last executing test programs: 11m36.729075983s ago: executing program 32 (id=35): socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_ADD_DEV(0xffffffffffffffff, 0x5000940a, &(0x7f0000001000)={{0xffffffff}, '/dev/nullb0\x00'}) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, 0x0, 0x1) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x841e, &(0x7f00000001c0)={[{@nojournal_checksum}, {@jqfmt_vfsold}, {@lazytime}, {@usrquota}, {@usrquota}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 11m32.498768329s ago: executing program 3 (id=46): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x510, 0x2e0, 0xd0, 0x2e0, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000180)=0x80, 0x4) setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f0000000040)=0x6, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 11m32.130932865s ago: executing program 3 (id=47): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp', 0x5) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000400)='hybla', 0x5) shutdown(r1, 0x1) 11m31.842103367s ago: executing program 3 (id=51): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804) r1 = io_uring_setup(0x1cf8, &(0x7f0000000040)={0x0, 0xe83e, 0xc000, 0x2000008, 0x4c1}) pselect6(0x40, &(0x7f0000000380)={0x101, 0xfffffffffffffffc, 0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x400000000001}, &(0x7f0000000000)={0x800002100000001e, 0x0, 0x927b, 0x3, 0x0, 0x2000000000401, 0xfffffffffffffffe}, 0x0, 0x0, 0x0) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000040)=0x10001) 11m27.515388988s ago: executing program 3 (id=61): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000980)={[{@nojournal_checksum}, {@nombcache}, {@barrier}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@nodelalloc}, {@discard}, {@noauto_da_alloc}, {@bh}, {@init_itable}]}, 0xff, 0x563, &(0x7f0000001240)="$eJzs3c9rHFUcAPDvbDbpT20KpaAHCfZgpXbTJP6o4KEeRYsFvdclmYaSTbdkN6WJBduDvXiRIohYEP8A7x6L/4B/RUELRUrQg5fIbGbTTbObbJJtkrqfD8z2vZm3fe+7b97rm50pG0DfGsleChGvRMS3ScSxlmPFyA+OrJRbenJrMtuSWF7+7K8kknxfs3yS/3mkmSlG/PZ1xJnCmiqHs5fawuJMuVJJ5/Kdo/XZ66O1hcWzV2fL0+l0em18YuL8OxPj77/3bs9iffPSPz98+uCj89+cWvr+l0fH7yVxIY7mx1rj2IHbrZmRGMk/k8G48EzBsR5Utp+sxDm8181giwbycT4Y2RxwLAbyUQ/8/30VEctAn0rWjP+hvWsIsMua64DmtX2ProNfGI8/XLkAWh9/ceW7kTjYuDY6vJSsuTJKenS1m9Xx65/372Vb9O57CIBN3b4TEeeKxfXzX5LPf9t3rosyz9Zh/oPd8yBb/7zVbv1TWF3/RJv1z5E2Y3c7Nh//hUc9qKajbP33Qdv1b37TajiGB/LcS43sYHLlaiXN5raXI+J0DB7I8hvdzzm/9HC507HW9V+2ZfU314J5Ox4VD6x9z1S5Xt5Z1E89vhPxatv1b7La/0mb/s8+j0td1nEyvf9ap2Mr8Q9F5/ifr+WfI95o2//Japlk4/uTo43zYbR5Vqz3992Tv3eqf/P+f76y/j+8cfzDSev92trW6/jp4L9pp2N5/AN5tuvzfyj5vJEeyvfdLNfrc2MRQ8kn6/ePP31vM98sn8V/+tTG81+78/9QRHzRZfx3T9ztWHRH/Z902YANZPFPban/t554+PGXP24//qz/326kTud7upn/um3gTj47AAAAAAAA2G8KEXE0kkJpNV0olEorz3eciMOFSrVWP3Ol+no0jjWefyg073Qfa3keYix/HraZH38mPxERxyPiu4FDjXxpslqZ2uvgAQAAAAAAAAAAAAAAAAAAYJ840uH//2f+GNjr1gHPnZ/8hv616fjvxS89AfuSf/+hfxn/0L+Mf+hfxj/0L+Mf+pfxD/3L+If+ZfwDAAAAAAAAAAAAAAAAAAAAAAAAAABAT126eDHblpee3JrM8lM3FuZnqjfOTqW1mdLs/GRpsjp3vTRdrU5X0tJkdXazv69SrV4fG4/5m6P1tFYfrS0sXp6tzl+rX746W55OL6eDuxIVAAAAAAAAAAAAAAAAAAAAvFhqC4sz5UolnZOQ2FaiuD+aIdHjxF7PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw1H8BAAD//5/FL/M=") open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f00000005c0)={[{@block_validity}, {}, {@sysvgroups}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@orlov}, {@nogrpid}, {@noauto_da_alloc}, {@norecovery}]}, 0x3, 0x57b, &(0x7f0000000bc0)="$eJzs3c9rHFUcAPDvbJI2/aFNoRT1IIEerNRumsQfFYTWo2ixoPe6bKahZNMt2U1pYqHtwV68SBFELIh/gHePxX/Av6KghSIl6MFLZDazzTbJ5lc3TXQ+H5j2vZnZvHn75vv2Ozu7bACFNZz9U4p4NSK+SSKOdGzrj3zj8NJ+C09uVhcO3Kwmsbj42Z9JJPm69v5J/v+hvPJKRPz6VcSp0up2G3PzU5VaLZ3J6yPN6Wsjjbn501emK5PpZHp1bHz87DvjY++/927P+vrmxb+///TBR2e/PrHw3c+Pjt5L4nwczrd19uM53O6sDMdw/pwMxPkVO472oLG9JNntA2Bb+vI4H4hsDjgSfXnUA/9/tyJiESioRPxDQbXzgNa1fb7sbkbyYj3+cOkCaHX/+5feG4nB1rXRwYXkmSuj7Hp3qAftZ2388sf9e9kSG7wPcasH7QG03b4TEWf6+1fPf0k+/23fmdabx+tb2UbRXn9gNz3I8p+31sp/Sk/zn1gj/zm0Ruxux8bxX3rUg2a6yvK/D9bMf59OXUN9ee2lVs43kFy+UkvPRMTLEXEyBvZn9fXu55xdeLjYbVtn/pctWfvtXDA/jkf9+599zESlWXmePnd6fCfiteX8N4lV8/9gK9ddOf7Z83Fxk20cT++/3m3bxv3v1PsMePGniDfWHP/lO1rJ+vcnR1rnw0j7rFjtr7vHf+vW/tb633vZ+B9cv/9DSef92sbW2/hx8J+027btnv/7ks9b5X2xdP12o9JszoxG7Es+WV4f+fqx5ce26+39s/6fPLH+/LfW+X8gIr7YZP/vHrvbdde9MP4TWxr/rRcefvzlD93a39z4v90qnczXbGb+2+wBPs9zBwAAAAAAAHtNKSIOR1IqPy2XSuXy0uc7jsXBUq3eaJ66XJ+9OhGt78oOxUCpfaf7SMfnIUbzz8O262Mr6uMRcTQivu070KqXq/XaxG53HgAAAAAAAAAAAAAAAAAAAPaIQ12+/5/5vW+3jw7YcX7yG4prw/jvxS89AXuS138oLvEPxSX+objEPxSX+IfiEv9QXOIfikv8AwAAAAAAAAAAAAAAAAAAAAAAAAAAQE9dvHAhWxYXntysZvWJ63OzU/XrpyfSxlR5erZartZnrpUn6/XJWlqu1qc3+nu1ev3a6FjM3hhppo3mSGNu/tJ0ffZq89KV6cpkeikdeCG9AgAAAAAAAAAAAAAAAAAAgP+Wxtz8VKVWS2cUuhbOxZ44jG0Xko1G+Vx+Mmyrif7d76DCDhTaM0SSrDN9DO78DAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEf8GAAD//w+JMu0=") mount(0x0, 0x0, 0x0, 0x301400, 0x0) creat(&(0x7f00000007c0)='./bus\x00', 0x182) setxattr$security_ima(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000200), &(0x7f0000000240)=ANY=[], 0x700, 0x1) 11m26.389153639s ago: executing program 3 (id=66): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x0, 0x2}, 0x1be) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) 11m25.672474325s ago: executing program 3 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000001090480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31"], 0x0}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 11m25.259919349s ago: executing program 33 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000001090480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31"], 0x0}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 9m33.242824387s ago: executing program 6 (id=501): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x104000, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@broadcast, @local}, 0xc) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='pstore\x00', 0x0, 0x0) r1 = creat(0x0, 0x28) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x14, 0x0, 0x10, 0x70bd27, 0x25dfdbff}, 0x14}}, 0x4008000) 9m32.393700119s ago: executing program 6 (id=504): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x3, 0x6, 0x1d67c53c, 0xffffffff, 0x3}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfc0, &(0x7f00000006c0)=ANY=[], 0x0) 9m31.640810239s ago: executing program 6 (id=508): r0 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/tracing/events/sched/sched_switch/enable\x00', 0x1, 0x0) fchdir(r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) close_range(r2, 0xffffffffffffffff, 0x0) creat(&(0x7f00000002c0)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x102) 9m31.306618786s ago: executing program 6 (id=510): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x10000, &(0x7f00000000c0)={[{@nobh}, {@auto_da_alloc}, {@grpquota}]}, 0x3, 0x4cc, &(0x7f0000000c80)="$eJzs3M9vFGUfAPDvbHdpgZfXioiCKAU0Nia2UFA4eMHExIMmRjzIsWkrQRYwtAchREpiuJN4NDEejTdNvOrRePIPwIMHE0NCDBfA05jZnWm3291ttz8p+/kk232emWfmeZ6ZeWaffZ7OBtCzhrI/ScT/IuJORDxVjy5MMFR/e3j/+sSj+9cnYjZNz/yT1NI9yOK5YrudeWS4FFH6MmnaYd301WsXxqvVqSt5fHTm4mej01evvX7+4vi5qXNTl8ZOnTpx/NjJN8fe6L5SLfLL6vVg/xeXD+x79+zt9yfKxfKB/L2xHm2VuyvGUId1r3S3q8feroZwsvg43djQwrBsA/llXcna//Xq4bObXSBgw6Rpmva3Xz2bNru5aAmwZSWx2SUANkfxQZ99/y1eG9T1eCzcO13/ApTV+2H+qq8pRylPU2n6fruWhiLi49l/v8le0Wkc4s91KgAA0HN+OV30BJv7f6XY25Du//kcymBEPB0RuyPimYjYExHPRtTSPhcRzzdnkESkHfLf0xSfz//HfBahdHfVlewg6/+9lc9tLez/Fb2/GOzLY7siig7z1NH8mAxHpf+T89WpY232v22J/Bv7f9kry7/oC+bluFtuGqCbHJ8ZX1ltF7t3M2J/ubn+STk7ccU0ThIR+yJifxf7HWwIn3/tuwNzkUr+/nX9ben616QtpvS6no9rJf024tX6+Z+NBed/Psek8/zk6EBUp46OZlfB0ZZ5/Pb7rQ/a5b9k/X/6q3mTd07+fGa11Z6Tnf8dDdd/FPO38/UfTCKSufna6Yi0r7s8bv3RfoOVXv/bko9q4aJ9fT4+M3PlWMS25L3Fy8fmty3iRfqs/sNHWrf/3fk22ZF4ISKyi/jFiHgpIg7mZT8UEYcj4kiH+v/69sufrrz+6yur/2TL+9+C8z8/X7/MQLFxtqTvwqE7j9rcPJZ3/k/UQsP5ktb3v2TBLWK5JV3d0QMAAICtoRS1//0vjcyFS6WRkfoY0J7YUapenp45GBGXJuvPCAxGpVSMdNXHgytJMf452BAfa4ofz8eNv+rbXouPTFyuTm525aHH7ay1+WRR+8/83eU4L7AFrcE8GrBFLdX+997eoIIAG87nP/SuhvY/2ybJrP+UgSeTz3/oXa3a/434vuOzC+4ZsPWl2jL0NO0felc5PpwL1x57bvm0LfAk8vkPPanb5/q7C6T9rVcNRItfDBhYn2Jsb5HXpgSyntUa7rASEctLvH0lWRRdwPa/8FDqbof9sXhVX3TaKunidxyKQHZUlkx8bu+aX/zFb6Ks9WXzw3w7rTSci/JSZ2f1gQ2/FQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKyL/wIAAP//VkzSeQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000540), 0x1, 0x490, &(0x7f0000000580)="$eJzs3UFrXNUeAPD/nSR9aZu+pO+9RV/BWmwlLdqZpLFtcFEriK4Kat3HmExCyCQTMpO2CUVS/ACCiAquXLkR/ACC9COIUNC9iCiirS5cqCMzudPWOJMETHNx5veD03vOPTPzP6eTOXPPPZe5AXSt4xFxKSJ6IuJ0RAym+3NpivWNVH/c3Ts3puopiVrtyg9JJOm+5msl6fZg+rT+iHj5hYjXkr/GrayuzU+WSsXltFyoLiwVKqtrZ+YWJmeLs8XFsbHR8+MXxs+Nj+xaXy8+9807b374/MVPn7z21cR3p16vN2sgrXuwH7tpo+t9jf+Lpt6IWH4YwTLQk/anL+uGAACwI/Vj/P9ExGON4//B6GkczQEAAACdpPbMQPyaRNQAAACAjpVrXAOb5PLptQADkcvl8xvX8P4vDuRK5Ur1iZnyyuL0xrWyQ9GXm5krFUfSa4WHoi+pl0cb+fvls5vKYxFxOCLeHtzfKOenyqXprE9+AAAAQJc4uGn+//PgxvwfAAAA6DBDWTcAAAAAeOjM/wEAAKDzmf8DAABAR3vx8uV6qjXvfz19dXVlvnz1zHSxMp9fWJnKT5WXl/Kz5fJs4zf7FrZ7vVK5vPRULK5cL1SLlWqhsro2sVBeWaxONO7rPVF0n2gAAADYe4cfvfVlEhHrT+9vpLp9aZ25OnS2XNYNADLTk3UDgMz0Zt0AIDPm+ECyTX1/u4rPdr8tAADAwzH8f+v/0K2s/0P3sv4P3cv6P3Qvc3zA+j8AAHS+gUZKcvl0LXAgcrl8PuJQ47YAfcnMXKk4EhH/jogvBvv+VS+PZt1oAAAAAAAAAAAAAAAAAAAAAAAAAPiHqdWSqAEAAAAdLSL3bZLe/2t48OTA5vMD+5JfBhvbiLj2/pV3r09Wq8uj9f0/3ttffS/dfzaLMxgAAADAZs15enMeDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC76e6dG1PNtJdxv382IoZaxe+N/sa2P/oi4sBPSfQ+8LwkInp2If76zYg40ip+Um9WDKWt2Bw/FxH7M45/cBfiQze7VR9/LrX6/OXieGPb+vPXm6a/q/34l7s3/vW0Gf8O7TDG0dsfF9rGvxlxtLf1+NOMn7SJf2KH8V99ZW2tXV3tg4jhlt8/yZ9iFaoLS4XK6tqZuYXJ2eJscXFsbPT8+IXxc+MjhZm5UjH9t2WMtx755Pet+n+gTfyhbfp/cof9/+329Tv/3SL+qROt3/8jW8Sv/008nn4P1OuHm/n1jfyDjn30+bGt+j/dpv/bvf+ndtj/0y+98fUOHwoA7IHK6tr8ZKlUXJaRkZG5l8l6ZAIAAHbb/YP+rFsCAAAAAAAAAAAAAAAAAAAA3Wsvfk4s6z4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOzEHwEAAP//0wfUAw==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) mknod$loop(&(0x7f0000001280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r0, &(0x7f00000091c0)=""/16384, 0x4000) madvise(0xffffffffffffffff, 0x0, 0x14) 9m30.292392395s ago: executing program 6 (id=519): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) syz_usb_connect$cdc_ecm(0x6, 0x4d, &(0x7f00000013c0)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x2, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x6, 0x3, 0x2, 0x6, 0x0, 0x5d, {{0x5}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x1691, 0x80, 0x334, 0x6}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x2, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x8, 0x5, 0x2}}}}}]}}]}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r3, @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 9m29.852163895s ago: executing program 6 (id=522): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="000086dd0203051209000a004000683739ed28282fff"], 0xfdef) 9m29.245832899s ago: executing program 34 (id=522): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="000086dd0203051209000a004000683739ed28282fff"], 0xfdef) 7m36.532077787s ago: executing program 0 (id=1058): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) socket$inet6_sctp(0xa, 0x1, 0x84) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x8010) openat(0xffffffffffffff9c, 0x0, 0x42, 0x18) timer_getoverrun(r1) ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, 0x0) 7m35.343831374s ago: executing program 0 (id=1065): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req={0x82, 0x57b3, 0x3, 0x9}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x132) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, r2, {0x7, 0x2b, 0x0, 0x40080000, 0x0, 0x100, 0x7, 0xa18, 0x0, 0x0, 0x4}}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000001580)='./file0/file0\x00', 0x1) syz_fuse_handle_req(r1, &(0x7f0000004200)="0aca6c6a1bafd2989666a6014bd5e9e63945bda64c1239d970f0d349110c18fe029ac3e29dc9ff9ead2ed3cef0fe77ef8348a82d3da186ce2140d53dfeb34dc1e128dca5a5225db8052bd348c2d1a3de224233032fff8b85c85885c90e9d0c205001db3dfc55d17a7dab1761c1733c465113c056d3bcbaf6a52dbda820a1db5e7d777f6c716e5f60b04cc1c6a362d891cb08fa109c5a00e427f8636059d934f255021cf13d2bc9cff93f049018b8e48f6480d324f08eb83655d3eb5a379ec18c861f596db17bcc23ada65f26a02c4c0c9e3167cc582e93661cdd0dc7581ac1958d9cd08104af251d87d8b5d82150b8cc4ca6d23475f259a8b7d69839cf728a6c478eec56135bdfc6428a318cf2b838d16984d0498d33ac41fe67361bdf5752db6a5ae32979463b60ad6b99527affdcb2b4a0f23b2f140c981b00c99cd25d563ff6c3308b048371eb2e599880a2b67ef9a2282947dbb23a3f1944193a801187f206587a52ee7a33032a842b31fcc0db079c554c97a09e3812aea45702099ab648888d08ae48a187a5acee7b9a2edbc320c64514554e540286053dd2acb9f9ec83435f43193b45b324c8406cdf976bc7607cf9385e99bf5f5205110d0c27abcac49e7ec7deef560f953d2c64bfd014ddcb1b2cbccbe401a312436799235807f4fdf52a9f894656fcbe1e971163e8d743450c49875379522df77d5e8910df837701d135f4589d4d15355e1638eff568a18a0d6217a11acf8fdf0fed0216635215d248aff37d85b62edbc989bc6d4757e6347ec971ae2b1e0d194e6c11dd8f7c108219569e157eceb7c14a288aad98a24de9a81f9ba1dd5271c17adfdf41f3393789c30f9345f6ad4ad1a6bf46640f69f7c038c4fec6652853a3f4fece3c3d15bfdea15f37e961a03de54181724801808a3a9030ba4650ce6fa9e6822c794d7b9da548a2eab977ab0c08b2d985957d5cd70ec677637219c6ca7c7c4d0a7a7ca38c1862583735b46b3addfd1c72cf7f63f11bd85ed59b9ba94db5c2fbd48461ab735b439a992e3a4462545e042e3c863199c006ef3a3be4473b24b782f86a3c1dca9848283bc47f4322273681efa1c8c413dc81a459e4e755846a094971708eb7f428aa67d0c81ce7f33d856e13a342b05eb403af7b4cab191c4ab9d650158808ec74d04f4b765e513b94f10345322e48485d29eb8b1408d7776f98e3625a20220e94789476affdbd19b44bac6bd2fa2b0ba10e93582178a3ef4938dcda25bc6245621b1ced780ca089010e8e51493c1ac7747e949b67fe6e3858e60a1e45a657c080fdc0bcbfcac2ba9d027f02ce30cc7440ce71eac66bb2eb264dcb1306a6054fde6640ca51ec4ccaf500a87f073b58ab286daeefd8d3ec7ee882551f7b6a36ab79a8e10d1d3c234ffaa33e95026025cc39a057efe7823dcb689131b1e83572b4dd1f49097580976c046424618fd6047d46928087d483df952738448d164c9288b15a4982493bf7ebc1976d0942846c8310556732b4cabff937a51e926caa37ae54dea339c2a2a8d73be2ca3a39edcb4ef8bd58a3c4c98c48b9f37a1424b6a54919921d4429611d0dd585d1d357c3c1ad1cf68f36907f8d9c28a14ec2cf2510fe54510111ddd7a67fb8d2f449227da397c32b8dca19971ab9d76e1f6ce0c54c9de1cb1daa1936b62f838170b8b6e7f34168a099619a113c83347ce2c0f6086855385062b6e074b68391e59430236f9ec687a265072f7a40efbef3cfe5bc1cfb364d87a597507811d2bf6af59e20fcf4703caa63285decabcc367ccfb8e27efecb14db8b1167938f457d4117c62f440d807b5482bb223b4b14e9526f9ede33631cdf9fcab53b3fbebc9344ab130d793dad610f2fe41ef388acaebd6cf26aedf7c7c6aaee956cf92c14583bd45b189d43f7b44419df1e0adecc8fbedb357656b7649721f81c2207ebb37e3ae21bdce8c982cbbdec012c7fe587161ff741610fb8ea5883c758527873ca2197b5f1058083c40203cc4dbdf7f4f1388f2309d22a6a1767137703296ad3aeabdbb3529a290da9c6cc5631b2f1ad25c766e3cbd8d9f588bafd17495f572bf1cfe1e8b5bb22130963cca8832f846300bb6dc0baec85b500e1a48fdd14cf0442fe4d441821d7e46fb5e2220c96bfb16ab8ca883a4477bc756dfc6622f320a648cfb57f9de9aef33f9986c6517d1a7eb59348541d6d3494ebe7bc1ed4a86f06411491d176da36de8c8a8d8ea28928bda63fe863277e4325b756421d4d2042428250ed526e538fb930671e9ad517aac494a58aecbc908b512016fe4d8f60b576e230b3206a0c7bd4fef717a8cda0029d13ecc3c8f8686f717adc1440353c236aa71f842839c5ce92c83fbfb57b221271aa6f4029219c3c2ed7a3a53d8ff065ce30d403c95cf69e7963d5bfb63bccb5b28ca125f0d7094072273ce3108093d0ff83ab98393b8e9a87117f4933a8c8ecf353931da3b8dacb20685a65dd865bd6031cd2b0b7e237901c782c6e6ea8742e89dbb01eb925dd6e74c53bd28d3c424cee35eb29823f2138b92516075e00342fa4dbc5b27675a651032c8ffb3da6c5349d0f9b2779778d0cfa1c8d4cc34d4fe95fc435e4768e93d56d2c142f25df1b9afa7d103486842372b36261b96b7b3acc0e78ff20a535ed515ace0cf3300168a7ef42d6bd511c019d0ccd7599ba70cbabc95f34a052fe9d6f97b49dc1cde40d5ebf305797d7d572a61cd38a0cf85f28c5d018648b769327bd9559722d5422754f26c9e5439b42bedf34e31bbc845b99ce315eeeb0383fb3ae021084cedcd843b86831c78441ccc0d2c23de528e53cff785816a3a3d99b4a4684df9546a285203bb615eb480fa8385e90226b27b39a7d50c83babf5ba890da1a8848ba372971347dc34b76370544feb183b9292043f2ef072b69bcff45b1917c073222d50bd585f2173bdae673198b95b67f8387f6d2b2934597c5ce165fd420ddcc01d29d71d532b5d127afc98657845230e363cbb9ecc05b247996ecbfce0e8215ec7dc5e9be115de2e7ebe8fe3e191f455d244ad1ce75c828a2adbbe509589f389936e62dfd1ecdef105162d357cfb22412b64570dcb04fe18bbbe5518985d7316a75a19a16a482105b7fac923e1eefd780d036ccc39e3cc53d2002ccd10004be1694be4110fb062110e1a44ba88acfa282d9c7cdae0cb55f48f7caa3c324d9f52265d21606a20779accdc9f69dd0fc49e4bc2c49891e526561569abe5673533c8a9b6a3004c809d3f7452b02787047d4442df3f4cc5d47e5aa73b7994c113541ea312970f2e741d4fd50a83f5a0293fbd56d619aa4bb3b491606642fcb922b5ccd6bedb442e450609343e18f61abb3a4b2fc69e06a72edc7bcba0da06da3e80f59b737f088d01f0dbcad89003b505fe29bdc8118e3fbcdb90a4f464e0e70d20f093790ae1b9f6f8a904a268cb4bb116404de1bd4c3f9522c36893a902a3a90f52670b7ff2074815329f3fe2c8ccfabe2d812394e6b0e34741abece71b7db0fbf0a80e6c13bc7bba89a4ee01cad9dd76e49cd91690db6fe402640db8b3523c49bcf611a9da991123edcb64ef505906d8ab4b8586e631828402105f045cff3681f2f36e3713be5bcb6af157278b194a51f04d04507231aa6f4d77b4065f2a97894c201b23f7b5f79b029c74fc4c57fff87c03e01210674417c1297155ca7a7fbe855fdcf65561619ffca0099fa08ddc8ddd7f713b2b0c6af0fcc4bd4cba9e9f47debdc6d9e6e2dce63fec20efc51e15d013fadba2707a449dbfd025f1a7c329282c797b2071afb37a89f8d58c1e3b4f06586f00a433161373548b699fabd92771346a25ff10789ca89cbf00f92248c6b8468f22aa4cf7ba90aea16a3cc2b1ee598609dfbe75fb8e11c5003ad0c9ac7205cd35552a53703f06e465633f9653cd670952feb9e77db960ea18914235af757e75204d1f74de9829dfac217d87aecc1c80066426f12e52883bfcd982e54bfdae8ef55f3b70f78bae9e6a1e24388c642cba3b3215602294bb7d68bb6f8e0b24c0b6e99df504c30beb2a7f47b02f9af6511eda25407c30dfdee39ec8db32d93e1e09472474883a87b7b4664bef06d5c0a43793237187acaaa9654f74e5d3bf1ce389befc139fba61378e7b66b4b0d87334732592ebd0e4989373ca541b92d003e67e0292256c256344dbf03ad24540f11cdc174b45d3781c1da793a460ba671373a0fa082ba63f5418733c9907d360c9bc54ba0e2b374de7965a87316df1c7af17164e1b6dfe32d71fb5ba641bb8d6cd6299473f37e44a69e90a87cd2f8a486a0db4eb104bf87d9f7cc87dc294e6debec7e5819f3f26bdf4cac91f8ee94a826df99da39a4bd6d476943428e3f5009546ee569d6273f7ecb115538c6ce8fe150249c89452c2f0cf0796208a216fc2cb55e1b6c892778f15e7f8b78e6e97093572a29ca3600c72feb4e1ef42a225da695b3111777f3833e306f2a90b8ed6095127b0f13be495a3321bf8201955d40f6b486904a4e1f4c9965563d30277b30cb0d1ef375338a25314fc5abce41f1e95118e89455af9e786cdc460e4e48fda5f21cece9b4e5276523d6919e165df5efe59aff13067d3ef0e82259305942b5f25e831dcb72f5c7fa67ceba7678078d8311aefdc91916f8c1db2ac61188b46825707dd26d29aec734df8bebd7474277908b2ba9e77daea20c395253b3cc876e5dcac960556072bec36e14da26c335b509a38dbf3037d620f4765e63b946ef8ada1729b1323acc8b5e436f3967ab7cc033ccb7d0c9cc74d3a3faa2ff2afb1cd571e3749cb0203e70756273fc6a4d80cf646d551f3a801ca513ac587f0ddc8c58870d817ea2671b2ef30be91a45dc730c6636e7de2ec235044b837ed9861dc89e4df342cff52a29ae6b8d5817fe31bb3a74d0202efca5d94b4d232f3dff885bf52f8d43097d069ce81220e8578c630d496b01fc60562bfbfda22fce6ce68564ab31d1a3d38af2d7b73a970b9b30f6c48dc38991da402491b2d643e0f5e71bb9c0aa834006ddf24b7dbb180f68751535d8cc34823ba3d1ddfbfeb6a15655118d4e1e11b255b998006906017ad9978d6cf4a45a669eabf653363391e77a82a9da14d184a50f1421eeb61411e859cf6f98ab0846ed5345b63e3ad004d1ffd1e48e6574ba7d832f7ad1345b8df27f7707245b335ddff2e4ca1430ec44af208e633c25678b3cfee96424ca026b159bb18c1bdc51db6c66e8788e5aadce1d3e531c9b02edc65b846763ee64113c0cd0d23824c4baf3516e2c8e5192afb9fcd390e51b3bcdcc0a49f932a6907b38713e2229aaa9abc5305420f50a2016429012e835407dee7d8d0b8404655620c3df407e7be2a5a1e668341dd91224509ffd48db6861f558d098954f83aeb6e426099cc4291da311c37bd46c8d80c3ea975e0db6ce12dbdae9116bf08909431fd5483f7cb3076d33a900d56c26d6f151386abb32ea335f5337683201a1ce5d9df25c5df29a375d2680827e182b1aa0813ee7f9d273d7ce1b86194a8cf48d630a5be0b947245c1ee0a0645500ce2ced6dade1b63c0e7572260cce25636778d79ef11ed5e3c42835c8e53a6d26cf85293050cedee2a116e5f38b9cae91a503ec9e0cf784d9cfdccedf95971540ec37926eb43b27cbff1d96b83f80018e6afec70523b6672111a47f9922db34da15d7ca3cc3a77f1abe7221b72d43d2cb4c23fd2bff6cd5ef6b31b6a4c65babcdc918b0d99fad656e471a20a8f4b66d6e37877da1a8b7fb7a8692d6d578ff953b18deebea1353f915102e4d2064dcf8eb0965a2f4c2eeda70b4177dedd7597797ec76bb72ee422ec4d16e494ed77c9bd843ee01885cc3aba1f77806e8f501b856935494918ef83379ac5ae1e06697606053a8c5c880975d1f085c93f2adb1bd2c6ae07c29bbb245cac4726a20a2f61ded013722eee8878933a90319cc8cab7a2bc69dbc79767ba18fcdd8f9ba7de44e9f0575994b28aa9e3e7b4c1f2ce0eee264dfefe3e1600cd969683551894d28b690122093105133b22ee04a50f4883274cb929beb1bb45444ca5d470c0ac611c4990eefea25526f590b269ad40d23842c5b5996c1cb393dbff28a7e2f7cf04ac30fbc2d29ece6708fad830bc523fa52d2ebbfda27379e8c48d085b260a2dfc2e8d7e1a94a245b518612bfc9ca0260c8fdede5298bf584e5d71fc131f5eb6ad2dd7bfd42a77f523eb0aaa787003fb71b9a64fa783e918595af0413fcc0d7818a514c055a48ba9b1bbc6c974f7cb55c3af3edf117835d169e5e2b31e4278d0419b23625ae004171eb2ef8c231a61331886234b402886b4993ca6376f8664134cead1bea142bbed5d46e3bb71b0f8a4cec0c79a9b5f6c823128d02063967a5363b6bd6e242fa3fd21953fdb57725f1eda22984bcff8e40f2076fc0a462706dc2bd95dc447a2aec2a8a4808f2930ff1353348942e28204af42141fa120c8e5fa9c225d16f3624deb2ce178fdf594db504159bbf475e8bee281e3c8ebb29b404b3fbd13dea76df5aee05ad6a85054b838e149d0ebfabe61dcbda6c3494e170e75633843a01e2458b526ac5424177d6bc4706a09694be1c372cc79cf7c4d82ff4e62489d1fc7819d749710035a6fac239d716b57a1af1346c1e8420dc8ae46fd18245160d43a40c564bf11f0232bfd1fed67ba1aebce120ee93a0a000570b808d9fcd60b622c59ad53ef535c1db7de15b52ed2540708eb5baa7195e1a86990b6611ad5c50127f7e876f8031856e9a2c0566f357d6c75e6ca5f217d428602fa7c8f7fb9f3abbefee76d88b3b08c3be2f0d093ce96c6a00f3a157dc0a05e1fc5d8de583c25e09c77348f5825fcd4631396f3e8c26f5c1432784eb8c377fb520d28aedcaa5addfda6eed11da4d2cc91c2e3c3728c763c9d58283af32d00aa1910011a552adabee99d1387d14e582cf68fea46b729eddd0d3ad8eb9125d5fb060f4d6f70a166cc3ce9b02a7bc65200399fc2a47b90039ac23afb853925195e8079da20cbffea72365158fbd94a6e0a654f6c09a8032fb26df99913c2300e03428ab3cd1b3f7aee15460732d445b4797673b47a93a325b2e5157106ade0959be9c4562d5a4292a9ac94940c66375e559f34e57a1158b5d77a5dc9515bdab63799627301f19398d84c7afde812100a65a1642e9515a30434d344b380a92eeb2013a0f63cba648c37095bfd985c607b120f1769a79f1fd7c03f09f966b72945606ade67f9aaa631948bb82f9ae3f89ecf6db12c02d174f62ad6e1b60f4819ae19f4979e0f9dcf51bedf4b1bd1de73bc2adb1923544ede6dbd40ed4c559cf1f079f5dc8986691540e13f5a2505cc0923ca8fe2608ec92b95dbb5facc320e43b2049b79eb02618f6fab08b7e9dbe00fcd69b338b1bb6a9beae531972e16a19d94bd2273c4d042eca34dd7c5aebfbf16552681ad4e243824a9c5d0d8b8d3aba4c102fb76c216c230c2ec34838a0817b03a04480c61c899b2e442bcf2567d4e73000d9c9d4d0acb712df0183fc288634cfde234b94fdbbc0b7e66ea5b6437f312167b1ea93e2a6b2105308d8198a2d4054ba2ff2855250e0e6c952364056e2d3d09e5a2c578837d6521ffb82780f169d07f2f032b34d62f2712a77a56175017257ea1caea41acbbc520b429bd4e3ec3f9a6eafce46731dd3396f1ce1a6198927fd2dbefb3f77c9173be0934747ca47b98c6548c8cd07249d9715414b8a8ddc8430575d8b8903d3923089282a3ccead6e11044c67f3d5d8ed8cc0c0331f2dc09e1bae77ab55307e6445ad382451eff64faca8a4c0cba7cfa2fc9b087afb040e594115c35ce1dbec69ef1e5af8003339afda5faa1be1a3da7c5cb84273009c32d300fba7d222d2dc783241a9414ee30c8bd7e655c09a7f50dfb249ae9b15284b971503f6ce8866a1b36f993acf28d387da88c8defd323d1cd91d4eb46ff87458269a134675556b067a1b71829b7706ba58c93a919884089dc333c9b5d8279dbcc20071991762d2569c8ff5f21783e2961228b2006f8805750c0f9f4f9dc3df86dae1ab98af22122966a6ba04ccbb2bdf90e91e1f2595b979b6934fe132eda34cec0f83132f3867a197a6dfd0d43528bd56613732704bb62b12f4ede7439b2150384fa04db658fda2ddf97ab571f02d150c50c95009d0aa2e553019ac1cf9bbaf15474bf66d69224913b11080badb47d4a085fa13e965de6e95b7aa6e07bb212774d0240738cc07ccc1670d33c100cead3fb99c3f32fdd97c9b16956b1c22a90cd5c7aa0d920dae9e2b149fb5f9870129a0e97d1edba0dbf8fc4fcca6c65c639dd3eaa8803b1e9e601907e086ed1079ff6bc6de941c91df0634ce3730b8035bfdfa699304666920bfb092354da1f0bdd28c9023bd2e152e931e82eeabb86b0323c789daac94422eb7855f18775917e12feb85019e2e017303002ff8e04513ae0fb03f334a76addd8fcbd69ed25931f44044eeffb5d66cab5a22b21e85324946ab15408dd5d68b17727d2e4779bc378750eaa6ef6e943966c0dc4d066c6b8b8945023a0fc49f81a9c15a35d350e3d741652b8a8014b3649dcfd028f25c0b38b7cc14f7e375acfd3960af2eefc49ac6589f38791c9c0b0ea4e55992274052eed15cb8de213794636c4db2385eb9bcfc28f8a97e7c7ac949cd519ab62d1ab10d855a7ac6acda00b78d35d80a9ab4b7099603782384c461dee90abcc14a539779435cf0677eb0b6ff7e47488667788f9b0fd7d5e0cf53aee5ca0071fa30c062da3c44e79096e24594c6e202b7cdbdc49be2ddac8058c7ded15f07d4c413886fdd7017b9fedb86e39917fd1e81b294675bde06c8fac0dbce7f4b90b3859c66f9f6fec640c6781728a8b347da28b4360924ef68c3c740ed5ddbf013720c6de54d9bce5232864f9e80a652cd778641c327876b2a3e1049355a58fb5054aa17064e97142d64be9daf5d1b162566a009c69133f60e3d4c2a53c153185c659d16236fcc1690eed8c6c2e4f8b172eec457a9407003ddad723e3b183e81b17ddbe46ba368ab3e3ff574d9e3fb82e102ab46d7f608e235d064ea963fdf1622ed7278a27fd8210ad39c3acd9069abba71ca051b64561683068ca6a1be906c196ddde1839b3897d5af8fee51614d73e51511b03a5763f3ed3e64bf7293118dc321cf5e940a2829c6b8550083d66d31680fb55af098d9ccebde9882f818c29f4cbb55c26a97c359d8606bff3744ff3efc22e8d34e67b7c97b567483963c574bd1dac8c46c911c48b6e29e73e52f8c9385729a73b70d2ebba9e744247d9003a962fd607686e6c5972b59616acfe327d8b736f38c703832d7690c6474641bf87538e785353c1fd7df1b5ecb1200eed8c5857abd16c26ae72d0147de475b0c4bc98dbff530b334c9c50607bd46ddbcb1ffebf7513cc842e4cdd6c8c00a284e81cb531a04f75210add4f73db3da9783694fc541cd470368c8776973f02835dc355ef54ca90a580a45a2df6137c43b151ade1e51bc879e7fb43141541bfab79b3eaf0eab323c7147ecce6eb3eb3eb02a204755cdcc7405ad903b91fa4d297262cf77fe395a18e269ec36bd534d4939e78719d7c312ce5205979b2fb92fbf9e1d1effb0f663b9361893fcb11bfd66c92af3394e899876990883e9f5374b5642c68e8468498612e3848d367598c2cb0806b7f0c7f4b004dde2b4cc50161a4d293f2ec89c4cd35a767736f9282f848b9d1cdf405f61abcb3e50ff4092d2afb86fdceeec4791d892546e29495f97876cd8015f193113f1b8584a9ff3f32650e29126b81254961e677b6f67023295567f574364b7320313db988616ac123368179beaabb5a56257f0b6df8f6956324ac31d3e8db83dc994425ad80e235051af62ec79a6dc4bfa36283af72af26136c8f5eeb32e1fa1b9e21a228a2a12aed39e717e8f404334d8367ef3edceab1f3e250ab9dc1e89f9b84e658d38806f4d4a09ff07ca539077a5a496699a9d7d4aafa78120eb90f404c2a6ae00aa1c813b25cb6ff9dab8b66b1dd83c80c1225aa24a47df3cbff7f6842d9486bbcd4179150e1bcad3caa604ac1db71aac913c9d3cbc154182187e2aeb852011b22e40b25f9cb31ab7f458a11b1836085c4a99a633215684e7fc70646ee2158faf8329c320a3bc050cdbbac216a18a88af2dd1bb4d648110c5c90f7f5948128eafbe36c01ea709ca8b5fb8ad9eb7384feb7055220aed45690664b0312052792a5b9dfc90a1248995cf68f80b7822fa577724ad143b1d987d2fae7992d3ad270e6b1fc4f1bb3130f134607e8129a6b1442ac05f114062be3604d7cf1595022f49e7cc55282f0f666ad6ff3b03d692c2a66fc2eb5fd0751e4514229861e2343d43162dcbdec156aa5f2c5f9aafaf470f17e5ed688b3516647b9a1a220e843791ddda20fcc444ef63ba31fc27e62fee4676f097f3fecc625755b26ad48dc7ceec1920443c6c466c7bb36e91082f115f4e563a562af1ce5cf37c45bb2da72ab39ecf00e0349eed7e87994b6670e8bde4f4f9142cb99f6bf36eb41bb4dc72b6c6a6686b63fa21c167b1ba5ff481abcc2ca29905d6b75eff932296d75a90080f3a727690eab0e804aa95b545f55107d308f4cd9884d75c28388151a72e82291f79eb52921718903a8bf029a3e7c0ce28f204926dc221f78711a08834a917a0843d8249ca317c7154b88a5a10a09d7477fcf2d6296725bb6a69c2739964a768cd6ae51d7e7de63bb17fe7fabebb0ee46c285c683a41203d059a5c89024a7f3c59915121921000075ed397d30ada6d56e6caa685cb98cc0bf279fa2d96408611ae7e43c3bf70f73148c6615f20060b5c337c6555a3bdb1870bededac9eff951cf1c7fd4f0046d7661789bcfd56fe6198b502e01f90333ad6e9354db449435d0506526bb0c65595dead87be428eb1b988906de152f9a7f126ede6b933c2de1f7d20ec3e64c7468906fba2bdea8b300bab203542dec13a90e4195b3f7da1b669bfe9e8989440b24807ffd44d9e3d61e098caaa029a7063d25604cbacc5f2b3671a163b80a440948230ae90dc3bd7fd46b667cc7d6dba2f53775e9a2180ced0e1cdc6e1275e741607d6dfe40f91ec81602f9bc7c26c322b82114949fd17a9284dd2918326b7880f42db6e468b80f980db98e31ad57be1f131407a0d099cbad9eff25916048e4210c0eb0b68d4d11cc1545cb46114b3969ad0d7a6570b7571c877ed8060cf8b736f8c82ddb64d19fc29af3453f0efe33c68c21c7c8c054707790cf5c056d0ba408d077fb65cef8fb071398ce35cc95c48ba546230f4dd60ad633f81478c87019736044783599a17d4dafd30cc6f4278cae2384763ff2ef395b8e7265ebf0453cef5c98e62a0e48ad422af17a4eee1acc10a51a3fb6e98594309e4976f71027dfe7a9593cdb6860cba745f2346c8d4868b07f381d3c137b396780545e0ea331e586b176821e45f67761fd8b4c6cbbecfd34b72201f6145a6b06eaa8fa9872a54734acbccad497390ff69f676c496258479aa06d9fd1ecec02a01216fd66554afbd5e728608f4572a4d485e57ff5bfc3df", 0x2000, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x90, 0x0, 0x2, {0x1, 0x80003, 0x0, 0x0, 0xffffffff, 0x0, {0x4, 0x0, 0x8, 0x1, 0xe, 0xde, 0x1, 0x0, 0x0, 0x8000, 0x5, r3}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 7m34.990682372s ago: executing program 0 (id=1067): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)={0x20, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) 7m30.629846675s ago: executing program 0 (id=1096): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000280), &(0x7f0000000000)='./file0\x00', 0x804818, &(0x7f0000000980)=ANY=[@ANYRES64=r0, @ANYRES32=r0, @ANYBLOB="0c2ec34edb42fe4f2c1b832d9141290140e677e53cc188dc41581142590d4e0713f4ae95293dd9ce1c8836b03632dab46a43356a89c37f32b221bf1e737101a03cdb083ffc8585af679581ab62438f23ef4adeb4629413", @ANYRESHEX, @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYBLOB="91156f62712814b49a095a3b11802840d5afbf5494fe15a50de44c5080456ecf73e895d0e95d2b9738f5c2f9141a2fe0243540cf7faf3a065ee17c6403c7b9d550cea8f851f24b4b107003687cc27c2908639ee4bf5469ee594225359e162d37a29f9327604c178af4866c3b851cb7d9fab7ea0f080e015d093b7ef91ff01fb2367f7fcef2fb197d5af62a8c1f1e8171dce3393d96c5666b1082d0a453426b16a9d539b68863346f2abb04cf448db1a4713281b7ff0da0b72f32c349be1a627c64a6", @ANYRES8=r0, @ANYBLOB="b209eb6ac758b26226e3afb394a796baf3c6ce63c6342fceeedece41257e82ae0c182b8db1d9bcee3c8cc711a99a1b9fe2152fc846cdf5b62cf323b61a14c81100aa81ab73f3ed2ef2c4ffd4000435582841d1ec94cab677ebe3c11acdffc890d218a41f668954cb9f57fa7f418649"], 0x2, 0x56a, &(0x7f0000002c80)="$eJzs3V1v08gawPHHpT1EOVLP0eEIoarAUM6RilSCk0BQxJXXmaSGxI5sB7VXqKIpqkhhRVlp2xu2N+yutPsh2Mv9EPuN0H4EVh47bWnzsmxft/r/onYce+J5nFrzdNp4LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQCy3ZttFS5qe31lSw7m1MGjtPc1efWiF3PmsGNGuiJV8SS4n19JV1/67t/lq8m1OZtNns5JLipxs//Pqvx9dmZzov35EwF/kl7+4p82t7ZcrvV73zXEFcg5dvzx8W0P7XhR4LaehlRcFqlqp2PcW65Gqe00dLUexbik31E4chGrevaOK1WpZ6cJy0PEbNaep+ysf3i3ZdkU9LrS1E0aBf+9xIXIXvWbT8xumTrI5qfMwORGfeLGKtdNSam291y2PO4CkUvHPVCqNq1SyS6VisVQqVh5UHzy07clDK+wD5FCN4ztp8fd0jL03cDQTWf6XpnjiS0eWRA18uFKTUAJpDdme6ef//9/TI9vdn//7Wf7a3uYZMfn/RvrsxrD8PySW03tsypZsy0tZkZ70pCtvzjyi0300RIsvnkQSiCctccwala1RUpWKVMSWZ7Io9ankh1gXT5qiJZJliSQWbc4oV0LR4kgsgYSiZF5cuSNKilKVqpRFiZaCLEsgHfGlITVxzF7WZN2872VR1uHokrNGyW6l4tDDyPfPu66URhwt+R9Hd5zdN3Akn/r5HwAAAAAAXFiW+ev7lPm6bp7Xvaa2zzosAAAAAABwjMx//meTwnw667pYjP8BAAAAALhoLHONnSUiebmZLq2JZS6X4o8AAAAAAABcEOb//zeSwsyBclOs3elSGP8DAAAAAHBB/DB2jv2ofdn67XcJwylrp730P2vDzM3rbFxKX3fp4B7j+ow1ne3EFJW0mJx09ayVSyvtToL5MSvWxsVh7QXg7Lb13ZcEcGVSfpJbaZ1bq2m5mm35V9pKvu41dcENmo+K4jjTE7Feir95tf6tmMP/0W9NWzlZ73ULz1/3Vk0sO8ledjayCRQPzaM4Ipa3Zr4Fc83FwCOeMhdiZO3mLVlb73Xt9tLlbM/OxkS6MPF5i++mR7T5XubSWnPZjLf5/pa0zVzSZrEw7OizKIpHPPL3cjutc3v+dloMiKI0LorS/igGvxdHj6I8LoryEaMAgLOyNiYLWXIg7w7LOyN7uQPZPen2Rmf3L//1wvTo82md+RnTsU7ODOjR7XE9un3E7PbroXsgDcuxSbs/H8iqH5IXfBjabtQsWclbeOntxtdydXNr++76xsqL7ovuq1KpXLHv2/aDkkyZw8gKcg8AYID999ixBub/UXfh+fQpyd33s1H1zsFRdZbx/rP7kYKCPJfX0pNVWTBXG5hPHAz8vSO/72MIC2NGrXmTJtM7vCyMGNX9w1zl0N9vaWTdz2Mon8aPAgCAUzM3Jg+Pzv/p2H1hzLg7L2tP++0tjBkd5/fdrQ0AAJwMHX608vH3Vhh67WfFarXoxItahYH7RIVeraGV58c6dBcdv6FVOwziwA2aycJTr6YjFXXa7SCMVT0IVTuIvCUzfaDKbv0e6Zbjx54btZvaibRyAz923FjVvMhV7c5XTS9a1KF5cdTWrlf3XCf2Al9FQSd0dUGpSOt9Fb2a9mOv7iWLvmqHXssJc+pp0Oy0tKrpyA29dhykO+y35fn1IGyZ3RbO+s0GAOCc2NzafrnS63XfnODCwIZzp36oAAAgMyZLAwAAAAAAAAAAAAAAAAAAAACAc+A0rv9j4YIv9KeCPi/xsHAMC2O7jncn3jkBOFF/BAAA//9mb05r") r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89101) mount_setattr(r5, &(0x7f0000001d80)='.\x00', 0x9800, &(0x7f0000001dc0)={0xe, 0x1, 0x80000}, 0x20) 7m29.897068241s ago: executing program 0 (id=1102): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) 7m28.844956752s ago: executing program 0 (id=1108): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', &(0x7f0000000080)='system.posix_acl_default\x00', 0x0, 0x0, 0x3) 7m27.77048855s ago: executing program 35 (id=1108): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', &(0x7f0000000080)='system.posix_acl_default\x00', 0x0, 0x0, 0x3) 7m24.316826865s ago: executing program 4 (id=1120): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x90, 0x24, 0x4ee4e6a52ff56541, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x60, 0x2, {{}, [@TCA_NETEM_LOSS={0x30, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14}, @NETEM_LOSS_GI={0x18}]}, @TCA_NETEM_RATE={0x14, 0xd}]}}}]}, 0x90}}, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) 7m23.235059493s ago: executing program 4 (id=1121): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x6, 0x0, 0x7fff0000}]}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14507e, 0x0) r3 = eventfd2(0x0, 0x0) r4 = dup2(r3, r2) r5 = eventfd(0x8) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r5}) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00000000c0)={0x0, r4}) close_range(r0, 0xffffffffffffffff, 0x0) 7m22.907995489s ago: executing program 4 (id=1123): syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_usb_connect(0x2, 0x3f, 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x3, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x207, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x5, 0x40000183}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x6da0, 0x7721, 0x16, 0x0, 0x0) 7m19.724610961s ago: executing program 4 (id=1130): bpf$MAP_CREATE(0x0, 0x0, 0x48) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000080)={[{@nojournal_checksum}, {@nombcache}, {@barrier}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@nodelalloc}, {@usrquota}, {@noauto_da_alloc}, {@bh}, {@barrier_val={'barrier', 0x3d, 0x9d}}]}, 0xff, 0x55b, &(0x7f0000000640)="$eJzs3V9rW+UfAPDvSdP9//3WwRjohRR34WQuXVv/TPBiXooOB3o/Q3tWRtNlNOlY68Dtwt14I0MQcSC+AO+9HL4BX8VAB0NG0QtvIic9WdM2adM22m75fOBkz3POyZ7zzTnfp8/Jk5AABtZo9lCIeCkivk4ijrdtK0a+cXRlv+Wnt6eyJYlG45M/kkjyda39k/zfo61KMeKXLyPOFtY0OZI91BaXZsuVSjqfrxyrz90Yqy0unbs2V55JZ9LrE5OTF96anHj3nbf7Fuvrl//67uOHH1z46vTytz89PnE/iYtxLN/WHscu3GmvjMZo/poMx8V1O473obH9JNnrA2BHhvI8H46sDzgeQ3nWAy++LyKiAQyoRP7DgGqNA1r39n26D35uPHl/5QZoY/zFlfdG4lDz3ujIcrLmzihpvZGxS1kbP//+4H62RP/ehwDY0p27EXG+WNzY/yV5/7dz53vYZ30bK+0P7bJloBcPs/HPG53GP4Vn45/oMP4pdsjdneic/+0Kj/vQTFfZ+O+9juPffNJqJEaG8tr/mtXh5Oq1Spr1bf+PiDMxfDCrbzafc2H5UaPbtvbxX7Zk7bfGgvlxPC4eXPuc6XK9vLuoVz25G/Fyx/Fv8uz8Jx3Of/Z6XO6xjVPpg1e6bds6/n9X48eI1zqe/9UZrWTz+cmx5vUw1roqNvrz3qlfu7W/1/Fn5//I5vGPJO3ztbXtt/HDob/Tbtt2ev0fSD5tlg/k626V6/X58YgDyUcb10+sPrdVb+2fxX/m9Ob9X6fr/3BEfNZj/PdO3uu6a5f422/Nu+vDpGsW//S2zv/2C48+/Pz7bca/7vy/2Sydydf00v/1eoC7ee0AAAAAAABgvylExLFICqVn5UKhVFr5Du/JOFKoVGv1s1err0ZzW/PzD4XWTPfxts9DjOefh23VJ9bVJyPiRER8M3S4WS9NVSvTex08AAAAAAAAAAAAAAAAAAAA7BNHu3z/P/Obn2GBF5+f/IZBdXjr/O/HLz0B+5K//zC45D8MLvkPg0v+w+CS/zC45D8MLvkPg0v+AwAAAAAAAAAAAAAAAAAAAAAAAAAAQF9dvnQpWxrLT29PZfXpm4sLs9Wb56bT2mxpbmGqNFWdv1GaqVZnKmlpqjq31f9XqVZvjE/Ewq2xelqrj9UWl67MVReu169cmyvPpFfS4f8kKgAAAAAAAAAAAAAAAAAAAHi+1BaXZsuVSjqvoLCjQnF/HIZCnwt73TMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwKp/AgAA//9+MDsO") r0 = open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0x0, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000f58818d78c660e677df8dc905b90242b7c528a076d2f6a004000000000000f000", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8, 0x2]}) write$P9_RREAD(r0, &(0x7f0000000380)={0xb, 0x75, 0x2}, 0xb) 7m17.146599929s ago: executing program 4 (id=1135): socketpair(0x21, 0x5, 0xd, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000000), &(0x7f0000000040)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r3, r1}, 0x14) syz_emit_ethernet(0xfe4f, &(0x7f0000000240)=ANY=[], 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 7m16.347245644s ago: executing program 4 (id=1139): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x200000c, 0x32, 0xffffffffffffffff, 0x41e90000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xa, 0x32e}, 0x28) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) setns(0xc9, 0x0) r1 = socket(0x8, 0x2, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x400261f3, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 7m15.509408106s ago: executing program 36 (id=1139): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x200000c, 0x32, 0xffffffffffffffff, 0x41e90000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xa, 0x32e}, 0x28) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x1}) setns(0xc9, 0x0) r1 = socket(0x8, 0x2, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x400261f3, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 2m45.739235427s ago: executing program 7 (id=2054): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000001080)=0x91b) read$dsp(r1, &(0x7f0000002300)=""/4096, 0x1000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x64a, &(0x7f0000000040)={0x0, 0x8835c, 0xc000, 0x20000a, 0x33c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x4}, {0xe, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x24040005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 2m44.817401749s ago: executing program 7 (id=2058): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x8, 0x1, 0x3c, 0x42}, 0x50) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000240)={r3, &(0x7f0000000100), 0x0}, 0x20) 2m40.923571988s ago: executing program 7 (id=2061): setns(0xc9, 0x0) r0 = socket(0x1f, 0x5, 0x8) syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_mptcp_buf(r0, 0x11c, 0x1, &(0x7f00000000c0)=""/70, &(0x7f0000000180)=0x46) 2m39.566090872s ago: executing program 7 (id=2065): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x82401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x5, 0x7}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x1d}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x11, 0x0, 0x2}}}}}}}, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB=',']) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4020ae46, 0x0) 2m39.020646154s ago: executing program 7 (id=2066): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000001c0)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) r3 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet(r3, &(0x7f0000000680)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000040)="93", 0x1}], 0x1}}], 0x1, 0x4040040) bind$can_raw(r1, &(0x7f00000005c0), 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_DEST(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="010015be4c385af31d4911"], 0x14}, 0x1, 0x0, 0x0, 0x40084}, 0x40000) 2m38.459324643s ago: executing program 7 (id=2068): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./rpc_pipe\x00', &(0x7f0000000140)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1\n', 0x2) close(r2) 2m23.178604699s ago: executing program 37 (id=2068): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./rpc_pipe\x00', &(0x7f0000000140)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1\n', 0x2) close(r2) 28.738655859s ago: executing program 2 (id=2377): r0 = fsopen(&(0x7f00000000c0)='pstore\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0xf) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, &(0x7f0000000240)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x20) write(r1, &(0x7f0000000000)='3', 0x4e) sendmsg$RDMA_NLDEV_CMD_DELLINK(r1, 0x0, 0xc1) syz_emit_ethernet(0x2e, &(0x7f00000000c0)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x3, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @broadcast}, {0x4000, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x6, 0x0, @void}}}}}}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 26.972805828s ago: executing program 2 (id=2379): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000020c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1f2) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000080)=""/144) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b000000000008000400"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x40084) 25.781221371s ago: executing program 2 (id=2382): openat(0xffffffffffffff9c, 0x0, 0x68801, 0x164) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) 23.37985726s ago: executing program 2 (id=2384): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\', @ANYBLOB="01000000000000", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 18.43863365s ago: executing program 2 (id=2395): bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_dev$loop(&(0x7f0000000000), 0xa779, 0x100) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$unix(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) epoll_create1(0x80000) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 14.354890056s ago: executing program 2 (id=2400): r0 = syz_mount_image$nilfs2(&(0x7f0000000ec0), &(0x7f0000000080)='./file0\x00', 0x40, &(0x7f00000000c0)=ANY=[], 0x4, 0xf82, &(0x7f0000003080)="$eJzs3U9sHNX9APA36/W/2MRr4AcGfoQUWhEo2CGJ1PQWBOqlEuLSOygkNMJQ1NBKREBMD4hKiCIhThUHEBdKpRSpSKBKFeqp7alVb+0F9UKlKpWCemgjJa5iv1nvPu9k12N7dtf7+UjffX7zZuf7HXsTz4xn3wZgZNXWHo8dW8hCeOeztx99+ansk2vL7mqucXDtMYu9RghhvKWfJdv7Ii64cumlk53aLBxZe8z74bGLzefOhBBWwsHweWiEj5aWv/rw3UcOffza1C1vnnvmlV3a/aZ0PwAAYC+68Mflv973jz88MH/5woETYbK5PD8+b8T+TDzuPxwPlPPj5Vpo72ct0WoiWW8sRi1ZbyxZr57kqRfkG0+2M16w3kSXfGMtyzrtJwAAAAyj/Ly2EbLaYlu/VltcXD/vv+aLuYls8bkzy6fP9qlQAAAAoLR/n1+76XaIY2oAahBpTOcvsK0976Pvbv0524paxfnqFecbmSj3ehNCCCGE2LlwPCKGIFbnKrzYAAAAANBhvrBNVnZ2pq7m1hq95b/4cK3z82EHJK+/zdNO7PDr//r5pzavUGn+DnY//3if8193/z941f84AACUt1ePJvP9yo+j83kM0nkEx9qeNTO21fOPWrKd+hbrLJpXcFjmGyyqc6ziOsoqqn+rP8d+Kao/nQ9zUBXVn87TOaiK6p+suI6yiurvcOUnDOI/66L6pyuuo6yi+vdVXEdZRfXPVFxHWUX1z1ZcR1lF9d9QcR1lFdW/v+I6yiqqf1huqy2qv1FxHWUV1T+/3gz8YURR/TdWXEdZRfXfVHEdZRXVf3PFdfTLnbHNvw8HCtab6XDwN3AHgwAAAEBH/x36+f9GNOoDUIMQQgx9vLr+y7B9+VSHZWJbURuAGnYrpju9hoQQQoiBjPN9vPYAAAAADIb8fQH5u95Xo3x8bNP4396/9piP11vHpzY2kI+Pd9n+RJfxyS7jAAAAQAi/ef30bW9lG/Pdpe/p3+p8ePm8UdPhk6uhxDxG6XyEW82/3XnPtpu/84QjwzIbGwAAAHtV9p3Pr97/6HsvzF++cOBEy9nv1Xi+m88DWo/XBj6N/fy+gNmkn+Xn0Cfa89QK1kuvD9xQtL3Ht7mjAAAAMMLy8/dGyGqLLefdjVCrLS5unI8vhPHs9JnlU4djP/98lt/PjU9eW/5QxXUDAAAAvds43+98/p9/ju9CmMgWnzuzfPrsen+2uXy81npdYG5jedZ6XaCRLD9SsPxo7MfP7wzfn5teW7548gfLT+30zgMAAMCIOPviuWeeXF4+9cPR+aIeQtjWdsIg7IUvfLGrX/T7fyYAAGCnffnl2+M/Ojr72/X3/2/Mf3c1fnEw9htxbr8/xeX5fQL5+wA2vV//ifY8c0XrPd++XiNZbyzGZFL3VMt2wtp8g+3Pmy/K12jfzkRBvpkk32ySL52noJ6sn3WYSzB0mAkwX28uWZ7Ow1hPcmRJ/rs75AIAAIDc0gvPPr909sVzD5559smnTz196rmjR45/+/jxww9966Gltfv6l1rv7gcAAACG0cZNv/2uBAAAAAAAAAAAAAAAAAAAAEZXFR8n1u99BAAAgFH3r/MhhBUhCiL/gMF+1zHskQ1ADbsXq5P9r2FvR/DvUAghhBDbjP6e9005lhmMWF1NP2keAAAAYHddufTSydZ2k5VsR/M1t9ZYb67GvHk7++Bf5q9FvtrFh9uvl+zb0WoYdVW//uUf1PyTHcc/eHVn869diG9s9Lv//1dr38CJtcd67E33mvfepV8sNPOHEG6v95g/3f/He83Y7lCS/97QW/7V95L8T7T1ar3mvy/Jv6/H/Jv2//miDFPXzX9/zL8Q+4fu6TV/+y5OJtl6fQF8M9n/p0Kv+ZP9b/SYMPFAzA8Ao6j523z1fH8L2WH5UUJ+PD0T+/n+5ges6d0PWz3+ryXbqW+78vbt5sdBt8Z+86hupT1vbqv159+X2djeULLO1LDcVVJU/079HHdbUf3jFddRVlH9ExXXUVZR/Z3P3gdPUf3XP3scHEX193whos+K6h+W68pF9c9UXEdZRfXPVlxHWUX1b/X3eL8U1b+/4jrKKqp/ruI6yiqqv+RltcoV1T9fcR1lFdV/Y8V1lFVU/00V11FWUf03V1xHv9wR26Lz4fz8cy6O5f1G0p/s8L3s+Y8hAAAAwK7650DO/9dy5aDvtQghhBBiGGJsAGoQYpjjP6vr+l2HEGL3YnW1n1cf6LdsiO4VB2Dn7O5sFgw6P//R5uc/2vz8uZ78L/FZ0s+NdRmvdxkf7zI+kYxnyRMni8ajm5LtrubXNaObu4z/X9yDovH9yfN/nIzf2mX7C13Gb+syfnuX8Tu6jAMAADAabomt80MAAADYu17+5adv/PreJy7NX75w4ESY2DTv/OHYn4x/W3899tN573Pj8W/+P4n992P7u9j+PVnf/ScAAACw+/LPifH3fwAAANi78s8pdf4PAAAAe9d8bJ3/AwAAwN51Y2yd/wMAAMAelk11Xhzb/LrA3bHtdV4/AGDw/X9s74ztgdjeFduvxTY/Drgntl+vqD4AYOf8/Hs/Pf5WtjHf/9Fk/EpcnrebrKxfKchq7TP5T8d2X2y/0WM96ecB9Jo/t7/HPLuVf26b+QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAvaO29njs2EIWwjufvf3ozybe+PO1ZXc11zi49pjFXiOEMN58Xj660f9VXPHKpZdOtrZXY5uFIyELWXN5eOxiM9NMCGElHAyfh0b4aGn5qw/ffeTQx69N3fLmuWde2cVvQdv+AQAAwF70vwAAAP//7lUWHg==") syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) prlimit64(0x0, 0x3, &(0x7f0000000040)={0x8, 0x8b}, 0x0) setns(0xc9, 0x0) r1 = socket(0x2a, 0x2, 0x9) bind$inet(r1, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) recvmsg(r1, &(0x7f0000000800)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0xf2ff}, 0x0) mount(&(0x7f0000000100)=@sr0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='fusectl\x00', 0x2000000, &(0x7f0000000380)='nilfs2\x00') timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x890b, 0x0) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mknodat(r0, &(0x7f0000000180)='./file0/file0\x00', 0x400, 0xffffffff) 11.098512647s ago: executing program 1 (id=2411): openat$kvm(0xffffffffffffff9c, 0x0, 0x16481, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 9.141721277s ago: executing program 1 (id=2414): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='lz4hc', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/zswap/parameters/enabled\x00', 0x2, 0x0) write(r1, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000801000)=""/64, 0x40) write(0xffffffffffffffff, &(0x7f0000000240)='AAAAAAAAAAAAAAAAA', 0x11) read(0xffffffffffffffff, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000803000)=""/64, 0x40) madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15) mlock(&(0x7f0000000000/0x900000)=nil, 0x900000) madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x16) 8.384110334s ago: executing program 1 (id=2416): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') readlink(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)=""/83, 0x53) 7.248676241s ago: executing program 1 (id=2417): openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x80082, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x90) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r3, 0xc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x20, r6, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) 7.098230229s ago: executing program 5 (id=2418): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="540000001800010400000000000000000a000000fe030001000000000800040001000000060015"], 0x54}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000007c0)={'macvlan0\x00', 0x0}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001000)={&(0x7f0000000f40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@ptr={0x0, 0x0, 0x0, 0x2, 0x2}, @func={0x3}]}, {0x0, [0x0, 0x0, 0x2e]}}, 0x0, 0x35}, 0x20) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000600)={r4, r4, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10d2, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r5, 0x800448d2, &(0x7f00000000c0)={0x1, &(0x7f00000023c0)=[{}]}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r3], 0x68}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000140)=@getchain={0xffffffffffffffd0, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x1, 0x1}, {0x7, 0xc}, {0x1, 0xffe9}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x30) 6.820269222s ago: executing program 5 (id=2419): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4c840) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @loopback, 0x3}, 0x1c, 0x0}, 0x44060) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.520734833s ago: executing program 5 (id=2421): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="dc", 0x1}], 0x1}, 0x48043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0xad}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000100)=0x3, 0x4) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$9p(r5, &(0x7f0000001100)='-', 0x1) splice(r4, 0x0, r1, 0x0, 0x100000000, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) write$9p(r2, &(0x7f00000018c0)="4ac472c746b712c0580122b2a6188745cfb2fe6e797d1da468bece1d05d1748ed6d3c33e1da84d63f416047e5855d916b527b2a27f7c71daff9c06bfa31c6062a12b94410b0d73051b99d3d7196ca55363dffb0f354e4e99c2e60d00e73539c3c509a611fdce7c52b06f6a98fb847ce8f3d98687fba018ee1302b4fbc1ffa376ac2198e4fe4cc4ff73c3571cee23cca91f8393c6ddac5d2159a87e097e395fe2484d19ced7fd86914852eb39ca7ec84e781d0263935f5124617dd72cf2e329326ba1a3636076f4299fdbe325c101c3d74ee0efe9476871ef17f5ba1907c8b0fea747ec8f4af0e83395233e585aff746397a56a17988d889389b62acc01856e89cb5c976a6561b344e6c318f6ffd9da3bd7dc8619096732d19e41e346a9b3252f22803c034b42ff3f9c5c4eff35459654c19726f7a619e255936efcaf1955e4e21f6d3bb90ae9b1d3b1f7e330cdbdf2e93c1568668696083155ac262ae0008341a4b7902d40f4216f9897b95fa9dcd713d653a711dc5c5d0c4057aa053f80dbdf7381bf6b6efb411de4d32cedd89eafb0eea437c338e284e4cea0f59eeb341b1e98bf242fded94d90e62ebb5e2fb19cb15ba587b34a19fa47cf2d21ccf0335860b9f8b704119b714a127ea52f3f93a864f19918b76feaf8320cb04bc83fdf68226d1d3b7d8d27d9d5d9da83f7754d8476466b26ddf83e5bbf19395760a6925e80fa0fba502c1d23ce4682ea55ec29697b63b5cd9ba3b5a23b7de0ff9f93e1f24ba4a31c1008211d413796328447d81cff8f2c1d8946eee9f3c617f6662f943da95bc2321dfc4c50437ea1a1216fedabd2c0a0b5fe17238225fc4153599bac7b3daeafddaf1d98566033785fcc43684653f3a32609aa5d998a2e67b5be311d6bade79992c5ba2abf512245d6025b1897910726233fe8e0d541b9eb92cf0a390151db83e542d0abe79f7da2780f0a91877efe93ce5a7d2c730f77f42ea294697561bb02b78581c76baab73ac61c516c1c4c3a3f7fb2a52a8a844cc67a672fe20a5486897d160333ea6bf664cc39eb0b8887a600e41829eb48327d57e40231d52fcdc3603afdda7fd0a312057322df6ee0d79efd724daf7e41844b1dafdc38165bd51c07192e1197df41176005c1a057b9412b948c637879113437f1af394df7d6c3477bbc67792f217e16056f5166a4f7d54fc6dacaab85e0d9f9a96ea3a6dd77762f570a1a60cb6868e81537523276e7531934c8e616506af5a216be0880699768d330a6714caa9c35e77c67eb03c7722c450e9038de9d8052c01ff5f0573ffbb6fe43df2d2899b486389d1b5f8cfc233e6644ea6bd8d8dc3d4ca3cc58108ed22c358ec00e4f9f9b0ca73053d77f6c7d4bb5631494e1ded4ac02613f059d2c4c8fcdf9abeeade7476f5878b45206de93f9f8bd4db5f98817b90bec02b76e062a2146cb2fc2f2777c2f6139b614b4cd868b73", 0x411) close_range(r0, 0xffffffffffffffff, 0x0) 6.274577872s ago: executing program 5 (id=2422): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x0, 0x7, 0xc, 0x0, @gue={{0x1, 0x1, 0x3, 0xfd, 0x100, @void}}}}}}}, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 00040'], 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) unshare(0x22020600) 4.724238194s ago: executing program 5 (id=2424): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000600)={0x1, 'lo\x00'}, 0x18) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PING', 0x4) r3 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x3, 0x3, 0x101, 0x70bd2a, 0x25dfdbfb, {0x7, 0x0, 0xa}, [@typed={0x8, 0x115, 0x0, 0x0, @uid=0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0xa810}, 0x40801) close(r2) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000800)={0x1, 'lo\x00'}, 0x18) 4.60217632s ago: executing program 9 (id=2426): socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xb, 0x7, 0x8, 0x8, 0x5}, 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r1}, 0xc) 4.493530083s ago: executing program 9 (id=2427): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg(r0, 0x0, 0x0, 0x40840) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r4) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)={0x18, r5, 0x1, 0x4070bd31, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x80d0}, 0x4800) 3.102384726s ago: executing program 1 (id=2428): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r4, &(0x7f0000004400), 0x400000000000203, 0x0) 3.091471125s ago: executing program 9 (id=2429): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00', @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.8539734s ago: executing program 1 (id=2430): openat$null(0xffffffffffffff9c, 0x0, 0x80, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2000b, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) setreuid(0xffffffffffffffff, 0xee01) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/128, 0x80}], 0x1) landlock_restrict_self(r0, 0xe) landlock_restrict_self(r0, 0x9) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, 0x0, 0x0) io_uring_setup(0x1b80, 0x0) 1.796192222s ago: executing program 9 (id=2431): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_MCE_KILL(0x21, 0x1, 0x2) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c4}, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r3, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)=[{0x0}, {0x0}, {&(0x7f00000000c0)=""/64, 0x40}], 0x3}, 0x8}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f0000001600)=""/4090, 0xffa}, {&(0x7f0000004740)=""/4096, 0x1000}], 0x2}, 0x900000}], 0x7, 0x0, 0x0) 1.507749045s ago: executing program 8 (id=2432): socket$netlink(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f0000000200)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x0, 0xf369, 0x80, 0x0, 0x28a, 0x0, r2}, 0x0, 0x1, 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed, 0x400000000}]}) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x1, 0x9, 0x80000001, 0x0, 0x10000, 0x23, 0x200, 0x7ff, 0x9, 0x6, 0x400, 0x5ed1, 0x89, 0x0, 0x3, 0x8d], 0x100000, 0x140}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.093009219s ago: executing program 8 (id=2433): socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002a00)=ANY=[@ANYBLOB="140000001000010000800000000000000000000a54000000160a01030000000000000000050000030c00054000000000000000040900020173797a300000000008000740000000010900010073797a3100000000080007ffca67b5000900010073797a3100000000140000001100010000000000000000000100000a"], 0x7c}}, 0xc005) ioctl(r1, 0x1000, &(0x7f0000000000)="868a51fb1d642017deca96830d950cc3f0bb1fa03e63152d9bce13444fc8e670d251849c7c803ddae073718b01466dfe55babf796ca3f99839e03a2efa252e918e") prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f00000000c0)='2\x00', 0x2) 942.810291ms ago: executing program 8 (id=2434): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 810.513001ms ago: executing program 9 (id=2435): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000b80)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x400, 0x0, 0xfffd, 0x4}, {0x40, 0x1, 0x3, 0x7f, 0x5, 0x16800000}, 0xcd04, 0xfffffffe, 0x1526}}, @TCA_TBF_BURST={0x8, 0x6, 0xc}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x54815}, 0x4008000) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 643.719194ms ago: executing program 8 (id=2436): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x8) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x5) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x3a1}, 0x30, 0x0) landlock_restrict_self(r2, 0x0) link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 478.058389ms ago: executing program 8 (id=2437): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept4(r1, 0x0, 0x0, 0x80800) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x44, r3, 0x5, 0x70bd2b, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @from_mac}, @NL80211_ATTR_MAC_HINT={0xa, 0xc8, @from_mac=@broadcast}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x80}, @NL80211_ATTR_SSID={0x5, 0x34, @random='A'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8891}, 0x0) 350.612594ms ago: executing program 9 (id=2438): prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000100)='./file1\x00', 0x40, &(0x7f0000000440)={[{@compress_algo={'compress', 0x3d, 'zstd'}}, {@clear_cache}, {@space_cache_v1}]}, 0xff, 0x50d4, &(0x7f00000051c0)="$eJzs3U+IVWUfB/Dnzjg6KDjXnbp48QW3wiQKRURDaFaYc82CosVMLYIQYVAwFy3EgpIWDgha4cJgWmR/nFVFC3GVBEEQBcEgzEKQdkIxGC6Ke8957pz7HO+5dyZ1TD+fmDnnOb/zPOeZy1nc783n3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhhJNz585V1bdemTm7Y2DP1Us3T+w8NTE6H0KtdbyW1yeeeuaFNw5MPD8cO0zuz7b1erchs67zWWN1x8Fmv86f10IIQ8kAg/l292Bp1OLu4fKAlfZfXNh25NbeXTPHxg9dOLp5qvyn0zS80hNYKfl9dW3xXhpr/R5Izmi3C7dereMWzfqnN9w9+SMAgCUZbbQ27bej+Vvcdvt4Wk/aY0l7OmnHdwjTxcZyZOOu7jbPLWl9heY5lkWFNd3mWU/q+evfbjeSekjbnVFjCfPsPDWPNMPd5jmV1FdqngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD3k6c/+eJ6VX3rlZmzOwb2XL1088TOUxOj8yHUW8drWbn2xMLcwqa3dj/63e4vP/6zPn5yMO8Xt6sKJ4ff4s5jIyG8Xqhci8P+vj6ERmeh1QwflQtvtnaejQUAAAAeJJtavwfa7SwODnW0a600WWv9F2Vhcf/FhW1Hbu3dNXNs/NCFo5unlj9eo8t4Y7cdr92uL/7UCsE4xt90vMV6PPVwaZxq6Yhpnn959MPtVf1L+b9enf/jKyf/AwAA8G/I/+k41Xrl//nPX91X1b+U/7d0XLKU/+OMY/4fCMvL/wAAAHA/u9v5f6w0TrVe+f/r9/edrupfyv+j/eX/VcVpx4M/xgkfHAlhtNfUAQAAgC7i/3df/Ggh5vXsk4M0r7+49fpQ1Xil/D/WX/6vHBQAAAC4p34488jfVfVS/m/0l//X3NVZAwAAAEvxv/cmD1TVS/l/sr/8vzbf5isfsk7fx3+FcHokhOHmzlRWuBKmn2wXAAAAgDsk5vSXvt18tOq8Uv6fqn7+f3zSQVz/3/H8v9L6/0Ihe+rf4x4MAAAAwMOovJ4/Ph4/++aCbt+/3+/6/09//nVD1fVL+f94f/l/sLi9k9//BwAAAMvwX/v+v1dK41Tr9fz/t9/dsLT8P91f/o/bdcU/73J8fd4ZCWFjcyd/muBn8XIHk8LsUKHQ0kh6HIg98sLsmkKhZSrpsX0khP83d44nhQ2xMJ0UbqzPC+eTwk+xkN8P7cJXSeFyvNPOrM+nmxa+iYV8gcVsXEGxrr0kIunxR7cezcJte8y1Lw4AAPBQieE5z7JDnc2QRtnZWq8T1vY6YaDXCYO9TliVnJCe2O14mOwsxON//TL+XKhQyv/n+8v/8aVYnW26rf8Pcf1//r2G7fX/k7FQTwqzsdBInxjQiNfIwu4H8Rr1Rt7jxsZ2AQAAAB5o8XOBwRWeBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAPe/ceY8dVHw787PN61+vdDUHKQxYxL0N+ktdrOw7WLyCcVBEIpGQtov6DQtbYm9TxBhs/Co4s1RhUlCKEC66IQh+2RFSnEsgqbXmEEosqQVUtGoU2fziPpgWEKkGjFNclSiRX986c2bln9j78WNsbPh/Je8+933POzDn33vGcmblnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgt8PV373hy+3i7/jR1796U+8HXvjBbw6u/9I9ky+FMNV4vScL97zvzHNnrvvU7Ru+d/s3Hjk9fudDg3m5PB6W1v/05k8+F2v92bIQvt0TQn8aWDWSBQby5yOxvuUjIVwV5gJFiZnhrES64PDkUAhHwlygqOq7QyGMlAJ3PfPDJ75YTxweCuGdIYRauowXatkyhtLAysEsMJwGdvRngf89mykC3+nNAnDB4peh+NAfn2rOMD5/uRafv4GLtmKXV9q8vpgYb53vV7cu8EqVDKYvTF3Q21apjgVR+Xqc8G1bBN+2Sj8f8raVd6TyPZSzc6Fa6N06c+/mvbN74iu9YWKir1VNC/Q+n3pl/5ZzSS+az2FcgfGL8jm8//DNzw5+7I4XH3n98f2na19bfqGr2ap7F1ot5J+5RfM+RhttTxbB16+yl7TCTlcI4fSJk/vbxSvj//H24//4cY6PvU25Y62vjWZj8/jKSEy8PJqNzQEAAGDRWAxHTQdX/OtP29VXGf+v6O78fzzlnw/ms9aeCGFjI/HZsRCubbyeBR6Li/v4WAhvbaSmmgO3JoETIVzXSNxYVJWUWBJLrEgCvxjNAxuTwFMxMJUEHo2BQ0ngczFwPAlsiYETSeC2GAjbmtvx/0bzdnQdGIqB6awTj8erEH49GpeW9NVzRVUAAAAXST46HGh+WrrW4UIzxOHl8aFOGeIV2C0z1JIa0hFsMaxqWUN/pxp6O9VQtPtA++ZXau7pVHPlMoye5gz/c+qaHaGNyvh/sv34vzbPivRUzv+HyU2Nh5i7N4/MFhmmp5oyAAAAABfg9948vbldvDL+39jd9f/xmEhfKXM4GQ9DbB8LYbI5kFV7SzWQnfVemgcAAABgMSjOxxfnwrflj9kl2ul4upp/6hzzxxP/G+fNv+PH//J4u/WtjP+nurv+f7j5MVuJp+JafGUshCWlwI/iWtYDDSti4KX3Nwfy9j8VO+ALsar8woSiqi/EEtMxMJkEjrQq8XRR4trmQP5mFQv/bNGObXmJUgAAAAAuuXg4IJ6Xj9f/r/nbP3yyXbnK+H/63K7/b4yDK5f3zy4NYXV/CH3pDwNODmcTA8bASE+e+PvhrK6+tKqDwyHcUm9YWtV/5PP/96dzDP5kKKsqBq5927FXVtYTXx8KYXU58OxHj66vJ/YmgWLhvzsUwg311qYL/7sl2cIH0oU/vCSEt5QCRVVbloRQX9hgWtU/1PL7GKRVHa+FcHUpUFT1nloI+wIAi1X8v3Rr+cXd+x7cvnl2dmbXAibiQfyhcO+22ZmJLTtmt9ZarNPWZJ2b5jH6TLVN3d765vk4R9Hdx8a6SRc/FJwsLys/kF+5cjB/HneGBhrtXDvQ9HRd2uR3v726iFDalWrV5N4FbvJwuZK5N7FSf8w/GJaGJXt3z+ya+PTmPXt2rcn+dpt9bfY3nmfK+mpN2lfD861bFx+PltNlJc63r1aWK1m954Gdq3fve3DVtgc23zdz38wnNkyuW7vh5sn171ldb9Rk9rdDS1fOV3PS0rNHu2zWRWzp9f2lSi7FRkNCQmKxJQYH7jzVbvNTGf/vbD/+j1uduOHP52dodf5/PJ7mz16fO80/HQNHuj3/P97qbH5xYcCKJHAgBg44zQ8AAMAbQzwcGY9mxoPSB971wvvalauM/w909/v/izT/fzF1/YdaTfN/Yywx2Wr+/3Sa/2L+/wOt5v9Pp/kv5v8/chnm/99bBJIu+bX5/wEAgDeCSzf/f8fp/dMbBFQydJzeP71BQCVDx2n8u71BwDnP//83v1yzPrRRGf8f6m78b+J+AAAAuHJcc9sNP24Xr4z/j3Q3/r/08/+FVtf/r2gVmGo1MaD5/wAAAFikWs3/98xHdr6/XbnK+P94d+P/eNlFb1PuWOtro9mcdiGd0+7l0eInAwAAALA49IaJiYEu8zZNjHrr+S/zVJwKtE267NDnj53b7/9PdDf+b/pdxv2Hb3528GN3vPjaI68/vv907WvL587/AwAAAAun2+MSAAAAAAAAAAAAAADA5ffo1d+ad16AqPL7/7Cp8Xqr3//H+/413TTxTD4Z4IE4s/6XxkzzBwAAAAvroVtffTj+u+/Lf/Rf7fJWxv/j3Y3/4/0F8vvgZbfeOxHv//fZsRAat9YbzwKPxcV9fCyEtzZSU7FEdkO9D8USk1ngsThh4o2xxPRUc1VLYuB4EvjFaB44kQSeioH8KMWxeGPAPx4NYX0jtam5xM5YYjwJ3BkDK5LARAxMJoFlMbAxCfxyWR6YSgL/FAP5zQeLvvrWsryvAAAAzkU+zhpofhrScd7x/k4Zejpl6LiI4U4ZejtlqLXIEJ//dVyHgfJ8/HmG+NJAWutQUkslQ7wZ3vk3vZiu7+nmnGnByqL7YsHx5pwxw85/vukroY3K+H9Fd+P/y3j///Ru/htjYEUS2BkDG5PA9KY8cOSa5oD7/wMAAHBla3X//9G3/NWhduUq4//J7sb/8UDEm5tyx1o73/8/f37Xh7+5r7HKJ0dDeHs5sP3g9qvqiUdHQ3hXOfDE3Tc2Ru0H0xLff/G2n9cT96SBD65605l64r1JYDp20nVpIB5VObMsCcTu/UkaiP1xPA0M5oGHlmXt6En76j9Hsr7qSfvq1Eh2eUVP2lffHsmW0ZM28HASKBr4yTQQG3hHHuhN1+qbS7O1ioGRWPQvlhYXfQAAcGWKe4ED4d5tszOT6U94r+9vfoyabln+mWq1PV0u/vl4a/K7j411k+5L90VrRVUDoVZvwprK7mo5S0+jlRenlg5d9+YWTe50t/feFuVS59p1g61bNJS1aGLLjtmtAx0bvq5zlrX9HbOsqQx2yll6G13aRS1drEsXLeqyb7pY5fi8N0xM9CW5/n8MjocmnT4R3d6vr3yf/1afgnKeo5//91fb1VcZ/2/sbvwf27M0lD7On4u1/mxZCN/umTsaUQRWjWSB2NyRODxePhLCVaV+KErMDGclBpMFhyeHshHqYFrVd4eyYwzx+V3P/PCJL9YTh4dCeGfpvSqW8UItW8ZQGlg5mAWG08CO/iwQr/woAt/pzQJwwYqNQvxA5T91KYzPX67F5++Nck/QtHmVa6DmyTffNneh1NIX8muqCuf2tlWqY0FUvh4nfNsW47ct+LaVd6TyPZSzc6Fa6N06c+/mvbN74ivlPdmKBXqfy3up3aQvwufwwPmvbWe1dAUmk83H5Pzl5v8c9sTq7j9887ODH7vjxUdef3z/6drXlne9Gi3EgcKT//2mq8rdu9BqIf/MLbrtyZTtyWL8b2Dc2xZCOPTnQ59sF6+M/6e6G//3J48Nr8bO3D0WwrtLnXsydv/vjGXbwVIg20peXQ1kl9z/dLTllhMAAAAutuJwR3G8YFv+mP0gPB0nV/NPnWP+eLxi47z5u13v/U/+/mPt4pXx/3T78f+SZDWd/3f+nwXi/P+8rvRD0UvSFw5c0KHoSnUsCOf/53Wlf9uc/5+X8//O/8/H+f8OnP+f15X+tlX2knba6QohnL1+4OF28cr4f2d34//fsvn/09n8i/n/00n7i/n/p1vN/7+z1fz/B8z/DwAALKgWE82n47zK5PyVDOnk/JUMPUmGc7/FQMdp9M3/n87/f/DPbtkT2qiM/w90N/6PH4eR8tIXy/z/45talNi4qXl1i8ChGNjpjgEAAABcRvEAQbzovdsZJgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFhYd7x6ZnO7+Dt+9PWv3tT7gRd+8JuD6790z+RLIWxrvN6ThXved+a5M9d96vYN37v9G4+cHr/zoVpebiB/XN6UO9b62mgIR0qvjMTEy6P1J3OBuz78zX399cTJ0RDeXg5sP7j9qnri0dEQ3lUOPHH3jdfUEwfTEt9/8baf1xP3pIEPrnrTmXrivXmgJ13dP12WrW5PurpfXBbCWClQrO79y5qrKpbxgTzQmy7jL0eyZcTASCz68Ei2jBiYjSW2LQlhdX8IfWlV/1jLqupLq/peLauqL63qD2oh3BJC6E+r+rfBrKr+tOVPD2ZVxcC1bzv2ysp64uhgCKvLgWc/enR9PbErCRQL/8hgCDfUPzLpwr81kC18IF34nwyE8JZSoKhqeiCE+sIG06pO9GdVDaZVfaM/hKtLgaKqm/pD2Be4XOKGZGv5xd37Hty+eXZ2ZtcCJgbzZQ2Fe7fNzkxs2TG7tZasUys9pfTZz5x/259/Zf+WRuLuY2PdpIv1miyvy9NTlRfLz/vzpwONdq4daHq6brE0ebhcydybWKk/5h8MS8OSvbtndk18evOePbvWZH+7zb42+9uXR7O+WrNY+mpluZLVex7YuXr3vgdXbXtg830z9818YsPkurUbbp5c/57V9UZNZn8vRkuPXvqWXt9fquRSbDQkJCQWW6K3aes2eaVvxys7+nMrOhBqjQ10ZVhRztLTaOXFaPSt59Ha3Lk2ujIkqbRoTWXgUMmytnOWdZUxw1yWoSxLY1+wMjgs19Tb6NL4vDdMTPS16ofx5qfl7v3VBXTvqdh1XaYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4P3bgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04FgAAAAAQ5m8dRs8GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//Qczu7Q==") r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) getpid() sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_extract_tcp_res(&(0x7f00000001c0), 0x0, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r4, 0x0, 0x0, 0x90001) 264.064366ms ago: executing program 5 (id=2439): syz_open_dev$usbmon(&(0x7f0000000080), 0x8002, 0xa2000) epoll_create(0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x94, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x2, &(0x7f0000000000)=0x80000000000003) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) 0s ago: executing program 8 (id=2440): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40900, 0x0) close(r1) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x4000818) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x34, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4015}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0xfdef}], 0x1}, 0x4005) kernel console output (not intermixed with test programs): in-inode xattr: e_value size too large [ 401.421695][T10746] loop9: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 401.436389][ C0] EXT4-fs (loop9): error count since last fsck: 1 [ 401.436408][ C0] EXT4-fs (loop9): initial error at time 1791208095: ext4_iget_extra_inode:5210: inode 15 [ 401.436431][ C0] EXT4-fs (loop9): last error at time 1791208095: ext4_iget_extra_inode:5210: inode 15 [ 401.471303][T10746] EXT4-fs error (device loop9): ext4_orphan_get:1408: comm syz.9.1287: couldn't read orphan inode 15 (err -117) [ 401.471330][T10746] loop9: lost filesystem error report for type 5 error -117 [ 401.504950][T10746] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 401.705053][ T7502] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 401.732875][T10258] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 401.830383][ T5801] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 401.983015][ T5801] usb 8-1: New USB device found: idVendor=17e9, idProduct=8b6e, bcdDevice=9c.00 [ 401.983047][ T5801] usb 8-1: too many configurations: 129, using maximum allowed: 8 [ 402.023881][ T5801] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.039798][ T5801] usb 8-1: config 0 descriptor?? [ 402.311636][ T5801] usb 8-1: string descriptor 0 read error: -71 [ 402.344236][ T5801] usb 8-1: USB disconnect, device number 8 [ 402.475872][T10762] loop5: detected capacity change from 0 to 512 [ 402.567061][T10762] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2 [ 402.567448][T10762] EXT4-fs error (device loop5): ext4_free_branches:1023: inode #13: comm syz.5.1291: invalid indirect mapped block 2683928664 (level 1) [ 402.603522][T10762] loop5: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 402.608421][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 402.608440][ C0] EXT4-fs (loop5): initial error at time 1791208097: ext4_free_branches:1023: inode 13 [ 402.608462][ C0] EXT4-fs (loop5): last error at time 1791208097: ext4_free_branches:1023: inode 13 [ 402.636573][T10762] EXT4-fs (loop5): 1 truncate cleaned up [ 402.677966][T10762] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 402.730104][ T5613] Bluetooth: hci1: unexpected event for opcode 0x0402 [ 403.368301][ T7502] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 403.906285][T10789] netlink: 'syz.9.1296': attribute type 11 has an invalid length. [ 404.374165][T10797] loop7: detected capacity change from 0 to 512 [ 404.401747][T10797] EXT4-fs (loop7): Test dummy encryption mode enabled [ 404.431483][T10797] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e064e0ad, mo2=0002] [ 404.431578][T10797] System zones: 1-12 [ 404.528601][T10797] EXT4-fs (loop7): mounted filesystem 00000005-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 404.607526][T10797] EXT4-fs error (device loop7): htree_dirblock_to_tree:1051: inode #2: comm syz.7.1298: Directory hole found for htree leaf block 0 [ 404.628781][T10797] EXT4-fs (loop7): Remounting filesystem read-only [ 404.770044][T10804] fuse: Bad value for 'fd' [ 404.928552][T10808] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 405.668035][T10816] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 406.065687][T10804] kexec: Could not allocate swap buffer [ 406.316854][T10825] loop8: detected capacity change from 0 to 1024 [ 406.475468][T10825] overlayfs: failed to resolve '/½wQ Y4%ÛýH¡tYÚPC»O…­˜Ôr': -2 [ 406.804478][ T5613] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 406.804895][ T5613] Bluetooth: hci1: Injecting HCI hardware error event [ 406.812066][ T5613] Bluetooth: hci1: hardware error 0x00 [ 406.928724][ T8097] EXT4-fs (loop7): unmounting filesystem 00000005-0000-0000-0000-000000000000. [ 407.438908][T10848] netlink: 'syz.9.1309': attribute type 1 has an invalid length. [ 407.714595][T10850] bond1: (slave veth0_to_bond): making interface the new active one [ 407.715341][T10850] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 407.837888][T10848] macvlan2: entered promiscuous mode [ 407.837909][T10848] macvlan2: entered allmulticast mode [ 407.838376][T10848] bond1: entered promiscuous mode [ 407.838389][T10848] veth0_to_bond: entered promiscuous mode [ 407.905237][T10848] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 407.911683][T10848] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 407.911836][T10848] bond1: left promiscuous mode [ 407.911849][T10848] veth0_to_bond: left promiscuous mode [ 408.547363][T10873] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1311'. [ 408.960848][ T5613] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 408.995826][ T192] hid-steam 0003:28DE:1302.0005: unknown main item tag 0x0 [ 408.995854][ T192] hid-steam 0003:28DE:1302.0005: unknown main item tag 0x0 [ 408.995874][ T192] hid-steam 0003:28DE:1302.0005: unknown main item tag 0x0 [ 408.995893][ T192] hid-steam 0003:28DE:1302.0005: unbalanced collection at end of report description [ 409.035642][ T192] hid-steam 0003:28DE:1302.0005: steam_probe:parse of hid interface failed [ 409.035709][ T192] hid-steam 0003:28DE:1302.0005: probe with driver hid-steam failed with error -22 [ 409.094056][T10882] netlink: 'syz.9.1316': attribute type 4 has an invalid length. [ 409.891719][T10911] ip_tables: iptables: counters copy to user failed while replacing table [ 410.501892][T10922] mmap: syz.9.1325 (10922) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 411.020003][T10934] loop8: detected capacity change from 0 to 8 [ 411.158546][T10936] netlink: 'syz.9.1330': attribute type 4 has an invalid length. [ 411.160008][T10936] netlink: 'syz.9.1330': attribute type 4 has an invalid length. [ 411.662989][T10947] batman_adv: batadv0: Adding interface: syzkaller0 [ 411.663004][T10947] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.663029][T10947] batman_adv: batadv0: Interface activated: syzkaller0 [ 412.500611][ T9] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 412.714983][ T9] usb 8-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 412.738170][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.738198][ T9] usb 8-1: Product: syz [ 412.738210][ T9] usb 8-1: Manufacturer: syz [ 412.738221][ T9] usb 8-1: SerialNumber: syz [ 413.207623][ T9] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 413.207681][ T9] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 414.784746][T10947] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 414.913388][T10947] batman_adv: batadv0: Removing interface: syzkaller0 [ 415.279149][ T5613] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 415.279665][ T5613] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 415.296605][T10965] loop5: detected capacity change from 0 to 512 [ 415.343417][ T5613] Bluetooth: hci2: unexpected event for opcode 0x2060 [ 415.408809][T10967] FAULT_INJECTION: forcing a failure. [ 415.408809][T10967] name failslab, interval 1, probability 0, space 0, times 0 [ 415.408860][T10967] CPU: 0 UID: 0 PID: 10967 Comm: syz.8.1342 Tainted: G L syzkaller #0 PREEMPT(full) [ 415.408883][T10967] Tainted: [L]=SOFTLOCKUP [ 415.408889][T10967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 415.408900][T10967] Call Trace: [ 415.408906][T10967] [ 415.408913][T10967] dump_stack_lvl+0xe8/0x150 [ 415.408943][T10967] should_fail_ex+0x3eb/0x540 [ 415.408964][T10967] should_failslab+0xa8/0x100 [ 415.408983][T10967] ? key_alloc+0x318/0x1020 [ 415.408998][T10967] kmem_cache_alloc_noprof+0x9c/0x600 [ 415.409018][T10967] ? key_alloc+0x318/0x1020 [ 415.409037][T10967] key_alloc+0x318/0x1020 [ 415.409063][T10967] keyring_alloc+0x45/0xb0 [ 415.409082][T10967] lookup_user_key+0x4df/0x1360 [ 415.409105][T10967] ? __pfx_lookup_user_key+0x10/0x10 [ 415.409124][T10967] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 415.409145][T10967] ? __might_fault+0xaf/0x130 [ 415.409166][T10967] __se_sys_add_key+0x315/0x420 [ 415.409184][T10967] ? __pfx___se_sys_add_key+0x10/0x10 [ 415.409207][T10967] ? __x64_sys_add_key+0x20/0xc0 [ 415.409224][T10967] do_syscall_64+0x166/0x520 [ 415.409239][T10967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.409255][T10967] ? clear_bhb_loop+0x70/0xc0 [ 415.409273][T10967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.409289][T10967] RIP: 0033:0x7f2f8719e199 [ 415.409304][T10967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.409319][T10967] RSP: 002b:00007f2f88026028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 415.409336][T10967] RAX: ffffffffffffffda RBX: 00007f2f87425fa0 RCX: 00007f2f8719e199 [ 415.409349][T10967] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 415.409360][T10967] RBP: 00007f2f872350b8 R08: ffffffffffffffff R09: 0000000000000000 [ 415.409372][T10967] R10: 000000000000002d R11: 0000000000000246 R12: 0000000000000000 [ 415.409382][T10967] R13: 00007f2f87426038 R14: 00007f2f87425fa0 R15: 00007fffe9cb0ea8 [ 415.409406][T10967] [ 415.701268][T10965] EXT4-fs (loop5): couldn't mount as ext3 due to feature incompatibilities [ 416.127493][ T9] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000010. ret = -EPROTO [ 416.127543][ T9] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 416.270816][ T9] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 416.287553][ T9] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -71 [ 416.336717][ T9] usb 8-1: USB disconnect, device number 9 [ 418.836441][T10993] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 418.836456][T10993] IPv6: NLM_F_CREATE should be set when creating new route [ 418.963487][ T5716] usb 10-1: new low-speed USB device number 2 using dummy_hcd [ 419.039647][T10993] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.040085][T10993] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.137313][ T5716] usb 10-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 419.141204][ T5716] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 419.141227][ T5716] usb 10-1: config 0 has no interface number 0 [ 419.141255][ T5716] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 419.141272][ T5716] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 419.141292][ T5716] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 419.141310][ T5716] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 419.141330][ T5716] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 419.141349][ T5716] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 419.141380][ T5716] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.250757][ T5716] usb 10-1: config 0 descriptor?? [ 419.278749][T10991] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 419.278839][T10991] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 419.518737][T10993] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 419.539381][T10984] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 419.539476][T10984] Bluetooth: hci0: Failed to read MSFT supported features (-4) [ 419.576620][T10993] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 419.640001][ T5716] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 420.135484][ T9] lo speed is unknown, defaulting to 1000 [ 420.135536][ T9] syz0: Port: 1 Link DOWN [ 420.140245][T10997] bridge_slave_0: left allmulticast mode [ 420.140266][T10997] bridge_slave_0: left promiscuous mode [ 420.140427][T10997] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.209254][T10997] bridge_slave_1: left allmulticast mode [ 420.209277][T10997] bridge_slave_1: left promiscuous mode [ 420.209424][T10997] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.295805][T10997] bond2: (slave veth0_to_bond): Releasing backup interface [ 420.295826][T10997] bond2: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 420.360370][T10997] bond0: (slave bond_slave_0): Releasing backup interface [ 420.416760][T10997] bond0: (slave bond_slave_1): Releasing backup interface [ 420.456464][T10997] team0: Port device team_slave_0 removed [ 420.479522][T10997] team0: Port device team_slave_1 removed [ 420.479848][T10997] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 420.507232][T10997] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 420.545982][T10997] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 420.546174][T10998] vlan0: entered promiscuous mode [ 420.571971][ T6736] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.572013][ T6736] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.572041][ T6736] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.572069][ T6736] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.572096][ T6736] netdevsim netdevsim10 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.636800][T11002] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1354'. [ 420.678918][T11000] tipc: Started in network mode [ 420.698479][T11000] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 420.698624][T11000] tipc: Enabled bearer , priority 0 [ 420.747647][T11002] bridge1: port 1(dummy0) entered blocking state [ 420.747738][T11002] bridge1: port 1(dummy0) entered disabled state [ 420.747874][T11002] dummy0: entered allmulticast mode [ 420.767199][T11002] dummy0: entered promiscuous mode [ 420.808512][T11002] netlink: 'syz.7.1354': attribute type 10 has an invalid length. [ 420.808549][T11002] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1354'. [ 420.812219][T11002] bridge1: port 1(dummy0) entered blocking state [ 420.812371][T11002] bridge1: port 1(dummy0) entered forwarding state [ 420.951091][T11002] dummy0: left allmulticast mode [ 420.951287][T11002] bridge1: port 1(dummy0) entered disabled state [ 422.055382][ T9] usb 10-1: USB disconnect, device number 2 [ 422.077649][T11011] loop8: detected capacity change from 0 to 512 [ 422.135502][ T9] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 422.152192][T11011] EXT4-fs (loop8): Test dummy encryption mode enabled [ 422.152247][T11011] EXT4-fs (loop8): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 422.152266][T11011] EXT4-fs (loop8): feature flags set on rev 0 fs, running e2fsck is recommended [ 422.152276][T11011] EXT4-fs (loop8): Couldn't mount because of unsupported optional features (fffc1829) [ 422.152289][T11011] EXT4-fs (loop8): couldn't mount as ext3 due to feature incompatibilities [ 422.161228][ T192] tipc: Node number set to 11578026 [ 422.855497][T11026] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1362'. [ 422.978239][T11024] lo speed is unknown, defaulting to 1000 [ 423.092213][T11024] hsr0 speed is unknown, defaulting to 1000 [ 423.579213][T11034] ip_tables: iptables: counters copy to user failed while replacing table [ 423.810844][T11038] Invalid source name [ 423.810861][T11038] UBIFS error (pid: 11038): cannot open "./file0", error -22 [ 431.792594][T11083] loop8: detected capacity change from 0 to 512 [ 431.812250][T11083] EXT4-fs: Ignoring removed mblk_io_submit option [ 431.834620][T11083] EXT4-fs (loop8): orphan cleanup on readonly fs [ 431.836331][T11083] EXT4-fs (loop8): Cannot turn on journaled quota: type 0: error -13 [ 432.069639][T11083] EXT4-fs error (device loop8): ext4_clear_blocks:876: inode #13: comm syz.8.1376: attempt to clear invalid blocks 2 len 1 [ 432.069678][T11083] loop8: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 432.076201][ C0] EXT4-fs (loop8): error count since last fsck: 1 [ 432.076220][ C0] EXT4-fs (loop8): initial error at time 1791208126: ext4_clear_blocks:876: inode 13 [ 432.076243][ C0] EXT4-fs (loop8): last error at time 1791208126: ext4_clear_blocks:876: inode 13 [ 432.204747][T11083] EXT4-fs error (device loop8): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 432.247185][T11083] EXT4-fs error (device loop8): ext4_free_branches:1023: inode #13: comm syz.8.1376: invalid indirect mapped block 1819239214 (level 0) [ 432.247217][T11083] loop8: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 432.287408][T11083] EXT4-fs error (device loop8): ext4_free_branches:1023: inode #13: comm syz.8.1376: invalid indirect mapped block 1819239214 (level 1) [ 432.288404][T11083] loop8: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 432.434714][T11083] EXT4-fs (loop8): 1 truncate cleaned up [ 432.456978][T11083] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 432.592871][T11104] loop7: detected capacity change from 0 to 512 [ 432.643751][T11104] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 432.643840][T11104] ext4 filesystem being mounted at /140/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 432.820158][T11109] EXT4-fs error (device loop7): ext4_do_update_inode:5801: inode #2: comm syz.7.1378: corrupted inode contents [ 432.903038][T10112] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 432.942425][T11109] EXT4-fs error (device loop7): ext4_dirty_inode:6736: inode #2: comm syz.7.1378: mark_inode_dirty error [ 432.961487][T11109] EXT4-fs error (device loop7): ext4_do_update_inode:5801: inode #2: comm syz.7.1378: corrupted inode contents [ 432.982073][T11109] EXT4-fs error (device loop7): __ext4_ext_dirty:207: inode #2: comm syz.7.1378: mark_inode_dirty error [ 433.042473][T11110] EXT4-fs error (device loop7): ext4_do_update_inode:5801: inode #2: comm syz.7.1378: corrupted inode contents [ 433.457919][ T8097] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 433.541274][ T5613] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 433.559352][ T5613] Bluetooth: hci2: unexpected event for opcode 0x2060 [ 434.838137][ T9] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 434.989353][ T9] usb 10-1: New USB device found: idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 434.993148][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 434.993171][ T9] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 434.993189][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 434.993219][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.060252][ T9] usb 10-1: config 0 descriptor?? [ 435.329871][T11142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.346536][T11142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.394175][ T9] ath6kl: Failed to submit usb control message: -71 [ 435.394214][ T9] ath6kl: unable to send the bmi data to the device: -71 [ 435.394247][ T9] ath6kl: Unable to send get target info: -71 [ 435.436353][ T9] ath6kl: Failed to init ath6kl core: -71 [ 435.447487][ T9] ath6kl_usb 10-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 435.480880][ T9] usb 10-1: USB disconnect, device number 3 [ 435.915073][T10117] syz.1.1111 (10117) used greatest stack depth: 14400 bytes left [ 437.521795][ T9] lo speed is unknown, defaulting to 1000 [ 437.521875][ T192] syz1: Port: 1 Link DOWN [ 437.551724][T11189] random: crng reseeded on system resumption [ 437.576610][T11188] loop5: detected capacity change from 0 to 128 [ 437.804020][T11188] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 437.804050][T11188] hpfs: filesystem error: improperly stopped [ 437.804060][T11188] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 437.804071][T11188] hpfs: You really don't want any checks? You are crazy... [ 437.804083][T11188] hpfs: Code page index out of array [ 437.804088][T11188] hpfs: code page support is disabled [ 437.891482][T11188] hpfs: hpfs_map_4sectors(): unaligned read [ 437.892078][T11188] hpfs: hpfs_map_4sectors(): unaligned read [ 437.892089][T11188] hpfs: filesystem error: unable to find root dir [ 438.412352][ T5613] Bluetooth: hci2: unexpected event for opcode 0x041c [ 438.516625][T11204] loop5: detected capacity change from 0 to 512 [ 438.817522][T11204] ceph: No mds server is up or the cluster is laggy [ 439.623449][T11218] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1408'. [ 439.623472][T11218] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1408'. [ 440.732389][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.732435][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.879710][T11237] loop9: detected capacity change from 0 to 512 [ 440.900407][T11237] EXT4-fs: Ignoring removed bh option [ 440.956004][T11237] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 440.956084][T11237] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 441.185942][T11244] FAULT_INJECTION: forcing a failure. [ 441.185942][T11244] name failslab, interval 1, probability 0, space 0, times 0 [ 441.185990][T11244] CPU: 0 UID: 0 PID: 11244 Comm: syz.7.1416 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.186013][T11244] Tainted: [L]=SOFTLOCKUP [ 441.186019][T11244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 441.186032][T11244] Call Trace: [ 441.186038][T11244] [ 441.186045][T11244] dump_stack_lvl+0xe8/0x150 [ 441.186067][T11244] should_fail_ex+0x3eb/0x540 [ 441.186087][T11244] should_failslab+0xa8/0x100 [ 441.186106][T11244] __kvmalloc_node_noprof+0x171/0x820 [ 441.186132][T11244] ? pfifo_fast_init+0x112/0x6c0 [ 441.186147][T11244] ? pfifo_fast_init+0x112/0x6c0 [ 441.186168][T11244] pfifo_fast_init+0x112/0x6c0 [ 441.186191][T11244] qdisc_create_dflt+0x13b/0x4e0 [ 441.186210][T11244] dev_activate+0x37a/0x1150 [ 441.186234][T11244] __dev_open+0x699/0x850 [ 441.186253][T11244] ? __pfx___dev_open+0x10/0x10 [ 441.186267][T11244] ? __dev_change_flags+0x2e2/0x820 [ 441.186285][T11244] ? __local_bh_enable_ip+0xd6/0x140 [ 441.186304][T11244] __dev_change_flags+0x329/0x820 [ 441.186323][T11244] ? __pfx___dev_change_flags+0x10/0x10 [ 441.186339][T11244] ? __pfx___mutex_lock+0x10/0x10 [ 441.186360][T11244] netif_change_flags+0x7c/0x1b0 [ 441.186379][T11244] dev_change_flags+0x128/0x260 [ 441.186397][T11244] devinet_ioctl+0x966/0x1c50 [ 441.186422][T11244] ? __pfx_devinet_ioctl+0x10/0x10 [ 441.186442][T11244] ? get_user_ifreq+0x12b/0x180 [ 441.186459][T11244] inet_ioctl+0x42a/0x560 [ 441.186476][T11244] ? __pfx_inet_ioctl+0x10/0x10 [ 441.186507][T11244] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 441.186524][T11244] ? packet_ioctl+0x26b/0x350 [ 441.186541][T11244] sock_do_ioctl+0x101/0x320 [ 441.186559][T11244] ? __pfx_sock_do_ioctl+0x10/0x10 [ 441.186573][T11244] ? do_futex+0x3e7/0x4e0 [ 441.186599][T11244] sock_ioctl+0x57a/0x7e0 [ 441.186620][T11244] ? __fget_files+0x2a/0x420 [ 441.186638][T11244] ? __pfx_sock_ioctl+0x10/0x10 [ 441.186653][T11244] ? __fget_files+0x2a/0x420 [ 441.186668][T11244] ? __fget_files+0x2a/0x420 [ 441.186686][T11244] ? bpf_lsm_file_ioctl+0x9/0x20 [ 441.186702][T11244] ? __pfx_sock_ioctl+0x10/0x10 [ 441.186717][T11244] __se_sys_ioctl+0xfc/0x170 [ 441.186735][T11244] do_syscall_64+0x166/0x520 [ 441.186749][T11244] ? trace_irq_disable+0x3b/0x140 [ 441.186763][T11244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.186780][T11244] ? clear_bhb_loop+0x70/0xc0 [ 441.186797][T11244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.186818][T11244] RIP: 0033:0x7faec0f9e199 [ 441.186834][T11244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.186848][T11244] RSP: 002b:00007faec1e0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 441.186866][T11244] RAX: ffffffffffffffda RBX: 00007faec1225fa0 RCX: 00007faec0f9e199 [ 441.186878][T11244] RDX: 0000200000000180 RSI: 0000000000008914 RDI: 0000000000000004 [ 441.186888][T11244] RBP: 00007faec10350b8 R08: 0000000000000000 R09: 0000000000000000 [ 441.186898][T11244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 441.186909][T11244] R13: 00007faec1226038 R14: 00007faec1225fa0 R15: 00007ffee5226218 [ 441.186934][T11244] [ 441.554662][T11244] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 441.692676][T10258] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 442.382794][T11265] tipc: Failed to remove unknown binding: 66,0,0/11578026:1728638840/1728638842 [ 442.382821][T11265] tipc: Failed to remove unknown binding: 66,0,0/11578026:1728638840/1728638841 [ 442.400377][T11265] tipc: Failed to remove unknown binding: 66,0,0/11578026:1728638840/1728638842 [ 442.400403][T11265] tipc: Failed to remove unknown binding: 66,0,0/11578026:1728638840/1728638841 [ 442.488474][ T5613] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 442.488670][ T5613] Bluetooth: hci2: Injecting HCI hardware error event [ 442.496646][T10835] Bluetooth: hci2: hardware error 0x00 [ 444.459299][T11012] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 444.569440][T10835] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 444.612732][T11012] usb 10-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 444.625200][T11012] usb 10-1: config 1 has an invalid interface number: 3 but max is 0 [ 444.625222][T11012] usb 10-1: config 1 has no interface number 0 [ 444.651780][T11012] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.651803][T11012] usb 10-1: Product: syz [ 444.651813][T11012] usb 10-1: Manufacturer: syz [ 444.651825][T11012] usb 10-1: SerialNumber: syz [ 444.758049][T11012] usb 10-1: 3:0 : does not exist [ 444.758068][T11012] usb 10-1: 3:0 : does not exist [ 445.062597][T11012] usb 10-1: USB disconnect, device number 4 [ 445.273595][T11300] ip_tables: iptables: counters copy to user failed while replacing table [ 446.100865][T11315] loop9: detected capacity change from 0 to 1024 [ 446.259608][T11315] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 446.692360][T10258] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 448.444152][T11012] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 448.591056][T11012] usb 6-1: Using ep0 maxpacket: 8 [ 448.597265][T11012] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 448.615132][T11012] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 448.615171][T11012] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 448.615188][T11012] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 448.615205][T11012] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 448.615223][T11012] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 448.615254][T11012] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.911077][T11012] usb 6-1: usb_control_msg returned -32 [ 448.911115][T11012] usbtmc 6-1:16.0: can't read capabilities [ 449.388116][T11400] netlink: 'syz.7.1450': attribute type 1 has an invalid length. [ 449.502141][T11400] bond2: entered promiscuous mode [ 449.519509][T11406] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1451'. [ 449.520135][T11400] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.705442][T11408] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.705795][T11408] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 449.748808][T11408] bond2: (slave ip6gre1): Error -95 calling set_mac_address [ 451.153865][ T5801] usb 6-1: USB disconnect, device number 5 [ 451.874831][T11435] nbd5: detected capacity change from 0 to 63 [ 451.913954][T11439] FAULT_INJECTION: forcing a failure. [ 451.913954][T11439] name failslab, interval 1, probability 0, space 0, times 0 [ 451.913983][T11439] CPU: 0 UID: 0 PID: 11439 Comm: syz.7.1458 Tainted: G L syzkaller #0 PREEMPT(full) [ 451.914006][T11439] Tainted: [L]=SOFTLOCKUP [ 451.914012][T11439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 451.914022][T11439] Call Trace: [ 451.914028][T11439] [ 451.914035][T11439] dump_stack_lvl+0xe8/0x150 [ 451.914060][T11439] should_fail_ex+0x3eb/0x540 [ 451.914081][T11439] should_failslab+0xa8/0x100 [ 451.914097][T11439] ? anon_vma_clone+0x3b1/0xa20 [ 451.914112][T11439] kmem_cache_alloc_noprof+0x9c/0x600 [ 451.914131][T11439] ? anon_vma_clone+0x3b1/0xa20 [ 451.914151][T11439] anon_vma_clone+0x3b1/0xa20 [ 451.914172][T11439] __split_vma+0x3e0/0xa90 [ 451.914194][T11439] ? __pfx___split_vma+0x10/0x10 [ 451.914215][T11439] ? kernel_text_address+0xa5/0xe0 [ 451.914240][T11439] ? __kernel_text_address+0xd/0x30 [ 451.914263][T11439] vma_modify+0x6f6/0x1c40 [ 451.914289][T11439] vma_modify_flags_uffd+0x2a5/0x360 [ 451.914307][T11439] ? __pfx_vma_modify_flags_uffd+0x10/0x10 [ 451.914342][T11439] ? vma_can_userfault+0x23c/0x280 [ 451.914361][T11439] userfaultfd_register_range+0x3f8/0x5e0 [ 451.914386][T11439] ? __pfx_userfaultfd_register_range+0x10/0x10 [ 451.914415][T11439] ? mas_find+0x44e/0xcb0 [ 451.914434][T11439] userfaultfd_register+0xa80/0xc90 [ 451.914468][T11439] ? __pfx_userfaultfd_register+0x10/0x10 [ 451.914493][T11439] ? do_futex+0x3e7/0x4e0 [ 451.914523][T11439] userfaultfd_ioctl+0x261/0x560 [ 451.914541][T11439] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 451.914557][T11439] ? __fget_files+0x2a/0x420 [ 451.914576][T11439] ? bpf_lsm_file_ioctl+0x9/0x20 [ 451.914592][T11439] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 451.914607][T11439] __se_sys_ioctl+0xfc/0x170 [ 451.914625][T11439] do_syscall_64+0x166/0x520 [ 451.914639][T11439] ? trace_irq_disable+0x3b/0x140 [ 451.914653][T11439] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.914670][T11439] ? clear_bhb_loop+0x70/0xc0 [ 451.914687][T11439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.914703][T11439] RIP: 0033:0x7faec0f9e199 [ 451.914719][T11439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.914732][T11439] RSP: 002b:00007faec1e0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 451.914750][T11439] RAX: ffffffffffffffda RBX: 00007faec1225fa0 RCX: 00007faec0f9e199 [ 451.914762][T11439] RDX: 0000200000000080 RSI: 00000000c020aa00 RDI: 0000000000000004 [ 451.914773][T11439] RBP: 00007faec10350b8 R08: 0000000000000000 R09: 0000000000000000 [ 451.914783][T11439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 451.914793][T11439] R13: 00007faec1226038 R14: 00007faec1225fa0 R15: 00007ffee5226218 [ 451.914817][T11439] [ 452.357464][T10835] block nbd5: Receive control failed (result -104) [ 452.375317][ T11] block nbd5: Dead connection, failed to find a fallback [ 452.375337][ T11] block nbd5: shutting down sockets [ 452.375423][ T11] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 452.375446][ T11] Buffer I/O error on dev nbd5, logical block 1, async page read [ 452.377636][ T11] I/O error, dev nbd5, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 452.377660][ T11] Buffer I/O error on dev nbd5, logical block 2, async page read [ 452.379344][ T11] I/O error, dev nbd5, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 452.379366][ T11] Buffer I/O error on dev nbd5, logical block 3, async page read [ 452.559173][T11437] block nbd5: NBD_DISCONNECT [ 452.559254][T11437] block nbd5: Send disconnect failed -32 [ 452.582722][ C0] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 452.582812][ C0] Buffer I/O error on dev nbd5, logical block 0, async page read [ 452.655560][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.655592][ T11] Buffer I/O error on dev nbd5, logical block 0, async page read [ 452.655606][ T11] Buffer I/O error on dev nbd5, logical block 1, async page read [ 452.655618][ T11] Buffer I/O error on dev nbd5, logical block 2, async page read [ 452.655629][ T11] Buffer I/O error on dev nbd5, logical block 3, async page read [ 452.676683][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.676712][ T11] Buffer I/O error on dev nbd5, logical block 0, async page read [ 452.676726][ T11] Buffer I/O error on dev nbd5, logical block 1, async page read [ 452.684905][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.693558][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.695392][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.711655][ T11] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 452.723649][T11144] ldm_validate_partition_table(): Disk read failed. [ 452.766071][T11144] Dev nbd5: unable to read RDB block 0 [ 452.813165][T11144] nbd5: unable to read partition table [ 452.830963][T11144] ldm_validate_partition_table(): Disk read failed. [ 452.832913][T11144] Dev nbd5: unable to read RDB block 0 [ 452.850855][T11144] nbd5: unable to read partition table [ 453.321870][T11450] netlink: 'syz.7.1462': attribute type 1 has an invalid length. [ 453.378866][T11454] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1462'. [ 453.405721][T11454] bond3: entered allmulticast mode [ 453.408411][T11455] loop9: detected capacity change from 0 to 256 [ 453.609520][T11450] bond3: (slave bridge2): making interface the new active one [ 453.609542][T11450] bridge2: entered allmulticast mode [ 453.677791][T11450] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 454.189025][T11465] loop7: detected capacity change from 0 to 128 [ 454.314310][T11465] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 454.314339][T11465] hpfs: filesystem error: improperly stopped [ 454.314349][T11465] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 454.314360][T11465] hpfs: You really don't want any checks? You are crazy... [ 454.314369][T11465] hpfs: Code page index out of array [ 454.314376][T11465] hpfs: code page support is disabled [ 454.314448][T11465] hpfs: hpfs_map_4sectors(): unaligned read [ 454.314501][T11465] hpfs: hpfs_map_4sectors(): unaligned read [ 454.314509][T11465] hpfs: filesystem error: unable to find root dir [ 454.546664][T11465] hpfs: hpfs_map_4sectors(): unaligned read [ 454.636604][T11476] loop5: detected capacity change from 0 to 256 [ 455.360344][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 455.513280][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 455.514092][ T9] usb 6-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 455.514981][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 455.514998][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 455.519964][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.519982][ T9] usb 6-1: Product: syz [ 455.519993][ T9] usb 6-1: Manufacturer: syz [ 455.520004][ T9] usb 6-1: SerialNumber: syz [ 455.625612][ T9] usb 6-1: 0:2 : does not exist [ 455.825094][ T9] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 456.042740][ T9] usb 6-1: USB disconnect, device number 6 [ 456.286810][T11144] udevd[11144]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 456.450734][T11501] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1481'. [ 456.450756][T11501] netlink: 'syz.9.1481': attribute type 1 has an invalid length. [ 458.880408][T11509] 8021q: adding VLAN 0 to HW filter on device bond2 [ 458.931454][T11519] loop5: detected capacity change from 0 to 8 [ 458.959118][T11519] SQUASHFS error: zlib decompression failed, data probably corrupt [ 458.959760][T11519] SQUASHFS error: Failed to read block 0x9b: -5 [ 458.959774][T11519] SQUASHFS error: Unable to read metadata cache entry [99] [ 458.959783][T11519] SQUASHFS error: Unable to read inode 0x127 [ 459.019245][T11511] bond2: (slave bridge0): making interface the new active one [ 459.059264][T11511] bond2: (slave bridge0): Enslaving as an active interface with an up link [ 459.168253][T11521] futex_wake_op: syz.1.1484 tries to shift op by 144; fix this program [ 459.310842][ T5801] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 459.461610][ T5801] usb 6-1: Using ep0 maxpacket: 16 [ 459.462192][ T5801] usb 6-1: New USB device found: idVendor=041e, idProduct=3040, bcdDevice=0.40 [ 459.501176][ T5801] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.501202][ T5801] usb 6-1: Product: syz [ 459.501213][ T5801] usb 6-1: Manufacturer: syz [ 459.501223][ T5801] usb 6-1: SerialNumber: syz [ 459.752408][T11526] dummy0: left promiscuous mode [ 459.974151][T11521] futex_wake_op: syz.1.1484 tries to shift op by 144; fix this program [ 460.202362][T11526] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.258263][T11526] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.538555][ T5801] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 460.552700][ T5801] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 460.651494][T11535] netlink: 'syz.7.1490': attribute type 10 has an invalid length. [ 460.726694][ T5801] usb 6-1: USB disconnect, device number 7 [ 460.974898][T11296] udevd[11296]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 461.021405][ T6745] netdevsim netdevsim9 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.022360][ T1428] netdevsim netdevsim9 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.022465][ T1428] netdevsim netdevsim9 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.022518][ T1428] netdevsim netdevsim9 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.116429][T11529] loop8: detected capacity change from 0 to 32768 [ 461.298674][T11529] XFS (loop8): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 461.392630][T11529] XFS (loop8): Ending clean mount [ 461.955920][T11553] tipc: Resetting bearer [ 465.550493][T11614] netlink: 'syz.9.1511': attribute type 1 has an invalid length. [ 465.721056][T11614] 8021q: adding VLAN 0 to HW filter on device bond3 [ 465.790643][ T33] kauditd_printk_skb: 49 callbacks suppressed [ 465.790658][ T33] audit: type=1326 audit(1791208160.268:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11607 comm="syz.1.1509" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x0 [ 465.847701][T11618] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 465.882763][T11618] bond3: (slave batadv1): making interface the new active one [ 465.891958][T11618] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 465.990827][T11614] bond3 (unregistering): (slave batadv1): Releasing active interface [ 466.025747][T11614] bond3 (unregistering): Released all slaves [ 466.154281][T11012] XFS (loop8): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 466.756630][T11626] netlink: 'syz.9.1515': attribute type 1 has an invalid length. [ 466.774584][T10112] XFS (loop8): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 466.946420][T11626] 8021q: adding VLAN 0 to HW filter on device bond3 [ 467.262998][T11628] bond3: (slave veth3): Enslaving as an active interface with a down link [ 467.264776][T11629] veth0_virt_wifi: entered promiscuous mode [ 467.297959][T11629] bond3: (slave veth0_virt_wifi): Enslaving as an active interface with a down link [ 467.319936][T11626] bond3: (slave veth0_virt_wifi): Releasing active interface [ 467.777729][T11636] 8021q: adding VLAN 0 to HW filter on device bond1 [ 468.014104][T11639] bond1: (slave ip6erspan0): making interface the new active one [ 468.079584][T11639] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 469.265933][T11653] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1520'. [ 469.265957][T11653] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1520'. [ 469.380506][T11012] hsr0 speed is unknown, defaulting to 1000 [ 469.569706][T11652] 8021q: adding VLAN 0 to HW filter on device bond4 [ 469.596175][T11653] 8021q: adding VLAN 0 to HW filter on device bond0 [ 469.636231][T11653] bond4: (slave bond0): making interface the new active one [ 469.652715][T11653] bond4: (slave bond0): Enslaving as an active interface with an up link [ 469.655597][ T10] syz1: Port: 1 Link ACTIVE [ 470.125846][T11667] fuse: fd is not a fuse device [ 470.326808][T11671] netlink: 'syz.9.1526': attribute type 1 has an invalid length. [ 470.371068][T11675] netlink: 'syz.5.1529': attribute type 1 has an invalid length. [ 470.425136][T11674] kvm [11670]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010002) = 0x80ffffff [ 470.493511][T11684] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1529'. [ 470.497385][T11671] 8021q: adding VLAN 0 to HW filter on device bond4 [ 470.608403][T11675] bond3: entered promiscuous mode [ 470.608426][T11675] bond3: entered allmulticast mode [ 470.610136][T11675] 8021q: adding VLAN 0 to HW filter on device bond3 [ 470.642761][T11679] bond1: (slave veth0_to_bond): Releasing active interface [ 470.699988][T11679] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 470.877670][T11693] FAULT_INJECTION: forcing a failure. [ 470.877670][T11693] name failslab, interval 1, probability 0, space 0, times 0 [ 470.877698][T11693] CPU: 0 UID: 0 PID: 11693 Comm: syz.7.1533 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.877722][T11693] Tainted: [L]=SOFTLOCKUP [ 470.877734][T11693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 470.877746][T11693] Call Trace: [ 470.877752][T11693] [ 470.877759][T11693] dump_stack_lvl+0xe8/0x150 [ 470.877782][T11693] should_fail_ex+0x3eb/0x540 [ 470.877877][T11693] should_failslab+0xa8/0x100 [ 470.877896][T11693] __kmalloc_noprof+0xf9/0x710 [ 470.877913][T11693] ? sk_prot_alloc+0xe7/0x210 [ 470.877961][T11693] ? sk_prot_alloc+0xe7/0x210 [ 470.877982][T11693] sk_prot_alloc+0xe7/0x210 [ 470.877996][T11693] ? sk_alloc+0x27/0x390 [ 470.878013][T11693] sk_alloc+0x3a/0x390 [ 470.878031][T11693] __netlink_create+0x62/0x260 [ 470.878069][T11693] ? __pfx_genl_release+0x10/0x10 [ 470.878091][T11693] netlink_create+0x3ca/0x590 [ 470.878106][T11693] ? __pfx_genl_unbind+0x10/0x10 [ 470.878121][T11693] ? __pfx_genl_bind+0x10/0x10 [ 470.878138][T11693] __sock_create+0x4b5/0xac0 [ 470.878180][T11693] __sys_socket+0xd6/0x1b0 [ 470.878198][T11693] __x64_sys_socket+0x7a/0x90 [ 470.878215][T11693] do_syscall_64+0x166/0x520 [ 470.878254][T11693] ? trace_irq_disable+0x3b/0x140 [ 470.878269][T11693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.878286][T11693] ? clear_bhb_loop+0x70/0xc0 [ 470.878303][T11693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.878320][T11693] RIP: 0033:0x7faec0f9fa07 [ 470.878335][T11693] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.878350][T11693] RSP: 002b:00007faec1e08f98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 470.878368][T11693] RAX: ffffffffffffffda RBX: 00007faec1225fa0 RCX: 00007faec0f9fa07 [ 470.878381][T11693] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 470.878391][T11693] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 470.878401][T11693] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 470.878411][T11693] R13: 00007faec1226038 R14: 00007faec1225fa0 R15: 00007ffee5226218 [ 470.878435][T11693] [ 471.505140][T11681] erspan1: entered allmulticast mode [ 471.532165][T11681] bond3: (slave erspan1): making interface the new active one [ 471.533969][T11681] erspan1: entered promiscuous mode [ 471.565633][T11681] bond3: (slave erspan1): Enslaving as an active interface with an up link [ 471.606047][T11684] bond3 (unregistering): (slave erspan1): Releasing active interface [ 471.606071][T11684] erspan1: left promiscuous mode [ 471.630625][T11684] bond3 (unregistering): Released all slaves [ 472.319909][T11722] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1542'. [ 472.344159][T11722] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1542'. [ 472.472229][T11726] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1542'. [ 476.734742][T11753] syzkaller0: entered promiscuous mode [ 476.734761][T11753] syzkaller0: entered allmulticast mode [ 476.788939][ T6740] IPVS: starting estimator thread 0... [ 476.874970][T11757] IPVS: using max 37 ests per chain, 88800 per kthread [ 476.971807][T11761] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1549'. [ 477.672817][T11772] loop8: detected capacity change from 0 to 128 [ 477.764440][ T33] audit: type=1804 audit(1791208172.237:714): pid=11772 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.1554" name="/newroot/68/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus" dev="loop8" ino=120 res=1 errno=0 [ 477.883053][ T192] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 478.023696][T11783] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 478.047538][ T192] usb 8-1: New USB device found: idVendor=1e7d, idProduct=2d5a, bcdDevice=0.00 [ 478.051782][ T192] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.051809][ T192] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 478.051841][ T192] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.111521][ T192] usb 8-1: config 0 descriptor?? [ 478.589383][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589413][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589433][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589453][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589472][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589492][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589511][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589531][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589550][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.589574][ T192] savu 0003:1E7D:2D5A.0006: unknown main item tag 0x0 [ 478.656272][T10835] Bluetooth: hci4: command 0x0406 tx timeout [ 478.711110][ T192] savu 0003:1E7D:2D5A.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.7-1/input0 [ 479.513721][ T192] usb 8-1: USB disconnect, device number 10 [ 479.577389][T11795] syz_tun: entered allmulticast mode [ 479.955282][T11804] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1561'. [ 479.955337][T11804] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1561'. [ 480.386547][T11805] syzkaller0: entered promiscuous mode [ 480.386569][T11805] syzkaller0: entered allmulticast mode [ 480.449005][T11801] lo speed is unknown, defaulting to 1000 [ 483.863299][T11878] xt_IDLETIMER: timeout value is zero [ 484.011723][T11882] netlink: 'syz.9.1580': attribute type 1 has an invalid length. [ 487.588291][T11801] hsr0 speed is unknown, defaulting to 1000 [ 487.619973][T11860] pimreg: entered allmulticast mode [ 487.620147][T11865] pimreg: left allmulticast mode [ 487.620208][T11865] syz_tun: left allmulticast mode [ 487.651711][T11882] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 488.467775][ T33] audit: type=1326 audit(1791208182.946:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11914 comm="syz.1.1589" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x7ffc0000 [ 488.467956][ T33] audit: type=1326 audit(1791208182.946:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11914 comm="syz.1.1589" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x7ffc0000 [ 488.468662][ T33] audit: type=1326 audit(1791208182.946:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11914 comm="syz.1.1589" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f993f99e199 code=0x7ffc0000 [ 488.688764][T11920] loop5: detected capacity change from 0 to 256 [ 488.780600][T11920] FAT-fs (loop5): error, allocated dir entry found after end-of-directory marker (i_pos 1) [ 488.780655][T11920] FAT-fs (loop5): Filesystem has been set read-only [ 488.849350][ T33] audit: type=1326 audit(1791208183.316:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11914 comm="syz.1.1589" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x7ffc0000 [ 488.849422][ T33] audit: type=1326 audit(1791208183.326:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11914 comm="syz.1.1589" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x7ffc0000 [ 489.242291][T11935] FAULT_INJECTION: forcing a failure. [ 489.242291][T11935] name failslab, interval 1, probability 0, space 0, times 0 [ 489.242321][T11935] CPU: 0 UID: 0 PID: 11935 Comm: syz.8.1595 Tainted: G L syzkaller #0 PREEMPT(full) [ 489.242345][T11935] Tainted: [L]=SOFTLOCKUP [ 489.242351][T11935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 489.242362][T11935] Call Trace: [ 489.242369][T11935] [ 489.242384][T11935] dump_stack_lvl+0xe8/0x150 [ 489.242407][T11935] should_fail_ex+0x3eb/0x540 [ 489.242428][T11935] should_failslab+0xa8/0x100 [ 489.242445][T11935] ? fanotify_add_mark+0x31f/0x1290 [ 489.242462][T11935] kmem_cache_alloc_noprof+0x9c/0x600 [ 489.242480][T11935] ? fsnotify_grab_connector+0x42/0x240 [ 489.242497][T11935] ? fanotify_add_mark+0x31f/0x1290 [ 489.242519][T11935] fanotify_add_mark+0x31f/0x1290 [ 489.242549][T11935] do_fanotify_mark+0xe8f/0x1020 [ 489.242574][T11935] ? __pfx_do_fanotify_mark+0x10/0x10 [ 489.242595][T11935] ? rcu_is_watching+0x16/0xb0 [ 489.242616][T11935] __x64_sys_fanotify_mark+0xb5/0xd0 [ 489.242636][T11935] do_syscall_64+0x166/0x520 [ 489.242651][T11935] ? trace_irq_disable+0x3b/0x140 [ 489.242667][T11935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.242684][T11935] ? clear_bhb_loop+0x70/0xc0 [ 489.242702][T11935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.242719][T11935] RIP: 0033:0x7f2f8719e199 [ 489.242734][T11935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.242749][T11935] RSP: 002b:00007f2f88026028 EFLAGS: 00000246 ORIG_RAX: 000000000000012d [ 489.242768][T11935] RAX: ffffffffffffffda RBX: 00007f2f87425fa0 RCX: 00007f2f8719e199 [ 489.242780][T11935] RDX: 000000000000001a RSI: 0000000000000039 RDI: 0000000000000005 [ 489.242791][T11935] RBP: 00007f2f872350b8 R08: 0000000000000000 R09: 0000000000000000 [ 489.242802][T11935] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 489.242812][T11935] R13: 00007f2f87426038 R14: 00007f2f87425fa0 R15: 00007fffe9cb0ea8 [ 489.242838][T11935] [ 490.278940][T11932] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 490.956151][T11959] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 490.981866][T11941] loop8: detected capacity change from 0 to 32768 [ 491.044759][T11941] XFS (loop8): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 491.128237][T11941] XFS (loop8): Ending clean mount [ 491.396983][ T33] audit: type=1800 audit(1791208185.876:720): pid=11941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1598" name="file1" dev="loop8" ino=4422 res=0 errno=-22 [ 491.728647][T11980] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1609'. [ 491.836386][T11980] bond5: entered promiscuous mode [ 491.851136][T11980] 8021q: adding VLAN 0 to HW filter on device bond5 [ 491.928689][T11980] netlink: 28 bytes leftover after parsing attributes in process `syz.9.1609'. [ 491.928751][T11980] bond5: entered allmulticast mode [ 492.022123][T11980] bridge1: entered promiscuous mode [ 492.022254][T11980] bridge1: entered allmulticast mode [ 492.057586][T11980] bond5: (slave bridge1): Enslaving as an active interface with an up link [ 492.612320][T10112] XFS (loop8): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 493.458520][ T33] audit: type=1326 audit(1791208187.925:721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.458565][ T33] audit: type=1326 audit(1791208187.925:722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.520782][ T33] audit: type=1326 audit(1791208188.005:723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.520825][ T33] audit: type=1326 audit(1791208188.005:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.520858][ T33] audit: type=1326 audit(1791208188.005:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.629834][ T33] audit: type=1326 audit(1791208188.105:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.629877][ T33] audit: type=1326 audit(1791208188.105:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.629909][ T33] audit: type=1326 audit(1791208188.105:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.718162][ T33] audit: type=1326 audit(1791208188.195:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f4497f5e9ce code=0x7ffc0000 [ 493.718206][ T33] audit: type=1326 audit(1791208188.195:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.718239][ T33] audit: type=1326 audit(1791208188.195:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 493.834692][ T33] audit: type=1326 audit(1791208188.305:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.9.1615" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4497f9e199 code=0x7ffc0000 [ 494.007446][T12006] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1616'. [ 494.015967][T10835] Bluetooth: hci3: command 0x0406 tx timeout [ 494.147547][T12011] netlink: 'syz.1.1616': attribute type 5 has an invalid length. [ 494.147568][T12011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1616'. [ 498.283203][T12065] syz_tun (unregistering): left allmulticast mode [ 498.292851][T12065] bond1: (slave syz_tun): Releasing active interface [ 499.424919][T12087] netlink: 'syz.8.1643': attribute type 1 has an invalid length. [ 502.185409][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.185456][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.980268][T12107] bridge0: port 1(syz_tun) entered blocking state [ 502.980344][T12107] bridge0: port 1(syz_tun) entered disabled state [ 502.980478][T12107] syz_tun: entered allmulticast mode [ 503.051768][T12107] syz_tun: entered promiscuous mode [ 503.073437][T12108] netlink: 'syz.9.1649': attribute type 49 has an invalid length. [ 503.480726][T12111] lo speed is unknown, defaulting to 1000 [ 503.499094][T12111] hsr0 speed is unknown, defaulting to 1000 [ 504.742589][T12135] netlink: 'syz.8.1656': attribute type 8 has an invalid length. [ 505.135979][T12141] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 505.813507][T12161] loop7: detected capacity change from 0 to 1024 [ 505.853766][T12161] EXT4-fs (loop7): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 505.853847][T12161] ext4 filesystem being mounted at /195/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 506.241090][ T8097] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 506.891342][T12176] loop5: detected capacity change from 0 to 2048 [ 507.257129][T12176] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 507.304342][T12176] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 508.008616][T12176] UDF-fs: error (device loop5): udf_verify_fi: directory (ino 1376) has too big (552) entry at pos 1520 [ 508.061236][T12176] UDF-fs: error (device loop5): udf_verify_fi: directory (ino 1376) has too big (552) entry at pos 1520 [ 508.088128][T12193] mac80211_hwsim hwsim18 syzkaller0: left promiscuous mode [ 508.088152][T12193] mac80211_hwsim hwsim18 syzkaller0: left allmulticast mode [ 508.683900][T12201] tipc: Enabling of bearer rejected, failed to enable media [ 508.868934][T12204] FAULT_INJECTION: forcing a failure. [ 508.868934][T12204] name failslab, interval 1, probability 0, space 0, times 0 [ 508.868964][T12204] CPU: 0 UID: 0 PID: 12204 Comm: syz.5.1675 Tainted: G L syzkaller #0 PREEMPT(full) [ 508.868989][T12204] Tainted: [L]=SOFTLOCKUP [ 508.868996][T12204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 508.869006][T12204] Call Trace: [ 508.869014][T12204] [ 508.869024][T12204] dump_stack_lvl+0xe8/0x150 [ 508.869049][T12204] should_fail_ex+0x3eb/0x540 [ 508.869074][T12204] should_failslab+0xa8/0x100 [ 508.869092][T12204] __kmalloc_cache_node_noprof+0xa5/0x620 [ 508.869111][T12204] ? bdi_alloc+0x51/0x110 [ 508.869125][T12204] ? bdi_alloc+0x51/0x110 [ 508.869140][T12204] ? __alloc_disk_node+0x5e/0x600 [ 508.869231][T12204] bdi_alloc+0x51/0x110 [ 508.869248][T12204] __alloc_disk_node+0xab/0x600 [ 508.869267][T12204] __blk_alloc_disk+0x105/0x1d0 [ 508.869285][T12204] ? __pfx___blk_alloc_disk+0x10/0x10 [ 508.869320][T12204] ? __raw_spin_lock_init+0x45/0x100 [ 508.869338][T12204] dm_create+0x476/0xf70 [ 508.869384][T12204] dev_create+0x1f7/0x400 [ 508.869420][T12204] ? __pfx_dev_create+0x10/0x10 [ 508.869436][T12204] ? __might_fault+0xaf/0x130 [ 508.869458][T12204] dm_ctl_ioctl+0x9ec/0xe10 [ 508.869480][T12204] ? __pfx_dev_create+0x10/0x10 [ 508.869495][T12204] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 508.869535][T12204] ? __fget_files+0x2a/0x420 [ 508.869556][T12204] ? bpf_lsm_file_ioctl+0x9/0x20 [ 508.869571][T12204] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 508.869589][T12204] __se_sys_ioctl+0xfc/0x170 [ 508.869608][T12204] do_syscall_64+0x166/0x520 [ 508.869623][T12204] ? trace_irq_disable+0x3b/0x140 [ 508.869640][T12204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.869657][T12204] ? clear_bhb_loop+0x70/0xc0 [ 508.869675][T12204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.869692][T12204] RIP: 0033:0x7f97c339e199 [ 508.869708][T12204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.869723][T12204] RSP: 002b:00007f97c15f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 508.869741][T12204] RAX: ffffffffffffffda RBX: 00007f97c3625fa0 RCX: 00007f97c339e199 [ 508.869753][T12204] RDX: 0000200000000000 RSI: 00000000c138fd03 RDI: 0000000000000003 [ 508.869764][T12204] RBP: 00007f97c34350b8 R08: 0000000000000000 R09: 0000000000000000 [ 508.869775][T12204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 508.869791][T12204] R13: 00007f97c3626038 R14: 00007f97c3625fa0 R15: 00007fffa0a8d398 [ 508.869817][T12204] [ 510.277062][T12197] loop7: detected capacity change from 0 to 40427 [ 510.302816][T12197] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12 [ 510.302838][T12197] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 510.431341][T12197] F2FS-fs (loop7): invalid crc value [ 510.859455][T12227] netlink: 'syz.9.1684': attribute type 1 has an invalid length. [ 510.859477][T12227] netlink: 'syz.9.1684': attribute type 2 has an invalid length. [ 510.893854][T12197] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 510.992784][T12231] loop8: detected capacity change from 0 to 256 [ 511.081754][T12197] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 511.081779][T12197] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 511.119908][T12230] lo speed is unknown, defaulting to 1000 [ 511.211542][T12230] hsr0 speed is unknown, defaulting to 1000 [ 511.623980][T12245] F2FS-fs (loop7): Stopped filesystem due to reason: 0 [ 511.718452][T12241] lo speed is unknown, defaulting to 1000 [ 511.772427][T12241] hsr0 speed is unknown, defaulting to 1000 [ 515.512267][T12300] netlink: 'syz.9.1700': attribute type 1 has an invalid length. [ 515.773945][T12302] 8021q: adding VLAN 0 to HW filter on device bond7 [ 515.811390][T12302] bond6: (slave bond7): making interface the new active one [ 515.811725][T12302] bond6: (slave bond7): Enslaving as an active interface with an up link [ 515.850154][T12310] loop5: detected capacity change from 0 to 128 [ 515.943076][T12310] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x00000000 (sector = 1) [ 516.024492][T12300] 8021q: adding VLAN 0 to HW filter on device bond8 [ 516.039291][T12300] bond6: (slave bond8): Enslaving as a backup interface with an up link [ 518.106236][T12344] xt_limit: Overflow, try lower: 1207959552/384 [ 519.487468][T12360] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1714'. [ 519.487630][T12360] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1714'. [ 520.597342][ T5716] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 520.749681][ T5716] usb 6-1: New USB device found: idVendor=1e59, idProduct=0002, bcdDevice=98.ed [ 520.755683][ T5716] usb 6-1: config 253 has an invalid interface number: 130 but max is 0 [ 520.755705][ T5716] usb 6-1: config 253 has no interface number 0 [ 520.755727][ T5716] usb 6-1: config 253 interface 130 has no altsetting 0 [ 520.806376][ T5716] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.806398][ T5716] usb 6-1: Product: syz [ 520.806409][ T5716] usb 6-1: Manufacturer: syz [ 520.806421][ T5716] usb 6-1: SerialNumber: syz [ 524.737321][T12414] netlink: 'syz.1.1729': attribute type 1 has an invalid length. [ 524.847265][T12414] 8021q: adding VLAN 0 to HW filter on device bond1 [ 525.079314][T12416] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 526.110007][ T5716] dvb-usb: found a 'EvolutePC TVWay+' in cold state, will try to load a firmware [ 526.564849][T12427] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1732'. [ 526.588458][ T5716] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 526.588569][ T5716] dib0700: firmware download failed at 7 with -22 [ 526.638062][ T5716] usb 6-1: USB disconnect, device number 8 [ 527.129135][T12427] hsr_slave_1 (unregistering): left promiscuous mode [ 527.469891][T12434] Set syz1 is full, maxelem 6117 reached [ 529.602181][T12455] xt_socket: unknown flags 0x4c [ 532.768825][T12508] loop7: detected capacity change from 0 to 1024 [ 532.792841][T12508] EXT4-fs (loop7): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 532.792865][T12508] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (42152!=20869) [ 532.792935][T12508] EXT4-fs (loop7): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 532.795132][T12508] EXT4-fs error (device loop7): ext4_get_journal_inode:5927: inode #32: comm syz.7.1750: iget: special inode unallocated [ 532.795155][T12508] loop7: lost file I/O error report for ino 32 type 5 pos 0x0 len 0x0 error -117 [ 532.796584][ C0] EXT4-fs (loop7): error count since last fsck: 1 [ 532.796600][ C0] EXT4-fs (loop7): initial error at time 1791208227: ext4_get_journal_inode:5927: inode 32 [ 532.796623][ C0] EXT4-fs (loop7): last error at time 1791208227: ext4_get_journal_inode:5927: inode 32 [ 532.820939][T12508] EXT4-fs (loop7): no journal found [ 532.820954][T12508] EXT4-fs (loop7): can't get journal size [ 532.912648][T12508] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 533.211143][ T8097] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 533.959675][T12534] loop8: detected capacity change from 0 to 512 [ 533.988827][T12534] EXT4-fs: Ignoring removed mblk_io_submit option [ 534.063764][T12534] EXT4-fs error (device loop8): ext4_iget_extra_inode:5210: inode #15: comm syz.8.1756: corrupted in-inode xattr: e_value size too large [ 534.063794][T12534] loop8: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 534.078259][ C0] EXT4-fs (loop8): error count since last fsck: 1 [ 534.078279][ C0] EXT4-fs (loop8): initial error at time 1791208228: ext4_iget_extra_inode:5210: inode 15 [ 534.078302][ C0] EXT4-fs (loop8): last error at time 1791208228: ext4_iget_extra_inode:5210: inode 15 [ 534.080771][T12534] EXT4-fs error (device loop8): ext4_orphan_get:1408: comm syz.8.1756: couldn't read orphan inode 15 (err -117) [ 534.080795][T12534] loop8: lost filesystem error report for type 5 error -117 [ 534.210490][T12534] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 535.003839][T10112] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 537.633398][T12608] loop7: detected capacity change from 0 to 256 [ 539.300642][T12618] ref_ctr_offset mismatch. inode: 0x242 offset: 0x0 ref_ctr_offset(old): 0x30 ref_ctr_offset(new): 0x0 [ 541.500737][T12644] loop8: detected capacity change from 0 to 256 [ 541.516948][T12644] exFAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 541.516963][T12644] exFAT-fs (loop8): Medium has reported failures. Some data may be lost. [ 541.594619][T12644] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 541.749964][T12644] exFAT-fs (loop8): failed to load alloc-bitmap [ 541.749980][T12644] exFAT-fs (loop8): failed to recognize exfat type [ 543.274231][T12660] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1789'. [ 543.274284][T12660] netlink: 6 bytes leftover after parsing attributes in process `syz.7.1789'. [ 543.562853][T12667] mac80211_hwsim hwsim18 syzkaller0: entered promiscuous mode [ 543.562877][T12667] mac80211_hwsim hwsim18 syzkaller0: entered allmulticast mode [ 544.291905][ T5716] lo speed is unknown, defaulting to 1000 [ 544.291941][ T5716] syz0: Port: 1 Link ACTIVE [ 544.350158][T12672] lo speed is unknown, defaulting to 1000 [ 544.372550][T12672] hsr0 speed is unknown, defaulting to 1000 [ 546.683779][T12703] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1802'. [ 546.719648][ T9] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 546.877231][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 546.877915][ T9] usb 8-1: New USB device found: idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 546.898717][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.898738][ T9] usb 8-1: Product: syz [ 546.898750][ T9] usb 8-1: Manufacturer: syz [ 546.898761][ T9] usb 8-1: SerialNumber: syz [ 546.962552][ T9] r8152-cfgselector 8-1: Unknown version 0x0000 [ 546.962575][ T9] r8152-cfgselector 8-1: config 0 descriptor?? [ 547.346008][T12707] netlink: 'syz.5.1804': attribute type 4 has an invalid length. [ 547.360230][T12707] netlink: 'syz.5.1804': attribute type 4 has an invalid length. [ 547.449243][ T9] r8152-cfgselector 8-1: USB disconnect, device number 11 [ 548.364688][T12718] netlink: 14 bytes leftover after parsing attributes in process `syz.8.1807'. [ 549.470879][ T6740] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.224138][ T6740] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.698646][ T6740] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.012158][T12757] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1819'. [ 551.235571][T12760] loop7: detected capacity change from 0 to 1024 [ 552.289994][T12760] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 552.623974][T12760] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 552.674366][ T6740] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.823647][T12776] FAULT_INJECTION: forcing a failure. [ 552.823647][T12776] name failslab, interval 1, probability 0, space 0, times 0 [ 552.823677][T12776] CPU: 0 UID: 0 PID: 12776 Comm: syz.8.1824 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.823700][T12776] Tainted: [L]=SOFTLOCKUP [ 552.823707][T12776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 552.823719][T12776] Call Trace: [ 552.823725][T12776] [ 552.823732][T12776] dump_stack_lvl+0xe8/0x150 [ 552.823756][T12776] should_fail_ex+0x3eb/0x540 [ 552.823777][T12776] should_failslab+0xa8/0x100 [ 552.823796][T12776] __kmalloc_cache_noprof+0x9e/0x600 [ 552.823813][T12776] ? percpu_ref_init+0xc5/0x350 [ 552.823903][T12776] ? percpu_ref_init+0xc5/0x350 [ 552.823924][T12776] ? __pfx_css_release+0x10/0x10 [ 552.823939][T12776] percpu_ref_init+0xc5/0x350 [ 552.823958][T12776] cgroup_mkdir+0x2f3/0x14b0 [ 552.823977][T12776] ? kernfs_root+0x1c/0x230 [ 552.823992][T12776] ? kernfs_root+0x1c/0x230 [ 552.824010][T12776] ? __pfx_cgroup_mkdir+0x10/0x10 [ 552.824026][T12776] kernfs_iop_mkdir+0x213/0x360 [ 552.824046][T12776] vfs_mkdir+0x40e/0x630 [ 552.824067][T12776] filename_mkdirat+0x285/0x510 [ 552.824082][T12776] ? __might_fault+0xaf/0x130 [ 552.824102][T12776] ? __pfx_filename_mkdirat+0x10/0x10 [ 552.824121][T12776] ? do_getname+0x151/0x250 [ 552.824141][T12776] __se_sys_mkdirat+0x35/0x150 [ 552.824159][T12776] do_syscall_64+0x166/0x520 [ 552.824175][T12776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.824192][T12776] ? clear_bhb_loop+0x70/0xc0 [ 552.824210][T12776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.824226][T12776] RIP: 0033:0x7f2f8719e199 [ 552.824242][T12776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.824257][T12776] RSP: 002b:00007f2f88026028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 552.824275][T12776] RAX: ffffffffffffffda RBX: 00007f2f87425fa0 RCX: 00007f2f8719e199 [ 552.824288][T12776] RDX: 00000000000001ff RSI: 0000200000000040 RDI: ffffffffffffff9c [ 552.824300][T12776] RBP: 00007f2f872350b8 R08: 0000000000000000 R09: 0000000000000000 [ 552.824311][T12776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 552.824354][T12776] R13: 00007f2f87426038 R14: 00007f2f87425fa0 R15: 00007fffe9cb0ea8 [ 552.824381][T12776] [ 553.186183][ T8097] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 557.062232][T12787] bridge0: entered promiscuous mode [ 557.078035][ T8074] netdevsim netdevsim4 eth13: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.208251][T12805] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.208709][T12805] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.250758][T12805] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.250917][T12805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 557.251193][T12805] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.251282][T12805] bridge0: port 1(bridge_slave_0) entered forwarding state [ 557.335317][T12805] team0: Port device bridge0 added [ 557.343017][T12784] lo speed is unknown, defaulting to 1000 [ 557.350539][ T6736] netdevsim netdevsim4 eth14: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.567941][T12809] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.575940][T12809] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.810499][T12784] hsr0 speed is unknown, defaulting to 1000 [ 557.810546][T12802] lo speed is unknown, defaulting to 1000 [ 558.080394][ T6744] netdevsim netdevsim4 eth15: set [1, 0] type 2 family 0 port 6081 - 0 [ 558.082879][T12802] hsr0 speed is unknown, defaulting to 1000 [ 558.156707][ T6740] bridge_slave_1: left allmulticast mode [ 558.156730][ T6740] bridge_slave_1: left promiscuous mode [ 558.156888][ T6740] bridge0: port 2(bridge_slave_1) entered disabled state [ 558.188243][ T6740] bridge_slave_0: left allmulticast mode [ 558.188266][ T6740] bridge_slave_0: left promiscuous mode [ 558.188444][ T6740] bridge0: port 1(bridge_slave_0) entered disabled state [ 558.463451][T12823] picdev_write: 21 callbacks suppressed [ 558.463482][T12823] kvm: pic: non byte write [ 558.504874][T12823] kvm: user requested TSC rate below hardware speed [ 558.505179][T12823] kvm: vcpu 0: requested 1536 ns lapic timer period limited to 200000 ns [ 558.505195][T12823] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=540686624 (1081373248 ns) > initial count (200000 ns). Using initial count to start timer. [ 558.676381][ T6740] bond2 (unregistering): (slave geneve2): Releasing active interface [ 558.739312][ T6740] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 558.742131][ T6740] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 558.743579][ T6740] bond0 (unregistering): Released all slaves [ 558.789639][ T6740] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 558.791218][ T6740] bond1 (unregistering): Released all slaves [ 558.876626][ T6740] bond2 (unregistering): Released all slaves [ 559.173014][ T6740] tipc: Left network mode [ 559.629603][ T8076] netdevsim netdevsim4 eth16: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.754150][T12842] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1844'. [ 560.269132][T12852] loop8: detected capacity change from 0 to 512 [ 560.289349][T12852] EXT4-fs: Ignoring removed nomblk_io_submit option [ 560.289389][T12852] EXT4-fs: Ignoring removed mblk_io_submit option [ 560.366545][T12852] EXT4-fs (loop8): mounting ext3 file system using the ext4 subsystem [ 560.419855][T12853] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1847'. [ 560.419884][T12853] netlink: 'syz.5.1847': attribute type 7 has an invalid length. [ 560.419895][T12853] netlink: 'syz.5.1847': attribute type 8 has an invalid length. [ 560.419905][T12853] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1847'. [ 560.720190][T12852] EXT4-fs (loop8): 1 truncate cleaned up [ 562.196808][T12863] __vm_enough_memory: pid: 12863, comm: syz.1.1848, bytes: 4503599627366400 not enough memory for the allocation [ 563.620276][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.620322][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.833060][T12852] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 564.771038][ T33] kauditd_printk_skb: 88 callbacks suppressed [ 564.771061][ T33] audit: type=1326 audit(1791208259.252:821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12880 comm="syz.1.1854" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f993f99e199 code=0x0 [ 564.877076][T10112] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 565.671364][ T6740] team0 (unregistering): Port device team_slave_1 removed [ 565.750049][ T6740] team0 (unregistering): Port device team_slave_0 removed [ 566.354685][T12853] ip6gretap0: entered promiscuous mode [ 566.359513][T12853] syz_tun: entered promiscuous mode [ 566.416914][T12853] gretap0: entered promiscuous mode [ 566.443360][ T5271] 8021q: adding VLAN 0 to HW filter on device eth13 [ 567.994040][T12913] netlink: 'syz.9.1863': attribute type 4 has an invalid length. [ 568.035729][T12913] netlink: 'syz.9.1863': attribute type 4 has an invalid length. [ 568.084008][ T33] audit: type=1326 audit(1791208262.562:822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12884 comm="syz.7.1855" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faec0f9e199 code=0x0 [ 568.145733][T12885] lo speed is unknown, defaulting to 1000 [ 568.167454][T12885] hsr0 speed is unknown, defaulting to 1000 [ 568.369327][T12917] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1865'. [ 571.213358][ T5271] 8021q: adding VLAN 0 to HW filter on device eth14 [ 573.895306][ T5271] 8021q: adding VLAN 0 to HW filter on device eth15 [ 574.032599][T13014] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1888'. [ 579.414880][T13078] loop7: detected capacity change from 0 to 128 [ 579.431654][T13078] ufs: ufs_fill_super(): fragment size 2066844866 is not a power of 2 [ 580.069290][ T5271] 8021q: adding VLAN 0 to HW filter on device eth16 [ 584.102216][T13117] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 586.755391][T13146] 8021q: adding VLAN 0 to HW filter on device bond0 [ 586.784932][T13146] 8021q: adding VLAN 0 to HW filter on device team0 [ 586.814337][T13146] tipc: Resetting bearer [ 587.071066][T13146] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 589.029477][T13146] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 589.029502][T13146] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 589.292323][T13146] veth1_vlan: left promiscuous mode [ 589.334396][T13146] veth1_vlan: entered promiscuous mode [ 589.379896][ T8074] IPVS: starting estimator thread 0... [ 589.388420][T13146] veth1_macvtap: left promiscuous mode [ 589.412010][T13146] veth0_macvtap: left promiscuous mode [ 589.412954][T13146] veth0_macvtap: entered promiscuous mode [ 589.417168][T13146] veth1_macvtap: entered promiscuous mode [ 589.469812][T13178] IPVS: using max 38 ests per chain, 91200 per kthread [ 589.574768][T13146] 8021q: adding VLAN 0 to HW filter on device eth0 [ 589.593554][T13146] 8021q: adding VLAN 0 to HW filter on device eth1 [ 589.613023][T13146] 8021q: adding VLAN 0 to HW filter on device eth2 [ 589.632824][T13146] 8021q: adding VLAN 0 to HW filter on device eth3 [ 589.919819][T13182] loop7: detected capacity change from 0 to 256 [ 590.011420][T13182] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x987a2e96, utbl_chksum : 0xe619d30d) [ 590.049451][T13182] exFAT-fs (loop7): start_clu is invalid cluster(0x0) [ 590.094359][T13177] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1921'. [ 590.094408][T13177] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1921'. [ 590.094418][T13177] tipc: Invalid UDP bearer configuration [ 590.094450][T13177] tipc: Enabling of bearer rejected, failed to enable media [ 590.298280][ T8100] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.304169][T13167] lo speed is unknown, defaulting to 1000 [ 590.366778][T13167] hsr0 speed is unknown, defaulting to 1000 [ 590.409208][ T6738] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.589685][ T8100] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.590374][ T8100] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.122549][T13198] loop8: detected capacity change from 0 to 512 [ 591.200405][T13198] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 591.227078][T13198] ext4 filesystem being mounted at /137/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 593.510749][T10112] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 593.815676][T13233] netlink: 'syz.8.1935': attribute type 1 has an invalid length. [ 594.114819][T13233] bridge1: entered promiscuous mode [ 594.114839][T13233] bridge1: entered allmulticast mode [ 594.181531][T13233] bond2: (slave bridge1): making interface the new active one [ 594.198611][T13233] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 594.532375][T13248] loop8: detected capacity change from 0 to 16 [ 594.556737][T13248] erofs (device loop8): EXPERIMENTAL 48-bit layout support in use. Use at your own risk! [ 594.557015][T13248] erofs (device loop8): mounted with root inode @ nid 36. [ 599.043679][T13281] lo: entered allmulticast mode [ 599.043914][T13281] lo: left allmulticast mode [ 600.662859][ T5613] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 600.662885][ T5613] CPU: 0 UID: 0 PID: 5613 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 600.662909][ T5613] Tainted: [L]=SOFTLOCKUP [ 600.662915][ T5613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 600.662927][ T5613] Workqueue: hci3 hci_rx_work [ 600.663026][ T5613] Call Trace: [ 600.663034][ T5613] [ 600.663042][ T5613] dump_stack_lvl+0xe8/0x150 [ 600.663062][ T5613] sysfs_create_dir_ns+0x271/0x2a0 [ 600.663082][ T5613] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 600.663102][ T5613] ? do_raw_spin_unlock+0xf5/0x200 [ 600.663130][ T5613] kobject_add_internal+0x622/0xcd0 [ 600.663181][ T5613] kobject_add+0x163/0x240 [ 600.663202][ T5613] ? __pfx_kobject_add+0x10/0x10 [ 600.663224][ T5613] ? get_device_parent+0x366/0x3a0 [ 600.663263][ T5613] device_add+0x3fa/0xb80 [ 600.663282][ T5613] hci_conn_add_sysfs+0xd5/0x210 [ 600.663319][ T5613] le_conn_complete_evt+0x1094/0x1780 [ 600.663360][ T5613] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 600.663378][ T5613] ? __mutex_unlock_slowpath+0x731/0x900 [ 600.663419][ T5613] ? skb_pull_data+0xf0/0x200 [ 600.663461][ T5613] hci_le_conn_complete_evt+0x187/0x470 [ 600.663485][ T5613] hci_event_packet+0x67a/0xf10 [ 600.663508][ T5613] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 600.663541][ T5613] ? __pfx_hci_event_packet+0x10/0x10 [ 600.663561][ T5613] ? kcov_remote_start+0x523/0x7e0 [ 600.663580][ T5613] ? hci_send_to_monitor+0xdf/0x600 [ 600.663606][ T5613] hci_rx_work+0x2b4/0x1110 [ 600.663629][ T5613] ? process_scheduled_works+0x97a/0x1630 [ 600.663647][ T5613] process_scheduled_works+0xc3d/0x1630 [ 600.663690][ T5613] ? __pfx_process_scheduled_works+0x10/0x10 [ 600.663713][ T5613] ? assign_work+0x3cf/0x5d0 [ 600.663733][ T5613] worker_thread+0xa47/0xfb0 [ 600.663770][ T5613] kthread+0x38b/0x480 [ 600.663785][ T5613] ? __pfx_worker_thread+0x10/0x10 [ 600.663800][ T5613] ? __pfx_kthread+0x10/0x10 [ 600.663817][ T5613] ret_from_fork+0x514/0xb70 [ 600.663835][ T5613] ? __pfx_ret_from_fork+0x10/0x10 [ 600.663851][ T5613] ? __switch_to+0xc78/0x1410 [ 600.663869][ T5613] ? __pfx_kthread+0x10/0x10 [ 600.663886][ T5613] ret_from_fork_asm+0x1a/0x30 [ 600.663915][ T5613] [ 600.665892][ T5613] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 600.665927][ T5613] Bluetooth: hci3: failed to register connection device [ 604.502768][T13372] bond4: (slave bond0): Releasing backup interface [ 604.686246][T13372] bridge_slave_0: left allmulticast mode [ 604.686267][T13372] bridge_slave_0: left promiscuous mode [ 604.686439][T13372] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.785939][T13372] bridge_slave_1: left allmulticast mode [ 604.785963][T13372] bridge_slave_1: left promiscuous mode [ 604.786133][T13372] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.892638][T13386] loop8: detected capacity change from 0 to 8 [ 604.895696][T13386] squashfs: Unknown parameter '01777777777777777777777' [ 604.927199][T13372] bond0: (slave bond_slave_0): Releasing backup interface [ 608.702050][T13372] bond0: (slave bond_slave_1): Releasing backup interface [ 608.748708][T13372] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 608.763585][T13372] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 608.800351][T13372] bond3: (slave bridge2): Releasing backup interface [ 608.800375][T13372] bridge2: left allmulticast mode [ 608.838021][T13381] tipc: Enabling of bearer rejected, failed to enable media [ 608.846929][ T2238] syz1: Port: 1 Link DOWN [ 609.143796][T13401] overlayfs: failed to clone upperpath [ 609.573080][T13412] loop8: detected capacity change from 0 to 128 [ 610.249105][T13412] EXT4-fs (loop8): mounting ext2 file system using the ext4 subsystem [ 610.912712][T13412] EXT4-fs (loop8): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 610.976371][T13412] ext2 filesystem being mounted at /147/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 613.560500][T13446] EXT4-fs error (device loop8): dx_make_map:1296: inode #2: block 33: comm syz.8.1976: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 613.665664][T13446] EXT4-fs error (device loop8) in do_split:2029: Corrupt filesystem [ 615.251592][T10112] EXT4-fs (loop8): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 615.514022][T13500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1996'. [ 618.003911][T13526] loop7: detected capacity change from 0 to 512 [ 618.021673][T13526] EXT4-fs (loop7): Test dummy encryption mode enabled [ 618.021693][T13526] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 618.021706][T13526] EXT4-fs (loop7): SIPHASH is not a valid default hash value [ 619.639207][T13537] bridge0: port 1(dummy0) entered blocking state [ 619.639291][T13537] bridge0: port 1(dummy0) entered disabled state [ 619.639432][T13537] dummy0: entered allmulticast mode [ 620.614065][T13537] bridge0: port 1(dummy0) entered blocking state [ 620.614179][T13537] bridge0: port 1(dummy0) entered forwarding state [ 625.265193][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.265245][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.887244][ T8100] IPVS: starting estimator thread 0... [ 625.970588][T13555] IPVS: using max 37 ests per chain, 88800 per kthread [ 626.112438][T13560] syzkaller0: entered promiscuous mode [ 626.112458][T13560] syzkaller0: entered allmulticast mode [ 626.624450][T13565] fuse: Bad value for 'fd' [ 627.352283][T11012] libceph: connect (1)[c::]:6789 error -101 [ 627.352406][T11012] libceph: mon0 (1)[c::]:6789 connect error [ 627.387512][T13573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2018'. [ 627.531982][T13570] ceph: No mds server is up or the cluster is laggy [ 627.540529][T13583] netlink: 'syz.8.2019': attribute type 1 has an invalid length. [ 627.669632][T13586] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2019'. [ 628.568276][T13604] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 628.734022][T13583] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 629.401180][ T5271] veth1_vlan: left promiscuous mode [ 630.551416][T13647] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2031'. [ 630.851691][T13631] lo speed is unknown, defaulting to 1000 [ 630.868084][T13631] hsr0 speed is unknown, defaulting to 1000 [ 632.309732][T13653] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 632.635874][T13668] bridge0: port 1(dummy0) entered blocking state [ 632.635978][T13668] bridge0: port 1(dummy0) entered disabled state [ 632.636113][T13668] dummy0: entered allmulticast mode [ 632.664853][T13668] dummy0: entered promiscuous mode [ 632.674955][T13668] bridge0: port 1(dummy0) entered blocking state [ 632.675039][T13668] bridge0: port 1(dummy0) entered forwarding state [ 632.677607][T13667] loop7: detected capacity change from 0 to 16384 [ 634.266482][T13653] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 634.450746][ C0] blk_print_req_error: 51 callbacks suppressed [ 634.450766][ C0] I/O error, dev loop7, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2 [ 634.481048][ C0] I/O error, dev loop7, sector 4352 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 2 [ 634.481205][ C0] I/O error, dev loop7, sector 4288 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 634.481253][ C0] buffer_io_error: 138 callbacks suppressed [ 634.481263][ C0] Buffer I/O error on dev loop7, logical block 536, async page read [ 634.535100][ C0] I/O error, dev loop7, sector 4608 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 634.706268][T13673] loop7: detected capacity change from 16384 to 0 [ 634.952045][ T5271] veth1_vlan: entered promiscuous mode [ 635.876665][T13715] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 636.435120][T13722] loop7: detected capacity change from 0 to 8 [ 636.968967][ T33] audit: type=1326 audit(1791208331.441:823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13721 comm="syz.5.2049" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=9 arch=c000003e syscall=39 compat=0 ip=0x7f97c3397f17 code=0x0 [ 638.079317][ T1009] IPVS: starting estimator thread 0... [ 638.175927][T13760] IPVS: using max 38 ests per chain, 91200 per kthread [ 642.455906][T13775] fuse: fd is not a fuse device [ 644.393570][T13804] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 645.205581][T13786] loop8: detected capacity change from 0 to 32768 [ 645.280556][T13786] XFS (loop8): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 645.514951][T13786] XFS (loop8): Ending clean mount [ 646.052128][T13786] XFS (loop8): Quotacheck needed: Please wait. [ 646.490374][T13786] XFS (loop8): Quotacheck: Done. [ 646.952541][T10112] XFS (loop8): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 648.189200][T13866] bridge0: port 2(veth0) entered blocking state [ 648.189280][T13866] bridge0: port 2(veth0) entered disabled state [ 648.189412][T13866] veth0: entered allmulticast mode [ 648.195943][T13866] veth0: entered promiscuous mode [ 648.196426][T13866] bridge0: port 2(veth0) entered blocking state [ 648.196514][T13866] bridge0: port 2(veth0) entered forwarding state [ 648.656024][T13876] kvm: pic: non byte write [ 649.793772][T13889] netlink: 'syz.9.2085': attribute type 1 has an invalid length. [ 651.414354][T13889] bond9: entered promiscuous mode [ 651.414660][T13889] 8021q: adding VLAN 0 to HW filter on device bond9 [ 651.672530][T13889] bond9: (slave bridge2): making interface the new active one [ 651.672552][T13889] bridge2: entered promiscuous mode [ 651.716950][T13889] bond9: (slave bridge2): Enslaving as an active interface with an up link [ 652.228352][T13907] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2090'. [ 652.639119][ T192] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 652.789518][ T192] usb 9-1: Using ep0 maxpacket: 8 [ 652.791745][ T192] usb 9-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 652.792653][ T192] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 652.792674][ T192] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 652.792692][ T192] usb 9-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 652.792738][ T192] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 652.792759][ T192] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 652.792776][ T192] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 652.792808][ T192] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.043867][ T192] usb 9-1: GET_CAPABILITIES returned 0 [ 653.043904][ T192] usbtmc 9-1:16.0: can't read capabilities [ 653.286754][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319225][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319271][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319305][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319337][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319369][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319625][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319664][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319696][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319727][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319760][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.319791][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.320034][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.320071][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.320101][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 653.320132][ C0] usbtmc 9-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 653.322183][ T192] usb 9-1: USB disconnect, device number 4 [ 655.255742][T13928] loop8: detected capacity change from 0 to 8 [ 655.273863][T13928] unable to read id index table [ 655.430371][T13931] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 660.677042][T10835] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 660.700696][T10835] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 660.702151][T10835] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 660.720656][T10835] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 660.722190][T10835] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 662.863617][T10835] Bluetooth: hci5: command tx timeout [ 664.197994][T14046] netlink: 16390 bytes leftover after parsing attributes in process `syz.9.2115'. [ 664.523667][T13993] lo speed is unknown, defaulting to 1000 [ 664.544750][T13993] hsr0 speed is unknown, defaulting to 1000 [ 664.841180][T14059] FAULT_INJECTION: forcing a failure. [ 664.841180][T14059] name failslab, interval 1, probability 0, space 0, times 0 [ 664.841210][T14059] CPU: 0 UID: 0 PID: 14059 Comm: syz.8.2118 Tainted: G L syzkaller #0 PREEMPT(full) [ 664.841234][T14059] Tainted: [L]=SOFTLOCKUP [ 664.841240][T14059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 664.841252][T14059] Call Trace: [ 664.841258][T14059] [ 664.841265][T14059] dump_stack_lvl+0xe8/0x150 [ 664.841289][T14059] should_fail_ex+0x3eb/0x540 [ 664.841309][T14059] ? __alloc_skb+0x1db/0x7a0 [ 664.841325][T14059] should_failslab+0xa8/0x100 [ 664.841343][T14059] ? __alloc_skb+0x1db/0x7a0 [ 664.841356][T14059] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 664.841374][T14059] ? __alloc_skb+0x18d/0x7a0 [ 664.841390][T14059] ? __alloc_skb+0x1db/0x7a0 [ 664.841410][T14059] __alloc_skb+0x1db/0x7a0 [ 664.841431][T14059] ctnetlink_conntrack_event+0x440/0x15e0 [ 664.841533][T14059] ? lock_acquire+0x115/0x350 [ 664.841550][T14059] ? __pfx_ctnetlink_conntrack_event+0x10/0x10 [ 664.841576][T14059] ? __nf_conntrack_eventmask_report+0xc1/0x480 [ 664.841593][T14059] __nf_conntrack_eventmask_report+0x1fa/0x480 [ 664.841615][T14059] nf_conntrack_eventmask_report+0x2b5/0x450 [ 664.841634][T14059] ? __pfx_nf_conntrack_eventmask_report+0x10/0x10 [ 664.841656][T14059] ? ctnetlink_new_conntrack+0x74f/0x2940 [ 664.841675][T14059] ctnetlink_new_conntrack+0x236c/0x2940 [ 664.841694][T14059] ? ctnetlink_new_conntrack+0x74f/0x2940 [ 664.841722][T14059] ? __pfx_ctnetlink_new_conntrack+0x10/0x10 [ 664.841739][T14059] ? __pfx___mutex_trylock_common+0x10/0x10 [ 664.841758][T14059] ? rcu_is_watching+0x16/0xb0 [ 664.841774][T14059] ? trace_contention_end+0x3d/0x140 [ 664.841792][T14059] ? __mutex_lock+0x305/0x15a0 [ 664.841809][T14059] ? lock_acquire+0x115/0x350 [ 664.841833][T14059] ? __pfx___mutex_lock+0x10/0x10 [ 664.841864][T14059] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 664.841901][T14059] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 664.841931][T14059] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 664.841984][T14059] netlink_rcv_skb+0x226/0x4a0 [ 664.842002][T14059] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 664.842021][T14059] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 664.842047][T14059] ? bpf_lsm_capable+0x9/0x20 [ 664.842063][T14059] ? security_capable+0x7e/0x2c0 [ 664.842109][T14059] nfnetlink_rcv+0x2b9/0x28c0 [ 664.842131][T14059] ? __dev_queue_xmit+0x29b/0x3920 [ 664.842172][T14059] ? __local_bh_enable_ip+0xd6/0x140 [ 664.842189][T14059] ? lockdep_hardirqs_on+0x7b/0x110 [ 664.842205][T14059] ? __dev_queue_xmit+0x29b/0x3920 [ 664.842220][T14059] ? __local_bh_enable_ip+0xd6/0x140 [ 664.842235][T14059] ? __dev_queue_xmit+0x29b/0x3920 [ 664.842250][T14059] ? __dev_queue_xmit+0x1efb/0x3920 [ 664.842269][T14059] ? __dev_queue_xmit+0x29b/0x3920 [ 664.842289][T14059] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 664.842313][T14059] ? __pfx___dev_queue_xmit+0x10/0x10 [ 664.842336][T14059] ? __copy_skb_header+0xa3/0x4a0 [ 664.842367][T14059] ? skb_clone+0x246/0x3a0 [ 664.842385][T14059] ? __netlink_deliver_tap+0x681/0x6e0 [ 664.842401][T14059] ? netlink_deliver_tap+0x2e/0x1b0 [ 664.842421][T14059] ? netlink_deliver_tap+0x2e/0x1b0 [ 664.842437][T14059] ? netlink_deliver_tap+0x2e/0x1b0 [ 664.842457][T14059] netlink_unicast+0x7bd/0x940 [ 664.842482][T14059] netlink_sendmsg+0x7c3/0xae0 [ 664.842502][T14059] ? __pfx_netlink_sendmsg+0x10/0x10 [ 664.842526][T14059] ? apparmor_socket_sendmsg+0x98/0x360 [ 664.842563][T14059] ? __pfx_netlink_sendmsg+0x10/0x10 [ 664.842578][T14059] sock_sendmsg_nosec+0x14e/0x190 [ 664.842597][T14059] ____sys_sendmsg+0x54e/0x850 [ 664.842618][T14059] ? __pfx_____sys_sendmsg+0x10/0x10 [ 664.842641][T14059] ? import_iovec+0x73/0xa0 [ 664.842660][T14059] ___sys_sendmsg+0x2a5/0x360 [ 664.842675][T14059] ? __lock_acquire+0x747/0x2de0 [ 664.842695][T14059] ? __pfx____sys_sendmsg+0x10/0x10 [ 664.842714][T14059] ? futex_wake+0x51b/0x5f0 [ 664.842757][T14059] ? __fget_files+0x3a2/0x420 [ 664.842772][T14059] ? __fget_files+0x2a/0x420 [ 664.842795][T14059] __x64_sys_sendmsg+0x1b1/0x290 [ 664.842814][T14059] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 664.842846][T14059] do_syscall_64+0x166/0x520 [ 664.842893][T14059] ? trace_irq_disable+0x3b/0x140 [ 664.842908][T14059] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.842925][T14059] ? clear_bhb_loop+0x70/0xc0 [ 664.842944][T14059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.842961][T14059] RIP: 0033:0x7f2f8719e199 [ 664.842978][T14059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 664.842992][T14059] RSP: 002b:00007f2f88026028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 664.843011][T14059] RAX: ffffffffffffffda RBX: 00007f2f87425fa0 RCX: 00007f2f8719e199 [ 664.843024][T14059] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 664.843034][T14059] RBP: 00007f2f872350b8 R08: 0000000000000000 R09: 0000000000000000 [ 664.843045][T14059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 664.843055][T14059] R13: 00007f2f87426038 R14: 00007f2f87425fa0 R15: 00007fffe9cb0ea8 [ 664.843081][T14059] [ 664.899706][T10835] Bluetooth: hci5: command tx timeout [ 666.067546][T14077] ip_tables: iptables: counters copy to user failed while replacing table [ 666.644331][T13993] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.646697][T13993] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.646926][T13993] bridge_slave_0: entered allmulticast mode [ 666.698510][T13993] bridge_slave_0: entered promiscuous mode [ 666.713353][T13993] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.713430][T13993] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.737021][T13993] bridge_slave_1: entered allmulticast mode [ 666.749726][T13993] bridge_slave_1: entered promiscuous mode [ 666.929364][T13993] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 666.965123][T13993] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 666.979964][T10835] Bluetooth: hci5: command tx timeout [ 667.241082][T13993] team0: Port device team_slave_0 added [ 667.265901][T13993] team0: Port device team_slave_1 added [ 667.469288][T13993] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 667.469304][T13993] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.469325][T13993] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 667.917762][T13993] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 667.917778][T13993] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.917804][T13993] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 668.738828][T13993] hsr_slave_0: entered promiscuous mode [ 668.744074][T13993] hsr_slave_1: entered promiscuous mode [ 668.747323][T13993] debugfs: 'hsr0' already exists in 'hsr' [ 668.747342][T13993] Cannot create hsr debugfs directory [ 669.001923][T14116] Set syz1 is full, maxelem 6117 reached [ 669.059216][T10835] Bluetooth: hci5: command tx timeout [ 671.724502][T13993] netdevsim netdevsim2 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 672.380631][T14176] overlayfs: failed to clone upperpath [ 672.465454][T13993] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.028283][T13993] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.146246][T13993] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.726553][T13993] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 683.756526][T13993] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 683.771316][T13993] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 683.796307][T13993] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 683.810004][T13993] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 683.838414][T13993] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 683.854851][T13993] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 683.895088][T13993] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 684.787093][T13993] 8021q: adding VLAN 0 to HW filter on device bond0 [ 684.893007][T13993] 8021q: adding VLAN 0 to HW filter on device team0 [ 684.945752][ T6740] bridge0: port 1(bridge_slave_0) entered blocking state [ 684.945830][ T6740] bridge0: port 1(bridge_slave_0) entered forwarding state [ 685.098686][ T6740] bridge0: port 2(bridge_slave_1) entered blocking state [ 685.098764][ T6740] bridge0: port 2(bridge_slave_1) entered forwarding state [ 686.619601][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.619648][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.275321][T14304] loop8: detected capacity change from 0 to 8 [ 688.222850][T14313] No source specified [ 691.442069][T13993] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 691.678221][T13993] veth0_vlan: entered promiscuous mode [ 691.786074][T13993] veth1_vlan: entered promiscuous mode [ 691.946212][T13993] veth0_macvtap: entered promiscuous mode [ 691.988969][T13993] veth1_macvtap: entered promiscuous mode [ 692.108820][T13993] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 692.184347][T13993] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 692.311542][ T8069] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.311580][ T8069] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.311607][ T8069] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.311632][ T8069] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.676550][ T8069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 692.676570][ T8069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 692.933601][ T6738] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 692.933621][ T6738] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 693.397049][T14359] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 693.725092][T14347] IPVS: wrr: TCP 127.0.0.1:21 - no destination available [ 693.981334][ T1428] IPVS: starting estimator thread 0... [ 694.074615][T14370] IPVS: using max 38 ests per chain, 91200 per kthread [ 695.468245][T14390] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2176'. [ 695.507735][T14390] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2176'. [ 695.507848][T14390] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 695.746161][T14390] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 696.792919][T14395] syz_tun: left promiscuous mode [ 697.460934][T14423] netlink: 'syz.1.2184': attribute type 4 has an invalid length. [ 697.554718][T14423] netlink: 'syz.1.2184': attribute type 4 has an invalid length. [ 702.797965][T14481] kAFS: unable to lookup cell 'ÿ' [ 707.152627][T14558] netlink: 'syz.8.2209': attribute type 1 has an invalid length. [ 707.910410][T14563] 8021q: adding VLAN 0 to HW filter on device bond5 [ 707.927134][T14563] bond4: (slave bond5): making interface the new active one [ 707.951863][T14563] bond4: (slave bond5): Enslaving as an active interface with an up link [ 710.545210][T14566] bond4: (slave gretap1): Enslaving as a backup interface with an up link [ 710.581707][T14581] lo speed is unknown, defaulting to 1000 [ 710.584014][T14581] hsr0 speed is unknown, defaulting to 1000 [ 711.185015][T14595] ip_tables: iptables: counters copy to user failed while replacing table [ 711.203641][T14597] fuse: Bad value for 'fd' [ 714.880789][T14641] bond0: (slave bond_slave_0): Releasing backup interface [ 714.984179][T14643] bond0: (slave bond_slave_1): Releasing backup interface [ 716.970662][T14679] netlink: 'syz.9.2237': attribute type 1 has an invalid length. [ 717.048076][T14684] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2237'. [ 717.103895][T14679] 8021q: adding VLAN 0 to HW filter on device bond10 [ 717.147640][T10835] Bluetooth: hci4: unexpected subevent 0x01 length: 19 > 18 [ 717.147668][T10835] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 717.325090][T14679] bond10: (slave bridge3): making interface the new active one [ 717.358601][T14679] bond10: (slave bridge3): Enslaving as an active interface with an up link [ 717.594092][T14696] geneve0: entered promiscuous mode [ 717.607237][T14696] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2240'. [ 717.636591][T14696] geneve0 (unregistering): left promiscuous mode [ 718.463575][T14710] jffs2: notice: (14710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 719.493421][T14724] Config c/1 of g1 needs at least one function. [ 719.493773][T14724] udc usbip-vudc.0: failed to start g1: -22 [ 719.493791][T14724] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 720.966386][T14733] syz.8.2249 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 721.652224][T14724] UDC core: g1: couldn't find an available UDC or it's busy [ 722.847616][T14771] x_tables: ip6_tables: REJECT.0 target: invalid size 8 (kernel) != (user) 0 [ 723.143422][T14775] netlink: 'syz.9.2259': attribute type 12 has an invalid length. [ 723.143442][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2259'. [ 723.143462][T14775] bond0: option primary_reselect: invalid value (31) [ 724.856627][ T5613] Bluetooth: hci4: unexpected event for opcode 0x2003 [ 725.096011][T14812] lo speed is unknown, defaulting to 1000 [ 725.148548][T14812] hsr0 speed is unknown, defaulting to 1000 [ 729.335845][ T33] audit: type=1326 audit(1791208423.811:824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14826 comm="syz.1.2273" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f993f99e199 code=0x0 [ 731.511900][T14847] overlayfs: failed to clone upperpath [ 733.477471][T14841] dvmrp12: entered allmulticast mode [ 735.761032][T14877] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2290'. [ 736.816038][T14882] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.2293'. [ 738.586615][T14890] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2297'. [ 738.740180][T14890] 8021q: adding VLAN 0 to HW filter on device bond2 [ 738.864573][T14893] 8021q: adding VLAN 0 to HW filter on device bond3 [ 738.886204][T14893] bond2: (slave bond3): Enslaving as an active interface with an up link [ 738.985018][T14890] bond2 (unregistering): (slave bond3): Releasing backup interface [ 739.015361][T14890] bond2 (unregistering): Released all slaves [ 739.569649][T14902] netlink: 'syz.1.2299': attribute type 1 has an invalid length. [ 739.687335][T14902] 8021q: adding VLAN 0 to HW filter on device bond2 [ 739.740716][T14905] bridge0: port 1(dummy0) entered disabled state [ 739.741090][T14905] dummy0: left allmulticast mode [ 739.741122][T14905] dummy0: left promiscuous mode [ 739.741273][T14905] bridge0: port 1(dummy0) entered disabled state [ 739.828956][T14905] bond2: (slave dummy0): making interface the new active one [ 739.872827][T14905] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 739.873089][T14902] : renamed from dummy0 (while UP) [ 740.217994][ T33] audit: type=1326 audit(1791208434.691:825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14912 comm="syz.2.2303" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff3b9e199 code=0x7ffc0000 [ 740.218392][ T33] audit: type=1326 audit(1791208434.691:826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14912 comm="syz.2.2303" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=263 compat=0 ip=0x7f5ff3b9e199 code=0x7ffc0000 [ 740.245851][ T33] audit: type=1326 audit(1791208434.721:827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14912 comm="syz.2.2303" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff3b9e199 code=0x7ffc0000 [ 740.316099][ T33] audit: type=1326 audit(1791208434.721:828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14912 comm="syz.2.2303" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff3b9e199 code=0x7ffc0000 [ 744.012293][ T33] audit: type=1107 audit(1791208438.081:829): pid=14917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 747.408499][T14949] 9pnet_virtio: no channels available for device syz [ 747.654603][T14960] fuse: Bad value for 'fd' [ 748.044295][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 748.044342][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.323680][T14968] hfsplus: unable to find HFS+ superblock [ 748.987554][T14972] __vm_enough_memory: pid: 14972, comm: syz.2.2320, bytes: 4503599627366400 not enough memory for the allocation [ 750.779266][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 750.929359][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 750.929999][ T9] usb 3-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 750.948964][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 750.948984][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 750.980525][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.980547][ T9] usb 3-1: Product: syz [ 750.980558][ T9] usb 3-1: Manufacturer: syz [ 750.980569][ T9] usb 3-1: SerialNumber: syz [ 751.036157][ T9] usb 3-1: 0:2 : does not exist [ 751.243979][ T9] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 751.492119][ T9] usb 3-1: USB disconnect, device number 2 [ 751.530109][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807e07c400: rx timeout, send abort [ 751.781369][T14983] udevd[14983]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 752.030535][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807e07c400: abort rx timeout. Force session deactivation [ 753.600696][T15017] loop2: detected capacity change from 0 to 4096 [ 753.705427][T15017] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 754.314868][T15019] lo speed is unknown, defaulting to 1000 [ 755.844053][T13993] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 755.845290][T15019] hsr0 speed is unknown, defaulting to 1000 [ 756.253359][T15033] tipc: Started in network mode [ 756.253383][T15033] tipc: Node identity 4, cluster identity 4711 [ 756.253394][T15033] tipc: Node number set to 4 [ 761.789384][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 763.580211][ T10] usb 3-1: New USB device found: idVendor=0846, idProduct=1001, bcdDevice=1.00 [ 763.581189][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 763.581212][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 763.583071][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.583090][ T10] usb 3-1: Product: syz [ 763.583101][ T10] usb 3-1: Manufacturer: syz [ 763.583113][ T10] usb 3-1: SerialNumber: syz [ 764.395970][ T10] kaweth 3-1:1.0: Firmware present in device. [ 764.397652][ T10] kaweth 3-1:1.0: Statistics collection: 0 [ 764.397668][ T10] kaweth 3-1:1.0: Multicast filter limit: 0 [ 764.397679][ T10] kaweth 3-1:1.0: MTU: 0 [ 764.397689][ T10] kaweth 3-1:1.0: Read MAC address 00:00:00:00:00:00 [ 766.364428][ T10] kaweth 3-1:1.0: Error setting SOFS wait [ 766.364590][ T10] kaweth 3-1:1.0: probe with driver kaweth failed with error -5 [ 766.395998][ T10] usb 3-1: USB disconnect, device number 3 [ 768.628964][T15110] nftables ruleset with unbound set [ 769.843839][T15113] vlan3: entered promiscuous mode [ 769.843860][T15113] hsr0: entered promiscuous mode [ 769.844054][T15113] vlan3: entered allmulticast mode [ 769.844065][T15113] hsr0: entered allmulticast mode [ 769.844074][T15113] hsr_slave_0: entered allmulticast mode [ 769.844086][T15113] hsr_slave_1: entered allmulticast mode [ 770.127520][T15113] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2363'. [ 770.127610][T15113] hsr_slave_0: left promiscuous mode [ 770.149046][T15113] hsr_slave_1: left promiscuous mode [ 770.686146][ T6745] IPVS: starting estimator thread 0... [ 771.020092][T15131] IPVS: using max 37 ests per chain, 88800 per kthread [ 774.698105][T15150] FAULT_INJECTION: forcing a failure. [ 774.698105][T15150] name failslab, interval 1, probability 0, space 0, times 0 [ 774.698137][T15150] CPU: 0 UID: 0 PID: 15150 Comm: syz.2.2377 Tainted: G L syzkaller #0 PREEMPT(full) [ 774.698161][T15150] Tainted: [L]=SOFTLOCKUP [ 774.698167][T15150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 774.698178][T15150] Call Trace: [ 774.698184][T15150] [ 774.698191][T15150] dump_stack_lvl+0xe8/0x150 [ 774.698214][T15150] should_fail_ex+0x3eb/0x540 [ 774.698243][T15150] should_failslab+0xa8/0x100 [ 774.698261][T15150] __kmalloc_cache_noprof+0x9e/0x600 [ 774.698279][T15150] ? hash_netnet_create+0x83c/0x16e0 [ 774.698367][T15150] ? hash_netnet_create+0x83c/0x16e0 [ 774.698389][T15150] hash_netnet_create+0x83c/0x16e0 [ 774.698416][T15150] ? __pfx_hash_netnet_create+0x10/0x10 [ 774.698436][T15150] ? ip_set_create+0x4ef/0x1a50 [ 774.698470][T15150] ? __pfx_hash_netnet_create+0x10/0x10 [ 774.698489][T15150] ip_set_create+0xae8/0x1a50 [ 774.698504][T15150] ? ip_set_create+0x4ef/0x1a50 [ 774.698529][T15150] ? __pfx_ip_set_create+0x10/0x10 [ 774.698543][T15150] ? lock_acquire+0x115/0x350 [ 774.698585][T15150] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 774.698603][T15150] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 774.698633][T15150] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 774.698684][T15150] netlink_rcv_skb+0x226/0x4a0 [ 774.698701][T15150] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 774.698719][T15150] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 774.698744][T15150] ? bpf_lsm_capable+0x9/0x20 [ 774.698759][T15150] ? security_capable+0x7e/0x2c0 [ 774.698781][T15150] nfnetlink_rcv+0x2b9/0x28c0 [ 774.698802][T15150] ? __dev_queue_xmit+0x29b/0x3920 [ 774.698821][T15150] ? __local_bh_enable_ip+0xd6/0x140 [ 774.698837][T15150] ? lockdep_hardirqs_on+0x7b/0x110 [ 774.698853][T15150] ? __dev_queue_xmit+0x29b/0x3920 [ 774.698868][T15150] ? __local_bh_enable_ip+0xd6/0x140 [ 774.698883][T15150] ? __dev_queue_xmit+0x29b/0x3920 [ 774.698898][T15150] ? __dev_queue_xmit+0x1efb/0x3920 [ 774.698917][T15150] ? __dev_queue_xmit+0x29b/0x3920 [ 774.698937][T15150] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 774.698960][T15150] ? __pfx___dev_queue_xmit+0x10/0x10 [ 774.698983][T15150] ? __copy_skb_header+0xa3/0x4a0 [ 774.699014][T15150] ? skb_clone+0x246/0x3a0 [ 774.699031][T15150] ? __netlink_deliver_tap+0x681/0x6e0 [ 774.699046][T15150] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.699070][T15150] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.699086][T15150] ? netlink_deliver_tap+0x2e/0x1b0 [ 774.699106][T15150] netlink_unicast+0x7bd/0x940 [ 774.699130][T15150] netlink_sendmsg+0x7c3/0xae0 [ 774.699150][T15150] ? __pfx_netlink_sendmsg+0x10/0x10 [ 774.699172][T15150] ? apparmor_socket_sendmsg+0x98/0x360 [ 774.699191][T15150] ? __pfx_netlink_sendmsg+0x10/0x10 [ 774.699206][T15150] sock_sendmsg_nosec+0x14e/0x190 [ 774.699225][T15150] ____sys_sendmsg+0x54e/0x850 [ 774.699251][T15150] ? __pfx_____sys_sendmsg+0x10/0x10 [ 774.699274][T15150] ? import_iovec+0x73/0xa0 [ 774.699293][T15150] ___sys_sendmsg+0x2a5/0x360 [ 774.699308][T15150] ? __lock_acquire+0x747/0x2de0 [ 774.699327][T15150] ? __pfx____sys_sendmsg+0x10/0x10 [ 774.699347][T15150] ? futex_wait+0x2a2/0x390 [ 774.699385][T15150] ? __fget_files+0x3a2/0x420 [ 774.699400][T15150] ? __fget_files+0x2a/0x420 [ 774.699423][T15150] __x64_sys_sendmsg+0x1b1/0x290 [ 774.699441][T15150] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 774.699473][T15150] do_syscall_64+0x166/0x520 [ 774.699487][T15150] ? trace_irq_disable+0x3b/0x140 [ 774.699502][T15150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.699519][T15150] ? clear_bhb_loop+0x70/0xc0 [ 774.699537][T15150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.699639][T15150] RIP: 0033:0x7f5ff3b9e199 [ 774.699660][T15150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.699675][T15150] RSP: 002b:00007f5ff1df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 774.699693][T15150] RAX: ffffffffffffffda RBX: 00007f5ff3e25fa0 RCX: 00007f5ff3b9e199 [ 774.699711][T15150] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000006 [ 774.699721][T15150] RBP: 00007f5ff3c350b8 R08: 0000000000000000 R09: 0000000000000000 [ 774.699732][T15150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 774.699742][T15150] R13: 00007f5ff3e26038 R14: 00007f5ff3e25fa0 R15: 00007ffd771b1b38 [ 774.699769][T15150] [ 781.380392][T15187] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2380'. [ 781.410101][T15187] bond2: (slave ): Releasing active interface [ 784.905769][T15216] fuse: fd is not a fuse device [ 787.103346][T15211] Bluetooth: hci5: command 0x0406 tx timeout [ 789.265655][T15241] tipc: Enabling of bearer rejected, failed to enable media [ 791.322289][T15258] netlink: 'syz.1.2407': attribute type 1 has an invalid length. [ 791.864262][T15265] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2407'. [ 791.886549][T15258] bond4: entered promiscuous mode [ 791.895453][T15258] 8021q: adding VLAN 0 to HW filter on device bond4 [ 791.906068][T15265] bond4: entered allmulticast mode [ 791.983496][T15258] bond4: (slave bridge4): making interface the new active one [ 791.983517][T15258] bridge4: entered promiscuous mode [ 791.983661][T15258] bridge4: entered allmulticast mode [ 792.014682][T15258] bond4: (slave bridge4): Enslaving as an active interface with an up link [ 796.248450][T15294] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2418'. [ 798.107296][ T33] audit: type=1800 audit(1791208492.580:830): pid=15288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.2404" name="bus" dev="ramfs" ino=49398 res=0 errno=-4 [ 802.533690][T15339] tipc: Enabling of bearer rejected, failed to enable media [ 802.644696][T15343] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 802.812141][T15341] IPVS: stopping master sync thread 15343 ... [ 804.226554][ T34] INFO: task syz.7.2068:13813 blocked for more than 145 seconds. [ 804.226580][ T34] Tainted: G L syzkaller #0 [ 804.226590][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 804.226597][ T34] task:syz.7.2068 state:D stack:27432 pid:13813 tgid:13810 ppid:8097 task_flags:0x400140 flags:0x00080002 [ 804.226651][ T34] Call Trace: [ 804.226657][ T34] [ 804.226668][ T34] __schedule+0x1b47/0x5b40 [ 804.226710][ T34] ? __pfx___schedule+0x10/0x10 [ 804.226733][ T34] ? schedule+0x90/0x2b0 [ 804.226752][ T34] schedule+0x164/0x2b0 [ 804.226769][ T34] schedule_preempt_disabled+0x13/0x30 [ 804.226785][ T34] __mutex_lock+0x7c4/0x15a0 [ 804.226804][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 804.226823][ T34] ? write_versions+0x95/0xe30 [ 804.226903][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 804.226918][ T34] ? irqentry_exit+0x218/0x920 [ 804.226934][ T34] ? lockdep_hardirqs_on+0x7b/0x110 [ 804.226962][ T34] write_versions+0x95/0xe30 [ 804.226977][ T34] ? lockdep_hardirqs_on+0x7b/0x110 [ 804.226997][ T34] ? __pfx_write_versions+0x10/0x10 [ 804.227023][ T34] ? __pfx_write_versions+0x10/0x10 [ 804.227046][ T34] nfsctl_transaction_write+0x10f/0x160 [ 804.227064][ T34] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 804.227081][ T34] vfs_write+0x296/0xba0 [ 804.227104][ T34] ? __pfx_vfs_write+0x10/0x10 [ 804.227121][ T34] ? __fget_files+0x2a/0x420 [ 804.227136][ T34] ? __fget_files+0x3a2/0x420 [ 804.227151][ T34] ? __fget_files+0x2a/0x420 [ 804.227170][ T34] ? fdget+0x1ac/0x250 [ 804.227189][ T34] ksys_write+0x150/0x270 [ 804.227208][ T34] ? __pfx_ksys_write+0x10/0x10 [ 804.227232][ T34] do_syscall_64+0x166/0x520 [ 804.227247][ T34] ? trace_irq_disable+0x3b/0x140 [ 804.227262][ T34] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.227279][ T34] ? clear_bhb_loop+0x70/0xc0 [ 804.227297][ T34] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.227314][ T34] RIP: 0033:0x7faec0f9e199 [ 804.227329][ T34] RSP: 002b:00007faec1e0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 804.227346][ T34] RAX: ffffffffffffffda RBX: 00007faec1225fa0 RCX: 00007faec0f9e199 [ 804.227359][ T34] RDX: 0000000000000009 RSI: 00002000000002c0 RDI: 0000000000000003 [ 804.227369][ T34] RBP: 00007faec10350b8 R08: 0000000000000000 R09: 0000000000000000 [ 804.227380][ T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 804.227390][ T34] R13: 00007faec1226038 R14: 00007faec1225fa0 R15: 00007ffee5226218 [ 804.227415][ T34] [ 804.227423][ T34] INFO: task syz.7.2068:13819 blocked for more than 145 seconds. [ 804.227436][ T34] Tainted: G L syzkaller #0 [ 804.227446][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 804.227453][ T34] task:syz.7.2068 state:D stack:27432 pid:13819 tgid:13810 ppid:8097 task_flags:0x400040 flags:0x00080002 [ 804.227501][ T34] Call Trace: [ 804.227507][ T34] [ 804.227516][ T34] __schedule+0x1b47/0x5b40 [ 804.227546][ T34] ? preempt_schedule_notrace+0x56/0x90 [ 804.227568][ T34] ? __pfx___schedule+0x10/0x10 [ 804.227590][ T34] ? schedule+0x90/0x2b0 [ 804.227607][ T34] schedule+0x164/0x2b0 [ 804.227624][ T34] schedule_preempt_disabled+0x13/0x30 [ 804.227640][ T34] __mutex_lock+0x7c4/0x15a0 [ 804.227658][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 804.227677][ T34] ? write_threads+0x3b1/0x610 [ 804.227694][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 804.227708][ T34] ? simple_strntoull+0x114/0x190 [ 804.227761][ T34] ? qword_get+0x5ad/0x650 [ 804.227803][ T34] write_threads+0x3b1/0x610 [ 804.227821][ T34] ? __pfx_write_threads+0x10/0x10 [ 804.227850][ T34] ? _copy_from_user+0x94/0xb0 [ 804.227922][ T34] ? simple_transaction_get+0x12d/0x160 [ 804.227942][ T34] nfsctl_transaction_write+0x10f/0x160 [ 804.227959][ T34] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 804.227976][ T34] vfs_write+0x296/0xba0 [ 804.227998][ T34] ? __pfx_vfs_write+0x10/0x10 [ 804.228015][ T34] ? __fget_files+0x2a/0x420 [ 804.228035][ T34] ? __fget_files+0x3a2/0x420 [ 804.228050][ T34] ? __fget_files+0x2a/0x420 [ 804.228068][ T34] ? fdget+0x1ac/0x250 [ 804.228088][ T34] ksys_write+0x150/0x270 [ 804.228106][ T34] ? __pfx_ksys_write+0x10/0x10 [ 804.228131][ T34] do_syscall_64+0x166/0x520 [ 804.228145][ T34] ? trace_irq_disable+0x3b/0x140 [ 804.228159][ T34] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.228176][ T34] ? clear_bhb_loop+0x70/0xc0 [ 804.228193][ T34] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.228210][ T34] RIP: 0033:0x7faec0f9e199 [ 804.228224][ T34] RSP: 002b:00007faec1dc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 804.228240][ T34] RAX: ffffffffffffffda RBX: 00007faec1226180 RCX: 00007faec0f9e199 [ 804.228252][ T34] RDX: 0000000000000002 RSI: 00002000000002c0 RDI: 0000000000000003 [ 804.228263][ T34] RBP: 00007faec10350b8 R08: 0000000000000000 R09: 0000000000000000 [ 804.228274][ T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 804.228284][ T34] R13: 00007faec1226218 R14: 00007faec1226180 R15: 00007ffee5226218 [ 804.228309][ T34] [ 804.228331][ T34] [ 804.228331][ T34] Showing all locks held in the system: [ 804.228340][ T34] locks held by khungtaskd/34: 1, last CPU#0: [ 804.228352][ T34] #0: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 804.228412][ T34] locks held by getty/5366: 2, on CPU#1: [ 804.228423][ T34] #0: ffff888035a840a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 804.228484][ T34] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 804.228540][ T34] locks held by syz-executor/5610: 1, last CPU#0: [ 804.228552][ T34] #0: ffff8880324ea460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 804.228598][ T34] locks held by syz-executor/10112: 4, last CPU#0: [ 804.228610][ T34] #0: ffffffff8ee362f0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 [ 804.228646][ T34] #1: ffff88807ef7f180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 804.228682][ T34] #2: ffff888059a92800 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 804.228720][ T34] #3: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 804.228760][ T34] locks held by syz.7.2068/13813: 3, on CPU#0: [ 804.228771][ T34] #0: ffff88802a668ef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 804.228806][ T34] #1: ffff88807d2f2460 (sb_writers#37){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 804.228844][ T34] #2: ffffffff8f09de60 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x95/0xe30 [ 804.228880][ T34] locks held by syz.7.2068/13815: 3, on CPU#0: [ 804.228891][ T34] #0: ffff8880289b1b30 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 804.228925][ T34] #1: ffff88807d2f2460 (sb_writers#37){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 804.228963][ T34] #2: ffffffff8f09de60 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd10 [ 804.228998][ T34] locks held by syz.7.2068/13819: 3, on CPU#0: [ 804.229009][ T34] #0: ffff88802fb37970 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 804.229051][ T34] #1: ffff88807d2f2460 (sb_writers#37){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 804.229187][ T34] #2: ffffffff8f09de60 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x3b1/0x610 [ 804.229225][ T34] locks held by syz.5.2439/15354: 4, last CPU#0: [ 804.229236][ T34] #0: ffffffff8ee362f0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 [ 804.229271][ T34] #1: ffff888059a90340 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 804.229307][ T34] #2: ffff888059a94cc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 804.229366][ T34] #3: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: do_exit+0x1682/0x2380 [ 804.687709][ T34] [ 804.687715][ T34] ============================================= [ 804.687715][ T34] [ 804.687736][ T34] NMI backtrace for cpu 0 [ 804.687750][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 804.687772][ T34] Tainted: [L]=SOFTLOCKUP [ 804.687778][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 804.687788][ T34] Call Trace: [ 804.687796][ T34] [ 804.687804][ T34] dump_stack_lvl+0xe8/0x150 [ 804.687822][ T34] nmi_cpu_backtrace+0x274/0x2d0 [ 804.687900][ T34] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 804.687919][ T34] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 804.687938][ T34] sys_info+0x135/0x170 [ 804.687953][ T34] watchdog+0x1058/0x10d0 [ 804.687973][ T34] ? watchdog+0x209/0x10d0 [ 804.687993][ T34] kthread+0x38b/0x480 [ 804.688008][ T34] ? __pfx_watchdog+0x10/0x10 [ 804.688021][ T34] ? __pfx_kthread+0x10/0x10 [ 804.688038][ T34] ret_from_fork+0x514/0xb70 [ 804.688056][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 804.688071][ T34] ? __switch_to+0xc78/0x1410 [ 804.688093][ T34] ? __pfx_kthread+0x10/0x10 [ 804.688109][ T34] ret_from_fork_asm+0x1a/0x30 [ 804.688137][ T34] [ 804.688151][ T34] Kernel panic - not syncing: hung_task: blocked tasks [ 805.238773][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 805.249579][ T34] Tainted: [L]=SOFTLOCKUP [ 805.253919][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 805.263978][ T34] Call Trace: [ 805.267261][ T34] [ 805.270199][ T34] vpanic+0x26f/0x710 [ 805.274196][ T34] panic+0xc5/0xd0 [ 805.277928][ T34] ? __pfx_panic+0x10/0x10 [ 805.282365][ T34] ? nmi_cpu_backtrace+0x2b0/0x2d0 [ 805.287490][ T34] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 805.293739][ T34] watchdog+0x10cc/0x10d0 [ 805.298101][ T34] ? watchdog+0x209/0x10d0 [ 805.302545][ T34] kthread+0x38b/0x480 [ 805.306641][ T34] ? __pfx_watchdog+0x10/0x10 [ 805.311322][ T34] ? __pfx_kthread+0x10/0x10 [ 805.316045][ T34] ret_from_fork+0x514/0xb70 [ 805.320700][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 805.325820][ T34] ? __switch_to+0xc78/0x1410 [ 805.330511][ T34] ? __pfx_kthread+0x10/0x10 [ 805.335112][ T34] ret_from_fork_asm+0x1a/0x30 [ 805.339996][ T34] [ 805.343098][ T34] Kernel Offset: disabled [ 805.347426][ T34] Rebooting in 86400 seconds..