last executing test programs: 11m48.924177074s ago: executing program 32 (id=52): syz_clone(0x111, 0x0, 0x9, 0x0, 0x0, 0x0) r0 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0xa, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001000000000000000100100000b"], 0x28}, 0xfc40) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x28}, 0xfc40) recvmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) 10m35.799864103s ago: executing program 33 (id=698): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x8, 0x4) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @mcast1, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@hopopts={{0x18, 0x29, 0x36, {0x89}}}], 0x18}, 0x3404c8c4) 10m26.185977289s ago: executing program 34 (id=775): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYRES8=0x0], 0x1, 0x1c2, &(0x7f00000002c0)="$eJzslb+v0lAUx7+3hZIaE1x10UQScLC/UCODA3F00ESjcYNIIWgRAx2ACf4KZ2cHZ+JC4p+hgzqZKG5OJq8vt719va/hQeD1kZe88xluv+09HM45XL4FQRAXlp8//n3/VC7pXF9GCQXx/JeaxChS/Lz4/9bX7uPP762/3+aLR7VUOm3b788BWNRV+OI+CIJA3i+J6zMosc6jkey/AIMhdAMKngvtguGl0K8l3efxhtHueq7xqu+1uLD4YvPF4Us1Xd9yxtCS6mPS/nA8edP0PHdwevGQl71qa9P8lnUFD6T65N8rno2VzA82FNhCV8HwVOj7KMSziUYi9X8tl+RXz6b/DMTvzBIyYMr7O7alY4eEV4sbYvI4D6PLXMT/kiwS6omz7LML0cJ0q0+x8JD80fdbalbio5468zuLxJ+CDwxlyZ9ykn+Yfu+dORxPbnd7zY7bcd86TvWedcey7jpmaERm+8t6/9NDf7ok5c+fEKsxDaOm7w/saD26d0YF+ANnleNqof8pqNyMqmYrXnLhMbnCbvBLRQUOgoh1dRMEQRAEQRAEQRAEQRAEQWzPdbBZkKaG9BPnSRh9GAAA///djGbI") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x60840, 0x8) io_setup(0x2e, &(0x7f0000000200)=0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000040)='./file1\x00', 0x12000021) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xf, r0, 0x0, 0x0, 0x4000000}]) 7m41.309224861s ago: executing program 1 (id=2181): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x3, @empty, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0x2, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r1, &(0x7f0000000540)={&(0x7f0000000000)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}, 0x47, &(0x7f0000000440)=[{&(0x7f0000000040)="f0", 0x1}], 0x1}, 0x40054) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000001380)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0xabb8, 0x67, 0xa4f, 0x0, 0x28, 0xffffff85, 0xa9}, 0x9c) 7m40.40279492s ago: executing program 1 (id=2185): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x5000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) write$binfmt_aout(r1, 0x0, 0xffffffdb) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 7m38.513214443s ago: executing program 1 (id=2202): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) syz_clone(0x120e1100, 0x0, 0x13, 0x0, 0x0, 0x0) 7m38.268528192s ago: executing program 1 (id=2206): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x0) 7m38.048027244s ago: executing program 1 (id=2209): setresuid(0x0, 0xee00, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "0007f8f9951e76c13f64323723e7eecdf40c363423eb3d259266f79c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000040000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a0a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103c7114ab40a68e528329d97afc3612e325c1eb4a3ab2e156aaf44480000000000000000000000000000000000aed500", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec118b233cce7e4a1e49738d9679d33610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6762c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8542e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8508002e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928ff0100000000000095adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b6ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c303cf786093a21477431fea0458023953700"}) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x40001000000000, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) clock_settime(0x0, &(0x7f0000000000)) 7m37.485271466s ago: executing program 1 (id=2215): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mq_open(&(0x7f0000000000)='$@\x00', 0x40, 0x1b4, 0x0) fcntl$setlease(r1, 0x400, 0x0) mq_open(&(0x7f0000000140)='$@\x005gM\xfb\xa3\xabt\xb8\x97\xa2`\xcc\xfb&\r.\x97TM&\x93\xd3\xd2\x17[\x89}\xd2j\xd6\xee\xf4\'@\xff\x00\x00\x00\x00\x00\x00\x00\x00\xcd.,\xfb\xab\xb9\x00r\voG\x9d\xaa\x86\xe9\xff\x1b\xa20\x16\t\x05\xa4\x97\xfah\xe9u\xbb\xad~\xb3\x83\xb9\xa3\xe7\xa4\xea\xe6x\xd8H\xa9\xa89\x1a\xfeZ0+\x18\xe9\xc7\x87\\\x05\xbf`!Q\xf2\xcc\xbc4\xbc|s\xbdZY1\x02r\xac\x805\x06\x18\xb5\x88gx\xac\xd6\xc7.\xa6Z\x84X:{II>~<\xa4x\'\xd0\xdc\xf5`\x1a\x1dI:\x8b\xc6v/;U\xac\x12\xed\xed\x86W\xf4\xcb\xf4\xdd\x89w<\xd2d\xc0\x17\xf3\x9f\xdf\xd2', 0x1, 0x0, 0x0) mq_unlink(&(0x7f0000000040)='$@\xae') 7m36.802045441s ago: executing program 35 (id=2215): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mq_open(&(0x7f0000000000)='$@\x00', 0x40, 0x1b4, 0x0) fcntl$setlease(r1, 0x400, 0x0) mq_open(&(0x7f0000000140)='$@\x005gM\xfb\xa3\xabt\xb8\x97\xa2`\xcc\xfb&\r.\x97TM&\x93\xd3\xd2\x17[\x89}\xd2j\xd6\xee\xf4\'@\xff\x00\x00\x00\x00\x00\x00\x00\x00\xcd.,\xfb\xab\xb9\x00r\voG\x9d\xaa\x86\xe9\xff\x1b\xa20\x16\t\x05\xa4\x97\xfah\xe9u\xbb\xad~\xb3\x83\xb9\xa3\xe7\xa4\xea\xe6x\xd8H\xa9\xa89\x1a\xfeZ0+\x18\xe9\xc7\x87\\\x05\xbf`!Q\xf2\xcc\xbc4\xbc|s\xbdZY1\x02r\xac\x805\x06\x18\xb5\x88gx\xac\xd6\xc7.\xa6Z\x84X:{II>~<\xa4x\'\xd0\xdc\xf5`\x1a\x1dI:\x8b\xc6v/;U\xac\x12\xed\xed\x86W\xf4\xcb\xf4\xdd\x89w<\xd2d\xc0\x17\xf3\x9f\xdf\xd2', 0x1, 0x0, 0x0) mq_unlink(&(0x7f0000000040)='$@\xae') 5m29.950401355s ago: executing program 0 (id=3203): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4006, r1, 0x0}]) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) 5m29.56848897s ago: executing program 0 (id=3206): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000054) r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000000)=0x2, 0x4) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28}}], 0x1, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x10000, &(0x7f0000000040)={0xa, 0x4e20, 0x9, @private0, 0xfffffffc}, 0x1c) 5m29.31441251s ago: executing program 0 (id=3208): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xe, 0x4, 0x4, 0x100, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000004000000040000000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000061180000000000007a0af8ff0000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d800000018002f25e6924c1b00e6b904021d080006007c09e8fe55a10a0015400200142602600e1208000f0000000401a8001600140003400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001f180000000000000014d6d930dfe1d9d322303983a475730d16a4683f5aeb4edbb57a5025ccca1e10360000000000000080d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b9f65137743370e97039207", 0xd8}], 0x1}, 0x0) 5m27.429183802s ago: executing program 0 (id=3217): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x6000, 0x0) 5m27.215431464s ago: executing program 0 (id=3219): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x40000001, 0x0, 0x0) 5m26.614263323s ago: executing program 0 (id=3222): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x8, 0xc, 0x800, 0x1, 0xffffffffffffffff, 0xfffffff0}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000b00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000080)="630b008646dc3f0adf398151d900", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, 0x50) 5m26.142056296s ago: executing program 36 (id=3222): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x8, 0xc, 0x800, 0x1, 0xffffffffffffffff, 0xfffffff0}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000b00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000080)="630b008646dc3f0adf398151d900", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, 0x50) 5m13.735171782s ago: executing program 7 (id=3307): r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file1'}, 0xb) close(r1) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x6020, 0x0) 5m13.505253247s ago: executing program 7 (id=3310): r0 = gettid() r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_int(r2, 0x1, 0xa, 0x0, &(0x7f0000000000)) 5m12.927077102s ago: executing program 7 (id=3314): r0 = socket(0x28, 0x5, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r1, 0x4) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000280)="b00480fc5d92669a0c1ade67c5d2b854a37a8b6a9d65edb85153cee1", 0x1c}], 0x1}}], 0x1, 0x0) r2 = accept4$unix(r1, 0x0, 0x0, 0x800) recvfrom$unix(r2, &(0x7f0000000140)=""/248, 0x1ffd4, 0x0, 0x0, 0x0) 5m12.700590436s ago: executing program 7 (id=3316): syz_clone3(&(0x7f0000000080)={0xa610b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x149}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r4, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 5m11.249396312s ago: executing program 7 (id=3325): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) 5m9.634379691s ago: executing program 7 (id=3336): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0xfffc, @loopback}, 0x80004, 0x0, 0xffffffbf}}, 0x2e) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 4m54.096491225s ago: executing program 37 (id=3336): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0xfffc, @loopback}, 0x80004, 0x0, 0xffffffbf}}, 0x2e) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 2m59.054217211s ago: executing program 9 (id=4269): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x44010, &(0x7f0000000040)={0x11, 0x4, r2, 0x1, 0x7}, 0x14) 2m58.724586856s ago: executing program 9 (id=4270): r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x3, 0x1, 0x1, 0x0, 0x6, @random="ee52e7e07522"}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x40000158, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xba6, 0x0, 0x0, 0x1000, 0xd, 0x0, 0x0, 0xac}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x1, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587d, 0x200, 0x1, 0x69, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x800, 0x10000, 0x400000, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x20, 0x3, 0x0, 0x0, r1}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) 2m58.012182576s ago: executing program 9 (id=4274): openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x80102, 0x0) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) 2m57.716059004s ago: executing program 9 (id=4275): syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000010, &(0x7f00000022c0)=ANY=[], 0x1, 0x6dc, &(0x7f0000000680)="$eJzs3c1vHGcdB/DvrNeuN1TBaRMaoSKsRCpIEYkdK4VwwSCEcqhQVQ49W4nTWN0kVeKitELgAoITEof+AQXJNw4IiXtQuHApt159rITEJeIQ9bJoZmfXu/b6LS/rGD6faDzPzPPMM7/57TMzuxOtNsD/rSvn0ryfIlfOvXGvXN5YX2hvrC+8UFe3k5TlRtLszlLcSooHyWJZXwxMGZhv8/HK5bc+e7jxeXepWU9V+4ndththRNu1esps3d/syC0n97uLtTq8vJjkaj0fNrXfvoYalkk7W8/h0HW2WTvI5gc5b4HnTO/uVHTvm9vMJMeSTNfvA1JfHRrji/DZONBVDgAAAI6AUY+9P719CIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAkVX0/k7UC0X9+/5VxWyK3u//T/Ubd8vPocV9t7z/TOMAAAAAAAAAgPH4+qM8yr0c7y13iur//M9UCyfzRSf5Ut7P3SznTs7nXpaymtXcyXySmYGOpu4tra7eme9vWRq95cWRW14c1xEDAAAAAAAAwP+kX6a1+f//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwPCiSie6smk7W88yk0cxmXdaSfyaZOux4D6AYtfL++OMAAACAJzL9GNt8+VEe5V6O95Y7RfWZ/yvV5+XpvJ9bWc1KVtPOcq7Vn6HLT/2NjfWF9sb6ws1yKpeH+/3+vw8UxlTdw0S1NGrPp6sWrVzPSrXmfK5WwVxLo7vvs8npXjwDcQ34qIyp+F5tn5E167SWO/v9Tk8RnorhRxGNXVq2NoNL+hmZq2MrtzzRzUBRPahJtmZiz1enObQ0Uz8JKpV7mk+j/+Tn5JPkfG303o/V8/J4fvNMc35QM1V+J3O90c3Exd7oK8+Z3TORfOOvf3r7RvvWuzeu3z33/BzSHiZ2WN/PRD36FgYy8cqRzkTzgO3nqkyc6i9fyY/yk5zLbN7Mnazkp1nKapbTqeuX6vFc/p3ZPVOLQ0tv7hXJVP26dF+z/cQ0mx9WpaWcqbY9npUUuZ1rWc7r1b+Lmc+3cymXcnngFT61Y9zVsVVnfWPrWd97pf82Mviz36wL5dXtt5tXucXdjnin0fm0dK/9ZV5PDOS1O+of9ludGDgP5gay9FIvO5MjO3+c+1Hzq3Wh3Mev9rhPjNdMnYnyBOrdJXrRvdzNRLO6F20f53/olNulfavTubH03g79b71ZvFbPy2G1/rW9WveMfimernK8vJTp+koyPDrKupf7V5mBus7mWO7WDV5d56vtTlV1RdE7U3+c29UA2H6mTtXv4bb3dLGqe2Vk3UJVd3qgbuj9Vm6nnWtjyB8Aj+Mfb/eLMzk21fpX69PWJ61ft2603pj+wQvfeeHVqUz+ffK7zbmJ1xqvFn/JJ/n55ud/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg8d394MN3l9rt5TujC42dq4YKrWxds1fPWwpF/YM+B9vq+S1MJxlaU/3O0djDaG0NY1uh84tk7Pnp/Yjg6Da/KwvNbSNqVGFxaM2ft3f40QEjLPZ3XjzDQiPj3elERg+AQ7woAWNxYfXmexfufvDht1ZuLr2z/M7yrclLly7PXb70+sKF6yvt5bnu38OOEngWht4GAAAAAAAAAAAAAEfCqC8GnHlxry+N7Os7Hv01h32MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNF25Vya91Nkfu78XLm8sb7QLqdeebNlM0mjkRQ/S4oHyWK6U2YGuivyxwfpjNjPxyuX3/rs4cbnm301u+2TRj3f2e61SdbqKbNJJur5Exjq7+oT91f8p3cMZcK+6HQ6i08WHzwd/w0AAP//aKX0ZQ==") syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x80f811, 0x0, 0x0, 0x0, &(0x7f00000000c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/cpu/drivers/processor\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000200)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='cpu1\x00', 0x5) write(r1, &(0x7f0000000400)='cpu0\x00', 0x5) 2m56.866164982s ago: executing program 9 (id=4280): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = fanotify_init(0xf00, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) fanotify_mark(r0, 0x5, 0x4800003e, r1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x800, 0x89) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) read$FUSE(r0, &(0x7f0000000f40)={0x2020}, 0x2020) 2m54.962251877s ago: executing program 9 (id=4294): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x9, @loopback, 0x40000040}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "d64cc3f471c4204a", "36c50df5ddc4b6dd424341850238e8c2", 'It/\"', "a86bd41ce8767e30"}, 0x28) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0) 2m54.454679067s ago: executing program 38 (id=4294): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x9, @loopback, 0x40000040}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "d64cc3f471c4204a", "36c50df5ddc4b6dd424341850238e8c2", 'It/\"', "a86bd41ce8767e30"}, 0x28) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0) 1m24.134060568s ago: executing program 3 (id=4870): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='hybla', 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000300)="51289c001e00cca9072e1f21dc867f59d038a0f9dc5b491af28acb49ed57cb078a3854ba6868de75dc4dd4d6a6a2d4a93d08d65b9b9d4c1909c16ea574ed6c7f963425e749ef6246edeed157020743116d90c2b00900859863e1c07ab839fb7830ecd04df21f1356b0ad0d9b157d22bcf0", 0x9d0aeebe0bd281d3, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1m22.95657896s ago: executing program 3 (id=4863): rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8) r0 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000080)=0x0) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000140)={{0x77359400}, {0x0, 0xe4c}}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x7, &(0x7f0000000640)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000000)={{r2, r3+60000000}}, 0x0) rt_sigtimedwait(&(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x0, 0x8) 1m21.84240298s ago: executing program 3 (id=4875): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) openat(0xffffffffffffff9c, 0x0, 0xa02, 0x27) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000020) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$sock_int(r0, 0x1, 0x12, 0x0, &(0x7f0000002240)=0x12) 1m21.58814379s ago: executing program 3 (id=4877): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x800714, &(0x7f0000000000)={[{@nobarrier}]}, 0xff, 0x485, &(0x7f0000001040)="$eJzs3M9rHFUcAPDvTJL+bhNrrba2Gq1i8UfSpFV78KCi4EFB0EM9xiSttdtGmgi2BI0i9SgF7+JR8C/w5kXUgwheFTxKoWgQmnqKzK9mu9mkSZpkbfbzgc2+t/Nm3/vOzNt9My+zAbSt3uxPErEjIn6LiO4ie3OB3uJpZnpy+Pr05HASs7Nv/JXk5a5NTw5XRav1tpeZw2lE+mkSzyfz6x2/cPHMUK02er7M90+cfa9//MLFp06fHTo1emr03ODx48eODjz7zODTqxJnFte1/R+OHdj3yluXXxs+cfntH7/JmrX3YLG8Po5but4koCZ6s63292yucdmjy2j7nWBnXTrpbGFDWJaOiMh2V1fe/7ujI+Z2Xne8/ElLGwesqey7afPCi6dmgQ0siVa3AGiN6os+O/+tHus09PhfuPpCxKYyPTM9OTxzI/7OSMvXu9aw/t6IODH175fZI5Z7HQIAYAXysc2TzcZ/aezNn4u5jl3lHEpPRNwVEbsj4u6I2BMR90TkZe+NiPuKlWe7l1h/b0N+/vgnvdK0zaskG/89Vzf2m6mLv3zq6ShzO/P4u5KTp2ujR8ptcji6Nmf5gUXq+O6lXz9faFn9+C97ZPVXY8GyAVc6Gy7QjQxNDK3WRrj6ccT+zmbxJzdmArIjYF9E7F/eW++qEqcf//rAQoVuHf8iVmGeafariMeK/T8VDfFXksXnJ/u3RG30SH91VMz30y+XXl+o/tuKfxVk+3/bzcd/Q4nuf5JivrYrarXR8+PLr+PS758teE6z0uN/U/JmPmf98zvFax8MTUycH4jYlLya56tzuvz1wbl1q3xVPov/8KHm/X93uU4W//0RkR3EByPigYh4sGz7QxHxcEQcWiT+H1585N1F4k8iiZbu/5Gmn383jv+epH6+fgWJjjPff7vQjPnS9v+xmMo/awv5598tLLWBt7n5AAAA4I6QRsSOSNK+It27I9K0r6/4H/49sS2tjY1PPHFy7P1zI8U9Aj3RlVZXurrrrocOJFPlOxb5wfJacbX8aHnd+IuOrXm+b3isNtLi2KHdbb+5/0fV/zN/drS6dcCac78WtK/G/p+2qB3A+lvK979zAdiYmvT/ra1oB7D+nP9D+2rW/z9qyBv/w8Y0v///0eQn64CNyPgf2pf+D+1L/4e2dDv39a88Ud0ssPL32bLkO/zbJVH94sVa1rU15l6JtOUht1Ei6zHrW+ncb6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcyf4LAAD///ss5ts=") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124) write$P9_RREADDIR(r0, &(0x7f00000001c0)={0xb, 0x29, 0x3, {0x5}}, 0xb) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]}) truncate(&(0x7f0000000080)='./file2\x00', 0x4b1) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 1m19.937612315s ago: executing program 3 (id=4881): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004f40)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}}, 0x0) r2 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r2, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x0, 0x4}, 0x80, &(0x7f00000018c0)=[{&(0x7f0000000280)="9eb8a2c0e241fb0402ac67d48d04ecbc724648d79b443d2838", 0x19}], 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="18"], 0x18}, 0x8080) sendmsg$kcm(r2, &(0x7f0000000040)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x2}], 0x1, 0x0, 0x0, 0x900}, 0x0) 1m17.670495152s ago: executing program 3 (id=4885): syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x234a0c7, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000380)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) linkat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') setxattr(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)=@known='trusted.overlay.upper\x00', 0x0, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) 1m16.744671105s ago: executing program 39 (id=4885): syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x234a0c7, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000380)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) linkat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') setxattr(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)=@known='trusted.overlay.upper\x00', 0x0, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) 29.494269613s ago: executing program 2 (id=5152): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r1, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 27.624982253s ago: executing program 2 (id=5164): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0xf000, 0x3, &(0x7f0000009000/0xf000)=nil) mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffa000/0x2000)=nil) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000740)={[{@nouser_xattr}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@errors_continue}, {@nodelalloc}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}, {@nombcache}, {}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mlock2(&(0x7f0000009000/0x4000)=nil, 0x4000, 0x0) syz_clone(0x111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f00000000c0), 0xfdef) 24.640589001s ago: executing program 2 (id=5183): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad21ed0d52f91b5a090987f70e06d038e7ff7fc6e5539b5b43078b089b3b323b6d090890e0878f0e1ac6e7049b3371959b719a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074c0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) write$binfmt_elf32(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c4680400400050000000000000002000600c42f75405f00000038000000460000000800000001002000"], 0x4f) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 22.989073396s ago: executing program 2 (id=5192): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800004, 0x4) bind$inet6(r2, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) 21.822154767s ago: executing program 2 (id=5196): syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) pipe(&(0x7f0000000280)) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x101800, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') pselect6(0x40, &(0x7f00000000c0)={0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000100)={0x1ff, 0x0, 0x1ac6, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0x0) shutdown(r0, 0x1) 20.116453673s ago: executing program 2 (id=5202): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x9fc) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500150002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) 11.674752117s ago: executing program 8 (id=5240): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x41}, 0x3}}, 0x10) listen(r0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r1, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) r3 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0}, 0x4) 11.178777176s ago: executing program 8 (id=5241): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r3], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 10.846201161s ago: executing program 5 (id=5242): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x400) ppoll(&(0x7f0000000340)=[{r0, 0x81}], 0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) 10.627175544s ago: executing program 6 (id=5245): sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40c0}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x82801, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0xfc, 0x2, 0xc6, 0x2, 0x4, 0x0, 0x7, 0x4c, 0x7, 0x3, 0x3, 0x9, 0x8, 0x4, 0x8}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x102, 0x8000000000000, 0x1000000003, 0x0, 0x8, 0x0, 0x6, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10.536444772s ago: executing program 6 (id=5246): r0 = creat(&(0x7f0000000140)='./file0\x00', 0x4) fstat(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5) setreuid(r3, 0x0) setresuid(r1, 0x0, r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) ioprio_set$uid(0x3, r5, 0x4007) 10.402060449s ago: executing program 6 (id=5247): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) r8 = dup(r5) syz_ublk_setup_queues(r8, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 10.215809985s ago: executing program 8 (id=5250): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000002240)='./file0\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c666c7573682c646d61736b3d30303030303030303030303030303030303137373737372c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c756e695f786c6174653d312c726f6469722c696f636861727365743d757466382c666d61736b3d30303030303030303030303030303030303030303030342c646d61736b3d30303030303030303030303030303030303030303030372c757466383d312c726f6469722c73686f72746e616d653d77696e39352c726f6469722c00743ccfec81d6c7d05b0f2a54ddce151ec4cbbaacb9552647fd950fedfdc024b3953e7669bc9d4f66e3beaecb80fe73633280b1d3e82023d4f5c7f5a4989406c0f0d0cf537f132dc1e63d84a17532cb78ae7a368bc0029207b9b166705972f4e8dad041e6be170bf43057b456d43f100c53b471aa6c8e3751", @ANYRESOCT], 0x1, 0x2c2, &(0x7f00000006c0)="$eJzs3T+LI2UYAPBndpNJ7iySwkoEB7SwOm6vtckiOThMpaRQC128O5AkCHew4CkGK1sbSz+BINj5JWwEP4DgB7DzioNXJpkh2btJsoHLrX9+vyL77Lzv877POzPZPyzz7sevziZ3i7j/9Ze/R7ebxdEgBvE4i34cRS2llGJl8G0AAP9mj1OKP9PSJVMG5UsWEd3DlgYAHMje3/9/OnhJAMCBvff+B++cjkbDd4uiG7dn35yPy9/sy4/L9tP78WlM417cjF48Wf4toP5poXy9nVKat4pSP96Yzc/HZebso1+q8U/riU6iF/1FdDH/zmh4Uiyt5c/LOq5X8w/K+W9FL15umP/OaHirIT/Gebz5+lr9N6IXv34Sn8U07i6KWOV/dVIUb6fv/vriw7K8Mj+bn487i34r6fjFXRUAAAAAAAAAAAAAAAAAAAAAAP7rblR753RisX9Peajaf+f4SflJO4pa/+L+PMv8rB7oqf2B5im+T6nTihgNbxZFkaqOq/xWvNKK1tWsGgAAAAAAAAAAAAAAAAAAAP5ZHn7+aHI2nd570BD8dj1iQ9OGoN4NoH6sf0fW8aamwdqR1+LR5KyzecC1pqMq3DJpHNd9soity4lWux65v9dJ2D+4tqnmH37cd8Du7j7tbefn+QT13TU5y6KxTyfqI936mv683iePS86Vb2pKu2+/tSBvbOrtvfb8pUUw39Insm2FvfXH8sxVR7KnV5EvzmpjenttN47me6P5Wmx6pzwjW7yt8+f3xQcAAAAAAAAAAAAAAAAAALhg9dDvM03XdqQepc7BygIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAF2r1///3COZV8iU65/Hg4RUvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwMAAP//QSRWPA==") r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) keyctl$chown(0x4, r0, 0xee01, r1) keyctl$setperm(0x5, r0, 0x20002004) keyctl$read(0xb, r0, &(0x7f00000010c0)=""/4096, 0x1000) keyctl$restrict_keyring(0xa, r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 9.830112791s ago: executing program 8 (id=5251): syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0), 0x4, 0x48e, &(0x7f0000000d00)="$eJzs3M1vVFUbAPDnTj+AAm/7In6AKFU0NhpbWlBZuACjiQtNTHSBy9oWRAo1bTVCiFYXuDQk7o1LE/8CV7ox6srErbo2JMSwAXVzzZ25t50ZZsZp6TDA/H7J0HPuuZdznnvumZ5zb2cC6Fmj2T9JxI6I+DUihivZ2h1GKz+uX70w89fVCzNJpOnrfybl/a5dvTBT7Foct73IrNRur7Z07vzp6fn5ucU8P7F85t2JpXPnnz51Zvrk3Mm5s1NHjhw+NPncs1PPbEqcWZuu7f1wYd+el9+89OrM8Utv/fh1UsRfE8f77f+nW1uWjjbY1lckHm+/ljvCzqp00t/FhrAub0dE1l0D5fE/HH2x1nnD8dInXW0c0FFpmqZbmhevpMBdLIlutwDojvz3fBKxMpOtgavX883dPQu8K8cq4WRxX89flZL+KOX7DNStbzdTdiaPr/z9RfaKuvspAACd8O2xys9i7rc2/yjVTPKO5s+GRiLi/xGxKyLuiYjdEXFvRNwXEfdHxANVxzR67lOv/iHJjfOf0uUNBdambP73fP5sq3b+V8z+YqQvz+0sxz+QnDg1P3cwIv4XEWMxsCXLT7ao47sXf/msWdlo1fwve2X1F3PBvB2X++tu0M1OL0/fTMzVrnwcsbe/UfzJ6iw/68c9EbF3/8bqOPXkV/ualf13/C1swjIk/TLiiUr/r0Rd/IWk9fPJia0xP3dworgqbvTTzxdfa1b/TcW/CbL+H2p4/a/GP5JUP69dWn8dF3/7tOmaps3rf7D6mOz6H0zeKKeLgg+ml5cXJyMGk1fy7Ufz7bX1lfebWts/i3/sQOPxvyvWzsSDEZFdxA9FxMMRsT9v+yMR8WhEHGgR/w8vPPbOxuPvrCz+2XX1f9NE8Wx7bnEgaor6Tn//Tbmk6KyRFvEn0aD/D5dTY/mWdt7/WrZ08WauZgAAALjzlCJiRySl8dV0qTQ+Xvl7+d0xVJpfWFp+6sTCe2dnK58RGImBUnGna3j1fmisTObL+uL+6FRd/lB+3/jzvm3l/PjMwvxst4OHHre9yfjP/NHX7dYBHXf3/DkfsF4bHf9pmn60yU0BbrF1jf/BzrUDuOWGzP+hdzUY/9vq8i2+IwC4kzX6/W9hD73B/B96l/EPvcv4h961gfH/+1AnGgLcSvkn4fvb+YB/xxLZ+0/3am8nETUtTNMuNWPw9jgb5USUulZ7bPDwsS6dsX/yL9u8PTquzUS335kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2x78BAAD//xsC4og=") socket$netlink(0x10, 0x3, 0xb) openat(0xffffffffffffff9c, 0x0, 0x141104, 0x105) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r1, 0x1, 0x3}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r2, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf610000000000000701000004000000850000005d000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x1000, &(0x7f0000001000)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000002000)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 9.506306255s ago: executing program 8 (id=5252): pipe2(&(0x7f0000000040), 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x80003, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56171, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x6, "00000000000b0400"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001600)=ANY=[@ANYBLOB="201000001300210800000000fedbdf2508000000", @ANYRES32=r0, @ANYBLOB="0600fc0021a50000202bcb05ec7a582ce0ae744eac81f6aec3fe73e310c1fb24c997eb3035069a71f58308651137eacd005beafb2f05b1e2efe95164255281e72ad59a78d27fd4cb7e1d967e6f3ebf10a7c2b0d85456007b0c27d121927a23118bad42410feb8e34675c2b9230af9a2a3343c83b7402fa08f06189df42addbfea38cba4f5ee54de3ca37d6c81574b79b235403451cc59d22b0d2c5c893569b830d7f5df5cf72caf34f566250d590e7ce8e3a7f719b44d70a0f39608203a69a6161b169713b6e92141ef754e96863674d7d71bcb1e389eee7a333177542b8e53686eb5229b36af0a13f002b893aeb9b01774fb3d8bb305226d83871877731ca04b018fa7b658978dffcc4100711e1be08af783db12be9ba0817fa387760998e0006151af56ff3db273eba195cc126e6646af640108800f49f0116193fa388563e993296a3a8862de2cb68d3754b21675cb99ea627348afc64a4da1dbff6a8da3f094416a804347c6b02e0742381748f1cb5254532a81715399c6989d881351a285148a5e7309e261d100b0c1954227a293b03a453c91961928373db6231e03780b39cf02e1625c4c6c712a0716c1471ffe64265b47267f719db24ba24a81f380e8b2824f1178c1cd5f5bbc65fe6324b1b09a2c39ac360f385ce077cf18c1443cd32cc4f133a4740e8a252525261135f4850b7272de9ad1c344730f1e58fab6444271e81469c1be91fa9b86c10476e9e3ea23a4cfea1dd2c0b802513152c661aef2878a7a56610a7b67baf4f8e79410abf3d5f69e6f5f717c7e84457d8ca2e9ed1fd472af77411ca6ee0f186a521a6f9"], 0x1020}], 0x1, 0x0, 0x0, 0x20004814}, 0x0) 8.731089978s ago: executing program 6 (id=5253): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002400128009000100626f6e6400000000140002800500010006"], 0x44}, 0x1, 0x0, 0x0, 0x404c800}, 0x0) r3 = socket(0x1, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0) 6.814022226s ago: executing program 5 (id=5257): close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904010000010230000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) getdents(0xffffffffffffffff, 0xfffffffffffffffd, 0x58) accept$packet(0xffffffffffffffff, 0x0, 0x0) 4.744103585s ago: executing program 40 (id=5202): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x9fc) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500150002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) 4.651903583s ago: executing program 4 (id=5261): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x3f) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x48) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000480)={0x8, 0x6, 0x800000000300, 0xb, 0xd7d, 0x4}) 4.624529948s ago: executing program 5 (id=5262): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f00000000c0)=0x8, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701fe"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = dup(r0) bind$unix(r1, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) bind$unix(r3, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e) 4.431358716s ago: executing program 5 (id=5263): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {}, {0x0, 0x0, 0xe06}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x20}}, 0xe4) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x2, 0x13, 0x0, 0xe, 0x2, 0x0, 0x0, 0x25dfdbf8}, 0x10}}, 0x4000050) 4.026198456s ago: executing program 4 (id=5264): syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r0 = syz_ublk_setup_io_uring(0x1c, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x95}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10010001, 0xffffffffffffffff, 0x0, 0xcd}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x1000d8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40, 0x2000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0xfffffffd, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x2, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x40, 0x2, 0x369}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, r4, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) close(0x3) 4.026075246s ago: executing program 5 (id=5265): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r2], 0x68}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) pwritev2(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x7, &(0x7f0000000300)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xf, 0xa}, {0xd, 0xffff}, {0x1, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc5}, 0x0) 2.683510491s ago: executing program 4 (id=5266): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet(0x2, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000180)=0x6, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) 675.486996ms ago: executing program 4 (id=5267): r0 = socket$packet(0x11, 0x2, 0x300) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r1 = openat(0xffffffffffffff9c, 0x0, 0x143041, 0x2a) pwritev2(r1, 0x0, 0x0, 0xe7b, 0x0, 0x0) getsockopt$packet_int(r0, 0x107, 0x15, 0x0, &(0x7f0000001600)) 630.644965ms ago: executing program 8 (id=5268): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mprotect(&(0x7f00001be000/0x4000)=nil, 0x4000, 0x2) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x229, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x14) 489.137033ms ago: executing program 6 (id=5269): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b7}, @TCA_FQ_PIE_ECN={0x8, 0xa, 0x1}]}}]}, 0x44}}, 0x20004055) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0300000000000000280012"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x54) r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="840000001000010027bd700402d4df2500000000", @ANYRES32=r2, @ANYBLOB="94e40700100c000064001280110001006272696467655f736c617665000000004c000580080003000100000005002100"], 0x84}}, 0x200088c2) 382.308784ms ago: executing program 4 (id=5270): syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x88000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r1, r1, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 249.98529ms ago: executing program 4 (id=5271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f0000000140)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x6, 0x0, 0x14, 0xf}, @ipv4=@tcp={{0x5, 0x4, 0x3, 0x2f, 0x28, 0x64, 0x0, 0x8, 0x6, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x3e}}, {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x101, 0x0, 0x411}}}}, 0x36) 47.504101ms ago: executing program 6 (id=5272): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80143, 0x1ff) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r1, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae", 0x1b0, 0x805, 0x0, 0x0) recvmmsg(r1, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000980)=""/146, 0x92}, {&(0x7f0000000080)=""/43, 0x2b}, {&(0x7f0000000a80)=""/242, 0xf2}, {0x0, 0x12}], 0x4}, 0x2}], 0x2, 0x22, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x4840}, 0x11) 0s ago: executing program 5 (id=5273): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) read(r2, &(0x7f0000000140)=""/192, 0xc0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0xff, 0x6}, 0x1}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r2, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000005c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) kernel console output (not intermixed with test programs): ] exFAT-fs (loop3): failed to recognize exfat type [ 606.672956][T17430] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 606.750003][T16097] net_ratelimit: 86 callbacks suppressed [ 606.750025][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 606.908281][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 607.029685][ T5212] bond3: (slave batadv0): failed to get link speed/duplex [ 607.285375][ T4274] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 607.296088][ T4274] CPU: 1 PID: 4274 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 607.296112][ T4274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 607.296127][ T4274] Workqueue: hci0 hci_rx_work [ 607.319817][ T4274] Call Trace: [ 607.323120][ T4274] [ 607.326064][ T4274] dump_stack_lvl+0x188/0x24e [ 607.330783][ T4274] ? show_regs_print_info+0x12/0x12 [ 607.336098][ T4274] ? load_image+0x410/0x410 [ 607.340643][ T4274] sysfs_create_dir_ns+0x26a/0x290 [ 607.345798][ T4274] ? sysfs_warn_dup+0xa0/0xa0 [ 607.350781][ T4274] ? do_raw_spin_unlock+0x11d/0x230 [ 607.356119][ T4274] kobject_add_internal+0x617/0xca0 [ 607.361484][ T4274] kobject_add+0x160/0x230 [ 607.365957][ T4274] ? kobject_init+0x1c0/0x1c0 [ 607.370665][ T4274] ? __raw_spin_lock_init+0x41/0x100 [ 607.375976][ T4274] ? klist_children_get+0x50/0x50 [ 607.381114][ T4274] ? get_device_parent+0x121/0x3e0 [ 607.386474][ T4274] device_add+0x470/0x1050 [ 607.390919][ T4274] hci_conn_add_sysfs+0xd1/0x1e0 [ 607.396023][ T4274] le_conn_complete_evt+0xf93/0x15c0 [ 607.401440][ T4274] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 607.407933][ T4274] ? param_get_dyndbg_classes+0x160/0x160 [ 607.413703][ T4274] ? mutex_unlock+0x10/0x10 [ 607.418250][ T4274] hci_le_conn_complete_evt+0x183/0x440 [ 607.423903][ T4274] ? hci_remote_host_features_evt+0x230/0x230 [ 607.429991][ T4274] hci_event_packet+0x7b3/0x1290 [ 607.434964][ T4274] ? lock_chain_count+0x20/0x20 [ 607.439833][ T4274] ? bis_list+0x280/0x280 [ 607.444285][ T4274] ? lockdep_hardirqs_on+0x94/0x140 [ 607.449555][ T4274] ? hci_send_to_monitor+0x9c/0x4a0 [ 607.454865][ T4274] hci_rx_work+0x3eb/0xd40 [ 607.459475][ T4274] ? _raw_spin_unlock+0x40/0x40 [ 607.464607][ T4274] ? process_one_work+0x7b4/0x1160 [ 607.469740][ T4274] process_one_work+0x8ab/0x1160 [ 607.474795][ T4274] ? worker_detach_from_pool+0x240/0x240 [ 607.480559][ T4274] ? _raw_spin_lock_irq+0xb7/0xf0 [ 607.485808][ T4274] ? _raw_spin_lock_irqsave+0x100/0x100 [ 607.491391][ T4274] ? wq_worker_running+0x97/0x190 [ 607.496447][ T4274] worker_thread+0xaf5/0x12a0 [ 607.501271][ T4274] kthread+0x29d/0x330 [ 607.505444][ T4274] ? worker_clr_flags+0x1a0/0x1a0 [ 607.510529][ T4274] ? kthread_blkcg+0xd0/0xd0 [ 607.515311][ T4274] ret_from_fork+0x1f/0x30 [ 607.519858][ T4274] [ 607.523900][ T4274] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 607.537267][ T4274] Bluetooth: hci0: failed to register connection device [ 607.565101][T17739] FAULT_INJECTION: forcing a failure. [ 607.565101][T17739] name failslab, interval 1, probability 0, space 0, times 0 [ 607.673704][T17745] netlink: 64 bytes leftover after parsing attributes in process `syz.6.4159'. [ 607.685879][T17739] CPU: 0 PID: 17739 Comm: syz.3.4158 Not tainted syzkaller #0 [ 607.693382][T17739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 607.693397][T17739] Call Trace: [ 607.693404][T17739] [ 607.693414][T17739] dump_stack_lvl+0x188/0x24e [ 607.693449][T17739] ? show_regs_print_info+0x12/0x12 [ 607.693473][T17739] ? load_image+0x410/0x410 [ 607.693507][T17739] ? __lock_acquire+0x7ea0/0x7ea0 [ 607.707437][T17739] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 607.715064][T17739] should_fail_ex+0x390/0x4c0 [ 607.715105][T17739] should_failslab+0x5/0x20 [ 607.724827][T17739] slab_pre_alloc_hook+0x59/0x300 [ 607.736399][T17739] ? pipapo_clone+0x4a/0xae0 [ 607.745753][T17739] __kmem_cache_alloc_node+0x4f/0x270 [ 607.745797][T17739] ? pipapo_clone+0x4a/0xae0 [ 607.745818][T17739] __kmalloc+0xa3/0x240 [ 607.745840][T17739] pipapo_clone+0x4a/0xae0 [ 607.745875][T17739] nft_pipapo_init+0x50f/0x680 [ 607.746033][T17739] nf_tables_newset+0x1c0b/0x2530 [ 607.761698][T17739] ? nf_tables_delrule+0x1100/0x1100 [ 607.770547][T17739] ? __lock_acquire+0x7ea0/0x7ea0 [ 607.770602][T17739] ? __nla_parse+0x3c/0x50 [ 607.779798][T17739] nfnetlink_rcv+0x1119/0x2470 [ 607.779859][T17739] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 607.790896][T17739] ? ref_tracker_free+0x682/0x830 [ 607.790958][T17739] ? netlink_deliver_tap+0x2e/0x1b0 [ 607.790983][T17739] ? __netlink_deliver_tap+0x7a9/0x7e0 [ 607.791018][T17739] ? netlink_deliver_tap+0x2e/0x1b0 [ 607.791047][T17739] netlink_unicast+0x7ad/0x920 [ 607.791083][T17739] netlink_sendmsg+0x8ad/0xbd0 [ 607.791116][T17739] ? netlink_getsockopt+0x550/0x550 [ 607.791143][T17739] ? apparmor_socket_sendmsg+0x8a/0x330 [ 607.791175][T17739] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 607.791197][T17739] ? security_socket_sendmsg+0x7c/0xa0 [ 607.791222][T17739] ? netlink_getsockopt+0x550/0x550 [ 607.805442][T17739] ____sys_sendmsg+0x5ed/0x9a0 [ 607.816463][T17739] ? __sys_sendmsg_sock+0x30/0x30 [ 607.827198][T17739] ? __import_iovec+0x306/0x510 [ 607.837170][T17739] ? import_iovec+0x6f/0xa0 [ 607.853541][T17739] ___sys_sendmsg+0x2a2/0x360 [ 607.864404][T17739] ? __sys_sendmsg+0x2a0/0x2a0 [ 607.874424][T17739] __se_sys_sendmsg+0x1c3/0x2b0 [ 607.884355][T17739] ? __x64_sys_sendmsg+0x80/0x80 [ 607.884405][T17739] ? lockdep_hardirqs_on+0x94/0x140 [ 607.884437][T17739] do_syscall_64+0x4c/0xa0 [ 607.884458][T17739] ? clear_bhb_loop+0x60/0xb0 [ 607.884480][T17739] ? clear_bhb_loop+0x60/0xb0 [ 607.884504][T17739] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 607.884527][T17739] RIP: 0033:0x7f67b019e159 [ 607.884547][T17739] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.884566][T17739] RSP: 002b:00007f67b10c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 607.884593][T17739] RAX: ffffffffffffffda RBX: 00007f67b0425fa0 RCX: 00007f67b019e159 [ 607.884609][T17739] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 607.884624][T17739] RBP: 00007f67b023506b R08: 0000000000000000 R09: 0000000000000000 [ 607.884637][T17739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 607.884650][T17739] R13: 00007f67b0426038 R14: 00007f67b0425fa0 R15: 00007ffce39140c8 [ 607.884677][T17739] [ 608.748115][ T4318] usb 10-1: new full-speed USB device number 4 using dummy_hcd [ 608.953259][ T4318] usb 10-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 608.977885][ T4318] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.027247][ T4318] usb 10-1: Product: syz [ 609.031861][ T4318] usb 10-1: Manufacturer: syz [ 609.036589][ T4318] usb 10-1: SerialNumber: syz [ 609.092826][ T4318] usb 10-1: config 0 descriptor?? [ 609.127386][ T4318] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 609.955416][T17801] lo speed is unknown, defaulting to 1000 [ 610.755481][ T4318] gspca_stk1135: reg_w 0x200 err -71 [ 610.768141][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.795187][ T4318] gspca_stk1135: Sensor write failed [ 610.819936][T17809] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 610.830851][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.848176][ T4318] gspca_stk1135: Sensor write failed [ 610.857896][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.874716][ T4318] gspca_stk1135: Sensor read failed [ 610.882395][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.901909][ T4318] gspca_stk1135: Sensor read failed [ 610.917108][ T4318] gspca_stk1135: Detected sensor type unknown (0x0) [ 610.938056][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.954738][ T4318] gspca_stk1135: Sensor read failed [ 610.988105][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.994492][ T4318] gspca_stk1135: Sensor read failed [ 610.994521][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.994534][ T4318] gspca_stk1135: Sensor write failed [ 610.994558][ T4318] gspca_stk1135: serial bus timeout: status=0x00 [ 610.994569][ T4318] gspca_stk1135: Sensor write failed [ 610.994623][ T4318] stk1135: probe of 10-1:0.0 failed with error -71 [ 611.084587][ T4318] usb 10-1: USB disconnect, device number 4 [ 611.284501][T17837] fuse: Bad value for 'fd' [ 611.763847][T17854] netlink: 'syz.6.4193': attribute type 1 has an invalid length. [ 611.907710][ T14] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 612.057148][T17855] 8021q: adding VLAN 0 to HW filter on device bond6 [ 612.067322][T17855] bond5: (slave bond6): making interface the new active one [ 612.075538][T17855] bond5: (slave bond6): Enslaving as an active interface with an up link [ 612.098124][T17857] bond5: (slave gretap3): Enslaving as a backup interface with an up link [ 612.109223][ C1] net_ratelimit: 85 callbacks suppressed [ 612.117729][ T14] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 612.170832][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 612.190270][ T14] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 612.242080][ T14] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.292915][ T14] usb 4-1: Product: syz [ 612.303686][ T14] usb 4-1: Manufacturer: syz [ 612.317583][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 612.351552][ T14] usb 4-1: SerialNumber: syz [ 612.427729][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 612.537652][ T5210] bond3: (slave batadv0): failed to get link speed/duplex [ 613.593801][ T14] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 613.601482][ T14] cdc_ncm 4-1:1.0: dwNtbInMaxSize=5 is too small. Using 2048 [ 613.626142][ T14] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 613.886609][T17845] loop3: detected capacity change from 0 to 2048 [ 614.018657][T17845] loop3: p2 p3 < > p4 < p5 > [ 614.088977][ T14] cdc_ncm 4-1:1.0: setting tx_max = 184 [ 614.140651][ T14] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 614.318969][ T14] usb 4-1: USB disconnect, device number 5 [ 614.392857][ T14] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 614.632108][T17919] device vlan2 entered promiscuous mode [ 614.678737][T17919] device bridge0 entered promiscuous mode [ 615.069583][T17936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4214'. [ 615.878165][ T26] audit: type=1326 audit(1791038206.854:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17962 comm="syz.9.4225" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7b77d9e159 code=0x0 [ 616.269432][ T4274] Bluetooth: hci2: command 0x0406 tx timeout [ 617.198906][ T5207] net_ratelimit: 104 callbacks suppressed [ 617.198921][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 617.310926][T16066] bond3: (slave batadv0): failed to get link speed/duplex [ 617.447055][T16066] bond3: (slave batadv0): failed to get link speed/duplex [ 617.997280][T18043] netlink: 2028 bytes leftover after parsing attributes in process `syz.6.4246'. [ 618.057067][T18043] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4246'. [ 618.789752][T18069] loop9: detected capacity change from 0 to 1024 [ 619.272956][T18069] syz.9.4256: attempt to access beyond end of device [ 619.272956][T18069] loop9: rw=2049, sector=5778, nr_sectors = 2 limit=1024 [ 619.365745][T18069] Buffer I/O error on dev loop9, logical block 2889, lost async page write [ 620.186694][ T4287] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 620.196191][ T4287] Bluetooth: hci3: Injecting HCI hardware error event [ 620.208448][ T4274] Bluetooth: hci3: hardware error 0x00 [ 620.273682][T18113] HTB: quantum of class FFF10006 is big. Consider r2q change. [ 621.618733][ T26] audit: type=1326 audit(1791038212.595:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 621.721668][ T26] audit: type=1326 audit(1791038212.615:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 621.816307][ T26] audit: type=1326 audit(1791038212.615:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 621.937598][T18123] loop8: detected capacity change from 0 to 32768 [ 621.948599][ T26] audit: type=1326 audit(1791038212.615:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.013087][T18123] (syz.8.4268,18123,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 622.080956][T18123] (syz.8.4268,18123,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 622.092648][ T26] audit: type=1326 audit(1791038212.625:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.174273][ T26] audit: type=1326 audit(1791038212.625:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.203216][T18158] loop9: detected capacity change from 0 to 1024 [ 622.213825][ T26] audit: type=1326 audit(1791038212.625:1560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.219609][T18123] JBD2: Ignoring recovery information on journal [ 622.238875][ T26] audit: type=1326 audit(1791038212.635:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.272269][ T4274] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 622.308379][T16066] net_ratelimit: 89 callbacks suppressed [ 622.308395][T16066] bond3: (slave batadv0): failed to get link speed/duplex [ 622.467004][T18123] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode. [ 622.482961][ T26] audit: type=1326 audit(1791038212.635:1562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.520352][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 622.605280][ T26] audit: type=1326 audit(1791038212.635:1563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18147 comm="syz.2.4273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f922859e159 code=0x7ffc0000 [ 622.656328][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 622.933753][T18123] (syz.8.4268,18123,0):ocfs2_read_blocks_sync:112 ERROR: status = -12 [ 622.975034][T18123] (syz.8.4268,18123,0):update_backups:188 ERROR: status = -12 [ 623.015617][T18123] ocfs2: Failed to update super blocks on 7,8 during fs resize. This condition is not fatal, but fsck.ocfs2 should be run to fix it [ 623.042452][T16060] hfsplus: b-tree write err: -5, ino 3 [ 623.660409][T18194] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4286'. [ 623.773961][T18199] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4286'. [ 623.819369][T10930] ocfs2: Unmounting device (7,8) on (node local) [ 624.442667][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.449314][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.003823][T16060] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.234747][T16060] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.414392][T18208] loop8: detected capacity change from 0 to 40427 [ 625.415413][T16060] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.474164][T18208] F2FS-fs (loop8): Invalid log_blocksize (268), supports only 12 [ 625.524951][T18208] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 625.584343][T18208] F2FS-fs (loop8): invalid crc value [ 625.653583][T18208] F2FS-fs (loop8): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 39874397669) [ 625.685202][T16060] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.715144][T18208] F2FS-fs (loop8): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 625.979043][T18208] F2FS-fs (loop8): recover fsync data on readonly fs [ 626.054847][T18208] F2FS-fs (loop8): Try to recover 1th superblock, ret: -30 [ 626.096284][T18208] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e5 [ 626.126636][T16060] netdevsim netdevsim9 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.229198][T16060] netdevsim netdevsim9 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.325154][T16060] netdevsim netdevsim9 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.373013][T16060] netdevsim netdevsim9 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.376279][T18248] netlink: 197348 bytes leftover after parsing attributes in process `syz.6.4299'. [ 626.618246][ T4287] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 626.631444][ T4287] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 626.643835][ T4287] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 626.653190][ T4287] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 626.664204][ T4287] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 626.674506][ T4287] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 627.435770][T18251] lo speed is unknown, defaulting to 1000 [ 627.480253][ C0] net_ratelimit: 80 callbacks suppressed [ 628.047820][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.065741][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.104625][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.146761][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.165861][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.186068][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.205668][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.245653][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 628.292082][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 628.326931][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.336020][T18255] lo speed is unknown, defaulting to 1000 [ 628.375587][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.437152][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.472747][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.507469][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.533415][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.575592][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.615998][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.635552][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.684689][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.721138][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.746024][ T4274] Bluetooth: hci2: command 0x0409 tx timeout [ 628.801656][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 628.875717][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 628.902534][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 628.957800][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 629.015569][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 629.040163][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 629.105639][T16097] bond3: (slave batadv0): link status up again after 0 ms [ 629.155598][T16066] bond3: (slave batadv0): link status up again after 0 ms [ 629.180579][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 629.289465][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.335434][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.370737][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.425450][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.465700][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.486638][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 629.505385][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.544664][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.626522][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 629.646057][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 629.675494][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 629.695484][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 629.715396][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 629.763930][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.837575][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 629.856885][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 629.910255][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 629.955542][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 630.016078][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 630.061063][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.095349][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.135625][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.168783][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.220543][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 630.245269][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.265884][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 630.315493][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.337902][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 630.380920][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.410237][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.465357][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.474616][T18324] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4317'. [ 630.506430][T16417] bond3: (slave batadv0): link status up again after 0 ms [ 630.527155][ T5207] bond3: (slave batadv0): link status up again after 0 ms [ 630.547281][ T5212] bond3: (slave batadv0): link status up again after 0 ms [ 630.565303][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.597372][T18329] netlink: 'syz.3.4318': attribute type 4 has an invalid length. [ 630.597490][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.643006][T18330] netlink: 'syz.3.4318': attribute type 4 has an invalid length. [ 630.655336][ T5210] bond3: (slave batadv0): link status up again after 0 ms [ 630.691756][ T208] bond3: (slave batadv0): link status up again after 0 ms [ 630.825590][ T4274] Bluetooth: hci2: command 0x041b tx timeout [ 631.526240][T18360] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 631.533608][T18360] IPv6: NLM_F_CREATE should be set when creating new route [ 631.625202][ T4274] Bluetooth: hci5: command 0x0406 tx timeout [ 631.653458][T16060] device hsr_slave_0 left promiscuous mode [ 631.661208][T18364] 9pnet: p9_errstr2errno: server reported unknown error @c [ 631.679255][T16060] device hsr_slave_1 left promiscuous mode [ 631.687867][T16060] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 631.696773][T16060] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 631.706367][T16060] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 631.714068][T16060] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 631.808753][T16060] device veth1_macvtap left promiscuous mode [ 631.814896][T16060] device veth0_macvtap left promiscuous mode [ 631.845632][T16060] device veth1_vlan left promiscuous mode [ 631.851813][T16060] device veth0_vlan left promiscuous mode [ 632.664973][ C0] net_ratelimit: 55 callbacks suppressed [ 632.905102][ T4274] Bluetooth: hci2: command 0x040f tx timeout [ 633.262130][T18394] tipc: Failed to remove unknown binding: 66,1,1/0:380022420/380022422 [ 633.289866][T18394] tipc: Failed to remove unknown binding: 66,1,1/0:380022420/380022422 [ 633.854977][ T27] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 634.070698][ T27] usb 4-1: config 6 has an invalid interface number: 240 but max is 0 [ 634.084086][ T27] usb 4-1: config 6 has no interface number 0 [ 634.125022][ T27] usb 4-1: config 6 interface 240 has no altsetting 0 [ 634.147538][ T27] usb 4-1: New USB device found, idVendor=110a, idProduct=1130, bcdDevice=c4.60 [ 634.167831][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.189767][ T27] usb 4-1: Product: syz [ 634.194002][ T27] usb 4-1: Manufacturer: syz [ 634.199534][ T27] usb 4-1: SerialNumber: syz [ 634.438599][T16060] team0 (unregistering): Port device team_slave_1 removed [ 634.458232][ T27] ti_usb_3410_5052 4-1:6.240: required endpoints missing [ 634.476301][ T27] usbhid 4-1:6.240: couldn't find an input interrupt endpoint [ 634.554148][ T27] usb 4-1: USB disconnect, device number 6 [ 634.693682][T18417] fuse: Bad value for 'fd' [ 634.708237][T16060] team0 (unregistering): Port device team_slave_0 removed [ 634.833405][T16060] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 634.950552][T16060] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 634.993551][ T4274] Bluetooth: hci2: command 0x0419 tx timeout [ 635.910267][T16060] bond0 (unregistering): Released all slaves [ 635.973508][T18255] chnl_net:caif_netlink_parms(): no params data found [ 636.041299][T18378] netlink: 'syz.8.4333': attribute type 4 has an invalid length. [ 636.069728][T18380] netlink: 'syz.8.4333': attribute type 4 has an invalid length. [ 636.104092][T18421] netlink: 'syz.2.4353': attribute type 15 has an invalid length. [ 636.140536][T18421] netlink: 11594 bytes leftover after parsing attributes in process `syz.2.4353'. [ 636.158801][T18424] netlink: 'syz.2.4353': attribute type 11 has an invalid length. [ 636.172179][T18424] netlink: 'syz.2.4353': attribute type 15 has an invalid length. [ 636.180795][T18424] netlink: 'syz.2.4353': attribute type 16 has an invalid length. [ 636.189862][T18424] netlink: 'syz.2.4353': attribute type 21 has an invalid length. [ 636.203543][T18424] netlink: 'syz.2.4353': attribute type 25 has an invalid length. [ 636.224701][T18424] netlink: 'syz.2.4353': attribute type 27 has an invalid length. [ 636.232555][T18424] netlink: 'syz.2.4353': attribute type 28 has an invalid length. [ 636.953911][T18255] bridge0: port 1(bridge_slave_0) entered blocking state [ 636.995936][T18255] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.035389][T18255] device bridge_slave_0 entered promiscuous mode [ 637.078894][T18255] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.102311][T18255] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.123933][T18255] device bridge_slave_1 entered promiscuous mode [ 637.308939][T18255] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 637.346590][T18255] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 637.684229][T18255] team0: Port device team_slave_0 added [ 637.738985][T18255] team0: Port device team_slave_1 added [ 637.889969][T18470] netlink: 11594 bytes leftover after parsing attributes in process `syz.3.4357'. [ 638.034075][T18466] lo speed is unknown, defaulting to 1000 [ 638.082939][T18255] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 638.100851][T18255] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.215321][T18255] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 638.291274][T18255] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 638.307438][T18255] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.383160][T18255] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 638.424322][ C1] net_ratelimit: 41 callbacks suppressed [ 638.718057][T18255] device hsr_slave_0 entered promiscuous mode [ 638.752115][T18255] device hsr_slave_1 entered promiscuous mode [ 638.763559][T18255] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 638.778851][T18255] Cannot create hsr debugfs directory [ 640.232909][T18255] netdevsim netdevsim4 eth17 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.767222][T18255] netdevsim netdevsim4 eth16 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.121720][T18255] netdevsim netdevsim4 eth15 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.178510][T18549] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4375'. [ 641.527682][T18255] netdevsim netdevsim4 eth14 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.668282][T18556] bridge0: port 3(vlan2) entered blocking state [ 641.680651][T18556] bridge0: port 3(vlan2) entered disabled state [ 641.695634][T18556] device vlan2 entered promiscuous mode [ 641.701362][T18556] device vlan0 entered promiscuous mode [ 642.102025][T18568] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4381'. [ 642.490291][T18255] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 642.561749][T18255] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 642.662502][T18255] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 642.772815][T18255] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 643.097446][T18586] lo speed is unknown, defaulting to 1000 [ 643.286759][T18255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.377363][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 643.399850][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 643.485504][T18255] 8021q: adding VLAN 0 to HW filter on device team0 [ 643.535961][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 643.566026][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 643.623747][ C1] net_ratelimit: 64 callbacks suppressed [ 643.678797][T16060] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.686037][T16060] bridge0: port 1(bridge_slave_0) entered forwarding state [ 643.902749][T18598] loop3: detected capacity change from 0 to 40427 [ 643.919270][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 643.927107][T18598] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 643.935408][T18598] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 643.967854][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 644.005622][T18598] F2FS-fs (loop3): Found nat_bits in checkpoint [ 644.043669][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 644.088292][T18598] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 644.095706][T18598] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 644.118186][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 644.166914][T16060] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.174210][T16060] bridge0: port 2(bridge_slave_1) entered forwarding state [ 644.231811][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 644.285878][ T5212] bond3: (slave batadv0): failed to get link speed/duplex [ 644.484234][T18255] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 644.532286][T18598] syz.3.4390: attempt to access beyond end of device [ 644.532286][T18598] loop3: rw=2049, sector=77824, nr_sectors = 2048 limit=40427 [ 644.537165][T18255] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 644.568545][T18598] syz.3.4390: attempt to access beyond end of device [ 644.568545][T18598] loop3: rw=2049, sector=79872, nr_sectors = 2048 limit=40427 [ 644.598765][T18598] syz.3.4390: attempt to access beyond end of device [ 644.598765][T18598] loop3: rw=2049, sector=49152, nr_sectors = 2048 limit=40427 [ 644.632452][T18598] syz.3.4390: attempt to access beyond end of device [ 644.632452][T18598] loop3: rw=2049, sector=51200, nr_sectors = 2048 limit=40427 [ 644.663374][T18598] syz.3.4390: attempt to access beyond end of device [ 644.663374][T18598] loop3: rw=2049, sector=57344, nr_sectors = 2048 limit=40427 [ 644.695019][T18598] syz.3.4390: attempt to access beyond end of device [ 644.695019][T18598] loop3: rw=2049, sector=59392, nr_sectors = 2048 limit=40427 [ 644.733599][T18598] syz.3.4390: attempt to access beyond end of device [ 644.733599][T18598] loop3: rw=2049, sector=61440, nr_sectors = 3056 limit=40427 [ 644.771556][T18598] syz.3.4390: attempt to access beyond end of device [ 644.771556][T18598] loop3: rw=2049, sector=64496, nr_sectors = 2672 limit=40427 [ 644.844419][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 644.866028][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 644.890370][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 644.900643][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 644.914774][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 644.944809][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 644.960985][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 644.989838][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 645.007347][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 645.017286][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 645.026554][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 645.551130][T15006] syz-executor: attempt to access beyond end of device [ 645.551130][T15006] loop3: rw=2051, sector=49152, nr_sectors = 4096 limit=40427 [ 645.616410][T15006] syz-executor: attempt to access beyond end of device [ 645.616410][T15006] loop3: rw=2051, sector=77824, nr_sectors = 4096 limit=40427 [ 645.680401][T15006] F2FS-fs (loop3): Issue discard(6144, 6144, 512) failed, ret: -5 [ 645.680454][T15006] F2FS-fs (loop3): Issue discard(9728, 9728, 512) failed, ret: -5 [ 645.708684][T15006] F2FS-fs (loop3): Issue discard(7168, 7168, 513) failed, ret: -5 [ 646.006361][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 646.032841][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 646.077174][T18255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 646.324602][T18642] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4396'. [ 646.621552][T18653] bridge0: port 2(vlan2) entered blocking state [ 646.650219][T18653] bridge0: port 2(vlan2) entered disabled state [ 646.671267][T18653] device vlan2 entered promiscuous mode [ 646.703390][T18653] device vlan0 entered promiscuous mode [ 647.871196][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 647.902649][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 648.022174][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 648.022448][T18706] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4413'. [ 648.078743][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 648.126481][T18255] device veth0_vlan entered promiscuous mode [ 648.159566][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 648.188857][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 648.242158][T18255] device veth1_vlan entered promiscuous mode [ 648.384936][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 648.404549][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 648.465353][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 648.501937][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 648.576810][T18255] device veth0_macvtap entered promiscuous mode [ 648.665890][T18255] device veth1_macvtap entered promiscuous mode [ 648.773759][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 648.833343][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 648.894966][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 648.983052][ C1] net_ratelimit: 66 callbacks suppressed [ 648.990027][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.024506][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 649.066278][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.112337][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 649.163206][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.227352][T18255] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 649.262186][ T208] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 649.278704][ T208] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 649.310922][ T208] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 649.341687][ T208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 649.416731][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 649.468032][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.501895][T18255] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 649.550893][T18255] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.621533][T18255] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 649.653376][T18748] validate_nla: 12 callbacks suppressed [ 649.653449][T18748] netlink: 'syz.3.4423': attribute type 1 has an invalid length. [ 649.873553][T18748] 8021q: adding VLAN 0 to HW filter on device bond2 [ 649.883737][ T5212] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 649.931283][ T5212] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 650.116812][T18751] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 650.173455][T18255] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.202907][T18255] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.211688][T18255] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.282955][T18255] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.773622][T16418] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 650.802115][T16418] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 650.850467][T16418] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 651.045224][T16418] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 651.071513][T16418] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 651.102215][T16417] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 651.349916][T18787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4295'. [ 651.380211][T18787] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4295'. [ 651.411756][T18787] netlink: 'syz.4.4295': attribute type 15 has an invalid length. [ 651.496378][T18787] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 651.505803][T18787] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 651.514951][T18787] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 651.523786][T18787] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 651.678175][T18787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4295'. [ 651.706820][T18787] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4295'. [ 651.753132][T18787] netlink: 'syz.4.4295': attribute type 15 has an invalid length. [ 651.842925][T18787] netdevsim netdevsim4 netdevsim0: set [0, 1] type 1 family 0 port 60387 - 0 [ 651.852235][T18787] netdevsim netdevsim4 netdevsim1: set [0, 1] type 1 family 0 port 60387 - 0 [ 651.861744][T18787] netdevsim netdevsim4 netdevsim2: set [0, 1] type 1 family 0 port 60387 - 0 [ 651.870795][T18787] netdevsim netdevsim4 netdevsim3: set [0, 1] type 1 family 0 port 60387 - 0 [ 652.007091][T18798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4436'. [ 652.091295][T18798] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 652.100862][T18798] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 652.110300][T18798] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 652.119478][T18798] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 652.308003][T18798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4436'. [ 653.630878][T18842] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4452'. [ 653.672595][T18842] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4452'. [ 653.711480][T18842] netlink: 'syz.8.4452': attribute type 15 has an invalid length. [ 653.797824][T18842] netdevsim netdevsim8 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 653.807036][T18842] netdevsim netdevsim8 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 653.816325][T18842] netdevsim netdevsim8 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 653.825360][T18842] netdevsim netdevsim8 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 653.997385][T18842] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4452'. [ 654.067514][T18842] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4452'. [ 654.148219][T18842] netlink: 'syz.8.4452': attribute type 15 has an invalid length. [ 654.182397][ C1] net_ratelimit: 99 callbacks suppressed [ 654.224651][T18856] sctp: [Deprecated]: syz.6.4455 (pid 18856) Use of int in maxseg socket option. [ 654.224651][T18856] Use struct sctp_assoc_value instead [ 654.332911][T18842] netdevsim netdevsim8 netdevsim0: set [0, 2] type 1 family 0 port 60387 - 0 [ 654.341890][T18842] netdevsim netdevsim8 netdevsim1: set [0, 2] type 1 family 0 port 60387 - 0 [ 654.350940][T18842] netdevsim netdevsim8 netdevsim2: set [0, 2] type 1 family 0 port 60387 - 0 [ 654.360161][T18842] netdevsim netdevsim8 netdevsim3: set [0, 2] type 1 family 0 port 60387 - 0 [ 654.595734][ C0] Unknown status report in ack skb [ 654.604315][T16417] bond3: (slave batadv0): failed to get link speed/duplex [ 654.757832][ T5212] bond3: (slave batadv0): failed to get link speed/duplex [ 654.911075][T16418] bond3: (slave batadv0): failed to get link speed/duplex [ 655.063761][T18877] bridge0: port 4(syz_tun) entered blocking state [ 655.114632][T18877] bridge0: port 4(syz_tun) entered disabled state [ 655.134943][T18877] device syz_tun entered promiscuous mode [ 655.844484][T18907] netlink: 'syz.2.4480': attribute type 1 has an invalid length. [ 655.892777][ T4315] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 656.083051][ T4315] usb 4-1: Using ep0 maxpacket: 32 [ 656.097692][ T4315] usb 4-1: unable to get BOS descriptor or descriptor too short [ 656.127913][ T4315] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 656.168627][T18907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 656.218048][ T4315] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 656.263484][ T4315] usb 4-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 656.297644][ T4315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.312610][ T4315] usb 4-1: Product: syz [ 656.317047][ T4315] usb 4-1: Manufacturer: syz [ 656.324518][ T4315] usb 4-1: SerialNumber: syz [ 656.368994][T18910] bond0: (slave veth13): Enslaving as a backup interface with a down link [ 656.433354][T18913] __nla_validate_parse: 1 callbacks suppressed [ 656.433403][T18913] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4471'. [ 656.568546][ T4315] usb 4-1: 4:0: failed to get current value for ch 0 (-71) [ 656.645407][ T4315] usb 4-1: 4:0: failed to get current value for ch 0 (-71) [ 656.723529][ T4315] usb 4-1: USB disconnect, device number 7 [ 656.778330][T18919] tipc: Started in network mode [ 656.794435][T18919] tipc: Node identity ac1414aa, cluster identity 4711 [ 656.805194][T18488] udevd[18488]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 656.861361][T18919] tipc: Enabled bearer , priority 10 [ 657.170581][T18932] netlink: 668 bytes leftover after parsing attributes in process `syz.2.4477'. [ 657.655392][T18957] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4484'. [ 657.698034][T18957] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4484'. [ 657.782733][T18958] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4484'. [ 657.847343][T18959] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4484'. [ 657.902437][T18959] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4484'. [ 657.915827][T18966] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4485'. [ 657.927728][T18964] loop3: detected capacity change from 0 to 256 [ 657.986641][T18964] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 658.069964][T18964] exFAT-fs (loop3): Medium has reported failures. Some data may be lost. [ 658.148080][T18964] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000ff98, chksum : 0xc4d1c548, utbl_chksum : 0xe619d30d) [ 658.167640][T18964] exFAT-fs (loop3): failed to load alloc-bitmap [ 658.203964][T18964] exFAT-fs (loop3): failed to recognize exfat type [ 658.281719][T18972] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4488'. [ 658.301779][ T4318] tipc: Node number set to 2886997162 [ 658.312685][T18973] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4489'. [ 659.311433][ T5210] net_ratelimit: 81 callbacks suppressed [ 659.311453][ T5210] bond3: (slave batadv0): failed to get link speed/duplex [ 659.466637][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 659.601802][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 659.721870][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 659.842559][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 660.263412][T19041] sctp: [Deprecated]: syz.8.4516 (pid 19041) Use of struct sctp_assoc_value in delayed_ack socket option. [ 660.263412][T19041] Use struct sctp_sack_info instead [ 661.244152][ T4326] libceph: connect (1)0.0.0.0:6789 error -22 [ 661.259600][ T4326] libceph: mon0 (1)0.0.0.0:6789 connect error [ 661.542458][T17628] libceph: connect (1)0.0.0.0:6789 error -22 [ 661.548777][T17628] libceph: mon0 (1)0.0.0.0:6789 connect error [ 661.650449][T19093] __nla_validate_parse: 2 callbacks suppressed [ 661.650464][T19093] netlink: 64 bytes leftover after parsing attributes in process `syz.8.4520'. [ 662.027668][T19067] ceph: No mds server is up or the cluster is laggy [ 662.128319][T17628] libceph: connect (1)0.0.0.0:6789 error -22 [ 662.138224][T17628] libceph: mon0 (1)0.0.0.0:6789 connect error [ 662.411301][T19109] 9pnet_fd: p9_fd_create_tcp (19109): problem connecting socket to 127.0.0.1 [ 662.445644][T19109] 9pnet_fd: p9_fd_create_tcp (19109): problem connecting socket to 127.0.0.1 [ 662.639422][T19114] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4528'. [ 662.977105][T19129] fuse: Bad value for 'fd' [ 663.433292][T19123] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 664.332603][T16417] net_ratelimit: 99 callbacks suppressed [ 664.332620][T16417] bond3: (slave batadv0): failed to get link speed/duplex [ 664.458071][T19177] netlink: 'syz.6.4545': attribute type 1 has an invalid length. [ 664.483736][T19177] netlink: 64399 bytes leftover after parsing attributes in process `syz.6.4545'. [ 664.521788][ T5192] bond3: (slave batadv0): failed to get link speed/duplex [ 664.642530][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 664.783032][T19184] device vlan3 entered promiscuous mode [ 664.803216][T19184] device bridge0 entered promiscuous mode [ 664.867318][T19187] bridge0: port 5(vlan4) entered blocking state [ 664.903790][T19187] bridge0: port 5(vlan4) entered disabled state [ 664.931665][T19187] device vlan4 entered promiscuous mode [ 664.937657][T19187] bridge0: mtu less than device minimum [ 665.858106][T19221] 9pnet_fd: p9_fd_create_tcp (19221): problem connecting socket to 127.0.0.1 [ 665.871932][T19221] 9pnet_fd: p9_fd_create_tcp (19221): problem connecting socket to 127.0.0.1 [ 665.893677][T19221] 9pnet_fd: p9_fd_create_tcp (19221): problem connecting socket to 127.0.0.1 [ 666.367154][T19222] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 666.509209][T19236] lo speed is unknown, defaulting to 1000 [ 667.058709][T19264] fuse: Bad value for 'fd' [ 667.455315][T19274] 9pnet_fd: p9_fd_create_tcp (19274): problem connecting socket to 127.0.0.1 [ 667.670705][T19277] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4569'. [ 668.237387][T19286] netlink: 'syz.3.4571': attribute type 1 has an invalid length. [ 668.268412][T19286] netlink: 64399 bytes leftover after parsing attributes in process `syz.3.4571'. [ 668.696021][T19295] lo speed is unknown, defaulting to 1000 [ 668.725232][T19294] lo speed is unknown, defaulting to 1000 [ 669.391716][T16097] net_ratelimit: 84 callbacks suppressed [ 669.391734][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 669.566597][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 669.691601][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 669.840763][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 669.950594][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 670.081092][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 670.244032][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 671.578638][ T26] kauditd_printk_skb: 143 callbacks suppressed [ 671.578654][ T26] audit: type=1326 audit(1791038262.551:1707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e4719e159 code=0x7ffc0000 [ 671.771120][ T26] audit: type=1326 audit(1791038262.551:1708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f5e4719e159 code=0x7ffc0000 [ 671.948943][ T26] audit: type=1326 audit(1791038262.551:1709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e4719e159 code=0x7ffc0000 [ 672.181955][ T26] audit: type=1326 audit(1791038262.551:1710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e4719e159 code=0x7ffc0000 [ 672.340500][ T26] audit: type=1326 audit(1791038262.631:1711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e4719e159 code=0x7ffc0000 [ 672.456553][ T26] audit: type=1326 audit(1791038262.631:1712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5e4719dec2 code=0x7ffc0000 [ 672.576029][T19377] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4594'. [ 672.619493][ T26] audit: type=1326 audit(1791038262.631:1713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f5e4719df57 code=0x7ffc0000 [ 672.779959][ T26] audit: type=1326 audit(1791038262.631:1714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f5e4715ae51 code=0x7ffc0000 [ 672.905801][ T26] audit: type=1326 audit(1791038262.631:1715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f5e4719ef49 code=0x7ffc0000 [ 673.023551][ T26] audit: type=1326 audit(1791038262.641:1716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19355 comm="syz.8.4584" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f5e4715aebb code=0x7ffc0000 [ 674.420052][ C1] net_ratelimit: 99 callbacks suppressed [ 674.450863][ T5210] bond3: (slave batadv0): failed to get link speed/duplex [ 674.570282][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 674.691312][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 674.727729][T19425] loop3: detected capacity change from 0 to 128 [ 674.800135][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 674.898330][T19425] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985 [ 674.910151][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 674.969708][T19425] ; already mounted read-only [ 675.000154][T19425] hpfs: filesystem error: improperly stopped [ 675.020934][T19425] hpfs: You really don't want any checks? You are crazy... [ 675.059470][T19425] hpfs: hpfs_map_sector(): read error [ 675.080522][T19425] hpfs: code page support is disabled [ 675.111621][T19425] hpfs: hpfs_map_4sectors(): unaligned read [ 675.167387][T19425] hpfs: hpfs_map_4sectors(): unaligned read [ 675.210044][T19425] hpfs: filesystem error: unable to find root dir [ 675.269260][T19425] hpfs: hpfs_map_4sectors(): unaligned read [ 675.303669][T19425] hpfs: hpfs_map_sector(): read error [ 675.340222][T19425] hpfs: hpfs_map_4sectors(): unaligned read [ 675.355210][T19425] hpfs: hpfs_map_sector(): read error [ 675.383929][T19425] hpfs: hpfs_map_4sectors(): unaligned read [ 675.397243][T19425] hpfs: hpfs_map_sector(): read error [ 675.545899][T19411] loop4: detected capacity change from 0 to 40427 [ 675.637993][T19411] F2FS-fs (loop4): build fault injection attr: rate: 690, type: 0x3ffff [ 675.699733][T19411] F2FS-fs (loop4): invalid crc value [ 675.722890][T19442] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4609'. [ 675.744981][T19411] F2FS-fs (loop4): Found nat_bits in checkpoint [ 675.804419][T19448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4609'. [ 676.017851][T19411] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 676.293221][T18255] bio_check_eod: 1 callbacks suppressed [ 676.293242][T18255] syz-executor: attempt to access beyond end of device [ 676.293242][T18255] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 678.289704][T17628] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 678.489588][T17628] usb 4-1: Using ep0 maxpacket: 16 [ 678.497492][T17628] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 678.554778][T17628] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 678.629172][T17628] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 678.693476][T17628] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.726710][T19501] netlink: 'syz.2.4623': attribute type 8 has an invalid length. [ 678.743511][T17628] usb 4-1: Product: syz [ 678.762953][T19501] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4623'. [ 678.780614][T17628] usb 4-1: Manufacturer: syz [ 678.807671][T19505] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4624'. [ 678.807751][T17628] usb 4-1: SerialNumber: syz [ 678.829603][T19501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4623'. [ 678.968913][T19506] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4624'. [ 679.142153][T17628] usb 4-1: 0:2 : does not exist [ 679.173342][T17628] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 679.294747][T17628] usb 4-1: USB disconnect, device number 8 [ 679.330992][T19516] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4628'. [ 679.376152][T19516] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4628'. [ 679.459701][ T208] net_ratelimit: 84 callbacks suppressed [ 679.519517][ T208] bond3: (slave batadv0): failed to get link speed/duplex [ 680.479992][T19545] loop4: detected capacity change from 0 to 1024 [ 680.623055][T19545] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 680.676457][T19545] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 680.793028][ T26] kauditd_printk_skb: 32 callbacks suppressed [ 680.793043][ T26] audit: type=1804 audit(1791038271.772:1749): pid=19545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4636" name="/newroot/42/file1/file1" dev="loop4" ino=15 res=1 errno=0 [ 680.860501][T19551] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.4636: lblock 3 mapped to illegal pblock 3 (length 1) [ 680.932089][T19551] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117 [ 680.981899][T19551] EXT4-fs (loop4): This should not happen!! Data will be lost [ 680.981899][T19551] [ 681.028307][T19552] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.4636: lblock 3 mapped to illegal pblock 3 (length 1) [ 681.148128][T19553] EXT4-fs error (device loop4): ext4_free_blocks:6220: comm syz.4.4636: Freeing blocks not in datazone - block = 3, count = 1 [ 681.360553][T18255] EXT4-fs (loop4): unmounting filesystem. [ 682.239887][T19569] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4641'. [ 682.307849][T19572] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4641'. [ 682.751855][T19580] raw_sendmsg: syz.6.4642 forgot to set AF_INET. Fix it! [ 683.069185][T19585] overlayfs: failed to clone upperpath [ 683.626532][T19602] netlink: 'syz.4.4650': attribute type 8 has an invalid length. [ 683.649339][T19602] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4650'. [ 683.709731][T19602] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4650'. [ 683.797696][T19610] FAULT_INJECTION: forcing a failure. [ 683.797696][T19610] name failslab, interval 1, probability 0, space 0, times 0 [ 683.854678][T19610] CPU: 1 PID: 19610 Comm: syz.3.4652 Not tainted syzkaller #0 [ 683.862266][T19610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 683.872456][T19610] Call Trace: [ 683.875863][T19610] [ 683.878842][T19610] dump_stack_lvl+0x188/0x24e [ 683.883552][T19610] ? show_regs_print_info+0x12/0x12 [ 683.888786][T19610] ? load_image+0x410/0x410 [ 683.888824][T19610] ? __might_sleep+0xd0/0xd0 [ 683.888846][T19610] ? __lock_acquire+0x7ea0/0x7ea0 [ 683.888880][T19610] should_fail_ex+0x390/0x4c0 [ 683.898587][T19610] should_failslab+0x5/0x20 [ 683.908993][T19610] slab_pre_alloc_hook+0x59/0x300 [ 683.909025][T19610] ? __kernfs_new_node+0xe1/0x7f0 [ 683.909048][T19610] ? kernfs_new_node+0x148/0x250 [ 683.909075][T19610] kmem_cache_alloc+0x56/0x2f0 [ 683.909094][T19610] ? __kernfs_new_node+0xe1/0x7f0 [ 683.909120][T19610] __kernfs_new_node+0xe1/0x7f0 [ 683.909144][T19610] ? kernfs_new_node+0x250/0x250 [ 683.919645][T19610] kernfs_new_node+0x148/0x250 [ 683.919680][T19610] __kernfs_create_file+0x47/0x2e0 [ 683.930086][T19610] sysfs_add_file_mode_ns+0x233/0x2f0 [ 683.930128][T19610] internal_create_group+0x490/0xce0 [ 683.930158][T19610] ? kernfs_add_one+0x14e/0x8f0 [ 683.939938][T19610] ? __lock_acquire+0x7ea0/0x7ea0 [ 683.939976][T19610] ? sysfs_create_group+0x20/0x20 [ 683.949790][T19610] sysfs_create_groups+0x55/0x120 [ 683.949824][T19610] device_add_attrs+0xdb/0x830 [ 683.949860][T19610] ? get_device_parent+0x3e0/0x3e0 [ 683.959743][T19610] ? kernfs_create_link+0x186/0x200 [ 684.005703][T19610] device_add+0x677/0x1050 [ 684.010197][T19610] netdev_register_kobject+0x184/0x320 [ 684.015702][T19610] register_netdevice+0x133a/0x1b80 [ 684.020939][T19610] ? netif_stacked_transfer_operstate+0x200/0x200 [ 684.027406][T19610] register_vlan_dev+0x3a0/0x820 [ 684.032808][T19610] register_vlan_device+0x383/0x4a0 [ 684.038025][T19610] ? vlan_ioctl_handler+0x5c0/0x5c0 [ 684.043254][T19610] vlan_ioctl_handler+0x226/0x5c0 [ 684.048496][T19610] ? sock_ioctl+0x21b/0x700 [ 684.053027][T19610] ? net_generic+0x240/0x240 [ 684.057644][T19610] ? net_generic+0x240/0x240 [ 684.062428][T19610] sock_ioctl+0x23b/0x700 [ 684.066781][T19610] ? sock_poll+0x420/0x420 [ 684.071225][T19610] ? bpf_lsm_file_ioctl+0x5/0x10 [ 684.076170][T19610] ? security_file_ioctl+0x7c/0xa0 [ 684.081301][T19610] ? sock_poll+0x420/0x420 [ 684.085752][T19610] __se_sys_ioctl+0xfa/0x170 [ 684.090386][T19610] do_syscall_64+0x4c/0xa0 [ 684.094915][T19610] ? clear_bhb_loop+0x60/0xb0 [ 684.099612][T19610] ? clear_bhb_loop+0x60/0xb0 [ 684.104316][T19610] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 684.110226][T19610] RIP: 0033:0x7f67b019e159 [ 684.114655][T19610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 684.134369][T19610] RSP: 002b:00007f67b10c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 684.142893][T19610] RAX: ffffffffffffffda RBX: 00007f67b0425fa0 RCX: 00007f67b019e159 [ 684.151068][T19610] RDX: 0000200000000400 RSI: 0000000000008982 RDI: 0000000000000004 [ 684.159061][T19610] RBP: 00007f67b023506b R08: 0000000000000000 R09: 0000000000000000 [ 684.167043][T19610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 684.175028][T19610] R13: 00007f67b0426038 R14: 00007f67b0425fa0 R15: 00007ffce39140c8 [ 684.183029][T19610] [ 684.500127][T16060] net_ratelimit: 90 callbacks suppressed [ 684.860138][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 685.864828][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.871215][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.922226][T19654] loop3: detected capacity change from 0 to 40427 [ 686.962881][T19654] F2FS-fs (loop3): build fault injection attr: rate: 690, type: 0x3ffff [ 686.986471][T19654] F2FS-fs (loop3): invalid crc value [ 687.036972][T19654] F2FS-fs (loop3): Found nat_bits in checkpoint [ 687.226823][T19696] loop4: detected capacity change from 0 to 128 [ 687.233575][T19654] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 687.292536][T19696] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 687.355875][T19696] hpfs: filesystem error: improperly stopped [ 687.397407][T19696] hpfs: You really don't want any checks? You are crazy... [ 687.430910][T19696] hpfs: hpfs_map_sector(): read error [ 687.436365][T19696] hpfs: code page support is disabled [ 687.472801][T19696] hpfs: hpfs_map_4sectors(): unaligned read [ 687.497549][T19696] hpfs: hpfs_map_4sectors(): unaligned read [ 687.561291][T19696] hpfs: filesystem error: unable to find root dir [ 687.652890][T19696] hpfs: hpfs_map_4sectors(): unaligned read [ 687.668881][T19696] hpfs: hpfs_map_sector(): read error [ 687.683899][T15006] syz-executor: attempt to access beyond end of device [ 687.683899][T15006] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 687.724451][T19696] hpfs: hpfs_map_4sectors(): unaligned read [ 687.742086][T19696] hpfs: hpfs_map_sector(): read error [ 687.775117][T19696] hpfs: hpfs_map_4sectors(): unaligned read [ 687.809987][T19696] hpfs: hpfs_map_sector(): read error [ 689.562072][T19744] loop3: detected capacity change from 0 to 1024 [ 689.600891][ T5192] net_ratelimit: 99 callbacks suppressed [ 689.600912][ T5192] bond3: (slave batadv0): failed to get link speed/duplex [ 689.617215][T19744] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 689.671114][T19744] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 689.741455][T19744] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 689.770604][T19744] System zones: 0-1, 3-36 [ 689.782657][ T5192] bond3: (slave batadv0): failed to get link speed/duplex [ 689.797210][T19744] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 690.077061][T15006] EXT4-fs (loop3): unmounting filesystem. [ 690.452204][T19770] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 690.497774][T19770] CIFS: Attempting to mount \\127.0.0.1\share [ 690.509361][T19770] CIFS: VFS: Error connecting to socket. Aborting operation. [ 690.547862][T19770] CIFS: VFS: cifs_mount failed w/return code = -22 [ 690.966973][T19791] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 691.738395][T19825] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4711'. [ 691.860032][T19826] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4711'. [ 692.036574][T19833] netlink: 'syz.8.4714': attribute type 1 has an invalid length. [ 692.141708][T19833] 8021q: adding VLAN 0 to HW filter on device bond2 [ 692.249715][T19841] bond2: (slave geneve2): making interface the new active one [ 692.315215][T19841] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 692.365415][T16097] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 692.836506][T19858] loop3: detected capacity change from 0 to 1024 [ 692.867599][T19858] EXT4-fs: Ignoring removed nomblk_io_submit option [ 693.062002][T19858] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 693.302840][T19858] ext4 filesystem being mounted at /229/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 693.846490][T19873] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:477: comm syz.3.4720: Invalid block bitmap block 5133028834769767320 in block_group 0 [ 694.274267][T15006] EXT4-fs (loop3): unmounting filesystem. [ 694.689296][T16095] net_ratelimit: 113 callbacks suppressed [ 694.689318][T16095] bond3: (slave batadv0): failed to get link speed/duplex [ 695.087804][T16095] bond3: (slave batadv0): failed to get link speed/duplex [ 696.531930][T19917] netlink: 'syz.4.4733': attribute type 1 has an invalid length. [ 696.655589][T19917] 8021q: adding VLAN 0 to HW filter on device bond1 [ 696.842148][T19927] bond1: (slave geneve2): making interface the new active one [ 696.894963][T19927] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 696.957965][T16096] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 697.198950][T19941] netlink: 'syz.6.4738': attribute type 1 has an invalid length. [ 697.461177][T19946] 8021q: adding VLAN 0 to HW filter on device bond8 [ 697.509743][T19946] bond7: (slave bond8): making interface the new active one [ 697.538418][T19946] bond7: (slave bond8): Enslaving as an active interface with an up link [ 697.547890][T19941] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4738'. [ 697.568558][T19941] device bond7 entered promiscuous mode [ 697.574622][T19941] device bond8 entered promiscuous mode [ 697.600195][T19941] 8021q: adding VLAN 0 to HW filter on device bond7 [ 698.232556][T19984] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4748'. [ 698.520766][T19995] netlink: 'syz.8.4753': attribute type 10 has an invalid length. [ 698.628726][T19999] netlink: 'syz.6.4754': attribute type 12 has an invalid length. [ 699.117214][T20005] device-mapper: ioctl: device has been removed from the dev hash table. [ 699.302111][ T4274] Bluetooth: hci0: command 0x0406 tx timeout [ 699.697123][ C1] net_ratelimit: 91 callbacks suppressed [ 699.729186][T16096] bond3: (slave batadv0): failed to get link speed/duplex [ 699.929703][T16096] bond3: (slave batadv0): failed to get link speed/duplex [ 700.438869][T20049] netlink: 'syz.6.4766': attribute type 10 has an invalid length. [ 700.486358][T20049] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 700.537296][T20049] team0: Failed to send options change via netlink (err -105) [ 700.573060][T20049] team0: Port device netdevsim0 added [ 700.769790][T20060] fuse: Bad value for 'fd' [ 701.035207][T20063] tipc: Failed to remove unknown binding: 66,0,0/1:500452030/500452032 [ 701.087401][T20063] tipc: Failed to remove unknown binding: 66,0,0/1:500452030/500452031 [ 701.138681][T20066] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4771'. [ 701.202194][T20066] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 701.601289][T20066] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 701.975790][T20072] netlink: 'syz.2.4772': attribute type 4 has an invalid length. [ 704.776515][T16097] net_ratelimit: 90 callbacks suppressed [ 704.776538][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 704.978958][T16097] bond3: (slave batadv0): failed to get link speed/duplex [ 705.106499][T16065] bond3: (slave batadv0): failed to get link speed/duplex [ 705.236532][ T5212] bond3: (slave batadv0): failed to get link speed/duplex [ 705.280672][T20155] loop3: detected capacity change from 0 to 8192 [ 705.379051][T20155] loop3: p1 p2 < > p3 p4 < p5 > [ 705.391224][T20155] loop3: partition table partially beyond EOD, truncated [ 705.437756][T16096] bond3: (slave batadv0): failed to get link speed/duplex [ 705.451152][T20155] loop3: p1 size 1342439424 extends beyond EOD, truncated [ 705.501090][T20155] loop3: p2 start 16384 is beyond EOD, truncated [ 705.563723][T20155] loop3: p3 start 67108864 is beyond EOD, truncated [ 705.608823][T20155] loop3: p5 size 1342439424 extends beyond EOD, truncated [ 706.219664][T20181] lo speed is unknown, defaulting to 1000 [ 706.577083][T20195] Invalid ELF header len 1 [ 706.608460][T20172] udevd[20172]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 706.631369][T20167] udevd[20167]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 706.695059][T20198] udevd[20198]: inotify_add_watch(7, /dev/loop3p5, 10) failed: No such file or directory [ 707.362845][T20219] loop4: detected capacity change from 0 to 256 [ 707.734688][T20232] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4811'. [ 708.031629][T20236] netlink: 'syz.4.4825': attribute type 12 has an invalid length. [ 708.522079][T20251] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4818'. [ 709.045894][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 709.826982][T16060] net_ratelimit: 79 callbacks suppressed [ 709.827002][T16060] bond3: (slave batadv0): failed to get link speed/duplex [ 709.974439][ T5207] bond3: (slave batadv0): failed to get link speed/duplex [ 710.008543][T20284] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4831'. [ 710.066146][T20284] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 710.376789][T20284] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 710.600836][ T5212] bond3: (slave batadv0): failed to get link speed/duplex [ 712.201807][T20326] netlink: 'syz.3.4839': attribute type 12 has an invalid length. [ 712.483122][T20332] device syz_tun left promiscuous mode [ 712.521140][T20334] fuse: Bad value for 'fd' [ 712.531951][T20332] bridge0: port 4(syz_tun) entered disabled state [ 712.923637][T20332] team0: Port device bridge0 removed [ 713.029899][T20332] bond0: (slave team0): Releasing backup interface [ 713.126339][T20332] bond3: (slave batadv0): Removing an active aggregator [ 713.152216][T20332] bond3: (slave batadv0): Releasing backup interface [ 713.201065][T20332] bridge0: port 1(bridge_slave_0) entered disabled state [ 713.262366][T20332] device bridge_slave_1 left promiscuous mode [ 713.296110][T20332] bridge0: port 2(bridge_slave_1) entered disabled state [ 713.401671][T20332] bond0: (slave bond_slave_0): Releasing backup interface [ 713.448566][T20332] bond0: (slave bond_slave_1): Releasing backup interface [ 713.611276][T20332] team0: Port device team_slave_0 removed [ 713.716883][T20332] team0: Port device team_slave_1 removed [ 713.723598][T20332] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 713.787465][T20332] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 713.888724][T20332] team0: Port device netdevsim0 removed [ 713.947442][T20332] bond1: (slave geneve2): Releasing active interface [ 714.026395][T20332] bond2: (slave gretap2): Releasing active interface [ 714.094001][T20332] bond5: (slave bond6): Releasing backup interface [ 714.120254][T20332] bond5: (slave bond6): the permanent HWaddr of slave - ce:94:0a:ca:ee:31 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 714.165403][T20369] Invalid ELF header len 1 [ 714.179510][T20332] bond5: (slave gretap3): making interface the new active one [ 714.239108][T20332] bond5: (slave gretap3): Releasing backup interface [ 714.288226][T20332] device vlan2 left promiscuous mode [ 714.306141][T20332] device vlan0 left promiscuous mode [ 714.326010][T20332] bridge0: port 3(vlan2) entered disabled state [ 714.365183][T20332] device vlan4 left promiscuous mode [ 714.376411][T20332] device bridge_slave_0 left promiscuous mode [ 714.386164][T20332] bridge0: port 5(vlan4) entered disabled state [ 714.419299][T20332] bond7: (slave bond8): Releasing backup interface [ 714.434140][T20332] device bond8 left promiscuous mode [ 714.526530][T20355] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4848'. [ 714.975225][ C1] net_ratelimit: 66 callbacks suppressed [ 715.819314][T20400] netlink: 'syz.8.4858': attribute type 12 has an invalid length. [ 716.895972][T16062] wlan1: Trigger new scan to find an IBSS to join [ 718.237383][T20460] netlink: 196 bytes leftover after parsing attributes in process `syz.8.4876'. [ 718.470974][T20464] loop3: detected capacity change from 0 to 512 [ 718.560637][T20464] EXT4-fs error (device loop3): ext4_orphan_get:1409: inode #15: comm syz.3.4877: inode has both inline data and extents flags [ 718.681076][T20464] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.4877: couldn't read orphan inode 15 (err -117) [ 718.777128][T20464] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 719.020974][T20464] loop3: detected capacity change from 512 to 0 [ 719.651547][T15006] syz-executor: attempt to access beyond end of device [ 719.651547][T15006] loop3: rw=14337, sector=72, nr_sectors = 2 limit=0 [ 719.692502][T15006] Buffer I/O error on dev loop3, logical block 36, lost sync page write [ 719.722661][T15006] EXT4-fs error (device loop3): ext4_handle_dirty_dirblock:440: inode #2: block 36: comm syz-executor: IO error syncing itable block [ 719.775223][T15006] syz-executor: attempt to access beyond end of device [ 719.775223][T15006] loop3: rw=14337, sector=2, nr_sectors = 2 limit=0 [ 719.814777][T15006] Buffer I/O error on dev loop3, logical block 1, lost sync page write [ 719.884937][T15006] EXT4-fs (loop3): I/O error while writing superblock [ 719.896067][T15006] EXT4-fs error (device loop3) in ext4_delete_entry:2802: IO failure [ 719.933969][T15006] syz-executor: attempt to access beyond end of device [ 719.933969][T15006] loop3: rw=14337, sector=2, nr_sectors = 2 limit=0 [ 720.015409][T15006] Buffer I/O error on dev loop3, logical block 1, lost sync page write [ 720.075500][T15006] EXT4-fs (loop3): I/O error while writing superblock [ 720.184754][ C1] net_ratelimit: 42 callbacks suppressed [ 720.648560][T20485] syz.4.4882 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 720.692009][T15006] bond1: (slave syz_tun): Releasing active interface [ 720.756319][T20485] CPU: 1 PID: 20485 Comm: syz.4.4882 Not tainted syzkaller #0 [ 720.763982][T20485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 720.774594][T20485] Call Trace: [ 720.778064][T20485] [ 720.781020][T20485] dump_stack_lvl+0x188/0x24e [ 720.785746][T20485] ? ___ratelimit+0x14e/0x610 [ 720.790701][T20485] ? show_regs_print_info+0x12/0x12 [ 720.796012][T20485] ? load_image+0x410/0x410 [ 720.800612][T20485] ? ___ratelimit+0x474/0x610 [ 720.805296][T20485] ? radix_tree_cpu_dead+0x160/0x160 [ 720.810595][T20485] dump_header+0xd8/0x820 [ 720.814950][T20485] oom_kill_process+0x361/0x550 [ 720.820087][T20485] out_of_memory+0xe25/0x1220 [ 720.824902][T20485] ? mutex_lock_nested+0x10/0x10 [ 720.830191][T20485] ? unregister_oom_notifier+0x20/0x20 [ 720.830230][T20485] mem_cgroup_out_of_memory+0x2c0/0x390 [ 720.836294][T20485] ? mem_cgroup_oom_trylock+0x210/0x210 [ 720.836334][T20485] ? do_raw_spin_unlock+0x11d/0x230 [ 720.836360][T20485] try_charge_memcg+0xc9d/0x17c0 [ 720.848078][T20485] ? __lock_acquire+0x7ea0/0x7ea0 [ 720.848128][T20485] ? percpu_ref_put+0x180/0x180 [ 720.858260][T20485] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 720.858305][T20485] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 720.868175][T20485] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 720.879626][T20485] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 720.879658][T20485] __memcg_kmem_charge_page+0x220/0x380 [ 720.879687][T20485] __alloc_pages+0x21e/0x4f0 [ 720.891584][T20485] ? zone_statistics+0x170/0x170 [ 720.902116][T20485] pte_alloc_one+0x7b/0x310 [ 720.912853][T20485] ? pfn_modify_allowed+0x560/0x560 [ 720.918096][T20485] ? hugepage_vma_check+0x461/0x540 [ 720.918138][T20485] handle_mm_fault+0x257d/0x3d40 [ 720.918160][T20485] ? mt_find+0x157/0x830 [ 720.918198][T20485] ? numa_migrate_prep+0x250/0x250 [ 720.918225][T20485] ? lock_chain_count+0x20/0x20 [ 720.924282][T20485] ? ktime_get+0x247/0x270 [ 720.934390][T20485] ? lock_mm_and_find_vma+0xae/0x2f0 [ 720.944699][T20485] do_user_addr_fault+0x58e/0xb20 [ 720.944747][T20485] exc_page_fault+0x60/0x100 [ 720.944773][T20485] ? clear_bhb_loop+0x60/0xb0 [ 720.944797][T20485] asm_exc_page_fault+0x22/0x30 [ 720.944815][T20485] RIP: 0033:0x7fa7bb872980 [ 720.955488][T20485] Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 40 40 00 00 0f 85 1f fe ff ff e9 d3 fd ff ff 0f 1f 44 [ 720.955510][T20485] RSP: 002b:00007fff62e00280 EFLAGS: 00010202 [ 720.955529][T20485] RAX: 000000110c434000 RBX: ffffffff826c8d7a RCX: 0000000000000007 [ 720.955544][T20485] RDX: 0000000000000d7a RSI: 0000000000003235 RDI: 0000000000000080 [ 720.965447][T20485] RBP: 0000000000000002 R08: 00007fa7bbc10000 R09: 00007fa7bbc12000 [ 720.965476][T20485] R10: 00000000826c8d7e R11: 0000000000000007 R12: 00007fa7bbc26128 [ 720.965497][T20485] R13: 0000000000000c6f R14: ffffffff826c8cd8 R15: 00007fa7bc755720 [ 720.965524][T20485] ? nfs4_xattr_cache_count+0x18/0x100 [ 720.975405][T20485] ? nfs4_xattr_cache_count+0xba/0x100 [ 720.975445][T20485] [ 721.041514][ T5207] wlan1: Trigger new scan to find an IBSS to join [ 721.594748][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38e!!! [ 721.742488][ T5192] wlan1: Creating new IBSS network, BSSID c2:0e:65:0e:d0:f7 [ 721.785599][T15006] EXT4-fs (loop3): unmounting filesystem. [ 721.841155][T15006] syz-executor: attempt to access beyond end of device [ 721.841155][T15006] loop3: rw=14337, sector=2, nr_sectors = 2 limit=0 [ 721.937393][T20501] lo speed is unknown, defaulting to 1000 [ 721.980510][T15006] Buffer I/O error on dev loop3, logical block 1, lost sync page write [ 722.033328][T15006] EXT4-fs (loop3): I/O error while writing superblock [ 722.390526][T20485] memory: usage 307200kB, limit 307200kB, failcnt 18140 [ 722.441296][T20485] memory+swap: usage 427472kB, limit 9007199254740988kB, failcnt 0 [ 722.466535][T20485] kmem: usage 2936kB, limit 9007199254740988kB, failcnt 0 [ 722.494266][T20485] Memory cgroup stats for /syz4: [ 722.496024][T20485] anon 4403200 [ 722.496024][T20485] file 307146752 [ 722.496024][T20485] kernel 3006464 [ 722.496024][T20485] kernel_stack 196608 [ 722.496024][T20485] pagetables 778240 [ 722.496024][T20485] sec_pagetables 0 [ 722.496024][T20485] percpu 18320 [ 722.496024][T20485] sock 0 [ 722.496024][T20485] vmalloc 4096 [ 722.496024][T20485] shmem 307146752 [ 722.496024][T20485] zswap 0 [ 722.496024][T20485] zswapped 0 [ 722.496024][T20485] file_mapped 214867968 [ 722.496024][T20485] file_dirty 0 [ 722.496024][T20485] file_writeback 0 [ 722.496024][T20485] swapcached 131702784 [ 722.496024][T20485] anon_thp 0 [ 722.496024][T20485] file_thp 0 [ 722.496024][T20485] shmem_thp 0 [ 722.496024][T20485] inactive_anon 274415616 [ 722.496024][T20485] active_anon 37142528 [ 722.496024][T20485] inactive_file 0 [ 722.496024][T20485] active_file 8192 [ 722.496024][T20485] unevictable 0 [ 722.496024][T20485] slab_reclaimable 1245040 [ 722.496024][T20485] slab_unreclaimable 697704 [ 722.813849][T20485] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4 [ 722.837718][T20485] ,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.4752,pid=20001,uid=0 [ 722.882478][T20485] Memory cgroup out of memory: Killed process 20001 (syz.4.4752) total-vm:202732kB, anon-rss:1544kB, file-rss:20608kB, shmem-rss:105992kB, UID:0 pgtables:316kB oom_score_adj:1000 [ 723.205628][T20515] tipc: Started in network mode [ 723.210616][T20515] tipc: Node identity 2000004, cluster identity 4711 [ 723.254841][T20515] tipc: Node number set to 33554436 [ 724.229639][T20531] loop4: detected capacity change from 0 to 128 [ 724.612462][T20536] netlink: 'syz.8.4892': attribute type 1 has an invalid length. [ 724.707954][ T4274] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 724.725236][ T4274] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 724.738611][ T4274] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 724.751426][ T4274] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 724.761701][ T4274] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 724.769822][ T4274] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 725.009391][T20536] 8021q: adding VLAN 0 to HW filter on device bond3 [ 725.146322][T20540] bond3: (slave gretap1): making interface the new active one [ 725.169096][T20540] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 725.217947][ T5212] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 725.374753][ C1] net_ratelimit: 45 callbacks suppressed [ 725.480373][T20535] lo speed is unknown, defaulting to 1000 [ 725.598906][T20555] bridge0: port 3(vlan3) entered blocking state [ 725.634333][T20555] bridge0: port 3(vlan3) entered disabled state [ 725.673627][T20555] device vlan3 entered promiscuous mode [ 725.724398][T20561] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 725.784474][T20561] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 725.820208][T20561] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 725.881925][T20561] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.942359][T20561] device bridge_slave_1 left promiscuous mode [ 725.996107][T20561] bridge0: port 2(bridge_slave_1) entered disabled state [ 726.108794][T20561] bond0: (slave bond_slave_0): Releasing backup interface [ 726.170243][T20561] bond0: (slave bond_slave_1): Releasing backup interface [ 726.647213][T20561] team0: Port device team_slave_0 removed [ 726.776353][T20561] team0: Port device team_slave_1 removed [ 726.826807][T20561] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 726.873609][T20561] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 726.905377][ T4287] Bluetooth: hci4: command 0x0409 tx timeout [ 726.915408][T20576] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4900'. [ 726.990801][T20561] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 727.009067][T20561] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 727.133260][T20561] bond1: (slave geneve2): Releasing active interface [ 727.172388][T20561] device vlan3 left promiscuous mode [ 727.189591][T20561] device bridge_slave_0 left promiscuous mode [ 727.207831][T20561] bridge0: port 3(vlan3) entered disabled state [ 727.432963][T20557] lo speed is unknown, defaulting to 1000 [ 727.683203][T20584] 9pnet: p9_errstr2errno: server reported unknown error @c0x0000000000000006 [ 728.609204][T20535] chnl_net:caif_netlink_parms(): no params data found [ 728.950041][T20604] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4908'. [ 728.974813][ T4287] Bluetooth: hci4: command 0x041b tx timeout [ 729.448218][T20535] bridge0: port 1(bridge_slave_0) entered blocking state [ 729.461424][T20535] bridge0: port 1(bridge_slave_0) entered disabled state [ 729.496436][T20535] device bridge_slave_0 entered promiscuous mode [ 729.546532][T20535] bridge0: port 2(bridge_slave_1) entered blocking state [ 729.560358][T20535] bridge0: port 2(bridge_slave_1) entered disabled state [ 729.596162][T20535] device bridge_slave_1 entered promiscuous mode [ 729.777190][T20001] syz.4.4752 (20001) used greatest stack depth: 17552 bytes left [ 729.869528][T20535] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 729.929026][T20535] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 729.987731][T20624] netlink: 2028 bytes leftover after parsing attributes in process `syz.4.4911'. [ 730.010805][T20624] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4911'. [ 730.234316][T20628] 9pnet: p9_errstr2errno: server reported unknown error @c0x0000000000000006 [ 730.282070][T20535] team0: Port device team_slave_0 added [ 730.323710][T20535] team0: Port device team_slave_1 added [ 730.571064][T20535] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 730.584750][ C1] net_ratelimit: 49 callbacks suppressed [ 730.584958][T20535] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 730.755895][T20535] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 730.811831][T20535] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 730.874538][T20535] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 730.973649][T20535] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 731.005702][T20638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4918'. [ 731.055070][ T4287] Bluetooth: hci4: command 0x040f tx timeout [ 731.296035][T20647] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4919'. [ 731.347347][T20646] device hsr_slave_0 left promiscuous mode [ 731.371099][T20646] device hsr_slave_1 left promiscuous mode [ 731.589792][T20535] device hsr_slave_0 entered promiscuous mode [ 731.606897][T20535] device hsr_slave_1 entered promiscuous mode [ 731.647530][T20648] device bond0 entered promiscuous mode [ 731.692770][T20648] device gretap0 entered promiscuous mode [ 731.727896][T20648] device dummy0 entered promiscuous mode [ 731.764981][T20648] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 731.772936][T20648] Cannot create hsr debugfs directory [ 731.806169][T20650] netlink: 56 bytes leftover after parsing attributes in process `syz.8.4921'. [ 731.979178][T20650] device dummy0 left promiscuous mode [ 733.135004][ T4287] Bluetooth: hci4: command 0x0419 tx timeout [ 733.168191][T20685] fuse: Bad value for 'fd' [ 733.445147][T20535] netdevsim netdevsim5 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.506762][T20678] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4932'. [ 733.652417][T20678] device bond2 entered promiscuous mode [ 733.725250][T20678] 8021q: adding VLAN 0 to HW filter on device bond2 [ 733.842617][T20689] 8021q: adding VLAN 0 to HW filter on device bond2 [ 733.876079][T20689] bond2: (slave sit1): The slave device specified does not support setting the MAC address [ 733.903006][T20689] bond2: (slave sit1): Error -95 calling set_mac_address [ 734.493542][T20535] netdevsim netdevsim5 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.050388][T20535] netdevsim netdevsim5 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.492016][T20535] netdevsim netdevsim5 eth5 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.774933][ C1] net_ratelimit: 45 callbacks suppressed [ 735.890830][T20743] FAULT_INJECTION: forcing a failure. [ 735.890830][T20743] name failslab, interval 1, probability 0, space 0, times 0 [ 735.962549][T20743] CPU: 0 PID: 20743 Comm: syz.4.4949 Not tainted syzkaller #0 [ 735.970200][T20743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 735.980390][T20743] Call Trace: [ 735.983714][T20743] [ 735.986684][T20743] dump_stack_lvl+0x188/0x24e [ 735.991421][T20743] ? show_regs_print_info+0x12/0x12 [ 735.996670][T20743] ? load_image+0x410/0x410 [ 736.001240][T20743] ? __might_sleep+0xd0/0xd0 [ 736.005881][T20743] ? __lock_acquire+0x7ea0/0x7ea0 [ 736.011048][T20743] should_fail_ex+0x390/0x4c0 [ 736.015770][T20743] should_failslab+0x5/0x20 [ 736.020289][T20743] slab_pre_alloc_hook+0x59/0x300 [ 736.025329][T20743] ? memcg_list_lru_alloc+0x22d/0xb00 [ 736.030727][T20743] __kmem_cache_alloc_node+0x4f/0x270 [ 736.036115][T20743] ? memcg_list_lru_alloc+0x22d/0xb00 [ 736.041791][T20743] __kmalloc+0xa3/0x240 [ 736.045985][T20743] memcg_list_lru_alloc+0x22d/0xb00 [ 736.051215][T20743] ? slab_pre_alloc_hook+0xb1/0x300 [ 736.056436][T20743] ? memcg_reparent_list_lrus+0x850/0x850 [ 736.062201][T20743] ? get_obj_cgroup_from_current+0xd0/0x280 [ 736.068118][T20743] slab_pre_alloc_hook+0x2ad/0x300 [ 736.073246][T20743] ? slab_pre_alloc_hook+0xb1/0x300 [ 736.078460][T20743] kmem_cache_alloc_lru+0x49/0x2e0 [ 736.083591][T20743] ? new_inode_pseudo+0x7e/0x1c0 [ 736.088645][T20743] new_inode_pseudo+0x7e/0x1c0 [ 736.093422][T20743] ? pseudo_fs_get_tree+0x20/0x20 [ 736.098523][T20743] new_inode+0x25/0x1d0 [ 736.102690][T20743] ? pseudo_fs_get_tree+0x20/0x20 [ 736.107750][T20743] pseudo_fs_fill_super+0x182/0x350 [ 736.112984][T20743] ? kill_litter_super+0xa0/0xa0 [ 736.117958][T20743] ? pseudo_fs_get_tree+0x20/0x20 [ 736.123093][T20743] get_tree_nodev+0xb0/0x160 [ 736.127704][T20743] vfs_get_tree+0x88/0x270 [ 736.132147][T20743] do_new_mount+0x247/0xa40 [ 736.136670][T20743] __se_sys_mount+0x2e3/0x3d0 [ 736.141530][T20743] ? __x64_sys_mount+0xc0/0xc0 [ 736.146404][T20743] ? lockdep_hardirqs_on+0x94/0x140 [ 736.151623][T20743] ? __x64_sys_mount+0x1c/0xc0 [ 736.156405][T20743] do_syscall_64+0x4c/0xa0 [ 736.160843][T20743] ? clear_bhb_loop+0x60/0xb0 [ 736.165638][T20743] ? clear_bhb_loop+0x60/0xb0 [ 736.170364][T20743] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 736.176460][T20743] RIP: 0033:0x7fa7bb99e159 [ 736.181000][T20743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.201258][T20743] RSP: 002b:00007fa7bc805028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 736.209784][T20743] RAX: ffffffffffffffda RBX: 00007fa7bbc25fa0 RCX: 00007fa7bb99e159 [ 736.218558][T20743] RDX: 0000200000000180 RSI: 0000200000000100 RDI: 0000200000000040 [ 736.226902][T20743] RBP: 00007fa7bba3506b R08: 0000000000000000 R09: 0000000000000000 [ 736.226919][T20743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 736.226930][T20743] R13: 00007fa7bbc26038 R14: 00007fa7bbc25fa0 R15: 00007fff62e00238 [ 736.226967][T20743] [ 736.513128][T20535] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 736.606772][T20535] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 736.686487][T20535] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 736.806348][T20535] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 736.971229][T20764] overlayfs: failed to clone upperpath [ 737.192542][T20535] 8021q: adding VLAN 0 to HW filter on device bond0 [ 737.218416][T20769] overlayfs: failed to clone upperpath [ 737.286578][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 737.295816][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 737.329257][T20535] 8021q: adding VLAN 0 to HW filter on device team0 [ 737.382325][T20773] device ip6gre1 entered promiscuous mode [ 737.435178][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 737.504961][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 737.557997][ T5192] bridge0: port 1(bridge_slave_0) entered blocking state [ 737.565212][ T5192] bridge0: port 1(bridge_slave_0) entered forwarding state [ 737.607309][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 737.668227][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 737.706536][ T5192] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.713704][ T5192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 737.758036][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 737.778643][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 737.823207][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 737.862046][T16062] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 737.918820][T16062] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 737.939415][T16062] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 737.973786][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 737.990094][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 738.048554][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 738.076483][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 738.122802][T20535] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 738.181859][T20535] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 738.216277][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 738.236345][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 739.262260][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 739.284259][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 739.354328][T20535] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 739.689908][T20828] netlink: 'syz.8.4976': attribute type 1 has an invalid length. [ 739.811315][T20830] loop4: detected capacity change from 0 to 1024 [ 739.862116][T20828] 8021q: adding VLAN 0 to HW filter on device bond4 [ 739.865694][T20830] EXT4-fs: Ignoring removed mblk_io_submit option [ 739.939469][T20832] bond4: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 740.022149][T20833] device bond4 entered promiscuous mode [ 740.030462][T20830] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 740.285421][T20843] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:477: comm ext4lazyinit: Invalid block bitmap block 2952790016 in block_group 0 [ 740.438783][T18255] EXT4-fs (loop4): unmounting filesystem. [ 740.465175][T18255] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 4134528463 in block_group 0 [ 740.557920][T20862] netlink: 55631 bytes leftover after parsing attributes in process `syz.8.4982'. [ 740.575045][T18255] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 740.619131][T18255] EXT4-fs error (device loop4): ext4_quota_off:7147: inode #4: comm syz-executor: mark_inode_dirty error [ 740.814765][ C1] net_ratelimit: 45 callbacks suppressed [ 741.116882][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 741.159731][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 741.265386][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 741.305342][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 741.334253][T20535] device veth0_vlan entered promiscuous mode [ 741.344836][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 741.365345][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 741.392022][T20535] device veth1_vlan entered promiscuous mode [ 741.477656][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 741.507463][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 741.537801][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 741.566920][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 741.599324][T20535] device veth0_macvtap entered promiscuous mode [ 741.628039][T20883] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4989'. [ 741.704384][T20535] device veth1_macvtap entered promiscuous mode [ 741.838052][T20535] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.886211][T20535] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.905794][T20535] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.948179][T20535] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.983904][T20535] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 742.022933][T20535] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.061668][T20535] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 742.082316][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 742.106639][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 742.148250][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 742.200752][T16060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 742.237396][T20535] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 742.270041][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 742.285839][ T5192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 742.339704][T20535] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.361060][T20535] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.417833][T20535] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.454869][T20535] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.882899][ T5192] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.919957][ T5192] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.972263][T16095] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 743.161485][ T5212] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 743.188702][ T5212] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 743.258541][T16062] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 744.695276][T20965] loop5: detected capacity change from 0 to 1024 [ 744.741737][T20965] EXT4-fs: Ignoring removed orlov option [ 744.820300][T20965] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 745.343284][T20535] EXT4-fs (loop5): unmounting filesystem. [ 745.770042][T20997] tipc: New replicast peer: 255.255.255.255 [ 745.798542][T20997] tipc: Enabled bearer , priority 10 [ 745.938593][ T5192] net_ratelimit: 91 callbacks suppressed [ 746.446735][T21019] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5021'. [ 747.242938][T21039] loop5: detected capacity change from 0 to 512 [ 747.307289][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.313942][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.305219][T21065] netlink: 'syz.4.5033': attribute type 10 has an invalid length. [ 748.358712][T21070] FAULT_INJECTION: forcing a failure. [ 748.358712][T21070] name failslab, interval 1, probability 0, space 0, times 0 [ 748.412901][T21070] CPU: 1 PID: 21070 Comm: syz.5.5032 Not tainted syzkaller #0 [ 748.420519][T21070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 748.420604][T21070] Call Trace: [ 748.420613][T21070] [ 748.420622][T21070] dump_stack_lvl+0x188/0x24e [ 748.420657][T21070] ? show_regs_print_info+0x12/0x12 [ 748.420683][T21070] ? load_image+0x410/0x410 [ 748.420717][T21070] ? __might_sleep+0xd0/0xd0 [ 748.420740][T21070] ? __lock_acquire+0x7ea0/0x7ea0 [ 748.420767][T21070] ? kasan_set_track+0x60/0x70 [ 748.420794][T21070] ? __kasan_kmalloc+0x8e/0xa0 [ 748.420826][T21070] should_fail_ex+0x390/0x4c0 [ 748.420860][T21070] should_failslab+0x5/0x20 [ 748.420880][T21070] slab_pre_alloc_hook+0x59/0x300 [ 748.420907][T21070] ? bdi_alloc+0x4b/0x130 [ 748.420957][T21070] __kmem_cache_alloc_node+0x4f/0x270 [ 748.420985][T21070] ? bdi_alloc+0x4b/0x130 [ 748.421010][T21070] kmalloc_node_trace+0x22/0xe0 [ 748.421033][T21070] bdi_alloc+0x4b/0x130 [ 748.434595][T21070] super_setup_bdi_name+0xa5/0x200 [ 748.443092][T21070] ? fuse_fill_super_common+0x4e8/0x1110 [ 748.453202][T21070] ? vfs_get_tree+0x270/0x270 [ 748.462958][T21070] ? do_raw_spin_unlock+0x11d/0x230 [ 748.472818][T21070] fuse_fill_super_common+0x622/0x1110 [ 748.481994][T21070] ? up_write+0x1b6/0x410 [ 748.491418][T21070] fuse_fill_super+0x173/0x1f0 [ 748.501101][T21070] ? fuse_reconfigure+0xb0/0xb0 [ 748.510955][T21070] get_tree_nodev+0xb0/0x160 [ 748.521709][T21070] fuse_get_tree+0x2d7/0x4d0 [ 748.532029][T21070] vfs_get_tree+0x88/0x270 [ 748.542441][T21070] do_new_mount+0x247/0xa40 [ 748.552253][T21070] __se_sys_mount+0x2e3/0x3d0 [ 748.552288][T21070] ? __x64_sys_mount+0xc0/0xc0 [ 748.561466][T21070] ? lockdep_hardirqs_on+0x94/0x140 [ 748.565996][T21070] ? __x64_sys_mount+0x1c/0xc0 [ 748.566027][T21070] do_syscall_64+0x4c/0xa0 [ 748.566049][T21070] ? clear_bhb_loop+0x60/0xb0 [ 748.575411][T21070] ? clear_bhb_loop+0x60/0xb0 [ 748.575441][T21070] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 748.575465][T21070] RIP: 0033:0x7f0262d9e159 [ 748.575486][T21070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 748.575504][T21070] RSP: 002b:00007f0263c8d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 748.643675][T21070] RAX: ffffffffffffffda RBX: 00007f0263025fa0 RCX: 00007f0262d9e159 [ 748.651666][T21070] RDX: 0000200000002100 RSI: 00002000000001c0 RDI: 0000000000000000 [ 748.659742][T21070] RBP: 00007f0262e3506b R08: 00002000000002c0 R09: 0000000000000000 [ 748.667723][T21070] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 748.675706][T21070] R13: 00007f0263026038 R14: 00007f0263025fa0 R15: 00007ffd8912f3b8 [ 748.683797][T21070] [ 748.780128][T21065] team0: Port device netdevsim0 added [ 749.290224][T21082] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5037'. [ 749.341301][T21083] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5037'. [ 749.374853][ T4287] Bluetooth: hci2: command 0x0406 tx timeout [ 749.398502][T21083] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5037'. [ 750.589231][ T26] audit: type=1326 audit(1791038597.619:1750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 750.704860][ T26] audit: type=1326 audit(1791038597.639:1751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 750.730361][T21119] netlink: 'syz.6.5047': attribute type 1 has an invalid length. [ 750.789643][ T26] audit: type=1326 audit(1791038597.659:1752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 750.835048][ T26] audit: type=1326 audit(1791038597.659:1753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 750.977840][ T26] audit: type=1326 audit(1791038597.659:1754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=131 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 751.069194][T21119] 8021q: adding VLAN 0 to HW filter on device bond9 [ 751.135520][ C0] net_ratelimit: 57 callbacks suppressed [ 751.145799][ T26] audit: type=1326 audit(1791038597.659:1755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 751.207097][T21121] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 751.295168][T21128] device bond9 entered promiscuous mode [ 751.310130][ T26] audit: type=1326 audit(1791038597.659:1756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 751.465799][ T26] audit: type=1326 audit(1791038597.659:1757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 751.634279][ T26] audit: type=1326 audit(1791038597.659:1758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 751.744984][ T26] audit: type=1326 audit(1791038597.659:1759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21114 comm="syz.4.5046" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fa7bb99e159 code=0x7ffc0000 [ 752.049829][T21147] loop4: detected capacity change from 0 to 1076 [ 752.121258][T21147] FAT-fs (loop4): Unrecognized mount option "01777777777777777777777" or missing value [ 753.166073][T21179] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5063'. [ 753.381183][T21179] device bond10 entered promiscuous mode [ 753.405234][T21179] 8021q: adding VLAN 0 to HW filter on device bond10 [ 753.583115][T21186] 8021q: adding VLAN 0 to HW filter on device bond10 [ 753.602704][T21186] bond10: (slave sit2): The slave device specified does not support setting the MAC address [ 753.688577][T21186] bond10: (slave sit2): Error -95 calling set_mac_address [ 754.905129][ T4315] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 755.460917][T21217] device hsr_slave_0 left promiscuous mode [ 755.484894][T21217] device hsr_slave_1 left promiscuous mode [ 755.923876][T21225] device bond0 entered promiscuous mode [ 755.985815][T21225] device bond_slave_0 entered promiscuous mode [ 755.992309][T21225] device bond_slave_1 entered promiscuous mode [ 756.048568][T21225] device gretap0 entered promiscuous mode [ 756.079857][T21225] device dummy0 entered promiscuous mode [ 756.185278][T21226] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5073'. [ 756.444985][ C1] net_ratelimit: 65 callbacks suppressed [ 757.936705][T21226] device dummy0 left promiscuous mode [ 758.277198][T21254] tipc: Enabling of bearer rejected, failed to enable media [ 758.462655][T21263] overlayfs: failed to clone upperpath [ 758.533392][ T4315] usb 6-1: unable to get BOS descriptor or descriptor too short [ 758.588401][ T4315] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 758.608689][T21262] loop4: detected capacity change from 0 to 1024 [ 758.664792][ T4315] usb 6-1: can't read configurations, error -71 [ 758.696159][T21262] ext4: Unknown parameter 'nouser_xattr' [ 759.883385][T21298] netlink: 'syz.6.5097': attribute type 4 has an invalid length. [ 759.991533][T21302] netlink: 'syz.6.5097': attribute type 4 has an invalid length. [ 761.104643][T21336] FAULT_INJECTION: forcing a failure. [ 761.104643][T21336] name failslab, interval 1, probability 0, space 0, times 0 [ 761.148241][T21336] CPU: 0 PID: 21336 Comm: syz.4.5113 Not tainted syzkaller #0 [ 761.155782][T21336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 761.165858][T21336] Call Trace: [ 761.165870][T21336] [ 761.165879][T21336] dump_stack_lvl+0x188/0x24e [ 761.165915][T21336] ? show_regs_print_info+0x12/0x12 [ 761.165939][T21336] ? load_image+0x410/0x410 [ 761.165972][T21336] ? __might_sleep+0xd0/0xd0 [ 761.165993][T21336] ? __lock_acquire+0x7ea0/0x7ea0 [ 761.166027][T21336] should_fail_ex+0x390/0x4c0 [ 761.166062][T21336] should_failslab+0x5/0x20 [ 761.166081][T21336] slab_pre_alloc_hook+0x59/0x300 [ 761.166108][T21336] ? device_create+0x13a/0x300 [ 761.166140][T21336] __kmem_cache_alloc_node+0x4f/0x270 [ 761.177775][T21336] ? device_create+0x13a/0x300 [ 761.206413][T21336] kmalloc_trace+0x26/0xe0 [ 761.206445][T21336] device_create+0x13a/0x300 [ 761.206475][T21336] ? format_decode+0x90c/0x1330 [ 761.206504][T21336] ? string+0x257/0x290 [ 761.206537][T21336] ? widen_string+0x3b/0x2b0 [ 761.206564][T21336] ? string+0x257/0x290 [ 761.206590][T21336] ? root_device_unregister+0xf0/0xf0 [ 761.206632][T21336] bdi_register_va+0xa0/0x750 [ 761.206666][T21336] super_setup_bdi_name+0xf5/0x200 [ 761.206691][T21336] ? fuse_fill_super_common+0x4e8/0x1110 [ 761.206720][T21336] ? vfs_get_tree+0x270/0x270 [ 761.206752][T21336] ? do_raw_spin_unlock+0x11d/0x230 [ 761.206779][T21336] fuse_fill_super_common+0x622/0x1110 [ 761.206808][T21336] ? up_write+0x1b6/0x410 [ 761.226883][T21336] fuse_fill_super+0x173/0x1f0 [ 761.235992][T21336] ? fuse_reconfigure+0xb0/0xb0 [ 761.236027][T21336] get_tree_nodev+0xb0/0x160 [ 761.236055][T21336] fuse_get_tree+0x2d7/0x4d0 [ 761.259572][T21336] vfs_get_tree+0x88/0x270 [ 761.259607][T21336] do_new_mount+0x247/0xa40 [ 761.259638][T21336] __se_sys_mount+0x2e3/0x3d0 [ 761.259666][T21336] ? __x64_sys_mount+0xc0/0xc0 [ 761.259694][T21336] ? lockdep_hardirqs_on+0x94/0x140 [ 761.259721][T21336] ? __x64_sys_mount+0x1c/0xc0 [ 761.259747][T21336] do_syscall_64+0x4c/0xa0 [ 761.259769][T21336] ? clear_bhb_loop+0x60/0xb0 [ 761.259792][T21336] ? clear_bhb_loop+0x60/0xb0 [ 761.259817][T21336] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 761.259840][T21336] RIP: 0033:0x7fa7bb99e159 [ 761.259861][T21336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.285232][T21336] RSP: 002b:00007fa7bc805028 EFLAGS: 00000246 [ 761.295050][T21336] ORIG_RAX: 00000000000000a5 [ 761.304805][T21336] RAX: ffffffffffffffda RBX: 00007fa7bbc25fa0 RCX: 00007fa7bb99e159 [ 761.304827][T21336] RDX: 0000200000002100 RSI: 00002000000001c0 RDI: 0000000000000000 [ 761.304842][T21336] RBP: 00007fa7bba3506b R08: 00002000000002c0 R09: 0000000000000000 [ 761.304858][T21336] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 761.304871][T21336] R13: 00007fa7bbc26038 R14: 00007fa7bbc25fa0 R15: 00007fff62e00238 [ 761.304903][T21336] [ 761.495401][ C1] net_ratelimit: 50 callbacks suppressed [ 761.558149][T21341] tipc: Bearer : already 2 bearers with priority 10 [ 761.612647][T21341] tipc: Bearer : trying with adjusted priority [ 761.654600][T21341] tipc: New replicast peer: 255.255.255.255 [ 761.683510][T21341] tipc: Enabled bearer , priority 9 [ 763.317742][T21400] 6: renamed from veth0_vlan [ 763.806238][T21415] loop5: detected capacity change from 0 to 128 [ 764.216870][T21425] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 767.054906][T16097] net_ratelimit: 57 callbacks suppressed [ 767.360855][T21482] netlink: 'syz.5.5144': attribute type 1 has an invalid length. [ 767.410097][T21482] netlink: 'syz.5.5144': attribute type 4 has an invalid length. [ 767.456322][T21482] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.5144'. [ 767.516587][T21484] netlink: 'syz.5.5144': attribute type 1 has an invalid length. [ 767.524588][T21484] netlink: 'syz.5.5144': attribute type 4 has an invalid length. [ 767.593456][T21484] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.5144'. [ 770.621540][T21540] netlink: 'syz.8.5154': attribute type 4 has an invalid length. [ 772.174831][T16095] net_ratelimit: 56 callbacks suppressed [ 772.432592][T21592] futex_wake_op: syz.5.5165 tries to shift op by 32; fix this program [ 772.489223][T21592] loop5: detected capacity change from 0 to 512 [ 772.524852][ T27] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 772.546451][T21592] ext4: Unknown parameter 'fsuuid' [ 772.737258][ T27] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 772.777592][ T27] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 772.846707][ T27] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 772.887336][ T27] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.928482][ T27] usb 5-1: Product: syz [ 772.932990][ T27] usb 5-1: Manufacturer: syz [ 772.979129][ T27] usb 5-1: SerialNumber: syz [ 773.027229][ T27] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 773.105265][ T27] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 773.160467][ T27] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 775.215699][T21589] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear output buffers, -110 [ 775.252772][ T27] usb 5-1: USB disconnect, device number 7 [ 775.332889][ T27] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 775.430339][ T27] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 775.495456][ T27] ti_usb_3410_5052 5-1:2.0: device disconnected [ 775.908318][T21671] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 775.916058][T21671] IPv6: NLM_F_CREATE should be set when creating new route [ 777.190972][T21675] netdevsim netdevsim8 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.200074][T21675] netdevsim netdevsim8 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.209231][T21675] netdevsim netdevsim8 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.218418][T21675] netdevsim netdevsim8 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.376243][ T5212] net_ratelimit: 63 callbacks suppressed [ 777.435541][T21675] netdevsim netdevsim8 netdevsim0: unset [0, 1] type 1 family 0 port 256 - 0 [ 777.444776][T21675] netdevsim netdevsim8 netdevsim1: unset [0, 1] type 1 family 0 port 256 - 0 [ 777.453651][T21675] netdevsim netdevsim8 netdevsim2: unset [0, 1] type 1 family 0 port 256 - 0 [ 777.463035][T21675] netdevsim netdevsim8 netdevsim3: unset [0, 1] type 1 family 0 port 256 - 0 [ 777.600681][T21675] netdevsim netdevsim8 netdevsim0: unset [0, 2] type 1 family 0 port 60387 - 0 [ 777.610161][T21675] netdevsim netdevsim8 netdevsim1: unset [0, 2] type 1 family 0 port 60387 - 0 [ 777.610201][T21675] netdevsim netdevsim8 netdevsim2: unset [0, 2] type 1 family 0 port 60387 - 0 [ 777.629066][T21675] netdevsim netdevsim8 netdevsim3: unset [0, 2] type 1 family 0 port 60387 - 0 [ 777.856629][T21675] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.874902][T21675] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.905087][T21675] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.927471][T21675] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.716463][T16417] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.792899][T16417] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.200366][T16417] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.301198][T16417] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.617331][T16417] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.691632][T16417] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 780.039152][T16417] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 780.121824][T16417] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 780.704848][T16417] netdevsim netdevsim7 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 780.820478][T16417] netdevsim netdevsim7 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 780.903522][T16417] netdevsim netdevsim7 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 781.033542][T16417] netdevsim netdevsim7 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.121846][T21746] lo speed is unknown, defaulting to 1000 [ 782.494815][ T5207] net_ratelimit: 40 callbacks suppressed [ 782.725687][T21791] lo speed is unknown, defaulting to 1000 [ 784.623381][T21818] 6: renamed from veth0_vlan [ 785.423679][T21845] overlayfs: failed to clone upperpath [ 785.426942][T17628] kernel write not supported for file bpf-prog (pid: 17628 comm: kworker/0:8) [ 785.987868][T16417] bond2: (slave gretap1): Releasing active interface [ 787.089186][T16417] bond4: (slave gre2): Releasing backup interface [ 787.122128][T16417] device gre2 left promiscuous mode [ 787.166978][T16417] bond4: Destroying bond [ 787.615784][T16065] net_ratelimit: 45 callbacks suppressed [ 788.205624][T16417] bond4 (unregistering): Released all slaves [ 788.452430][T21898] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 788.463403][T21898] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 788.472052][T21898] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 788.546080][T21898] device bridge_slave_0 left promiscuous mode [ 788.566171][T21898] bridge0: port 1(bridge_slave_0) entered disabled state [ 788.600243][T21898] device bridge_slave_1 left promiscuous mode [ 788.624739][T21898] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.648823][T21898] bond0: (slave bond_slave_0): Releasing backup interface [ 788.665730][T21898] device bond_slave_0 left promiscuous mode [ 788.688387][T21898] bond0: (slave bond_slave_1): Releasing backup interface [ 788.698922][T21898] device bond_slave_1 left promiscuous mode [ 788.753102][T21898] team0: Port device team_slave_0 removed [ 788.768245][T21898] team0: Port device team_slave_1 removed [ 788.775886][T21898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 788.783582][T21898] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 788.792485][T21898] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 788.800264][T21898] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 788.818539][T21901] team0: Mode changed to "broadcast" [ 789.020264][T21915] netlink: 'syz.8.5241': attribute type 1 has an invalid length. [ 789.069259][T21916] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 789.078217][T21916] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 789.087274][T21916] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 789.096824][T21916] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 789.107858][T21916] bond5: (slave geneve3): making interface the new active one [ 789.159814][T21916] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 790.567860][T16417] device hsr_slave_0 left promiscuous mode [ 790.594305][T16417] device hsr_slave_1 left promiscuous mode [ 790.629232][T16417] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 790.681836][T16417] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 790.901232][T16417] device veth1_macvtap left promiscuous mode [ 790.918733][T16417] device veth0_macvtap left promiscuous mode [ 790.932070][T16417] device veth0_vlan left promiscuous mode [ 792.462221][T16417] bond3 (unregistering): Released all slaves [ 792.573707][T16417] bond2 (unregistering): Released all slaves [ 792.745940][T16060] net_ratelimit: 60 callbacks suppressed [ 793.365136][ T5731] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 793.547505][T16417] bond1 (unregistering): (slave team0): Removing an active aggregator [ 793.572642][T16417] bond1 (unregistering): (slave team0): Releasing backup interface [ 793.587998][ T5731] usb 6-1: unable to get BOS descriptor or descriptor too short [ 793.601063][ T5731] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.621852][ T5731] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 793.642235][ T5731] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 793.669066][T16417] bond1 (unregistering): Released all slaves [ 793.692519][ T5731] usb 6-1: string descriptor 0 read error: -22 [ 793.706424][ T5731] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 793.763320][ T5731] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.401797][ T5731] usb 6-1: 2:0: failed to get current value for ch 0 (-71) [ 794.448377][ T5731] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 794.511457][ T5731] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 794.530140][ T5731] usb 6-1: 2:0: cannot get min/max values for control 2 (id 2) [ 794.544978][ T5731] usb 6-1: USB disconnect, device number 5 [ 794.863432][T22006] udevd[22006]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 795.240863][T22013] EXT4-fs warning (device sda1): verify_group_input:180: Cannot read last block (265596) [ 795.749454][ T4287] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 795.767521][ T4287] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 795.795387][ T4287] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 795.805756][ T4287] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 795.814184][ T4287] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 795.822121][ T4287] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 796.127553][T16417] team0 (unregistering): Port device team_slave_1 removed [ 796.285807][T16417] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 796.470435][T16417] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 797.774945][ T5212] net_ratelimit: 40 callbacks suppressed [ 797.934935][ T4274] Bluetooth: hci5: command 0x0409 tx timeout [ 798.444076][T16417] bond0 (unregistering): Released all slaves [ 798.843816][T21952] netlink: 4096 bytes leftover after parsing attributes in process `syz.8.5252'. [ 798.975786][T21956] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5253'. [ 799.182091][T22026] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5265'. [ 799.744522][T22017] lo speed is unknown, defaulting to 1000 [ 799.932452][T22045] device syzkaller1 entered promiscuous mode [ 799.952691][ C0] ------------[ cut here ]------------ [ 799.958279][ C0] WARNING: CPU: 0 PID: 16417 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 [ 799.968807][ C0] Modules linked in: [ 799.972725][ C0] CPU: 0 PID: 16417 Comm: kworker/u4:36 Not tainted syzkaller #0 [ 799.980508][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 799.980526][ C0] Workqueue: netns cleanup_net [ 799.980558][ C0] RIP: 0010:__skb_flow_dissect+0xade/0x6d50 [ 800.002181][ C0] Code: c6 e8 76 28 4d f9 85 db 0f 84 5b 06 00 00 80 3d 78 3b d7 05 01 0f 85 81 06 00 00 e8 fc 24 4d f9 e9 e7 f9 ff ff e8 f2 24 4d f9 <0f> 0b e8 0b 9e fe 01 89 c3 31 ff 89 c6 e8 40 28 4d f9 85 db 74 18 [ 800.022233][ C0] RSP: 0018:ffffc90000006860 EFLAGS: 00010246 [ 800.028660][ C0] RAX: ffffffff8835218e RBX: 0000000000000000 RCX: ffff88802d3f3c00 [ 800.036725][ C0] RDX: 0000000000000100 RSI: ffffffff8adf6dc0 RDI: ffffffff8adf6d80 [ 800.045026][ C0] RBP: ffffc90000006e28 R08: dffffc0000000000 R09: 1ffffffff2166648 [ 800.045054][ C0] R10: dffffc0000000000 R11: fffffbfff2166649 R12: ffffffff8e214abc [ 800.045079][ C0] R13: 1ffffffff1c42958 R14: ffffffff8e214ac2 R15: dffffc0000000000 [ 800.045098][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 800.061718][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 800.078712][ C0] CR2: 0000001b3111eff8 CR3: 000000007c89d000 CR4: 00000000003506f0 [ 800.093328][ C0] Call Trace: [ 800.093341][ C0] [ 800.099492][ C0] ? __skb_flow_dissect+0x407/0x6d50 [ 800.099528][ C0] ? memset+0x1e/0x40 [ 800.108910][ C0] ? number+0xc99/0xef0 [ 800.113118][ C0] ? mark_lock+0x94/0x320 [ 800.117521][ C0] ? __lock_acquire+0x142d/0x7ea0 [ 800.122578][ C0] ? bpf_flow_dissect+0x3f0/0x3f0 [ 800.127740][ C0] ? desc_read+0x1a8/0x3d0 [ 800.132226][ C0] ? desc_read+0x1cf/0x3d0 [ 800.136722][ C0] ? verify_lock_unused+0x140/0x140 [ 800.142085][ C0] ? _prb_read_valid+0x91d/0x9a0 [ 800.147208][ C0] ? mark_lock+0x94/0x320 [ 800.151599][ C0] ? __lock_acquire+0x1359/0x7ea0 [ 800.156749][ C0] ___skb_get_hash+0x55/0x6e0 [ 800.161927][ C0] __skb_get_hash+0xd2/0x270 [ 800.166846][ C0] ? __up_console_sem+0x15f/0x1a0 [ 800.166884][ C0] ? __skb_get_hash_symmetric+0x3b0/0x3b0 [ 800.166907][ C0] ? __down_trylock_console_sem+0x19f/0x1f0 [ 800.166933][ C0] ? _printk+0xda/0x130 [ 800.166982][ C0] nft_trace_init+0x1e0/0x430 [ 800.193202][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 800.198331][ C0] ? nf_trace_fill_pkt_info+0x870/0x870 [ 800.204030][ C0] ? ip_vs_conn_hashkey_param+0x34a/0x5c0 [ 800.209852][ C0] nft_do_chain+0x1612/0x16d0 [ 800.214713][ C0] ? __ip_vs_conn_in_get+0x96/0xae0 [ 800.219980][ C0] ? _printk+0xda/0x130 [ 800.224194][ C0] ? ip_vs_conn_out_get+0x99/0xa90 [ 800.229540][ C0] ? ip_vs_conn_in_get+0x160/0x160 [ 800.234716][ C0] ? ip_vs_conn_out_get+0xa43/0xa90 [ 800.234745][ C0] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 800.246143][ C0] ? ip_vs_service_find+0xaaf/0xf70 [ 800.246235][ C0] nft_do_chain_ipv4+0x156/0x220 [ 800.256565][ C0] ? nf_tables_netdev_event+0x9c0/0x9c0 [ 800.262341][ C0] ? nf_nat_ipv4_local_fn+0x40d/0x560 [ 800.267895][ C0] ? nf_tables_netdev_event+0x9c0/0x9c0 [ 800.273677][ C0] nf_hook_slow+0xb9/0x200 [ 800.278277][ C0] ? nf_hook+0x390/0x390 [ 800.282805][ C0] nf_hook+0x224/0x390 [ 800.287144][ C0] ? nf_hook+0x9e/0x390 [ 800.291353][ C0] ? __ip_local_out+0x5d0/0x5d0 [ 800.296279][ C0] ? nf_hook+0x390/0x390 [ 800.300561][ C0] ? ip_route_output_key_hash+0x139/0x330 [ 800.306376][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 800.311535][ C0] ? ip_fast_csum+0x1ea/0x2b0 [ 800.316503][ C0] __ip_local_out+0x49c/0x5d0 [ 800.321220][ C0] ? nf_hook+0x390/0x390 [ 800.325693][ C0] ip_local_out+0x26/0x120 [ 800.325723][ C0] iptunnel_xmit+0x4a1/0x880 [ 800.325760][ C0] udp_tunnel_xmit_skb+0x22b/0x380 [ 800.334798][ C0] tipc_udp_xmit+0x85d/0xb40 [ 800.344602][ C0] ? tipc_udp_xmit+0xb3/0xb40 [ 800.349652][ C0] ? tipc_udp_msg2addr+0x1c0/0x1c0 [ 800.355047][ C0] ? tipc_udp_send_msg+0x29e/0x3e0 [ 800.360193][ C0] tipc_bearer_xmit_skb+0x2a9/0x3f0 [ 800.365578][ C0] ? tipc_bearer_xmit_skb+0xa6/0x3f0 [ 800.370932][ C0] ? tipc_bearer_min_mtu+0x1c0/0x1c0 [ 800.376309][ C0] tipc_disc_timeout+0x5e1/0x740 [ 800.381291][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 800.381341][ C0] call_timer_fn+0x1ac/0x670 [ 800.391187][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 800.396492][ C0] ? call_timer_fn+0xcf/0x670 [ 800.401202][ C0] ? __run_timers+0x810/0x810 [ 800.401239][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 800.411238][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 800.411268][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 800.421708][ C0] __run_timers+0x56c/0x810 [ 800.421751][ C0] ? detach_timer+0x350/0x350 [ 800.430948][ C0] run_timer_softirq+0x63/0xf0 [ 800.430979][ C0] handle_softirqs+0x291/0x910 [ 800.440567][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 800.440596][ C0] ? do_softirq+0x210/0x210 [ 800.449998][ C0] ? hrtimer_interrupt+0x775/0x980 [ 800.450033][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 800.460995][ C0] __irq_exit_rcu+0x13b/0x230 [ 800.465732][ C0] ? irq_exit_rcu+0x20/0x20 [ 800.465773][ C0] irq_exit_rcu+0x5/0x20 [ 800.475075][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 800.475112][ C0] [ 800.483659][ C0] [ 800.483674][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 800.483704][ C0] RIP: 0010:preempt_schedule_irq+0xb6/0x160 [ 800.483732][ C0] Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 25 61 1c f7 e8 b0 52 4c f7 fb bf 01 00 00 00 25 ba ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f [ 800.483749][ C0] RSP: 0018:ffffc90005f17620 EFLAGS: 00000282 [ 800.487223][ C0] RAX: 63541bf35555f100 RBX: 0000000000000000 RCX: 63541bf35555f100 [ 800.499513][ C0] RDX: dffffc0000000000 RSI: ffffffff8a8c18a0 RDI: 0000000000000001 [ 800.542353][ C0] RBP: ffffc90005f176c0 R08: ffffffff90b3332f R09: 1ffffffff2166665 [ 800.550686][ C0] R10: dffffc0000000000 R11: fffffbfff2166666 R12: 0000000000000000 [ 800.558927][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000be2ec4 [ 800.567290][ C0] ? preempt_schedule_notrace+0x120/0x120 [ 800.573079][ C0] ? rcu_irq_exit_check_preempt+0xdb/0x210 [ 800.579007][ C0] irqentry_exit+0x63/0x70 [ 800.583577][ C0] asm_sysvec_reschedule_ipi+0x16/0x20 [ 800.589202][ C0] RIP: 0010:lockdep_unregister_key+0x4e8/0x550 [ 800.595899][ C0] Code: 31 ae 90 48 c7 c6 20 ad 64 81 e8 c3 ad 07 00 e8 0e c1 07 00 e9 5c fc ff ff e8 a4 0c cf 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff [ 800.595920][ C0] RSP: 0018:ffffc90005f17780 EFLAGS: 00000246 [ 800.595944][ C0] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 63541bf35555f100 [ 800.595960][ C0] RDX: 0000000000000001 RSI: ffffffff8a8c2580 RDI: ffffffff8adf6de0 [ 800.595975][ C0] RBP: ffffc90005f17860 R08: ffffffff90b059e7 R09: 1ffffffff2160b3c [ 800.595990][ C0] R10: dffffc0000000000 R11: fffffbfff2160b3d R12: 0000000000000a03 [ 800.596005][ C0] R13: ffff888077f83529 R14: ffffffff90b031a8 R15: 1ffff92000be2ef4 [ 800.596041][ C0] ? lockdep_reset_lock+0x300/0x300 [ 800.623380][ C0] ? lock_chain_count+0x20/0x20 [ 800.639748][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 800.639783][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 800.639812][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 800.656630][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 800.670129][ C0] destroy_workqueue+0x87b/0xb20 [ 800.680220][ C0] wg_destruct+0x1e8/0x300 [ 800.690988][ C0] ? wg_xmit+0xed0/0xed0 [ 800.701281][ C0] netdev_run_todo+0xbe3/0xdb0 [ 800.710172][ C0] ? netdev_refcnt_read+0x50/0x50 [ 800.720332][ C0] ? unregister_netdevice_queue+0x17c/0x330 [ 800.726635][ C0] ? list_netdevice+0x640/0x640 [ 800.731505][ C0] ? vxcan_newlink+0x670/0x670 [ 800.736346][ C0] default_device_exit_batch+0x963/0x9f0 [ 800.750876][ C0] ? __might_sleep+0xd0/0xd0 [ 800.750902][ C0] ? rdma_dev_exit_net+0x2af/0x330 [ 800.756105][ C0] ? net_rps_action_and_irq_enable+0x200/0x200 [ 800.756132][ C0] ? rdma_dev_init_net+0x270/0x270 [ 800.768276][ C0] ? net_rps_action_and_irq_enable+0x200/0x200 [ 800.779582][ C0] cleanup_net+0x78e/0xba0 [ 800.779608][ C0] ? ops_free_list+0x3b0/0x3b0 [ 800.784574][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 800.795020][ C0] ? process_one_work+0x7b4/0x1160 [ 800.800166][ C0] process_one_work+0x8ab/0x1160 [ 800.805191][ C0] ? worker_detach_from_pool+0x240/0x240 [ 800.810951][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 800.816101][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 800.821689][ C0] ? wq_worker_running+0x97/0x190 [ 800.821721][ C0] worker_thread+0xaf5/0x12a0 [ 800.821769][ C0] kthread+0x29d/0x330 [ 800.827396][ C0] ? worker_clr_flags+0x1a0/0x1a0 [ 800.827421][ C0] ? kthread_blkcg+0xd0/0xd0 [ 800.836978][ C0] ret_from_fork+0x1f/0x30 [ 800.846637][ C0] [ 800.852918][ T53] sd 0:0:1:0: cmd ffff8880271822e0 CDB: 0x2a [ 800.854050][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 800.854071][ T53] Added buffer head 426 to ffff888023522800 [ 800.855634][ C1] virtqueue callback for ffff888023522800 (ffffffff85445c70) [ 800.855657][ C1] sd 0:0:1:0: cmd ffff8880271822e0 response 0 status 0x0 sense_len 0 [ 800.855677][ C1] No more buffers in queue [ 800.893604][ C0] CPU: 0 PID: 16417 Comm: kworker/u4:36 Not tainted syzkaller #0 [ 800.895071][ C1] nf_conntrack: normal packet for ffff888028338180 [ 800.895094][ C1] tcp_conntracks: [ 800.895102][ C1] syn=0 ack=1 fin=0 rst=0 old=3 new=3 [ 800.895184][ C1] No more buffers in queue [ 800.895194][ C1] eth0: xmit ffff88804bb8a5f0 42:01:0a:80:00:01 [ 800.895215][ C1] Added buffer head 23 to ffff888140198a00 [ 800.895270][ C1] virtqueue callback for ffff888140198a00 (ffffffff858ab750) [ 800.895412][ C1] Sent skb ffff88804bb8a5f0 [ 800.895425][ C1] No more buffers in queue [ 800.951363][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 800.961700][ C0] Workqueue: netns cleanup_net [ 800.966541][ C0] Call Trace: [ 800.969825][ C0] [ 800.972666][ C0] dump_stack_lvl+0x188/0x24e [ 800.977369][ C0] ? memcpy+0x3c/0x60 [ 800.981379][ C0] ? show_regs_print_info+0x12/0x12 [ 800.986615][ C0] ? load_image+0x410/0x410 [ 800.991181][ C0] panic+0x2d3/0x710 [ 800.995128][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 800.999679][ C0] ? ret_from_fork+0x1f/0x30 [ 801.004356][ C0] __warn+0x2f8/0x4f0 [ 801.008402][ C0] ? __skb_flow_dissect+0xade/0x6d50 [ 801.013756][ C0] ? __skb_flow_dissect+0xade/0x6d50 [ 801.019355][ C0] report_bug+0x2ba/0x4f0 [ 801.023727][ C0] ? __skb_flow_dissect+0xade/0x6d50 [ 801.029061][ C0] handle_bug+0x3a/0x70 [ 801.033256][ C0] exc_invalid_op+0x16/0x40 [ 801.037884][ C0] asm_exc_invalid_op+0x16/0x20 [ 801.042866][ C0] RIP: 0010:__skb_flow_dissect+0xade/0x6d50 [ 801.048816][ C0] Code: c6 e8 76 28 4d f9 85 db 0f 84 5b 06 00 00 80 3d 78 3b d7 05 01 0f 85 81 06 00 00 e8 fc 24 4d f9 e9 e7 f9 ff ff e8 f2 24 4d f9 <0f> 0b e8 0b 9e fe 01 89 c3 31 ff 89 c6 e8 40 28 4d f9 85 db 74 18 [ 801.068641][ C0] RSP: 0018:ffffc90000006860 EFLAGS: 00010246 [ 801.074944][ C0] RAX: ffffffff8835218e RBX: 0000000000000000 RCX: ffff88802d3f3c00 [ 801.083130][ C0] RDX: 0000000000000100 RSI: ffffffff8adf6dc0 RDI: ffffffff8adf6d80 [ 801.091499][ C0] RBP: ffffc90000006e28 R08: dffffc0000000000 R09: 1ffffffff2166648 [ 801.099684][ C0] R10: dffffc0000000000 R11: fffffbfff2166649 R12: ffffffff8e214abc [ 801.107788][ C0] R13: 1ffffffff1c42958 R14: ffffffff8e214ac2 R15: dffffc0000000000 [ 801.115987][ C0] ? __skb_flow_dissect+0xade/0x6d50 [ 801.121426][ C0] ? __skb_flow_dissect+0x407/0x6d50 [ 801.126755][ C0] ? memset+0x1e/0x40 [ 801.130783][ C0] ? number+0xc99/0xef0 [ 801.134798][ C1] nf_conntrack: new packet for ffff888062498300 [ 801.134831][ C1] nf_nat: Already setup manip DST for ct ffff888062498300 (status bits 0x188) [ 801.135294][ C1] nf_nat: Already setup manip SRC for ct ffff888062498300 (status bits 0x188) [ 801.135348][ C1] nf_nat: Already setup manip SRC for ct ffff888062498300 (status bits 0x188) [ 801.165139][T22063] kcov: kcov_start: t = ffff888024acbc00, size = 524288, area = ffffc900129e0000 [ 801.204343][ C0] ? mark_lock+0x94/0x320 [ 801.208741][ C0] ? __lock_acquire+0x142d/0x7ea0 [ 801.213845][ C0] ? bpf_flow_dissect+0x3f0/0x3f0 [ 801.218944][ C0] ? desc_read+0x1a8/0x3d0 [ 801.223439][ C0] ? desc_read+0x1cf/0x3d0 [ 801.227983][ C0] ? verify_lock_unused+0x140/0x140 [ 801.233367][ C0] ? _prb_read_valid+0x91d/0x9a0 [ 801.238418][ C0] ? mark_lock+0x94/0x320 [ 801.242977][ C0] ? __lock_acquire+0x1359/0x7ea0 [ 801.248089][ C0] ___skb_get_hash+0x55/0x6e0 [ 801.252832][ C0] __skb_get_hash+0xd2/0x270 [ 801.257649][ C0] ? __up_console_sem+0x15f/0x1a0 [ 801.262823][ C0] ? __skb_get_hash_symmetric+0x3b0/0x3b0 [ 801.268776][ C0] ? __down_trylock_console_sem+0x19f/0x1f0 [ 801.274859][ C0] ? _printk+0xda/0x130 [ 801.279194][ C0] nft_trace_init+0x1e0/0x430 [ 801.283890][T22065] kcov: kcov_start: t = ffff88802fc8da00, size = 524288, area = ffffc90005969000 [ 801.293150][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 801.298591][ C0] ? nf_trace_fill_pkt_info+0x870/0x870 [ 801.304197][ C0] ? ip_vs_conn_hashkey_param+0x34a/0x5c0 [ 801.310074][ C0] nft_do_chain+0x1612/0x16d0 [ 801.315003][ C0] ? __ip_vs_conn_in_get+0x96/0xae0 [ 801.320256][ C0] ? _printk+0xda/0x130 [ 801.324469][ C0] ? ip_vs_conn_out_get+0x99/0xa90 [ 801.324842][ C1] nf_conntrack: normal packet for ffff888028338180 [ 801.324903][ C1] tcp_conntracks: [ 801.324911][ C1] syn=0 ack=1 fin=0 rst=0 old=3 new=3 [ 801.325007][ C1] No more buffers in queue [ 801.325017][ C1] eth0: xmit ffff88804bb8a5f0 42:01:0a:80:00:01 [ 801.325039][ C1] Added buffer head 23 to ffff888140198a00 [ 801.325119][ C1] virtqueue callback for ffff888140198a00 (ffffffff858ab750) [ 801.325144][ C1] Sent skb ffff88804bb8a5f0 [ 801.325155][ C1] No more buffers in queue [ 801.362552][T22067] kcov: kcov_start: t = ffff88802b4d5a00, size = 524288, area = ffffc90005fe9000 [ 801.388181][ C0] ? ip_vs_conn_in_get+0x160/0x160 [ 801.393435][ C0] ? ip_vs_conn_out_get+0xa43/0xa90 [ 801.398763][ C0] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 801.404893][ C0] ? ip_vs_service_find+0xaaf/0xf70 [ 801.410301][ C0] nft_do_chain_ipv4+0x156/0x220 [ 801.415281][ C0] ? nf_tables_netdev_event+0x9c0/0x9c0 [ 801.417135][T22070] kcov: kcov_start: t = ffff8880792b8000, size = 524288, area = ffffc9000e111000 [ 801.430002][ C0] ? nf_nat_ipv4_local_fn+0x40d/0x560 [ 801.435603][ C0] ? nf_tables_netdev_event+0x9c0/0x9c0 [ 801.441210][ C0] nf_hook_slow+0xb9/0x200 [ 801.445681][ C0] ? nf_hook+0x390/0x390 [ 801.450147][ C0] nf_hook+0x224/0x390 [ 801.454276][ C0] ? nf_hook+0x9e/0x390 [ 801.458475][ C0] ? __ip_local_out+0x5d0/0x5d0 [ 801.463364][ C0] ? nf_hook+0x390/0x390 [ 801.467744][ C0] ? ip_route_output_key_hash+0x139/0x330 [ 801.473552][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 801.478618][ C0] ? ip_fast_csum+0x1ea/0x2b0 [ 801.483429][ C0] __ip_local_out+0x49c/0x5d0 [ 801.488152][ C0] ? nf_hook+0x390/0x390 [ 801.492444][ C0] ip_local_out+0x26/0x120 [ 801.496981][ C0] iptunnel_xmit+0x4a1/0x880 [ 801.501804][ C0] udp_tunnel_xmit_skb+0x22b/0x380 [ 801.508469][ C0] tipc_udp_xmit+0x85d/0xb40 [ 801.513304][ C0] ? tipc_udp_xmit+0xb3/0xb40 [ 801.518041][ C0] ? tipc_udp_msg2addr+0x1c0/0x1c0 [ 801.523221][ C0] ? tipc_udp_send_msg+0x29e/0x3e0 [ 801.528394][ C0] tipc_bearer_xmit_skb+0x2a9/0x3f0 [ 801.533647][ C0] ? tipc_bearer_xmit_skb+0xa6/0x3f0 [ 801.538977][ C0] ? tipc_bearer_min_mtu+0x1c0/0x1c0 [ 801.544328][ C0] tipc_disc_timeout+0x5e1/0x740 [ 801.546107][T22058] kcov: kcov_start: t = ffff88807c6b5a00, size = 524288, area = ffffc900101d6000 [ 801.558477][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 801.563756][ C0] call_timer_fn+0x1ac/0x670 [ 801.568485][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 801.573971][ C0] ? call_timer_fn+0xcf/0x670 [ 801.578719][ C0] ? __run_timers+0x810/0x810 [ 801.583448][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 801.588695][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 801.594018][ C0] ? tipc_disc_init_msg+0x560/0x560 [ 801.599266][ C0] __run_timers+0x56c/0x810 [ 801.603925][ C0] ? detach_timer+0x350/0x350 [ 801.608664][ C0] run_timer_softirq+0x63/0xf0 [ 801.610486][T22060] kcov: kcov_start: t = ffff88807c6b1e00, size = 524288, area = ffffc900119dc000 [ 801.612017][T22063] kcov: kcov_task_exit: t = ffff888024acbc00, kcov->t = ffff888024acbc00 [ 801.618092][T22060] kcov: kcov_task_exit: t = ffff88807c6b1e00, kcov->t = ffff88807c6b1e00 [ 801.640100][ C0] handle_softirqs+0x291/0x910 [ 801.644926][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 801.649817][ C0] ? do_softirq+0x210/0x210 [ 801.654352][ C0] ? hrtimer_interrupt+0x775/0x980 [ 801.659948][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 801.665193][ C0] __irq_exit_rcu+0x13b/0x230 [ 801.669905][ C0] ? irq_exit_rcu+0x20/0x20 [ 801.674553][ C0] irq_exit_rcu+0x5/0x20 [ 801.678930][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 801.684609][ C0] [ 801.687581][ C0] [ 801.690547][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 801.694698][ C1] wireguard: wg2: Handshake for peer 42 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 3) [ 801.694766][ C1] wireguard: wg2: Handshake for peer 71 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 8) [ 801.694814][ C1] wireguard: wg1: Handshake for peer 76 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 2) [ 801.694899][ C1] nf_conntrack: new packet for ffff88802ea43e00 [ 801.694916][ C1] nf_nat: Already setup manip DST for ct ffff88802ea43e00 (status bits 0x188) [ 801.694950][ C1] nf_nat: Already setup manip SRC for ct ffff88802ea43e00 (status bits 0x188) [ 801.697842][T16062] nf_conntrack: new packet for ffff888062499e00 [ 801.697861][T16062] nf_nat: Already setup manip DST for ct ffff888062499e00 (status bits 0x188) [ 801.697907][T16062] nf_nat: Already setup manip SRC for ct ffff888062499e00 (status bits 0x188) [ 801.698262][T16062] nf_conntrack: new packet for ffff88802ea43980 [ 801.698278][T16062] nf_nat: Already setup manip DST for ct ffff88802ea43980 (status bits 0x188) [ 801.698306][T16062] nf_nat: Already setup manip SRC for ct ffff88802ea43980 (status bits 0x188) [ 801.701128][T16062] nf_conntrack: normal packet for ffff888062499380 [ 801.788083][T22073] kcov: kcov_start: t = ffff88807c6b8000, size = 524288, area = ffffc900119dc000 [ 801.820148][ C0] RIP: 0010:preempt_schedule_irq+0xb6/0x160 [ 801.826175][ C0] Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 25 61 1c f7 e8 b0 52 4c f7 fb bf 01 00 00 00 25 ba ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f [ 801.846039][ C0] RSP: 0018:ffffc90005f17620 EFLAGS: 00000282 [ 801.852149][ C0] RAX: 63541bf35555f100 RBX: 0000000000000000 RCX: 63541bf35555f100 [ 801.860285][ C0] RDX: dffffc0000000000 RSI: ffffffff8a8c18a0 RDI: 0000000000000001 [ 801.868573][ C0] RBP: ffffc90005f176c0 R08: ffffffff90b3332f R09: 1ffffffff2166665 [ 801.876858][ C0] R10: dffffc0000000000 R11: fffffbfff2166666 R12: 0000000000000000 [ 801.885138][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000be2ec4 [ 801.893265][ C0] ? preempt_schedule_notrace+0x120/0x120 [ 801.894880][T22075] kcov: kcov_start: t = ffff8880254d9e00, size = 524288, area = ffffc9000e701000 [ 801.908254][ C0] ? rcu_irq_exit_check_preempt+0xdb/0x210 [ 801.914645][ C0] irqentry_exit+0x63/0x70 [ 801.919111][ C0] asm_sysvec_reschedule_ipi+0x16/0x20 [ 801.924700][ C0] RIP: 0010:lockdep_unregister_key+0x4e8/0x550 [ 801.930942][ C0] Code: 31 ae 90 48 c7 c6 20 ad 64 81 e8 c3 ad 07 00 e8 0e c1 07 00 e9 5c fc ff ff e8 a4 0c cf 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff [ 801.950596][ C0] RSP: 0018:ffffc90005f17780 EFLAGS: 00000246 [ 801.956798][ C0] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 63541bf35555f100 [ 801.964824][ C0] RDX: 0000000000000001 RSI: ffffffff8a8c2580 RDI: ffffffff8adf6de0 [ 801.972931][ C0] RBP: ffffc90005f17860 R08: ffffffff90b059e7 R09: 1ffffffff2160b3c [ 801.980955][ C0] R10: dffffc0000000000 R11: fffffbfff2160b3d R12: 0000000000000a03 [ 801.988970][ C0] R13: ffff888077f83529 R14: ffffffff90b031a8 R15: 1ffff92000be2ef4 [ 801.997178][ C0] ? lockdep_reset_lock+0x300/0x300 [ 802.002520][ C0] ? lock_chain_count+0x20/0x20 [ 802.007513][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 802.012593][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 802.018189][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 802.023442][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 802.028748][ C0] destroy_workqueue+0x87b/0xb20 [ 802.033750][ C0] wg_destruct+0x1e8/0x300 [ 802.038517][ C0] ? wg_xmit+0xed0/0xed0 [ 802.042912][ C0] netdev_run_todo+0xbe3/0xdb0 [ 802.047731][ C0] ? netdev_refcnt_read+0x50/0x50 [ 802.052795][ C0] ? unregister_netdevice_queue+0x17c/0x330 [ 802.058732][ C0] ? list_netdevice+0x640/0x640 [ 802.063716][ C0] ? vxcan_newlink+0x670/0x670 [ 802.068565][ C0] default_device_exit_batch+0x963/0x9f0 [ 802.071595][T22058] kcov: kcov_task_exit: t = ffff88807c6b5a00, kcov->t = ffff88807c6b5a00 [ 802.082757][ C0] ? __might_sleep+0xd0/0xd0 [ 802.087392][ C0] ? rdma_dev_exit_net+0x2af/0x330 [ 802.092550][ C0] ? net_rps_action_and_irq_enable+0x200/0x200 [ 802.098755][ C0] ? rdma_dev_init_net+0x270/0x270 [ 802.103917][ C0] ? net_rps_action_and_irq_enable+0x200/0x200 [ 802.110203][ C0] cleanup_net+0x78e/0xba0 [ 802.114836][ C0] ? ops_free_list+0x3b0/0x3b0 [ 802.119656][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 802.124891][ C0] ? process_one_work+0x7b4/0x1160 [ 802.130059][ C0] process_one_work+0x8ab/0x1160 [ 802.135054][ C0] ? worker_detach_from_pool+0x240/0x240 [ 802.140734][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 802.145804][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 802.151411][ C0] ? wq_worker_running+0x97/0x190 [ 802.156481][ C0] worker_thread+0xaf5/0x12a0 [ 802.161331][ C0] kthread+0x29d/0x330 [ 802.165438][ C0] ? worker_clr_flags+0x1a0/0x1a0 [ 802.170751][ C0] ? kthread_blkcg+0xd0/0xd0 [ 802.174740][ C1] nf_conntrack: normal packet for ffff888028338180 [ 802.174763][ C1] tcp_conntracks: [ 802.174770][ C1] syn=0 ack=1 fin=0 rst=0 old=3 new=3 [ 802.174870][ C1] No more buffers in queue [ 802.174879][ C1] eth0: xmit ffff88804bb8a5f0 42:01:0a:80:00:01 [ 802.174900][ C1] Added buffer head 23 to ffff888140198a00 [ 802.174952][ C1] virtqueue callback for ffff888140198a00 (ffffffff858ab750) [ 802.175029][ C1] nf_conntrack: new packet for ffff888062498300 [ 802.175053][ C1] nf_nat: Already setup manip DST for ct ffff888062498300 (status bits 0x188) [ 802.175516][ C1] nf_nat: Already setup manip SRC for ct ffff888062498300 (status bits 0x188) [ 802.175577][ C1] nf_nat: Already setup manip SRC for ct ffff888062498300 (status bits 0x188) [ 802.183292][ C1] Sent skb ffff88804bb8a5f0 [ 802.183308][ C1] No more buffers in queue [ 802.257706][ C0] ret_from_fork+0x1f/0x30 [ 802.262180][ C0] [ 802.265375][ C0] Kernel Offset: disabled [ 802.269896][ C0] Rebooting in 86400 seconds..