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 513.580403][ T9384] Node 0 DMA32: 737*4kB (UME) 471*8kB (UME) 413*16kB (UME) 599*32kB (UME) 590*64kB (UME) 233*128kB (UME) 143*256kB (UME) 61*512kB (UME) 14*1024kB (UME) 19*2048kB (UME) 296*4096kB (UM) = 1433580kB [ 513.603535][ T9384] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 513.617423][ T9384] Node 1 Normal: 193*4kB (UME) 61*8kB (UME) 53*16kB (UME) 185*32kB (UME) 53*64kB (UE) 11*128kB (UME) 4*256kB (U) 3*512kB (UME) 2*1024kB (UE) 1*2048kB (E) 948*4096kB (M) = 3902492kB [ 513.641469][ T9384] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 513.651961][ T9384] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 513.666274][ T9384] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 513.676240][ T9384] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 513.715716][ T9384] 72495 total pagecache pages [ 513.724978][ T9384] 3 pages in swap cache [ 513.729455][ T9384] Free swap = 124204kB [ 513.733627][ T9384] Total swap = 124996kB [ 513.741494][ T9384] 2097051 pages RAM [ 513.745370][ T9384] 0 pages HighMem/MovableOnly [ 513.754102][ T9384] 416965 pages reserved [ 513.766674][ T9384] 0 pages cma reserved [ 514.598547][ T5787] Bluetooth: hci3: command tx timeout [ 516.260803][ T9478] netlink: 8 bytes leftover after parsing attributes in process `syz.0.798'. [ 517.510821][ T5818] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 517.728169][ T5818] usb 7-1: Using ep0 maxpacket: 8 [ 517.742732][ T5818] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 517.768583][ T5818] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.776636][ T5818] usb 7-1: Product: syz [ 517.795551][ T5818] usb 7-1: Manufacturer: syz [ 517.801555][ T5818] usb 7-1: SerialNumber: syz [ 517.818477][ T5818] usb 7-1: config 0 descriptor?? [ 518.033950][ T5818] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 518.204833][ T9563] netlink: 64 bytes leftover after parsing attributes in process `syz.5.815'. [ 518.247306][ T9563] ip6gre1: entered promiscuous mode [ 518.262236][ T9563] ip6gre1: entered allmulticast mode [ 518.409416][ T5787] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 518.627138][ T9582] overlayfs: failed to clone upperpath [ 518.636480][ C1] raw-gadget.0 gadget.6: ignoring, device is not running [ 518.645639][ T5818] dvb_usb_rtl28xxu: probe of 7-1:0.0 failed with error -32 [ 518.666380][ T789] usb 7-1: USB disconnect, device number 6 [ 519.019479][ T9600] af_packet: packet size is too long (8130929 > 85) [ 521.895567][ T9726] loop6: detected capacity change from 0 to 512 [ 521.986094][ T9726] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 522.074514][ T9726] ext4 filesystem being mounted at /87/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 522.139994][ T28] audit: type=1800 audit(1790325512.992:15): pid=9726 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.857" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 522.251729][ T7696] EXT4-fs error (device loop6): ext4_validate_block_bitmap:439: comm syz-executor: bg 0: block 217: padding at end of block bitmap is not set [ 522.344954][ T9742] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 522.347792][ T7696] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 522.438612][ T7696] EXT4-fs error (device loop6): ext4_lookup:1860: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 522.498173][ T7696] EXT4-fs error (device loop6): ext4_lookup:1860: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 523.715949][ T9791] netlink: 244 bytes leftover after parsing attributes in process `syz.4.871'. [ 524.228911][ T5788] Bluetooth: hci3: command 0x0406 tx timeout [ 524.617874][ T1148] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.713555][ T1148] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.809028][ T1148] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.012329][ T1148] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.203046][ T5788] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 525.213540][ T5788] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 525.230672][ T5788] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 525.242027][ T5788] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 525.256882][ T5788] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 525.266765][ T5788] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 525.995468][ T9844] chnl_net:caif_netlink_parms(): no params data found [ 526.335321][ T9844] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.343456][ T9844] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.352127][ T9844] bridge_slave_0: entered allmulticast mode [ 526.359650][ T9844] bridge_slave_0: entered promiscuous mode [ 526.371021][ T9844] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.378836][ T9844] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.386497][ T9844] bridge_slave_1: entered allmulticast mode [ 526.394265][ T9844] bridge_slave_1: entered promiscuous mode [ 526.450579][ T9844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.465557][ T9844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.672622][ T9844] team0: Port device team_slave_0 added [ 526.763337][ T9844] team0: Port device team_slave_1 added [ 526.820033][ T1148] hsr_slave_0: left promiscuous mode [ 526.826197][ T1148] hsr_slave_1: left promiscuous mode [ 526.840654][ T1148] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.850315][ T1148] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 526.862623][ T1148] bridge_slave_1: left allmulticast mode [ 526.868480][ T1148] bridge_slave_1: left promiscuous mode [ 526.874975][ T1148] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.887112][ T1148] bridge_slave_0: left allmulticast mode [ 526.894869][ T1148] bridge_slave_0: left promiscuous mode [ 526.903784][ T1148] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.939542][ T1148] veth1_macvtap: left promiscuous mode [ 526.945244][ T1148] veth0_macvtap: left promiscuous mode [ 526.951589][ T1148] veth1_vlan: left promiscuous mode [ 526.957009][ T1148] veth0_vlan: left promiscuous mode [ 527.361410][ T5787] Bluetooth: hci1: command tx timeout [ 527.662335][ T1148] team0 (unregistering): Port device team_slave_1 removed [ 527.713145][ T1148] team0 (unregistering): Port device team_slave_0 removed [ 527.764155][ T1148] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 527.813229][ T1148] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 528.156698][ T1148] bond0 (unregistering): Released all slaves [ 528.264682][ T9844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 528.271919][ T9844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 528.306129][ T9844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 528.326060][ T9844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 528.343897][ T9844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 528.378936][ T9844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 528.503377][ T9844] hsr_slave_0: entered promiscuous mode [ 528.527488][ T9844] hsr_slave_1: entered promiscuous mode [ 528.547250][ T9844] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 528.565684][ T9844] Cannot create hsr debugfs directory [ 528.944213][ T9844] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 528.956110][ T9844] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 528.977398][ T9844] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 529.004045][ T9844] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 529.151882][ T9844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.273252][ T9844] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.301509][ T1148] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.308694][ T1148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.333852][ T1148] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.341055][ T1148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 529.435478][ T5787] Bluetooth: hci1: command tx timeout [ 529.817047][ T9844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 530.418569][ T9844] veth0_vlan: entered promiscuous mode [ 530.455173][ T9844] veth1_vlan: entered promiscuous mode [ 530.522891][ T9844] veth0_macvtap: entered promiscuous mode [ 530.530426][ T9984] overlayfs: failed to clone upperpath [ 530.553343][ T9844] veth1_macvtap: entered promiscuous mode [ 530.615386][ T9844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 530.650078][ T9844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 530.682925][ T9844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 530.703749][ T9844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 530.731530][ T9844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 530.766360][ T9995] IPVS: sync thread started: state = BACKUP, mcast_ifn = macsec0, syncid = 3, id = 0 [ 530.782428][ T9844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 530.804103][ T9844] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 530.825624][ T9844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.869878][ T9844] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.888449][ T9844] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.897551][ T9844] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.928077][ T9844] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.132530][ T1148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.174120][ T1148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 531.267096][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.275958][T10012] netlink: 4 bytes leftover after parsing attributes in process `syz.0.918'. [ 531.311119][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.191307][ T5787] Bluetooth: hci1: command tx timeout [ 532.505853][ T9844] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 534.282778][ T5787] Bluetooth: hci1: command tx timeout [ 534.640229][ T27] IPVS: starting estimator thread 0... [ 534.748337][T10076] IPVS: using max 20 ests per chain, 48000 per kthread [ 536.887934][ T789] smpboot: CPU 1 is now offline [ 537.076211][T10152] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 538.239949][ T28] audit: type=1326 audit(1790325535.096:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.135590][ T28] audit: type=1326 audit(1790325535.096:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.208554][ T28] audit: type=1326 audit(1790325535.096:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.238223][ T28] audit: type=1326 audit(1790325535.096:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.266707][ T28] audit: type=1326 audit(1790325535.096:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.294954][ T28] audit: type=1326 audit(1790325535.096:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.357251][ T28] audit: type=1326 audit(1790325535.096:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.386304][ T28] audit: type=1326 audit(1790325535.096:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.410626][ T28] audit: type=1326 audit(1790325535.096:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=17 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.420358][T10173] loop7: detected capacity change from 0 to 40427 [ 539.435011][ T28] audit: type=1326 audit(1790325535.096:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10197 comm="syz.5.961" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feea839e159 code=0x7ffc0000 [ 539.636939][T10173] F2FS-fs (loop7): Wrong segment_count / block_count (31 > 0) [ 539.674868][T10173] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 539.734456][T10173] F2FS-fs (loop7): invalid crc value [ 539.793803][T10173] F2FS-fs (loop7): Found nat_bits in checkpoint [ 539.938605][T10216] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 540.002555][T10173] F2FS-fs (loop7): Try to recover 2th superblock, ret: 0 [ 540.029058][T10173] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 540.236874][T10173] syz.7.956: attempt to access beyond end of device [ 540.236874][T10173] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 540.337854][T10173] syz.7.956: attempt to access beyond end of device [ 540.337854][T10173] loop7: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 540.400968][T10173] syz.7.956: attempt to access beyond end of device [ 540.400968][T10173] loop7: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 540.555150][ T9844] syz-executor: attempt to access beyond end of device [ 540.555150][ T9844] loop7: rw=2049, sector=45136, nr_sectors = 8 limit=40427 [ 540.621272][ T9844] F2FS-fs (loop7): Remounting filesystem read-only [ 544.949564][T10294] netlink: 164 bytes leftover after parsing attributes in process `syz.7.990'. [ 545.182386][T10303] syz.7.994 (10303): drop_caches: 2 [ 545.260328][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 545.260408][ T28] audit: type=1326 audit(1790325542.116:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10304 comm="syz.0.995" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc56659e159 code=0x0 [ 545.346941][T10314] overlayfs: failed to clone upperpath [ 545.454209][T10316] binder: 10315:10316 ioctl c0306201 200000000080 returned -14 [ 545.490639][T10316] binder: 10315:10316 ioctl c0306201 2000000003c0 returned -14 [ 546.896246][T10341] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 547.665523][T10380] loop7: detected capacity change from 0 to 512 [ 547.690276][T10380] EXT4-fs: Ignoring removed nomblk_io_submit option [ 547.714063][T10380] ext4: Unknown parameter 'fsname' [ 548.208759][T10398] ecryptfs_parse_options: eCryptfs doesn't support cipher: aes»G [ 548.216936][T10398] Error parsing options; rc = [-22] [ 550.330074][T10462] mount: server 127.0.0.1 not responding, timed out [ 553.993184][T10593] overlayfs: failed to clone upperpath [ 554.533729][ T28] audit: type=1326 audit(1790325551.386:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.561994][ T28] audit: type=1326 audit(1790325551.386:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.589395][ T28] audit: type=1326 audit(1790325551.396:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.615192][ T28] audit: type=1326 audit(1790325551.396:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.645398][ T28] audit: type=1326 audit(1790325551.396:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.673416][ T28] audit: type=1326 audit(1790325551.396:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fbf34b5e98e code=0x7ffc0000 [ 554.704712][ T28] audit: type=1326 audit(1790325551.396:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.765090][ T28] audit: type=1326 audit(1790325551.396:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.801408][ T28] audit: type=1326 audit(1790325551.406:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 554.843794][ T28] audit: type=1326 audit(1790325551.406:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10601 comm="syz.7.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf34b9e159 code=0x7ffc0000 [ 555.853734][T10650] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1071'. [ 555.929728][ T5788] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 556.563631][T10686] overlayfs: failed to clone upperpath [ 556.753359][T10662] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.762415][T10662] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.307453][T10662] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 557.346999][T10662] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 558.622013][T10662] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.648865][T10662] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.668468][T10662] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.687762][T10662] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.810199][T10715] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1082'. [ 558.859108][T10715] syz_tun: left allmulticast mode [ 558.877731][T10715] syz_tun: left promiscuous mode [ 558.899086][T10715] bridge0: port 3(syz_tun) entered disabled state [ 558.936777][T10715] bridge_slave_1: left allmulticast mode [ 558.957741][T10715] bridge_slave_1: left promiscuous mode [ 558.978553][T10715] bridge0: port 2(bridge_slave_1) entered disabled state [ 559.021180][T10715] bridge_slave_0: left allmulticast mode [ 559.028630][T10715] bridge_slave_0: left promiscuous mode [ 559.047951][T10715] bridge0: port 1(bridge_slave_0) entered disabled state [ 561.282476][T10785] overlayfs: failed to clone upperpath [ 561.680122][T10792] netlink: 'syz.5.1101': attribute type 1 has an invalid length. [ 561.833555][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 561.840025][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 561.844967][T10792] wireguard0: entered promiscuous mode [ 561.865744][T10792] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 561.907771][T10792] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 561.959437][T10792] bond1: (slave wireguard0): making interface the new active one [ 561.984961][T10792] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 562.051286][T10797] wireguard1: entered promiscuous mode [ 562.056923][T10797] bond1: (slave wireguard1): The slave device specified does not support setting the MAC address [ 562.140727][T10797] bond1: (slave wireguard1): Enslaving as a backup interface with an up link [ 564.680743][T10828] netlink: 'syz.4.1112': attribute type 1 has an invalid length. [ 564.871742][T10828] 8021q: adding VLAN 0 to HW filter on device bond1 [ 564.988649][T10830] bond1: (slave veth3): Enslaving as an active interface with a down link [ 565.075239][T10833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 565.142647][T10833] bond1: (slave batadv0): making interface the new active one [ 565.419745][T10833] batadv0: entered promiscuous mode [ 565.471985][T10833] bond1: (slave batadv0): Enslaving as an active interface with an up link [ 565.729050][T10828] veth5: entered allmulticast mode [ 565.736358][T10828] bond1: (slave veth5): Enslaving as an active interface with a down link [ 571.107812][ T5787] Bluetooth: hci2: command 0x0406 tx timeout [ 572.732871][T10920] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1138'. [ 574.809145][ T5787] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 574.829697][ T5787] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 574.841577][ T5787] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 574.889471][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 574.902906][ T5787] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 574.910305][ T5787] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 575.257363][T10944] chnl_net:caif_netlink_parms(): no params data found [ 575.379944][T10944] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.387204][T10944] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.403886][T10944] bridge_slave_0: entered allmulticast mode [ 575.413663][T10944] bridge_slave_0: entered promiscuous mode [ 575.427222][T10944] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.443143][T10944] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.452618][T10944] bridge_slave_1: entered allmulticast mode [ 575.464973][T10944] bridge_slave_1: entered promiscuous mode [ 575.513838][T10944] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.535494][T10944] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.606110][T10944] team0: Port device team_slave_0 added [ 576.110097][T10944] team0: Port device team_slave_1 added [ 576.159920][T10944] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.166914][T10944] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.205561][T10944] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 576.281598][T10944] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 576.294425][T10944] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.335390][T10944] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.413663][T10944] hsr_slave_0: entered promiscuous mode [ 576.425821][T10944] hsr_slave_1: entered promiscuous mode [ 576.436808][T10944] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 576.452586][T10944] Cannot create hsr debugfs directory [ 576.947808][ T5788] Bluetooth: hci3: command tx timeout [ 577.053738][T10944] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 577.104311][T10944] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 577.313114][T10944] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 577.342290][T10944] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 577.807304][T10944] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.912572][T10944] 8021q: adding VLAN 0 to HW filter on device team0 [ 578.004423][ T6986] bridge0: port 1(bridge_slave_0) entered blocking state [ 578.011646][ T6986] bridge0: port 1(bridge_slave_0) entered forwarding state [ 578.034933][ T1148] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.042142][ T1148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 578.126871][T10992] futex_wake_op: syz.5.1152 tries to shift op by 144; fix this program [ 578.170408][T10992] trusted_key: syz.5.1152 sent an empty control message without MSG_MORE. [ 578.638279][ T1134] hsr_slave_0: left promiscuous mode [ 578.644365][ T1134] hsr_slave_1: left promiscuous mode [ 578.656704][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 578.665168][ T1134] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 578.688458][ T1134] bridge_slave_1: left allmulticast mode [ 578.694158][ T1134] bridge_slave_1: left promiscuous mode [ 578.706276][ T1134] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.028913][ T5788] Bluetooth: hci3: command tx timeout [ 580.030982][ T1134] bridge_slave_0: left allmulticast mode [ 580.036677][ T1134] bridge_slave_0: left promiscuous mode [ 580.055045][ T1134] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.930702][ T1134] team0 (unregistering): Port device team_slave_1 removed [ 581.025661][ T1134] team0 (unregistering): Port device team_slave_0 removed [ 581.111923][ T5788] Bluetooth: hci3: command tx timeout [ 581.123787][ T1134] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 581.209501][ T1134] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 582.610739][ T1134] bond0 (unregistering): Released all slaves [ 582.771255][T11002] netlink: 'syz.5.1154': attribute type 10 has an invalid length. [ 583.160126][T11002] team0 (unregistering): Port device team_slave_0 removed [ 583.187805][ T5788] Bluetooth: hci3: command tx timeout [ 583.420811][T11018] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1160'. [ 583.452799][T11002] team0 (unregistering): Port device team_slave_1 removed [ 584.440702][T10944] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 584.478700][ T1098] batadv0: left promiscuous mode [ 585.126613][T10944] veth0_vlan: entered promiscuous mode [ 585.181561][T10944] veth1_vlan: entered promiscuous mode [ 585.271469][T10944] veth0_macvtap: entered promiscuous mode [ 585.310763][T10944] veth1_macvtap: entered promiscuous mode [ 585.365428][T10944] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 585.395234][T10944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.436896][T10944] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 585.478174][T10944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.495176][T10944] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 585.520799][T10944] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 585.562985][T10944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.589287][T10944] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 585.632103][T10944] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.668774][T10944] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.677515][T10944] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.711934][T10944] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.752232][ T6986] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.807876][ T6986] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.826387][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.853639][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.480555][T11068] loop8: detected capacity change from 0 to 64 [ 589.113803][T11080] ffs_data_put(): freeing [ 590.119574][T11116] bond_slave_0: entered promiscuous mode [ 590.125736][T11116] bond_slave_1: entered promiscuous mode [ 590.178347][T11116] vlan2: entered promiscuous mode [ 590.197789][T11116] bond0: entered promiscuous mode [ 590.981988][T11134] loop8: detected capacity change from 0 to 1024 [ 592.349923][T11161] syz_tun: entered allmulticast mode [ 595.556237][T11224] loop8: detected capacity change from 0 to 2048 [ 595.691592][T11224] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 599.129368][ T27] IPVS: starting estimator thread 0... [ 599.217754][T11282] IPVS: using max 23 ests per chain, 55200 per kthread [ 601.801324][T11306] syzkaller0: entered promiscuous mode [ 601.806869][T11306] syzkaller0: entered allmulticast mode [ 607.192714][T11352] loop8: detected capacity change from 0 to 512 [ 607.209818][T11352] EXT4-fs: Ignoring removed nomblk_io_submit option [ 607.230559][T11352] ext4: Unknown parameter 'fsname' [ 613.114444][T11467] loop8: detected capacity change from 0 to 512 [ 613.933734][T11467] EXT4-fs: Ignoring removed nomblk_io_submit option [ 613.973032][T11467] ext4: Unknown parameter 'fsname' [ 616.388068][T11506] fuse: Unknown parameter '0x000000000000000300000000000000000000' [ 624.348064][T11583] overlayfs: missing 'lowerdir' [ 624.412268][T11594] loop8: detected capacity change from 0 to 512 [ 624.437368][T11594] ext4: Unknown parameter 'smackfshat' [ 624.528060][T11594] loop8: detected capacity change from 0 to 512 [ 624.553614][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.564171][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.606756][T11594] EXT4-fs error (device loop8): ext4_orphan_get:1408: inode #15: comm syz.8.1260: iget: bad i_size value: 38620345925642 [ 624.678197][T11594] EXT4-fs error (device loop8): ext4_orphan_get:1413: comm syz.8.1260: couldn't read orphan inode 15 (err -117) [ 624.734527][T11594] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 624.927840][T11599] EXT4-fs error (device loop8): ext4_validate_block_bitmap:430: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 626.112932][T10944] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 626.460160][T11614] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 628.053865][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 628.053880][ T28] audit: type=1326 audit(1790325624.906:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11625 comm="syz.8.1263" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f44ec19e159 code=0x0 [ 629.248051][ T27] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 629.465432][ T27] usb 9-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 629.476954][ T27] usb 9-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 629.490532][ T27] usb 9-1: Product: syz [ 629.494758][ T27] usb 9-1: Manufacturer: syz [ 629.507729][ T27] usb 9-1: SerialNumber: syz [ 629.522157][ T27] usb 9-1: config 0 descriptor?? [ 630.071948][T11662] netlink: 'syz.4.1266': attribute type 1 has an invalid length. [ 630.089540][T11662] netlink: 'syz.4.1266': attribute type 2 has an invalid length. [ 630.814820][T11672] overlayfs: failed to clone upperpath [ 630.860133][ T5781] usb 9-1: USB disconnect, device number 2 [ 637.010005][T11725] tipc: Enabling of bearer rejected, failed to enable media [ 641.644542][ T6147] libceph: connect (1)[c::]:6789 error -101 [ 641.712633][ T6147] libceph: mon0 (1)[c::]:6789 connect error [ 641.825067][T11756] ceph: No mds server is up or the cluster is laggy [ 641.931335][ T6147] libceph: connect (1)[c::]:6789 error -101 [ 641.985243][ T6147] libceph: mon0 (1)[c::]:6789 connect error [ 642.973735][T11769] syz.8.1297 (11769): drop_caches: 2 [ 644.293802][T11791] overlayfs: missing 'lowerdir' [ 652.343963][T11828] loop8: detected capacity change from 0 to 512 [ 652.567961][T11828] EXT4-fs (loop8): 1 orphan inode deleted [ 652.569274][T11828] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 652.572700][T11828] ext4 filesystem being mounted at /40/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 653.008913][ T6986] Quota error (device loop8): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 653.026333][ T6986] EXT4-fs error (device loop8): ext4_release_dquot:6989: comm kworker/u4:12: Failed to release dquot type 1 [ 653.066275][T10944] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 653.925373][T11838] sctp: [Deprecated]: syz.8.1313 (pid 11838) Use of struct sctp_assoc_value in delayed_ack socket option. [ 653.925373][T11838] Use struct sctp_sack_info instead [ 657.381193][T11844] Failed to get privilege flags for destination (handle=0x2:0x0) [ 662.075055][T11868] overlayfs: failed to clone upperpath [ 664.903540][T11890] No such timeout policy "syz1" [ 671.326529][T11934] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 672.351063][T11945] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1340'. [ 672.621786][T11948] Cannot find set identified by id 0 to match [ 677.597881][ T27] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 677.807858][ T27] usb 9-1: Using ep0 maxpacket: 8 [ 677.819592][ T27] usb 9-1: New USB device found, idVendor=07ca, idProduct=a868, bcdDevice=c4.d4 [ 677.829103][ T27] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 677.848700][ T27] usb 9-1: config 0 descriptor?? [ 677.860441][ T27] dvb-usb: found a 'AVerMedia AVerTVHD Volar (A868R)' in warm state. [ 678.072753][ T27] cxusb: set interface failed [ 678.097720][ T27] dvb-usb: bulk message failed: -22 (1/0) [ 678.141141][ T27] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 678.165170][ T27] dvbdev: DVB: registering new adapter (AVerMedia AVerTVHD Volar (A868R)) [ 678.183260][ T27] usb 9-1: media controller created [ 678.235373][ T27] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 678.344390][ T27] DVB: Unable to find symbol lgdt330x_attach() [ 678.361574][ T27] dvb-usb: no frontend was attached by 'AVerMedia AVerTVHD Volar (A868R)' [ 678.373448][ T27] dvb-usb: bulk message failed: -22 (1/0) [ 678.384505][ T27] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully initialized and connected. [ 678.413525][ T27] usb 9-1: USB disconnect, device number 3 [ 678.473433][ T27] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully deinitialized and disconnected. [ 678.829067][T11977] loop8: detected capacity change from 0 to 256 [ 679.950256][T11982] loop8: detected capacity change from 0 to 8 [ 679.964309][T11982] MTD: Attempt to mount non-MTD device "/dev/loop8" [ 680.959134][T11962] udevd[11962]: incorrect cramfs checksum on /dev/loop8 [ 685.995145][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.064480][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.802037][T12020] md: could not open device unknown-block(1,1). [ 686.829711][T12020] MPI: mpi too large (113288 bits) [ 686.836630][T12020] MPI: mpi too large (113288 bits) [ 688.099287][T12021] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 689.570871][T12036] ªªªªªª: renamed from vlan0 (while UP) [ 695.795520][T12088] loop8: detected capacity change from 0 to 1024 [ 698.493696][ T5787] Bluetooth: hci3: command 0x0406 tx timeout [ 699.547528][T12124] loop8: detected capacity change from 0 to 512 [ 700.211870][T11962] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 700.436590][T12127] loop8: detected capacity change from 0 to 512 [ 703.908060][T12147] syz.8.1392 (12147): drop_caches: 2 [ 705.879383][T12170] netlink: 'syz.5.1397': attribute type 3 has an invalid length. [ 706.718963][T12173] netlink: 'syz.4.1399': attribute type 3 has an invalid length. [ 706.997700][T12179] syz.8.1402 (12179): drop_caches: 2 [ 708.521230][T12202] netlink: 'syz.8.1408': attribute type 3 has an invalid length. [ 709.823080][T12214] netlink: 'syz.5.1411': attribute type 3 has an invalid length. [ 712.036617][T12239] netlink: 'syz.5.1423': attribute type 3 has an invalid length. [ 715.005678][T12268] netlink: 'syz.4.1433': attribute type 3 has an invalid length. [ 715.080711][T12272] netlink: 'syz.8.1434': attribute type 3 has an invalid length. [ 716.093391][T12275] netlink: 'syz.8.1435': attribute type 3 has an invalid length. [ 717.463312][T12285] netlink: 'syz.0.1437': attribute type 3 has an invalid length. [ 719.626172][T12287] netlink: 'syz.0.1440': attribute type 3 has an invalid length. [ 721.487450][T12299] netlink: 'syz.0.1444': attribute type 3 has an invalid length. [ 730.331964][T12347] netlink: 'syz.8.1460': attribute type 3 has an invalid length. [ 732.738931][T12365] netlink: 'syz.8.1464': attribute type 3 has an invalid length. [ 733.826530][T12369] netlink: 'syz.8.1465': attribute type 3 has an invalid length. [ 734.555050][T12371] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1466'. [ 738.020265][T12400] netlink: 'syz.4.1476': attribute type 3 has an invalid length. [ 740.743285][T12412] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1481'. [ 743.354707][T12417] netlink: 'syz.4.1482': attribute type 3 has an invalid length. [ 746.263978][T12446] netlink: 'syz.8.1488': attribute type 3 has an invalid length. [ 746.717354][T12457] netlink: 'syz.0.1490': attribute type 3 has an invalid length. [ 747.433135][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.439660][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 755.247148][T12532] [ 755.249536][T12532] ====================================================== [ 755.256565][T12532] WARNING: possible circular locking dependency detected [ 755.263597][T12532] syzkaller #0 Not tainted [ 755.268009][T12532] ------------------------------------------------------ [ 755.275017][T12532] syz.8.1522/12532 is trying to acquire lock: [ 755.281070][T12532] ffff888024f980b8 (&hdev->lock){+.+.}-{3:3}, at: l2cap_chan_connect+0xfc/0xe30 [ 755.290250][T12532] [ 755.290250][T12532] but task is already holding lock: [ 755.297627][T12532] ffffffff8e562248 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0x95/0xec0 [ 755.306566][T12532] [ 755.306566][T12532] which lock already depends on the new lock. [ 755.306566][T12532] [ 755.317084][T12532] [ 755.317084][T12532] the existing dependency chain (in reverse order) is: [ 755.326092][T12532] [ 755.326092][T12532] -> #2 (rfcomm_mutex){+.+.}-{3:3}: [ 755.333473][T12532] __mutex_lock+0x135/0xc80 [ 755.338505][T12532] rfcomm_security_cfm+0x41/0x550 [ 755.344051][T12532] hci_encrypt_cfm+0x363/0x4d0 [ 755.349401][T12532] hci_cc_read_enc_key_size+0x219/0x380 [ 755.355465][T12532] hci_cmd_complete_evt+0x4e7/0xa40 [ 755.361206][T12532] hci_event_packet+0x7b4/0x1280 [ 755.366661][T12532] hci_rx_work+0x43a/0xd60 [ 755.371657][T12532] process_scheduled_works+0xa60/0x1600 [ 755.377734][T12532] worker_thread+0xa5e/0xfe0 [ 755.382843][T12532] kthread+0x2fa/0x390 [ 755.387426][T12532] ret_from_fork+0x48/0x80 [ 755.392364][T12532] ret_from_fork_asm+0x11/0x20 [ 755.397672][T12532] [ 755.397672][T12532] -> #1 (hci_cb_list_lock){+.+.}-{3:3}: [ 755.405420][T12532] __mutex_lock+0x135/0xc80 [ 755.410456][T12532] hci_remote_features_evt+0x535/0x900 [ 755.416439][T12532] hci_event_packet+0x807/0x1280 [ 755.421899][T12532] hci_rx_work+0x43a/0xd60 [ 755.426836][T12532] process_scheduled_works+0xa60/0x1600 [ 755.432904][T12532] worker_thread+0xa5e/0xfe0 [ 755.438020][T12532] kthread+0x2fa/0x390 [ 755.442603][T12532] ret_from_fork+0x48/0x80 [ 755.447544][T12532] ret_from_fork_asm+0x11/0x20 [ 755.452838][T12532] [ 755.452838][T12532] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 755.460138][T12532] __lock_acquire+0x37ef/0x7d80 [ 755.465525][T12532] lock_acquire+0x19e/0x420 [ 755.470552][T12532] __mutex_lock+0x135/0xc80 [ 755.475573][T12532] l2cap_chan_connect+0xfc/0xe30 [ 755.481033][T12532] l2cap_sock_connect+0x586/0x760 [ 755.486578][T12532] kernel_connect+0x142/0x1c0 [ 755.491883][T12532] rfcomm_dlc_open+0xa1f/0xec0 [ 755.497171][T12532] rfcomm_sock_connect+0x2ed/0x600 [ 755.502864][T12532] __sys_connect+0x3da/0x470 [ 755.507976][T12532] __x64_sys_connect+0x7a/0x90 [ 755.513346][T12532] do_syscall_64+0x55/0xb0 [ 755.518285][T12532] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 755.524710][T12532] [ 755.524710][T12532] other info that might help us debug this: [ 755.524710][T12532] [ 755.534934][T12532] Chain exists of: [ 755.534934][T12532] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 755.534934][T12532] [ 755.547451][T12532] Possible unsafe locking scenario: [ 755.547451][T12532] [ 755.554897][T12532] CPU0 CPU1 [ 755.560254][T12532] ---- ---- [ 755.565611][T12532] lock(rfcomm_mutex); [ 755.569768][T12532] lock(hci_cb_list_lock); [ 755.576786][T12532] lock(rfcomm_mutex); [ 755.583458][T12532] lock(&hdev->lock); [ 755.587521][T12532] [ 755.587521][T12532] *** DEADLOCK *** [ 755.587521][T12532] [ 755.595661][T12532] 1 lock held by syz.8.1522/12532: [ 755.600764][T12532] #0: ffffffff8e562248 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_open+0x95/0xec0 [ 755.610083][T12532] [ 755.610083][T12532] stack backtrace: [ 755.615961][T12532] CPU: 1 PID: 12532 Comm: syz.8.1522 Not tainted syzkaller #0 [ 755.623415][T12532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 755.633467][T12532] Call Trace: [ 755.636745][T12532] [ 755.639670][T12532] dump_stack_lvl+0x18c/0x250 [ 755.644358][T12532] ? load_image+0x420/0x420 [ 755.648877][T12532] ? show_regs_print_info+0x20/0x20 [ 755.654100][T12532] ? print_circular_bug+0x12b/0x1a0 [ 755.659307][T12532] check_noncircular+0x2fc/0x400 [ 755.664253][T12532] ? print_deadlock_bug+0x5d0/0x5d0 [ 755.669450][T12532] ? lockdep_lock+0xf5/0x230 [ 755.674042][T12532] ? _find_first_zero_bit+0xd6/0x100 [ 755.679330][T12532] __lock_acquire+0x37ef/0x7d80 [ 755.684190][T12532] ? is_bpf_text_address+0x28f/0x2a0 [ 755.689478][T12532] ? verify_lock_unused+0x140/0x140 [ 755.694691][T12532] ? __lock_acquire+0x1336/0x7d80 [ 755.699763][T12532] ? verify_lock_unused+0x140/0x140 [ 755.705004][T12532] lock_acquire+0x19e/0x420 [ 755.709599][T12532] ? l2cap_chan_connect+0xfc/0xe30 [ 755.714713][T12532] ? __might_sleep+0xe0/0xe0 [ 755.719305][T12532] ? read_lock_is_recursive+0x20/0x20 [ 755.724678][T12532] ? hci_get_route+0x3a5/0x4d0 [ 755.729447][T12532] ? __lock_acquire+0x7d80/0x7d80 [ 755.734472][T12532] __mutex_lock+0x135/0xc80 [ 755.738978][T12532] ? l2cap_chan_connect+0xfc/0xe30 [ 755.744086][T12532] ? do_raw_read_unlock+0x3d/0x80 [ 755.749108][T12532] ? _raw_read_unlock+0x28/0x40 [ 755.753956][T12532] ? hci_get_route+0x3a5/0x4d0 [ 755.758721][T12532] ? l2cap_chan_connect+0xfc/0xe30 [ 755.763830][T12532] ? mutex_lock_nested+0x20/0x20 [ 755.768764][T12532] ? print_unlock_imbalance_bug+0x160/0x160 [ 755.774657][T12532] ? mark_lock+0x94/0x320 [ 755.778989][T12532] l2cap_chan_connect+0xfc/0xe30 [ 755.784021][T12532] ? lock_chain_count+0x20/0x20 [ 755.788897][T12532] ? l2cap_chan_le_send_credits+0x4e0/0x4e0 [ 755.794808][T12532] ? __local_bh_enable_ip+0x13a/0x1c0 [ 755.800189][T12532] ? _local_bh_enable+0xa0/0xa0 [ 755.805045][T12532] ? bacmp+0xe/0x30 [ 755.808859][T12532] l2cap_sock_connect+0x586/0x760 [ 755.813889][T12532] ? l2cap_sock_bind+0x940/0x940 [ 755.818827][T12532] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 755.824807][T12532] ? __lock_acquire+0x7d80/0x7d80 [ 755.829834][T12532] ? kernel_connect+0xf2/0x1c0 [ 755.834608][T12532] kernel_connect+0x142/0x1c0 [ 755.839292][T12532] ? kernel_accept+0x350/0x350 [ 755.844151][T12532] ? rfcomm_dlc_open+0x9e3/0xec0 [ 755.849094][T12532] rfcomm_dlc_open+0xa1f/0xec0 [ 755.853856][T12532] ? rfcomm_sock_connect+0x2c6/0x600 [ 755.859142][T12532] ? __local_bh_enable_ip+0x13a/0x1c0 [ 755.864513][T12532] ? rfcomm_dlc_free+0x50/0x50 [ 755.869275][T12532] ? __local_bh_enable_ip+0x13a/0x1c0 [ 755.874646][T12532] ? _local_bh_enable+0xa0/0xa0 [ 755.879495][T12532] ? do_raw_spin_unlock+0x121/0x230 [ 755.884700][T12532] rfcomm_sock_connect+0x2ed/0x600 [ 755.889814][T12532] __sys_connect+0x3da/0x470 [ 755.894403][T12532] ? __sys_connect_file+0x170/0x170 [ 755.899613][T12532] __x64_sys_connect+0x7a/0x90 [ 755.904376][T12532] do_syscall_64+0x55/0xb0 [ 755.908794][T12532] ? clear_bhb_loop+0x40/0x90 [ 755.913475][T12532] ? clear_bhb_loop+0x40/0x90 [ 755.918153][T12532] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 755.924050][T12532] RIP: 0033:0x7f44ec19e159 [ 755.928463][T12532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.948083][T12532] RSP: 002b:00007f44ed0f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 755.956498][T12532] RAX: ffffffffffffffda RBX: 00007f44ec425fa0 RCX: 00007f44ec19e159 [ 755.964469][T12532] RDX: 000000000000000a RSI: 0000200000000040 RDI: 0000000000000005 [ 755.972529][T12532] RBP: 00007f44ec23506b R08: 0000000000000000 R09: 0000000000000000 [ 755.980500][T12532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 755.988482][T12532] R13: 00007f44ec426038 R14: 00007f44ec425fa0 R15: 00007ffc937260b8 [ 755.996463][T12532] [ 758.067971][ T5787] Bluetooth: hci3: command 0x0406 tx timeout