last executing test programs: 3m39.386258313s ago: executing program 4 (id=10): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x540b, 0x0) sendmmsg(r0, &(0x7f0000009b80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000005300)=[{0x10, 0x119, 0x9}], 0x10}}], 0x1, 0x300) 3m38.794333818s ago: executing program 4 (id=12): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001000)=0x10, 0x4) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000200)=0x18) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f00000002c0), 0x3, 0x45c, &(0x7f0000000940)="$eJzs281vFGUYAPBnZtsCArYifvChVtHY+NFSQOXgQY0mHjAx0YMem7YQZKGG1kQIUTAGT8aYeDce/Rc86cUYTyZe9W5IiOECeFozuzN0d9ld6LLbLezvlwy873z0fZ6deXffmXc3gKE1mf2TRGyLiL8iYrxWbdxhsvbftSvn5q9fOTefRKXy3r9Jdb+rV87NF7sWx23NK1NpRPplEntatLt85uyJuXJ58XRen1k5+fHM8pmzLx4/OXds8djiqQOHDx86OPvKywde6kmeWUxXd3+2tHfX2x9++86Rr7N1aZF/Ux49Mtlp4zOVSo+bG6ztdeVkZICBsCaliMhO12i1/49HKVZP3ni89cVAgwP6qlKpVLa233y+AtzDkmis6/IwLIoP+uz+t1iaBwGv9W/4MXCXX6/dAGV5X8uX2paR6vOByO+Ntvep/cmI+OD8f99nS/TnOQQAQIOfs/HPC63Gf2k8XLff/fnc0EREPBAROyLiwYjYGREPRVT3fSQiHl1j+82TJDePf9JLXSV2m7Lx36v53Fbj+K8Y/cVEKa9tr+Y/mhw9Xl7cn78mUzG6KavPdmjjlzf//KbdtvrxX7Zk7RdjwTyOSyObGo9ZmFuZu5Oc612+ELF7pFX+yY2ZgCQidkXE7i7bOP7cj3vbbbt1/h30YJ6p8kPEs7Xzfz6a8i8knecnZzZHeXH/THFV3Oz3Py6+2679O8q/B7Lzf1/L6/9G/hNJ/Xzt8trbuPj3V23vabq9/seS96vlsXzdp3MrK6dnI8aSI7Wg69cfWD22qBf7Z/lP7Wvd/3fE6iuxJyKyi/ixiHg8Ip7IY38yIp6KiH0d8v/tjac/6j7//sryX1jT+V8tjEXzmtaF0olff2podOKm/K93Pv+HqqWpfM3tvP/dTlzdXc0AAABw90kjYlsk6fSNcppOT9e+L78zIi0vLa88f3Tpk1MLtd8ITESkxZOu8brnobP5bX2tfiEial8tKLYfzJ8bf1faUq1Pzy+VFwadPAy5rW36f+af0qCjA/rO77VgeOn/MLxu1f8/X6c4gPXn8x+GV4v+v2UQcQDrbVPLz39jfhgOTf3ftB8Mkab+v3lQcQDrr/vnf2M9jQNYf57/w1Ba3hK3/pF8x0Lxl7o8/J4txOiGCKNvhUg3RBgbtjB6l/eLwb0nAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9NL/AQAA//8kV94B") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) getdents64(r1, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x2841, 0x0) flock(r2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f0000000100)='./file0\x00', 0x8000, 0x84) flock(r3, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x10a) flock(r4, 0x2) 3m37.587362117s ago: executing program 4 (id=16): socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)}, 0x3f02) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x37, &(0x7f00000000c0)=""/3, &(0x7f0000000280)=0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_BALANCE(r1, 0x5000940c, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x200000, &(0x7f0000000340)={[], [{@appraise}, {@smackfstransmute={'smackfstransmute', 0x3d, '\x00\x00'}}, {@uid_lt}, {@appraise_type}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}]}, 0xfd, 0x57e, &(0x7f0000000540)="$eJzs3U1rG9caAOB3ZClfzr12IIR77+ISyKIpIXJs9yOFQtJlaUMD7T4VtmKC5ShYcojdQJNFs+mmhEIpDZT+gO67DP0D/RWBNhBKMO2iFFxGHjmKJfkrcqVGzwOTnKMZzTlHZ96jMzOSFcDQOpn+k4v4b0R8kUSMtazLR7by5Pp2q09vz6RLEmtrH/6axIVN+0qy/0ezzH8i4sfPIs7k2sutLa/MlyqV8mKWn6gv3JioLa+cvbZQmivPla9PTU+ff3166q033+hZW1+9/PvXHzx89/znp1a/+v7xsftJXIyj2bq0XT0o4k5r5mTpzyxViIubNpzsQWGDJOl3BdiTkSzOC5GOAWMxkkU98PL7NCLWgCGViH8YUs15QPPcvkfnwf8YT95ZPwFqb39+/dpIHGqcGx1ZTZ47M0rPd8d7UH5axg+/PLifLrH1dYjD2+QBduXO3Yg4l8+3j39JNv7t3bnGxeOtbS5j2N5/oJ8epvOf5E5EW/znNuY/0WH+M9ohdvfi2T7WpzPt8Z973INiukrnf293nP9uDF3jI1nuX405XyG5eq1SPhcR/46I01E4mOa3up9zfvXRWrd1rfO/dEnLb84Fs3o8zh98/jmzpXrpRdrc6sndiP91nP8mG/2fdOj/9PW4vMMyTpQf/L/buu3bv7/Wvot4pWP/P7ujlWx9f3KicTxMNI+Kdr/dO/FTt/L73f60/49s3f7xpPV+ba3rrrreOPr20B/lbuv2evwfSD5qpA9kj90q1euLkxEHkvfzo5sfn3r23Ga+uX3a/tOnOsf/Vsd/Olp93PWleN694/e6bjoI/T+7q/7ffeLRe5980638nfX/a43U6eyRnYx/O63gi7x2AAAAAAAAMGhyEXE0klxxI53LFYvrn+84HkdylWqtfuZqden6bDS+KzsehVzzTvdYy+chJrPPwzbzU5vy0xFxLCK+HDncyBdnqpXZfjceAAAAAAAAAAAAAAAAAAAABsRol+//p34e6XftgH3X+GGDg/2uBdAP2/7kfy9+6QkYSNvGP/DS2n38uzIALwvv/zC8xD8ML/EPw2un8V8Y2+eKAH877/8wvMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAA9NTlS5fSZW316e2ZND97c3lpvnrz7Gy5Nl9cWJopzlQXbxTnqtW5Srk4U13Ybn+VavXG5FQs3Zqol2v1idryypWF6tL1+pVrC6W58pVywR8bBgAAAAAAAAAAAAAAAAAAgDa15ZX5UqVSXpTomrgQA1GN/Wzguj09PT8orZDoaaLPAxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtPgrAAD//20CM10=") prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) timer_create(0x7, &(0x7f0000000180)={0x0, 0x2, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240)=0x0) timer_settime(r4, 0x1, &(0x7f00000002c0)={{0x0, 0x989680}}, &(0x7f0000000300)) r5 = inotify_init() inotify_add_watch(r5, &(0x7f0000000000)='.\x00', 0x1400037e) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x4040) 3m36.554657853s ago: executing program 4 (id=20): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='nodots,dos1xfloppy,usefree,nodots,fmask=0000000000000010,flush,nfs=nostale_ro,dots,nodots,\x00'], 0x2, 0x15a, &(0x7f0000000780)="$eJzs2z+r01AYB+C33l6NutxZHAIuTkX9BIpUEAOK0kEnherSSsEu0cV+FL+gIJ26HdFoS/9JK/QGkudZ8sLvHDgnkLycQN7e/jgaTqYfJi/mkXU60X0YeSw6cRFX4iwqswAAmmSRUvxIKaVrs7j+LVJKW0O+1rIwAOBkDuj/AEDD6P8A0D76PwC0z6vXb549Kor+yzzPIr7PykE5qK5V/uRp0b+X/3axmjUvy8HZMr9f5fl6fh43/uQPduZX4+6dKv+VPX5ebOQ3Y3j67QMAAEAr9PKl9fP937y3J9/+PrBxfu/Gre4lbQIAOMr085fRu/H4/aejioj/mdWI4jwidkdZtPi2KJpW1P1mAk5t9dDXvRIAAAAAAAAAAAAAAGCfg/8Hyv49eJH2T697jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDpZwAAAP//iBFNOg==") mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}]}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='mountinfo\x00') read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0x2020) syz_mount_image$msdos(&(0x7f0000000140), &(0x7f0000000f00)='.\x00', 0x1a5843c, &(0x7f0000001dc0)=ANY=[@ANYBLOB, @ANYRES8, @ANYRESOCT, @ANYBLOB="680b0400f4d0f02dfcbce2ee9830c9834041e8b03a79b761c78b8336d2ce3836eeefd2c25d1bd290cee8daa44c63e6dcdf2f4560e841ca729e234c3d923ca2af4a08ca0d77716e4469551f839d8337a0d89e26f030e25fcc40f95b3a1b1853f3d8cbf096b332399ecf918675660665b455ac0367c3b2c06475a885cdc6759bc934f995c0b3f1fbba9b8d261e53d6af1a928b8d", @ANYRESHEX, @ANYRES16, @ANYRESDEC, @ANYRESOCT, @ANYRES16=r0, @ANYRESHEX=0x0, @ANYBLOB="ac2d5b5b8945d57e7869648ebe10b8d2719763b4bf3f6667bf8f722606d2b3593f26218e9a5fba2e7d4166787da71737b380045fb0a682e2915271f214c0112961b73c4638e7ba68deb34826d7682ace7549c83bf52bd9142b6c5adebf82155270d33204c09c07ed4ca2fc932af48646c9624e3e3544d68f61a2b073fb85332599b299a4f441a8e2f74c57aa38b5b596238280c1693bba97ff258679ab84485970b60f81093dda6501baba18a7790ca3e6fcfa12898b9fff3faf613d71f9d64dbd5c2edad8e774fb0da39e532d92164e2d34aff7cae32f3cd7aa9aace000f136323e4808d0c66c0828942def38deb2e1d847555fe0d5ba8084babb3169f9f06246ecd5327758448c9c7e4591da12ff1b084e757d05af4f0f0444ecfcc0c4d2067a98d49fe52412218380bb75e21cd2372404ea0b116b9a1c1e3350b3e6f17c5bd1f1adb4ce1d03d5b30eb0690340708f06dfca5c9d74a7c140cabddd0f37d8bcf15e578dde85d7c28ccb1c9633ceeb54bb278d5a097220ca53a2ea4781aca2b70189199938afba9a700a610225311fe8316794ca0ae139a50dbd34d572d6165eaaa94844620045e615d51f5e19c29aadad3539490961135851f15bbfd0604f3926877583d85c45a04c6f155ad6e1966d2004ab6ab51f9beb82dbcdcaaab886564cbf81b581da397eba4fc8fe430ef93ed613cd588e399669b9f4b63481163e6c2b74112538192be9551ca400bc2b947a535fccbc567a68a3ab94554385bb1f2a0e2146310113102a9ffbcbbf44d30e076d363d6201faecf8bbbbc9d7fcd38195860bbc85ee3f5f9b2c990164abc3a7674ab2a631147d708585f52694a46b681cbc623b53a272f21f2aa5597beec8094954541316cc45ec9751fef12369e7272b7bdcb527bac4a19e0bba1b68ef98e3563705e9ca40bb914cece2fd75c2375b81a06dadcdb1c54a175855e30c3d9ca58ca873e43d703b1471526fb3dfe12e140b81df3afae6104e5ffa4e8585b456a7199c75c5abc7afeca743fce310df09062f20b9a99fac5d019338d98606805f4faad9cc81ebf03b7239a340c973828b676af4e594d796689f9823730c5ead8dba256925869ab0d7196a99b75a15f9927852d7813aa5a4cb76764749e882d59c094c5ebd1911153150e8d53aa8abbf360a4045b63e0e296d03158de8aa02b5aeb459dcdc6b9d5aa8c0e455e7cb6a5d9b26ee5420e41d89590a0c04ca8701a6a386716a32e04102f281f66317a21940c0cf83e128f4f83bdf6770170d74d43f3b1f4c0bb5e8c69254e0bfd15c6d02596bf3b547e5b9b8e84390455a9c4b00b633c661616aca4a4158868be21633f343155996eaff00c2c347fea03c6f06e7adcd83cf320e3a446d07dba202e5960632560da8a3b60efe5a814a5cb2a4ff0842fff23897b583b381e5030e506caef8dc97f290c0406a07d4d39bbef9532111e3eb3621870ec39fe2351d3814a02d2f9e38aac1f0897f32ddbffdc6e0acdea95ff7f67865daae1130f68f00985682ecefc43fb6f8521514923b5cf3560be0739aeb4eb00b389d39ebb9b974e054120fcd48c0d6bc09441c2c19f41bdfceed01a3b686921500fae88795f216794d21dd3a98f2fdb5a1590e0cbdc5cd9593b164e255131c21f22ed7e7ed4ec83db91f8bf5f327d7222be1e470a7c0d0a657c73ad606f2ef0c59d3c118c601d23d67ee16ce3658c9153b8131f06c1e4f83c49dbe6dbc3478b1313b9221bc4c5eadebfd16cd07afde509f2e926fcfd5f8feabe836f4080ea5e65c1e4d859f16ac45ad8c804eb9ecce363faf19c1409d8192a644823578ccfd5b643478eb948223676d375f811fffa874f7c2a281104a28baf4da2716ae870abb3e0f05e63466176356728a700fe39ebb62bdbff139fdbf21520022984dc6d3eed1d81b94f28a07cc238ccb64d65e87534c0111bb76212368c6e8e9a536e758fa2f16a2cab9d31984055488b27bcff12bcc5a0fe21a0e44edfb87c681060e6944ff89dce4a9c7122c53acc27913a5fbf15c9ada971df88f0df3f82eb563f63c640ad6e39a1f5c1aad83c364957ec6d645f4243d1fb4ecef275d4c0ca0284064cde0c282d793f290bab5a4dec15f3e2adcc9d455d2e28bd040d6e0f651ac6f20f55d1303d2aaef2104b393afc849e9cd7743ca20a6f092cbf42a67446892493128d38bb0d0f507ffe3fd718ec48eff58df729728bc01ee180d676dfa22c81da0e4e3fda94f4f94195bc82e1f941d8a290ca0d416373d420eba196470e4f25940506061c601f12b3656d6d6b3a47e50d5235b7fd0f82bb0835aee3470b69bf7e59616ece447d9af36c396f687214ff7d7e27961f461c780b4c563aeb47fa9f335cbdade8a06711ba79b6fe8778ac1bc06bb59131c17409c1d1d0cc746aec8c3b1348f9585945192d8e32002c676753ab246a92702fc8e3a3ce89b84661b1b10dcd73fddacd311ca663d483b87a59225f60627eecf409d6188236b198633d47c5f1c0ba0bb4321aac88a6061d5e97883914cd74284ab937b9579ccee6ab5bb39f6274a04e3e7a8c3d033e340357bc15c5f6daa047b1cee448ac380bbde4bf806b0891a04b9e408609b040b7d3a02d2a76d4013756d79244792c543fe2327a3c371852bed5ab54de987bc4699b32ad1c08f7fff7a23069e722f5d78742d622d4ccbc1a7bddc9a590b2c707bac3957d46b657a4e17f1914db58fb6436bdd58b86df491016a2b9ebe0c35a859b216f17f4828c8dee30a38ed1fc36347af978999d0c404313cf99c9281c45194abd79475a80ea1486840aad72b1c0c4f17fe35a150fcb574fa9fcc09a7fc5dcd34e15d4bf1bccfa8bf423d2437e2eb0d3ca9324fbfc7e256b862c50ebc8db3fb69f69003d37807af8ddccf2d929ad9d06ebbb7e538d93bb0b7bc828e1639e0b5e89c22badca307ad28183c3083e87c917feb4c882397d397ea2e7ff0e05ebb252940302cdc0f0f7efe40685f7c3e8923e3795d70d69c70d9a071e401cee771f29dcb5316471768464c4659f2c76d11713ab44f4c944a4819deb1248b02457403e9630aaf4a180e9e55bb4d291e9a2bc85a1ed17f906d54935c7e5e8b707ead56284fda0208bd88ab5c3259bd5329c0d26653eb07b6856ad799fd6fa8d2111da3970ff8509bc2ef3a8813d04f36001526b70757646ed4bf25a256751b8ec714f2e62dea19e82aacec389195532bf7f335afae4351adb93c846e22f1f2a3e0d620d81688bd5530e389f2284b3c997d4abab7c30aac1b141425cd9aa315dc5a5e8b04fd503d79896b1494d8be48048c7392fc92c325b76bde4496c49da34c9ff95969bec8f95c356239d5336907957383b12c512fff6d797097a26a5aee9251bae940ef1a19b3f746396300d3baeb476b023f740ed7c1da92fdbf1834c3a882a6079885b933333d0e194cc1f25a06c3a2d370936886cb385d9861d6762c7416a1db5275228b6499cdef9767fb998d43251b963bc4477b2c051b70a0317de5f6ec3158914145bd036ff194df9722d2a3d2ac2397891b573a34ad16236cdc7ca77bc15f0fdbc3cae923d61633a42bab450a80cf3ee6580e792b1617d74fa189d450a64ca12d8c797698208ea61010b6072885b762af598159621f838ebacc00ea11f5924b39b2bbbc5c7d667871ce32e9aa75893a9fa13a2ffe66b360e266446259a8745addb4e186139d86d4e8d48537ac35029b0d87c03e8c1a9b9a422594496feda8bc5502777428fe737198ed896c2128a4f7d552f2eea8fef6e68feaf3cbfd549e622eea7bc988bb16fc49b7ab241426f2e40edcca07d4f947ccb1d3b8c2e9cb14a0c04495dbb75bd9c935f36bfe398455b0e5f927d5726e617c69ca81fe36c3e6ea510c5fe4735161c992f9ebf66727e5a7ded590061d4da3b86b996846a6bb102e47d33465d88a68644c8a76a770d5e0318e6c301e7c7f5575bf15a9589b32cfaa41ee15972488497195a2cb49a6b6f937a8e311e34d311dfd4fe222d3abc095b0b24a1b7193eb3353def0cc1511c8fce9b0a7867ae2fed4db93009646dc91a3745387cbe61b37f749b40d5d38970856b7ab8b6e1e0b81c078c68cb55c57854b8b5863b7a4c87f42e6d6dca2de0326b1b26970168c99f59816877448e7f72626f5354fdb5e033cd6b42e9476665efae66287e656590d1f80b3a09557a57d7de4bade6a122d40a92db1d347463b74151d44a02dbe067259c633b8c84425e77a736fca99f06d0fd66e35365511ec017537f4c212e7f2e23369958c3a7b92feffad9edb12139f1f690f9512725c0a1a164e78b4130c91fd3961df91c1a11783c24b03bcf305fd0e14e6510f4d58cf73326e94f2bc1b1ab295297bee7a98b77afe483a7d66e780d5e111b4202285f580ce571ecc0985501faa0e9f2f5b9848d770d8d8ad7b90a951f83279073e45a0c7abcf89cd6200f7fc320e46ea3de2addee3a984432501063f9928d0897d93dde20fe8ebe4dabc1ac34b0efdb3d7c7b4d49571ea64252d7209ff6d0ae5b95ef35d8160c5976f7ed9c4b69db81a73f6d00fd254c417696d6af694f3688826cc04db8019f2419fa99e47dc436fd76890b5291cd2724717a1e604e6cb5e214235664e8c7148c2bd87996c05bcfe1f29200f40a0d766df3ddc6faef82fb34d385f90b8f0e4bb7ba519e7986735c169cb3546d62fb70fbd49eec4edd70397d2fcbfdb9cd87331fce3c9786b7090501b904c8f925a1dbfa151a18e6c145ebb74da7100de60a627100d6c04ce789a7d4e88692cb090fd9ff2006e5ddb870f5b2aa502081eb7a26744de9a0d29a66ef18eb097e1d396561078e3f9258046a3a3e9b5878964d71b526755084f385d9777b2ab503f9d77c09a46004b5005f69eedee80edd87dd17f2292eba00f71dedb010b7b003a8400f6b44d63559a10bc0052c678ac8ed9658aff4f858778ebb60cbaf53d82248a260c7255f943711e8ac31a4b7a4694dcdace3be25ea43bdc9dfd52d369292d8d7581a6979d1b8ad543baeb9296907e0926025f4c3597e98e2eacd048a5dedd0e9dabc3268ed35a91c6180908af07a95bf374573c7b4f611eb30bbb5f1721a6550f483dcaed51d84fdaa5c6a52d7c4d04ca4edfd2884483c2d5aaebf6f06c6fff8bff813923ac8c6edd0eadefab938442ff09b1b3ff926c963d67a01cccbd86cb69bb5e5a4adca82110f87d3ee7800b14412b48cd94feacbaa9c1921e816d0287ad1198b94fd6de314912b79938a0d00ef5968ca4cb506afa1496ce4886c8c44955a92c9d2395f108a357e240511cc7e6548ac4174e5b52cc1f03ea8fa8268a7283e9cd25518cc71114869537891b64337222f04c111407bc2c8777f1132e1b294ec533610fd1ae3b4aa7e20c315d87aeed3a19151677e04173fbd55e88669f515dea19c8b99f8d7e829734f615a9b95e278fec62cf2d1a37d535ef71996530c62e65bb6fde625447e9122cfd947d7032c7580bfa5286bdde0bd9c4f0c63cbceddc302e1daef7f27bf289f72456802560e4477b27520b45f3a39e787824f169b3fa0ec7fba1c37f4499d43a9cdca7595f3e9ab74223c34819b260130d8a7613653101cc9a6e236ac01965356c90814c632ed421a62654a457ccc66040026451610b94898d13292cf2096fc1744b8fe67cebbcee0a3830be987694e593d732f05e3c6503a71173dc9870c3eca017318b628dd651232ea1c424a98b394188c8b8dbf30d69f1976219fd5b1975f8deebabeca970581f011f428c164bb35e0d6be187a5a2887d6bb0889c41c5c24d0b173f05db5d3a9e50318b448b3c8c53e8afceede4caf8850d585d4134559a6abbee463da46f316c3faeffa30fec0b35fff3f320b99e805fa2d3d179fe0d9a40e8b5a3df3d5fea5e743163c8a21eb10b84046c95b735e5c727336666c9922041490702d1e17c8ba24c84aba669c74882519e99ef2bd815f23b411aacfad9c8ed3614dcb29d37c5f02edd5ba342777a7e36e95b4c7c26", @ANYBLOB="bf7fe9cb93052564a58cf162e5bc836b4b2e6fd14348400b6ba1aff2642cb042c2f4e1bd71004cd1ffd53879e7d4ecf762003918ea4a707be1489ee814082acc6a81be456c9cb5f463b559db0b96a119bc88bf26419dbc5d57a836b44d5673147e6c3908590789954cd23c9a7296b61f318882896c97e26e0fd4d80a6fc09dad2f974a331a79dda3a2f72c4422", @ANYRESOCT, @ANYRES16=r0], 0xd, 0x0, &(0x7f0000000000)) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x20020c0, 0x0, 0x1, 0x0, &(0x7f0000001a00)) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc2}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000800)=ANY=[@ANYBLOB="000829bd7000fedbdf25660000000400b80008002201400000000800a00000000000080026006c09000008009f000700000005001801040000000800270001000000050018010b000000"], 0x50}, 0x1, 0x0, 0x0, 0x4000c801}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x4, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x103000, 0x0) syz_clone(0x40011, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0x201, &(0x7f0000000080)={0x0, 0xc9f, 0x10, 0x23, 0x3}, &(0x7f0000000200), &(0x7f0000000140), &(0x7f0000000180)) io_uring_enter(r3, 0x1, 0x8000020, 0x1, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, 0x0, 0x1) socket$packet(0x11, 0x2, 0x300) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) 3m35.287583954s ago: executing program 4 (id=26): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x24, 0x0, &(0x7f0000000340)) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000901, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xc, &(0x7f0000000300)=0x1000, 0x4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000440)=@req3={0x101, 0xf, 0x7, 0x5, 0x7ffe, 0x0, 0x3}, 0x1c) pselect6(0x40, &(0x7f0000000480)={0x972, 0xc, 0x3, 0x113, 0x1ff, 0x0, 0x2, 0xd4}, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) socket$nl_generic(0x10, 0x3, 0x10) fsetxattr$system_posix_acl(r4, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="02000000010000000000000002000600", @ANYRES32=0x0, @ANYBLOB="040005000000000008000200", @ANYRES32=0x0, @ANYBLOB="08000400", @ANYRES32=0x0, @ANYBLOB="0888ba006b54d24d58a43cf316a3824c2316c077975433fc8423478f459bf791a2144a45a97ce1b577dbf831790ec236959d042f1a8793840c8837000000000000000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="08000600", @ANYRES32=0x0, @ANYBLOB="10000700000000002000020000000000"], 0x54, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000080000000c00000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x2000000000000128, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018110000", @ANYRES8, @ANYBLOB="0000000000000000b7080004000000000000f8ff00000000bf6b465988f8b2f8523e59a20000000000000702000083ffff1eb703000008000000b70400000000000085000000030000009500000000000000", @ANYBLOB="84d7f32faa46465f2d416bbb6e6af5c311c176d7a26d423bc909294090bc63364a5c6c4411", @ANYRESDEC], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x75, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000080)={@multicast2, @loopback, @remote}, 0xc) 3m35.140421418s ago: executing program 4 (id=28): bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_read_part_table(0x5c6, &(0x7f0000001180)="$eJzs2z9ok2kcB/BfojlB4VycnNTB4XBRHM2gkkRFIUS7HA4KioiZIhxELiDooBksl6F07FIKWfpnapqhw9HSQudSOvQodOhyR7sUujRH6XMcxw39S0H4fODlx/O83+f58Rve8Q2+a9n4q9frZSKid+7wp/vaheLDK+W7lWcRmXgeEVd//3F8900mJf659Vpar6T18ND57tfNB7n28tOt6y9mmtnsv7d+jIgLI52+403GaRjNz1789LlW+lbPv10qNda+LC48GdsoVDqPm63xR7n7r1JuLtWzqb6PenyId/EyqlGN11E7of6D7dWbO5dL7ck3d7aL3f7pWylXPuacB+3/y9Xffm417t2YuDRwuz41X1k/s5erHuHrAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg9I3mZy9++lwrfavn3y6VGmtfFheejG0UKp3Hzdb4o9z9Vyk3l+rZVN9HPT7Eu3gZ1ajG66gdrN0P+/UfbK/e3Llcak++ubNd7PZP30q58n9OnTvyvPv1352v1bh3Y+LSwO361Hxl/cxernpyLQEAAAAAAAAAAAAAAAAAAOB/CsWHV8p3K88iMvE8In7689fs7n4v/e+eSblrqa6k/eGh892vmw9y7eWnW9dfzDT/SPsf03NhpNN36sNwaH8HAAD//xiLk4s=") r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20940, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x37, 0x0, 0x0, 0x2}, 0x28) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xc, @private1, 0x14}, 0xfffffffffffffecb, 0x0, 0x0, 0x0, 0x56}, 0x20000800) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000700)='./file0\x00', 0x10, &(0x7f0000000080)={[{@user_xattr}, {@noinit_itable}, {@minixdf}]}, 0xfe, 0x450, &(0x7f0000000140)="$eJzs3MtvG0UYAPBvnTh9URJKofQFgYKoeCRN+qAHLkUg9QASEhyKOJk0rUrdBjVBolUFhUM5okrcEUck/gIulAsCTkhc4Y6QIpQLhZPR2rupcWwnTpy4xL+ftPWMd9yZb3cnHs94HUDfGo2I/RFxX0T8GhHDEZE0FhitPdxZuD7198L1qSQqlTf+TKrl/lq4PpUXzV+3o5apDLSp9+bbEaVyefpKlh+fu/Te+OzVa89fuFQ6P31++vLkyZPHjh4cOjF5vCtx7kzbuu/DmQN7T79167WpM7fe+fHrJIs7GuLoltHqUWvuqW5X1mM769LJYA8bQkfSPpqermK1/w/HQGxb3Dccr3zS08YB66pSKVS2tN59owJsYuloHuhH+Rt9+vk33zZo6HFPmD8Vi/MYd7KttmcwClmZ4jrWPxoRZ27880W6xTrNQwAA1Lt9KiKeazb+K8TDdeXuz9aGRiLigYjYFREPRsTuiHgoolp2T0Q80mH9jSskS8c/leFVBbZC6fjvxWxt67/jv3z0FyMDWW5nNf5icu5CefpIdkwOR3FLmp9oU8d3L//yWat99eO/dEvrz8eCWTv+GGyYoDtbKpbWEnO9+Y/Tf083iT+JfBknHR/vjYh9Hf7fe7LHC898daBVmeXjb6ML60yVLyOerp3/G9EQfy5puT458cKJyePjW6M8fWQ8vyqW+unnm6+3qn9N8XfB/O1KbG96/S/GP5JsjZi9eu1idb12tvM6bv72acvPNKu7/udKQ8mb1fRQ9twHpbm5KxMRQ8mrS5+fvPvaPJ+XT6//w4ea9/9dcfdI7I+I9CI+GBGPRsRjWdsfj4gnIuJQm/h/eOnJdzuPv82sfBel8Z9d7vxH/fnvPDFw8ftvOo8/l57/Y9XU4eyZ9PwvF9dKG7iWYwcAAAD/F4Xqd+CTwthiulAYG6t9h393bC+UZ2bnnj038/7ls7Xvyo9EsZDPdA3XzYdOZHPDeX6yIX80mzf+fGBbNT82NVPudD4R6K4dLfp/6vd2N/AAm4P7taB/6f/Qv/R/6F/6P/Qv/R/6V7P+/1EP2gFsvGXe/7dtVDuAjWf8D/1L/4f+pf9DX2p5b3xhTbf8S/Qo8e3Q2n6rYeWJKNwjIW+aRDGa7hpc8Y9ZrDKxpemuXv9lAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I5/AwAA//84IOG2") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6erspan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000840)={'syztnl0\x00', r4, 0x80, 0x7800, 0xa, 0x1b7, {{0xc, 0x4, 0x2, 0x17, 0x30, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x1b, 0x3, [{0xd9d3886ed9901b3c, 0x3, "8e"}, {0x2, 0x8, "074b1332a69a"}, {0x5, 0x5, "fea7d9"}, {0x7, 0x5, "e36fd7"}]}]}}}}}) r5 = syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a1a400010102030109022800010100c0320904000001020900000524001001052406000105240100000705810310"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0xb0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, &(0x7f00000001c0)='-\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x16) syz_usb_ep_write(r5, 0x81, 0x8, &(0x7f0000000100)="a101000000000000") r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000780)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001900010026bd7000fcdbdf251d01000015001300000000c0010100003e0da54693c9866904000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20004010) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ppoll(&(0x7f0000000180)=[{r7}, {r7, 0x4408}], 0x2, 0x0, 0x0, 0x0) ioctl(r7, 0xc138fd01, &(0x7f0000000000)="0400000000000000000000003801") 3m34.903652094s ago: executing program 32 (id=28): bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_read_part_table(0x5c6, &(0x7f0000001180)="$eJzs2z9ok2kcB/BfojlB4VycnNTB4XBRHM2gkkRFIUS7HA4KioiZIhxELiDooBksl6F07FIKWfpnapqhw9HSQudSOvQodOhyR7sUujRH6XMcxw39S0H4fODlx/O83+f58Rve8Q2+a9n4q9frZSKid+7wp/vaheLDK+W7lWcRmXgeEVd//3F8900mJf659Vpar6T18ND57tfNB7n28tOt6y9mmtnsv7d+jIgLI52+403GaRjNz1789LlW+lbPv10qNda+LC48GdsoVDqPm63xR7n7r1JuLtWzqb6PenyId/EyqlGN11E7of6D7dWbO5dL7ck3d7aL3f7pWylXPuacB+3/y9Xffm417t2YuDRwuz41X1k/s5erHuHrAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg9I3mZy9++lwrfavn3y6VGmtfFheejG0UKp3Hzdb4o9z9Vyk3l+rZVN9HPT7Eu3gZ1ajG66gdrN0P+/UfbK/e3Llcak++ubNd7PZP30q58n9OnTvyvPv1352v1bh3Y+LSwO361Hxl/cxernpyLQEAAAAAAAAAAAAAAAAAAOB/CsWHV8p3K88iMvE8In7689fs7n4v/e+eSblrqa6k/eGh892vmw9y7eWnW9dfzDT/SPsf03NhpNN36sNwaH8HAAD//xiLk4s=") r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20940, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x37, 0x0, 0x0, 0x2}, 0x28) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xc, @private1, 0x14}, 0xfffffffffffffecb, 0x0, 0x0, 0x0, 0x56}, 0x20000800) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000700)='./file0\x00', 0x10, &(0x7f0000000080)={[{@user_xattr}, {@noinit_itable}, {@minixdf}]}, 0xfe, 0x450, &(0x7f0000000140)="$eJzs3MtvG0UYAPBvnTh9URJKofQFgYKoeCRN+qAHLkUg9QASEhyKOJk0rUrdBjVBolUFhUM5okrcEUck/gIulAsCTkhc4Y6QIpQLhZPR2rupcWwnTpy4xL+ftPWMd9yZb3cnHs94HUDfGo2I/RFxX0T8GhHDEZE0FhitPdxZuD7198L1qSQqlTf+TKrl/lq4PpUXzV+3o5apDLSp9+bbEaVyefpKlh+fu/Te+OzVa89fuFQ6P31++vLkyZPHjh4cOjF5vCtx7kzbuu/DmQN7T79167WpM7fe+fHrJIs7GuLoltHqUWvuqW5X1mM769LJYA8bQkfSPpqermK1/w/HQGxb3Dccr3zS08YB66pSKVS2tN59owJsYuloHuhH+Rt9+vk33zZo6HFPmD8Vi/MYd7KttmcwClmZ4jrWPxoRZ27880W6xTrNQwAA1Lt9KiKeazb+K8TDdeXuz9aGRiLigYjYFREPRsTuiHgoolp2T0Q80mH9jSskS8c/leFVBbZC6fjvxWxt67/jv3z0FyMDWW5nNf5icu5CefpIdkwOR3FLmp9oU8d3L//yWat99eO/dEvrz8eCWTv+GGyYoDtbKpbWEnO9+Y/Tf083iT+JfBknHR/vjYh9Hf7fe7LHC898daBVmeXjb6ML60yVLyOerp3/G9EQfy5puT458cKJyePjW6M8fWQ8vyqW+unnm6+3qn9N8XfB/O1KbG96/S/GP5JsjZi9eu1idb12tvM6bv72acvPNKu7/udKQ8mb1fRQ9twHpbm5KxMRQ8mrS5+fvPvaPJ+XT6//w4ea9/9dcfdI7I+I9CI+GBGPRsRjWdsfj4gnIuJQm/h/eOnJdzuPv82sfBel8Z9d7vxH/fnvPDFw8ftvOo8/l57/Y9XU4eyZ9PwvF9dKG7iWYwcAAAD/F4Xqd+CTwthiulAYG6t9h393bC+UZ2bnnj038/7ls7Xvyo9EsZDPdA3XzYdOZHPDeX6yIX80mzf+fGBbNT82NVPudD4R6K4dLfp/6vd2N/AAm4P7taB/6f/Qv/R/6F/6P/Qv/R/6V7P+/1EP2gFsvGXe/7dtVDuAjWf8D/1L/4f+pf9DX2p5b3xhTbf8S/Qo8e3Q2n6rYeWJKNwjIW+aRDGa7hpc8Y9ZrDKxpemuXv9lAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I5/AwAA//84IOG2") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6erspan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000840)={'syztnl0\x00', r4, 0x80, 0x7800, 0xa, 0x1b7, {{0xc, 0x4, 0x2, 0x17, 0x30, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x1b, 0x3, [{0xd9d3886ed9901b3c, 0x3, "8e"}, {0x2, 0x8, "074b1332a69a"}, {0x5, 0x5, "fea7d9"}, {0x7, 0x5, "e36fd7"}]}]}}}}}) r5 = syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a1a400010102030109022800010100c0320904000001020900000524001001052406000105240100000705810310"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0xb0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, &(0x7f00000001c0)='-\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x16) syz_usb_ep_write(r5, 0x81, 0x8, &(0x7f0000000100)="a101000000000000") r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000780)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001900010026bd7000fcdbdf251d01000015001300000000c0010100003e0da54693c9866904000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20004010) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ppoll(&(0x7f0000000180)=[{r7}, {r7, 0x4408}], 0x2, 0x0, 0x0, 0x0) ioctl(r7, 0xc138fd01, &(0x7f0000000000)="0400000000000000000000003801") 2m50.567835457s ago: executing program 5 (id=164): syz_open_dev$tty20(0xc, 0x4, 0x1) r0 = socket$inet_udp(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000000c000/0x4000)=nil, 0x4000, &(0x7f0000000040)='865') madvise(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x64) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKZEROOUT(r4, 0x127b, &(0x7f00000000c0)={0x1000000000, 0x1000}) getrlimit(0xf, &(0x7f0000000180)) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/rndis.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/functions/rndis.usb0/dev_addr\x00', 0x1, 0x0) 2m48.802098631s ago: executing program 5 (id=172): openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) pipe(&(0x7f00000002c0)) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000080)=0x21e6, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xe, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, 0x0, 0x40000) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) quotactl_fd$Q_SYNC(r3, 0xffffffff80000100, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r5, &(0x7f0000000380)={'syz0\x00', {0xfffd, 0x6, 0x0, 0xf000}, 0x4, [0x6, 0x4, 0x7fff, 0xe00, 0x8d94, 0x3, 0x5, 0x8, 0xe, 0xffff, 0x6, 0x10001, 0xfffffffa, 0x277c, 0x4, 0x7, 0x7c, 0x8, 0x1, 0x1, 0xf2, 0x7, 0xce3, 0x4, 0x3, 0x838, 0xfffffffe, 0x101, 0x1, 0x0, 0x5, 0x5, 0x9, 0x3, 0xd4a2, 0xffffffff, 0x10000, 0x8, 0x5, 0x4, 0x4, 0x5, 0x6, 0x2, 0x200081, 0x5, 0x1, 0x80000002, 0x40, 0x7, 0x4, 0x8, 0x3bb, 0x2, 0x6, 0xab, 0x7f, 0xffc8, 0x4, 0x6, 0x3ff, 0x3ffffff, 0x3, 0xd2cf], [0x7fffffff, 0x10001, 0x6, 0x9, 0x8, 0x0, 0x4d, 0x8000, 0x0, 0x4e16d7d1, 0xfffffffb, 0x3, 0x8, 0x6fc, 0x2, 0x4, 0x7fffffff, 0x4efa, 0x6, 0x4, 0x6, 0x10, 0x1fe, 0x2, 0x7, 0x200, 0x9, 0x9, 0x3, 0x3, 0x10000, 0x100, 0x5, 0x8001, 0x100, 0x5, 0x3, 0x5, 0x9, 0x0, 0x2, 0x3, 0x0, 0x4, 0x6, 0x40a, 0x5, 0x800, 0x2, 0x770, 0x9, 0x1ff800, 0x6b8000, 0x5028, 0x5, 0x6, 0x9, 0x8, 0x7, 0xff, 0x3, 0xf30, 0x8, 0xfffffff7], [0x41, 0x5, 0x1c00, 0x1c000, 0x4, 0x6, 0x1, 0x98d, 0x4, 0x2, 0x6, 0x3ff, 0x0, 0x1, 0x8, 0x4, 0x800, 0x9, 0x8000, 0x800, 0x3, 0x1000, 0x9, 0x9, 0x98b, 0x9, 0x0, 0x2, 0x8000, 0x2, 0x9, 0x6, 0x0, 0x6, 0x9, 0x8, 0x8000, 0x3, 0x3, 0x100, 0x5, 0x80000000, 0x8, 0x4, 0xa, 0x4, 0x6, 0x280000, 0x10, 0x5, 0x0, 0x4, 0xa, 0x7, 0x2, 0x0, 0x7fffffff, 0x1000, 0x6, 0x2, 0x4b9, 0x8, 0x10001], [0x5, 0x6, 0x5, 0x200, 0x3ff, 0x3, 0x0, 0x0, 0x4, 0xf0, 0x2e6, 0x0, 0x7b4285dc, 0x8, 0x1e0000, 0x3e4, 0xffffff3d, 0x3, 0x8, 0x2, 0x9, 0xb, 0x400, 0xffffffff, 0x200, 0x2, 0x7, 0xd, 0x9, 0x1, 0x7, 0x7, 0x7ff, 0x4, 0x1, 0xff, 0x8, 0xb0, 0x9, 0xed7, 0x8a34, 0x562, 0x3ee, 0x40, 0x10000000, 0x9, 0x6, 0x7, 0x3, 0x6, 0x3, 0x3fc, 0x6, 0x8, 0x6, 0x10001, 0x0, 0x9, 0x8, 0x9, 0xa, 0x101, 0x5, 0x7]}, 0x45c) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r5, 0x5501) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b70000000000009500"/32], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x47}, 0x48) fstat(r4, &(0x7f0000000140)) socket$inet_udp(0x2, 0x2, 0x0) 2m47.887546404s ago: executing program 5 (id=179): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x189802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)=0xfffffffd) ioctl$PPPIOCSNPMODE(r3, 0x4008744b, &(0x7f0000000080)={0x281, 0x3}) sendto$packet(r0, 0x0, 0x0, 0x8000, &(0x7f00000002c0)={0x11, 0x800, r2, 0x1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r2, @ANYRESHEX=r1, @ANYBLOB="de617382b84f8289f9068ddd96d858b4008842712f02e6256050e02d0a979420a62e47b2863da367025e83c9d97a392a5a968f698a3e01342f4ff52fb915c9a2161f766dd6c2b3e5cbeb0a2382fb404298bf12e259075bdb917b44a486ac27d614dc347a1ff3dcf090c8f95467bf6e114ee2f9ddbfb02c8067a159bf58196afe030c95700c80dd70ff47a5f47ea6d31e1e81038a501732008aad7aadada78e9eeebe2249a8c2cdef645c129421869d0b91c977acff684426bc0d68b325da285f932eb0262d9f4d9f440e4ddc09003393954cd6f7a2df3c07c9e031868aaf663c2387ed234bef9636620db6980765f28597163a2e", @ANYRESDEC=0x0, @ANYRESDEC=r1, @ANYRES32=r0, @ANYRESHEX=0x0], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x2000008, &(0x7f0000001440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x400) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file2\x00', &(0x7f0000000140), 0x2000) openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x5b22ac08184d970c, 0x126) 2m47.24484114s ago: executing program 5 (id=181): r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mountstats\x00') writev(r0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r1 = syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x2010090, &(0x7f0000001700)=ANY=[], 0x3, 0x2b5, &(0x7f0000000380)="$eJzs3c9qY1UYAPDvpkkaLZIsXIngXczCjWUyWxdmkApiV0oW/gEdnBkYmjDQQGBUDF35BC5c+B7uXLlR3PgGgg/gziKFIze5TWKbpk1rWun8fpsezvm+nO/k3PYuLvf0s1f7ew+fDh4ffPV7NBpZVDrRicMsWlGJY6kUAMCtcJhS/Hmp+3u1sq6aAID1mrv/184I2Tzd9da6ywIA1uiDDz967/7u7s77ed6I6H8z7GYx+TkZv/84nkQvHsXdaMbR7FlASpP2O+/u7kQ1L7TiTn807BaZ/U9/nX9sUOS3oxmtxfntfGIufzTs1uLFiCyLeNIpCrkXzXj5VH4xvnNvQX506/F6o1xkMf92NOO3z+Np9OLh+JnGbP6v23n+dvr2ry8/LoKL/Gw07G6O42bSxnXvDQAAAAAAAAAAAAAAAAAAAAAAt9d2PtWKO/2iqzx/Z+NoPL79r/Hx+TqV8fgkP4uojxsnzgcapfj++Hydu3mep2wSPzvfpxqvVKN6YwsHAAAAAAAAAAAAAAAAAACA/5HBsy/2HvR6j/b/k0b5kv/0tf7Lfk5nrue1WB68udJcsVGGF7WejGn//El/2lMsYvXiD18a1vKIZTXXTvW8UNRz/hR/p5RSlkVcbZtqF5nrnMbW8pjiC/7xu6039h5k532HjeON+2F+qB77g2cn9jSyovHTLxfb7rTS5VdfElMvr5gLfc7WFX+J3vxjMlnZk62wilrZiLMuv8ZK1/M1/QECAAAAAAAAAAAAAAAAAACmZi/9Lhg8WJpaWVtRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDNZv//f4XGqExeHJNSGk176rE/uOElAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Bz4JwAA///l5m1V") r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f00000000c0)="17000000010001000003be8c5ee17688a2002b08030300ecff3f0200000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba000840024f0298e9e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0x11a) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000040)={'veth0_to_bond\x00', @link_local}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000016c0)={r3, &(0x7f0000000640)="b0c5890276fc256ab7c3e6bd206481dfe9688de298048f6ca22d6ec7895017696e9bcd4ecc0a3e1f6463e2a4175115fce34a8abc7cacbafe166525a9135c9fd693aa7b75b42969586dfe91e00e81de5b918ebd7e7910d5ea6cad10ffcb6638a7682f971307a1e799a52047edab5cc15392c0df39a2e3ec6264528f5979a97af359a51aa649ccff0d06090370c66b8fae3b0506f1d52448f7ba68c1291fa9a6e1e3a14f19c1721033e986b8e052fa2c64b24a094aa532dc592df4fc8197d9468e54199ce8274f4d77673d78ad128a7b433c8204c23be806a145efa2be2462d8c114a4bb15ce34abc730aa6b6dcc71accd78e7c509461e5ba5aef801ced45253337b68a3b9a8b77ef547903b64591a43a4aeb053cecb658e48ad17150229940e7cdcec0286ad627edab9e7701821ae9ccc57e0b0b0302da079ce4f41f2578ec2b5c1e6f3972de6c282e85b29366879ba596f0feca43447a6a645c00eff24954abc0108c6be3b6fa1756ff447c0c0b8c2f8b6eddda3179f6d017361fce5738494e7193dd42a428e790c3608d13c4b49cb2563b36fe25c2efe2d9b4ffa1a2aa68df576fbe9e27e0c900ee6b9d24c7ec21d2d1a8c87488255ac21923adedcb3359125151e9076f45ecd08bf7c85fc20b1c3227ee7d56980fc1bd989c5dc78f210769266568fd54f82a6077884c522ee06f2d1ef12e2a173fadc9347755fd2ab25388699254be2fb88e76f00bac9af53d602862eda7526038d7e2c5c5ae723cc38889f82e83640dea07122ecb19f903f72ee2523d0fa9286efa1a932f4df48411de42e664ee871c9cb3af8c993bc84d4b2486afde16bee70906faa34c9b7f601fb5c6b1ff91263a15ab25d692b7d2f64a67534248eea5ec2cadb44a3ddbcd111d8213194833ca9ad55bfd1655506133689807831a4fa51d6fc8c8f725bb1e498ea205ed0de29240bc6876b2b2d2f089b09011f83337a62f353f7fcbcf6b89eb2b669865cb19f8ee969ee5242d9278939748824e6f557325ae0c0315b4fd6fea69ba51cc8988d1e357f0921e38c35a2e482beb2986c4764f9987a61703aade5cb94e7d6733e2ca414842dc61aff56b2ccd88aebd1a270f114d7e21564fc3c60899a65569fcac39d755104e569d507f9ae477cc42287aa7128e542b7118f70c4f3173403cadee5c9c732b7d1539d62abbaeeea5c162b582f902570e9f0ca6190d728e5c3d2a09a14a5ee85b73a6f2d101145a00b1b73c7ddc930a25f757f2da7c373235220271598c141a4952b14f6dd7fada4791144336cd64dcf8e21a6485ea2f93e425f253c2737997e74ea9b91195e53448f6ebc835e6cb16ccc2c3a2c549ee6c602274af1b5d294c966f104b7795675af1f743a54b72d566b61b43ebf9a0ece5ca261ba209ac1d3edf7392c8b224872c108d0377aea4d34aca571dea66049727735ad814fc57189a7601a42862ba7e8c20162fa87aef9c0a5c000f8dc09e75efda0096219644fe1e0a191e9f95d114cbde33d75344399912b8eab454efa0a25dae21ab15cfaf4cfedbb3bd7b15ecae5e92416ac7f59c3a4c5fe47b36f0dd1f2748482610e53b7779470a4ba7ab567d9ae149e47c69ea2231be2122293f94899e422f452b3a67e3a528f11140f6d1ab29946221bb99b8862ead78a0a5d38fa63db0ac8f9b5fd3710469821dd2b1d10ea633c24ca13acb7a744b33da2929315bbbe6389811f25b81e0fd6f8aa6990fb131aeb9112a8b480aed86d44add5c85178a643a2b0e3020ced27d0b7ba52f6238f478e475b0bf6974e635f52eb11230c68d091e7f95c86b0d59fd8d2a0e6426a4a91fb6927e3421968866457d3e138e2106e1fb302887018e812e8992781167e7082e3956195734510133bf168e89ff8b669857ccb946ac2a3b30e1ae1e8337dc8d7724f621655926e305df5e9bc7df3b1bb5c62425193ddf06adffe9d653ce65bde4627f252222b998cf86de01a0450cd304ede61e53cefa70984b8191c4141c45e07aa9ec4db8cc1f2641f81d802854eb6632407e481cd3f343e74ecb61726e5c0f23620294522a8fa3763836d0245f6ae35dcbedfb89b3d5f7e226bb2a3d8b5c6dad6505ee9555b7e855526512d041f663a12a6aa6af5244303813b8a5575f5f1b788d61db950dc7b4977ff18f5ef62d2a6b38482439016c24dfbe4046f7651f83f4e6a57c8381ca2cc12fef58528304db9455addb6d6e3cf77680e4c37ad9230e25908b9b6c78349c62658c28fe4da13e39eb5fc564632074c687c8a3011babf39bdf6b5e19e6f4824ecc14131a5f4fd85f49e2887df39cf4ba07b156365b5b31e57eaf04a5483b06bd7dba64c9ae3fce7a84057a2040b3b1ee1673d2c510db16dc312a47ece1a35b4ca061426661ca779b90698b8aa797c2e3bd1e0a2e76f72cc0fa461a725923e7bf1e4fa880a9b6a42534474e0bdb6199ef1de39d5dcf30a4c7da35d81dcb72071a1b665fb3dbdd8ba2c89f6dd24a8eb8f9964946cdf9d658855cc4132cddffccd0edf7385b851ffb9b13ed455ca97749c26a21c29df529ef671c6313aebd4c900ef8e781a2b34b481c06e8f10e747f29a767c8ff099421bdecbee0f5d64ae5014253ed69eaf54d6d3933c0ac6a3ef540081794ee51f2b685b3fa9ac93a4a9925a38799f9799e24ca632197c66b63d471ac5d303ac7c37f067add8e142f0669e261e81b4f874d4d46620df5a0932676b4a9259f125bd1dc791493db39cb217472c87c90636e3ba932d39577c672281295096b23991ee3e8ff6dccf5c2b27dad67217f74ed354a3ccd50e61383e9790723d195620e0e3e8e19135a6679f7a4aae867f0be289a20c42e9ad62e04c28e53bd88bbdf7a7c09bc48259f165839e160d0b11726719ba95008a90394d0f72021e70b9c4f69a6a784336dada84f6fdc4ced81f94a5611f8e887bb5507fcd784a53ec6ca23150d0f10e8bd21f57e56c65cd47c1c8a9930fff7d2e8575590582a7b2d24faf934c93a10b5eaab0f65ba21e38cb00996e3e48f1d21cdfc2ec3daa67f78e3e3de915e891229a108ae2b482580a5a19ba582cdccaf036c18a8eb826c0de06356bb8628aa4b62e6eda96218d7c2e91a355e9d6ffd10165474593facfb964b0a912fa18f0a2f35023ef391ad66aa51511d7e4de86ecc3839504573c65f62676ee2d5bb48907c123bfffab8cc148fb4a18bfa3bbc4dfd089d28d486babb66990edbc383397537a06fb52e1ae665e9a05de9fe35ec368157d89f2aa0ffc1b4448dcf1144f892d62102ff1e073a2b07d0f55b44c0135d5bb977a4ebb41ad1663bfb7586981552ada051f12d15c8498bbf4a2d19e6f0ea8ac3b15c9fd7b8e57f566ac553489317587d2fac7a826e57e74c0b1c3354c9e935bbd9d7e05c0f217bb5e6e1dc24e90e6e743e310fdd7117468e71cb657144a9d13e309a09bc9fc75f381d6a9abf16ef8a8bb25d1e8f26677d403450c0968b66077496a79a13a10e17caf0bf13b0801682c400ff3d837a462149c2948a994fb3d4926699f55f0581d856ae9148460157653715b764748a2031c44f7a225cf885e6ee2031a08def42c928ea309e461d88b7119c6862afb83f2e3f05af4f31bee2a80b35e78b903308fae30b81830d29c525ff14de51dd1ead28e5c402bc569f255027071672f780414ee9666769530e91766f13ee1ee358c5b9de2cb99e20c8e97138868ff5efa42bf7146b29a795f0ad22b052d7a4c9b919b6206d8146fef1f31ff170c48d61a2803ef2e84a85da0c5e1c9359821740285c1f0dbf3147fe2dc18629d9362dd76226560d4894e0727065929e5036086072ec9bdb44a803dbaf0ec262e317ed66a99184924b3d9589c0ac1bf22f960d5435848ad7d487a2f83f9d3840b03fc30839f9bf152d9135e92261dd75ab04c54d84963789e254140602a06ad15fcea2f6d08810a52afb004b0733f8cddbc993b965b22be35e38cdfe432daf1b85e5a80fab5e8a28c02550de3bde17aa4a397928f6ed5a5bf089cf7b7bf60d6f4f6a52183c710497c899bdf4e71b379c2701df4f0c0ff5f065609315910b9a0387e864d99ecf5ec8b9f03cd7a5f089e0edb4aaec559ddc54fe695f93cc72050b4f7d78a48b7d6e43ef8ed63f81c81412e08edbb79cba61244e2d1a993758079438453632119e880a7345c95d40cb71e81af65bf610edd5a03a628bd15d0b2953eae00db145e23306a097e0a6e3078bf20f5d9a5bbe90ed8fbe8e826f62f657f5da0ff21c85b14a71b9a0bc8c06ae117671c01d442f707820d093128a9303900e0fa4b15504e3ce44e48d033af59d3c2d2e7e4dc95e4dd84505eb819ba11eb88f7565dd34c77d7d1c9271e94e14c5e1a00ac3792245cc984ccd4ace908200607e444f988ebadf3408fd48cfd0c2d12d2316b3eedc486e455401fae6b68ace0957cdc79fbe81d538e02103b6a0ae581d367bea882d08ccfe6477f921ebba4e0bcfc87944dde55070d7e671767968f26119e9a15a8751b4532246abd57564e1ff2b2963865bf8eb93d78ba770193aadb71b7257389f07db6ca4c401668246c1f4086810e5f01217f240c9e1f87c8e8fcb8c2b9fb9c6dafc02a087e786e29a03090cb68ccf4cebed83c5da44588ebd8f99b177e1502a6894bef9a2f19eda5d9cc7eaacaf977f6a857db0c5c10592e035a1f03418052441a0bf12ecf858b249b7f02f350bd4f76ae2e01372ab655247cd10d82582ca12c9524551a4457a28eb5d16a1efcdcba31c04d1b5ee0333f0f25f860b83098d1d14e259265d015ed2813da28ce1c9aabf545913604f1235fdfa739bd5216180f560bdb89728ff01f9de4d63a32c23fa237b92f5be99c8c76dc9d1f855f931a24bbb4fac7161a5ece26f6651b0843bb99708564c1bcc04a0cc80ac7e162cf8a2926bfedc09482ecd1124d4b14f03e730d75e56a4269500e91c82c0a2e1cd02fd3b8dee6cf0aa1975c4ee839b1b09a4343534493ff22f6e2718babe15f99b82445bf75d11d1e2e4ed9fd6c523d206ae2371b8e0af223f7c5eef95df74d2e0f8a5b86d4025b8134192629e19899ce041d94b1684a75fbadd9f4bb9d5aa0f7cdf6793984872ae91f50ad8589fc2eae8279f4fd413d40ef260c170c6fcc39861fd01fb138435b259008dc704826d95b0346e91f0d3374da3504c547fcd5ad0fb3f83090d2c9e194bd0bde70cb303013b0ea65862edda5b09123d26cfbffd7e6695464ff003dfc3096859496e3a404c9581b05d1aff4899ca3186bfc39c897864630802054dba5e16a2cb2b9a8a044bedbcb7346794eefd0cfedf6b69421b3d398c0449944cbb1c2fc6eca35a9e906b5b11e0e29c0ec643722092deb75fad74bc643b85e9977b86ae04d38bfaa9d94f5d11ee4d379b24ad79630e283d9de0a6393f4d2b4d25956333a60e95b189e7ecf3c6f8b7c05f80ff9a1bce20e26995b52c9a08b44729253f4731b0394eb2d2609c3c2c43811c0e5cf2fa83c857e2513adc3841f7d4830d8700913b2f1d8ee77047f96c6c7091350b736e937dfcb682a1adc568a032bff614360c12961c7fec9fecd036edfbfd4010b4a132f5b41d9b3883f5217faab84f8e90733b2883e651dd3c32485244d1c9cdd63d694ba8f435c35612aed54f7415a5ab191407ed76297b321f226c5b18bdf9605ca0b59f265f25bd7ea227e2102c07ec1ef8adb8cce5375133bf7fdc9a0b54e4f724b67552e489acfd5dac22487027f96f02f245190031a075fb33ec35b3379b4ec1642878cff6480fa44a3c03947ccc367432fcfeece49", &(0x7f0000001640)=""/105}, 0x20) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x8c, r4, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x2}, @ETHTOOL_A_LINKMODES_OURS={0x70, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x6c, 0x4, "a8412ce53f46dde1699f607b4a4afb876b1c905f77d83c5484724aac5182f88f921f9da1e33ad68a2279a2463c71515cc7b351a2935c86da64b5bcc9773bf83bc5d04bd3e4092e0c59f7a1b6d5a789b7ae24a69702ed69ede917494b877f081a683c9ea566a5bee3"}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x80}, 0x4000001) r5 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x1, 0x0) write$cgroup_pid(r6, &(0x7f0000000100)=r5, 0x12) ioctl$BTRFS_IOC_SET_FEATURES(r1, 0x40309439, &(0x7f0000000080)={0x2, 0x2}) 2m46.542084947s ago: executing program 5 (id=182): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) clock_gettime(0xa00, &(0x7f0000000040)) 2m46.188102886s ago: executing program 5 (id=185): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x54, 0x4, 0x3a, 0x5, 0x3, 0x6, 0xf9, 0x2, 0x23, [0xb, 0x0, 0xa, 0x319dea4c, 0x10000, 0x2, 0x17e5, 0x6], [0x80000000, 0x81, 0x1, 0x9, 0xe5]}}) 2m46.156107397s ago: executing program 33 (id=185): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x54, 0x4, 0x3a, 0x5, 0x3, 0x6, 0xf9, 0x2, 0x23, [0xb, 0x0, 0xa, 0x319dea4c, 0x10000, 0x2, 0x17e5, 0x6], [0x80000000, 0x81, 0x1, 0x9, 0xe5]}}) 40.546122261s ago: executing program 2 (id=634): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x1c, 0x66, 0x0, 0xf, 0x11, 0x0, @empty, @empty=0xe0000001}, {0x4e24, 0x4e20, 0x8}}}}}, 0x0) 40.545844891s ago: executing program 2 (id=636): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0x5, 0x0, 0x70bd2b, 0x0, [@sadb_x_sa2={0x2, 0x13, 0xad, 0x0, 0x0, 0x70bd28}, @sadb_x_nat_t_port={0x1, 0x3, 0x4e24}]}, 0x28}, 0x1, 0x7}, 0x0) 40.499700222s ago: executing program 2 (id=638): prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') 39.911674397s ago: executing program 2 (id=642): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x1400c, &(0x7f0000000040)={[{@debug}, {@data_journal}, {@norecovery}]}, 0x3, 0x498, &(0x7f0000000240)="$eJzs3L9vG1UcAPDvOXFCaCGhlF8tPwIFUSFImrZABwZAIDEUgQQDjFYSqtK0oCZItIpEylAmVCGxI0b+BSZYEGJCYgVmVFGhLG2ZjM53l9iu7eaHY5f685GcfN/d2e997+45z/dyDmBgTaY/kojdEfF7RIxnxcYNJrNf11aXZ6+vLs8mUa2+809S2+7q6vJssWnxvF31hUhif4t6F8+dP1VZWJg/m5enl05/PL147vxzJ09XTsyfmD9z+Nixo0dmXnzh8PPbyG4sIva8lcWlfNkb73/15vEvG/JvyqNLJjutfKpa7XJ1/XVXXTzcx3awOUP58SrX+v94DNUdvfF4/fO1wmd9aiCwY6rVanVX+9UrVeA2lkRjWZeHQVH8oS8+/+a/R+sHAS/v6Aikv668kn0ASvO+lj+yNcNrVwzKTZ9vu2kyIt5b+feb9BEdr0MkO9QCAGDQ/JCOf55NRzvLs+nYY338UYr767a7O58bmoiIeyJiT0TcG2dib0TcF1Hb9oGIeHCT9ddNktSGmVdXR5rGP6XLW05uA9Lx30v53Fbj+K8Y/cXEUK10LitEOfng5ML8oXyfHIzyaFqe6VDHj6/9dqnduvrxX/pI6y/Ggnk7Lg+PNj5nrrJU2XrGja5ciNg33Cr/ZG0mIB15PhQR+1q9QOnmdZx85ruH2627ef4ddGGiqfptxNPZ8V+JpvwLSef5yek7YmH+0HRxVtzol18vvt2u/m3l3wXp8b+z5fm/lv9EUj9fu7j5Oi7+8UXbudXJch5s4vxfqSxVRpJ3a/FIvuzTytLS2ZmIkeR41uj65YfXn1uUi+3T/A8eaN3/98T6ntgfEelJ/EhEPBoRj+XH7vGIeCIiDnTI/+dXn/ywedlYkf8tcPznNnX814ORaFxSarFNGgyd+un7hkon1sM8/+ud3/+O1qKD+ZKNvP/d2IrWwXb3HwAAAPwflCJidySlqbW4VJqayv6Hf2829Z365Mxcdo/ARJRLxZWu8brroTP5x/qsfCEisn8tKNYfiVLtuvHXQ2O18tTsRwtzfc0c2NWm/6f+Gup364Ad54YtGFz6Pwyujv2/3Lt2AL13Q//v2OdHd7QtQG+1+Ps/1o92AL3Xavzv+35gMDT1f9N+MEBc/4fBpf/D4NrAPfzA7WdxLG5+k/xaUI6I5lXFK23g6VsJxiM208LtB8U3I273daLcuzb3I4hSd17nz3x/t1g10v7U+vtSxC2wE1oHyc51h94F/XtPAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6Kb/AgAA//8GT9U6") getdents(0xffffffffffffffff, &(0x7f0000001fc0)=""/184, 0xb8) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) setxattr(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000000)=@known='trusted.overlay.impure\x00', &(0x7f0000000140)='overlay\x00', 0x1, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000003c0), 0x8, &(0x7f00000000c0)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) 39.497269987s ago: executing program 2 (id=653): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) write(r0, 0x0, 0x0) 39.053681128s ago: executing program 2 (id=660): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}}, 0x0) 38.950056131s ago: executing program 34 (id=660): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}}, 0x0) 3.415752165s ago: executing program 1 (id=1048): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0xaaaaaaaaaaaac8f, 0x44, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088d0}, 0x48000) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.828490359s ago: executing program 0 (id=1060): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001c80)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"}) r1 = syz_open_pts(r0, 0x80) r2 = dup3(r1, r0, 0x80000) read$watch_queue(r2, &(0x7f0000001d40)=""/4095, 0xfff) 2.719709392s ago: executing program 1 (id=1061): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) sendmmsg$inet(r0, &(0x7f0000008440)=[{{&(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10, 0x0}}], 0x1, 0x0) 2.672306954s ago: executing program 1 (id=1062): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000080)) 2.622179575s ago: executing program 1 (id=1063): readv(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r2, 0x0) setpriority(0x2, 0xff, 0x0) r3 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000380), 0x1, 0x0) write$binfmt_register(r3, 0x0, 0x53) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r0, 0x0, 0x30, 0x19, @val=@netkit}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x298, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4, 0x0, 0x8}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000200)='test_pkt', 0x8, 0x0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) process_vm_writev(0x0, &(0x7f0000001800)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) 2.547211577s ago: executing program 0 (id=1065): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r3, 0x0, 0x0) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, 0xffffffffffffffff, 0x0) 2.279820033s ago: executing program 6 (id=1068): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x48080) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000a00)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="616c6c6f775f7574696d653d30303030303030303030303030303030303030303030312c73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c696f636861727365743d64656661756c742c756e695f786c6174653d302c6e6f6e756d7461696c3d302c757466383d302c666c7573682c726f6469722c726f6469722c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c756e695f786c6174653d302c757466383d302c73686f72746e616d653d6d697865642c756e695f786c6174653d312c73686f72746e616d653d77696e6e742c001762a07a915c8f6c3378b924fc250bdae45cd22bb33f29d72cf1c8410df88b83b9710b49374a748455718cc4af5f3ced9aa10632d595e9c8c3a89f41b650b9ebd4886ae65bf02b7c8ea4e76ef2cc241ac9f89f2753df98db0ba9558c753363f296424ec60e703fac2db7e9f31283852e115cf6acb8d77b3e5d68", @ANYRESDEC, @ANYBLOB="b13c376fdd66a7d639c02532bf04ce21f7d86f67914cd24c1a16c85d000e56c7368c5baa847b8d1390c871ca73979c130e2e8dba52cb6e29e7ef9ce8e7f092a32dd4dff5839727b3f591e388d041527960a1e20a1e133b12dfc18f1f732ea8614d5847cd54edc1c0aa5422ef3bb9508fdbebcc135de98954f1d9fbffbb190a49b16c1275d4830b8a85acf0b55c1e19533fb1ae4ca8f80bdefda060e3e6837a10fc794ecf34ec4b7a7c76402285c415d76a33d64d218596c8126c7b35076511e52e235fb9be2d0a381962e129748855c39c84436bd553b25d7f0ae7e35b54eebdb608625a42b589438a35d78997"], 0xff, 0x2c1, &(0x7f0000000a40)="$eJzs3bFra1UcB/DfTdMkT5FEcBLBCzo4PV7f6pIifVDMpGRQBy22BUmCkEKhVYydXF0cXV0Ewc1/wsX/QHAV3CxYuHKTe03SpiFB06rv81l6eu755vzOyS0lQ8794KVB7zCN44tPf45GI4lKO9pxmUQrKlH6POa0vwwA4L/sMsvit2xinVwSEY3NlQUAbNDa//+/33hJAMCGvf3Ou2/udjp7b6VpI54Mvjjt5p/s858RDyJi9zg+in4cxaNoxlVE9pdJ+0mWZaNqmmvFq4PRaTdPDt7/sXj93V8bMc7vRDNa4675/H5nbyedmMmP8jqeKeZv5/nH0YwXFsy/39l7vCAf3Vq89spM/Q+jGT99GB9HPw7HRUzyUYn4bCdN38i++v2T9/Ly8nwyOu3Wx+Omsq27f3cAAAAAAAAAAAAAAAAAAAAAAPi/elicnVOP8fk9eVdx/s7WVf7LdqSl1vz5PJN8Ur7QtfOBRll8XZ7P8yhN06wYOM1X48VqVO9n1QAAAAAAAAAAAAAAAAAAAPDvcnJ23jvo94+G/0ijPA2g/Fr/qvGLaz3tmTEvx/J4fTpXpWgumSu2yjFJxNLC8kWsvPY/imMPVt2oasz2PH9bzd9+t/Jb8M3ta38wf2l72f78jUatmObsvFfeXb2DZPEe1qPsaZQ3yQ+zY2qx6qS3XcrWuP2GJ7WFl5prb0Lt2XFjtGRMJMsKe/2Xyc6d9w6e6x8Nk+urqI13dWF8u2gU8ZtjGqvfz/lfyg2J0zoAAAAAAAAAAAAAAAAAAGCjpl/6neuePK7/Ymm0ktU3WxsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3JXp8//XaIyK8AqDazE8ueclAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8BT4MwAA//9YnFw0") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) 1.855282723s ago: executing program 6 (id=1074): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x3c1, 0x3, 0x430, 0x0, 0x2b8, 0xb0000010, 0x0, 0x5c8f0200, 0x360, 0x3a8, 0x3a8, 0x360, 0x3a8, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x41}, @dev={0xfe, 0x80, '\x00', 0x27}, [0xffffffff], [0xffffff00, 0xffffffff, 0xff000000], 'netpci0\x00', 'erspan0\x00', {}, {0xff}, 0x0, 0xe0, 0x6, 0x19}, 0x0, 0x230, 0x258, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0x8, 0x103, 0x33, 0x2, 0x20000a, 0x80001, 0x9d07, 0x0, 0x9fb242d9c589420f, 0xe0}}}, @common=@frag={{0x30}, {[0xfffffffc, 0x3], 0x8c10, 0x1a, 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2c}, @private1, [0x0, 0xffff00, 0x0, 0xffffff00], [0xffffffff, 0xffffffff, 0x0, 0xffffff00], 'dvmrp0\x00', 'pimreg\x00', {}, {0xff}, 0x67, 0xb7, 0x1}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@private=0xa010102, [0x0, 0x7fffff7f, 0xff000000], 0x4e24, 0x4e23, 0x4e24, 0x4e22, 0x841, 0x6, 0x3, 0x2, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x490) 1.683752058s ago: executing program 1 (id=1076): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000080), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000005c0)=@v2={0x2, @adiantum, 0x0, '\x00', @auto="fc06d4cd1131a6f26983e371d4f64c42"}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0) 1.683443228s ago: executing program 6 (id=1077): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x2, &(0x7f0000000040)=[{0xa4, 0xfe, 0x2f, 0x100}, {0x6}]}) 1.680577548s ago: executing program 0 (id=1078): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) 1.58630499s ago: executing program 6 (id=1079): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0xccd02, 0x0) ptrace$ARCH_GET_UNTAG_MASK(0x1e, r0, &(0x7f0000000040), 0x4001) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket(0x2b, 0x80801, 0x1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, 0x0) unshare(0x2c020400) r3 = socket(0x2d, 0x2, 0x0) bind$inet(r3, 0x0, 0xc00) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, 0x0) 1.576859841s ago: executing program 0 (id=1080): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) 1.101372602s ago: executing program 1 (id=1081): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x84, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x2}}, @TCA_CT_ACTION={0x6, 0x3, 0x1}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x84}}, 0x0) pwritev2(0xffffffffffffffff, &(0x7f0000022e80)=[{0x0}], 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008004500002012340000401154970a0000010a0000023039d431000c"], 0x24) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500002012340000401154970a0000010a0000023039d431000c"], 0x24) 1.066110203s ago: executing program 0 (id=1082): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x29, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x50, 0x0, 0x1, 0x0, 0x0, 0x2400c000}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000000c0)=ANY=[], 0x8) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000022, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, &(0x7f0000000040)=0xe7, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000006800e9780000000000dbdf250a0000000000000008000500", @ANYRES32=r5], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="380000006800010003001000fdffff7f00000000000000000c00020001000000150000000c000c8006000100d43f00000600030001"], 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@gettfilter={0x44, 0x2e, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xffff}, {0xb, 0x8}, {0xfff1, 0x7}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x1000}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x80}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.024461424s ago: executing program 6 (id=1085): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000001c0)=0x59ca, 0x4) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000180)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000340)={&(0x7f0000000080), 0x10, &(0x7f0000000000)={&(0x7f0000000100)=@canfd={{0x2, 0x0, 0x1}, 0x40, 0x2, 0x0, 0x0, "559c4157df5c5fc0a343bdfd992c89ec7c178d3d401a0657e948c1e50e9f29438946924347e8c9a7f1d228cf082056214904d6e39350c2d1bf5443d0ef0296b0"}, 0x48}, 0x1, 0x0, 0x0, 0x4000051}, 0x811) recvmmsg(r0, &(0x7f0000006340)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2040, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0xffff}]}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 923.532597ms ago: executing program 3 (id=1086): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.self_freezing\x00', 0x275a, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES16=r6, @ANYBLOB="000000000000000000000000000000000000000000000c00000000003b6ed4dbdf384b010bb3a32eb9d6b871af60664065d27aa3068986d6b601f5c0cbeb98c4b65a548565119b52bdef8178a7f1b69aedde462aa12951f2b9893d0640"], 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1, 0x87}, @map_fd={0x18, 0x1, 0x1, 0x0, r8}, @generic={0x1d, 0x8, 0x1, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r9}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x3}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x728d9debdaa4f37e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sync_file_range(r5, 0x6, 0x9fd, 0x3) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000ac0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3d0, 0x270, 0x270, 0x0, 0x270, 0x0, 0x400, 0x400, 0x400, 0x400, 0x400, 0x6, &(0x7f0000000040), {[{{@ip={@private=0xa010100, @multicast2, 0xff, 0xffffffff, 'ipvlan1\x00', 'wg2\x00', {}, {}, 0x16, 0x0, 0x20}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0xb}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0xd, 0xffffffdb, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@local, @dev={0xac, 0x14, 0x14, 0x3b}, 0x0, 0xffffff00, 'ip6tnl0\x00', 'ipvlan1\x00', {0xff}, {0xff}, 0x6, 0x0, 0x18}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0xe, 0x90, 0x1}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x7, 0x1, 0x1, 0x2, 0x8, 0x4], 0x6, 0x1}, {0x0, [0x1, 0x7, 0x0, 0x0, 0x1, 0x4], 0x3, 0x4}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x430) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x4}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, '\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x9c}}, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x10010, r10, 0xc6d6a000) 923.342977ms ago: executing program 0 (id=1087): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406a053b03000000000001090222000101"], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0xaaaaaaaaaaaac8f, 0x44, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088d0}, 0x48000) ioctl$KVM_RUN(r3, 0xae80, 0x0) 899.970048ms ago: executing program 7 (id=1089): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x3, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc05, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xb}, {0x4, 0x4}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x1}}]}, 0x40}}, 0x4894) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 634.604654ms ago: executing program 7 (id=1090): r0 = socket(0x2b, 0x1, 0x1) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'sh\x00', 0x30, 0x660f577c, 0x3}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000440)={{0x84, @rand_addr=0x64010101, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@rand_addr=0x64010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44) 609.982285ms ago: executing program 7 (id=1091): syz_mount_image$exfat(&(0x7f0000000180), &(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000080)={[{@discard}, {@fmask={'fmask', 0x3d, 0x1}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@discard}, {@namecase}, {@errors_remount}, {@namecase}, {@umask={'umask', 0x3d, 0x81}}, {@errors_continue}, {@namecase}]}, 0x1, 0x1535, &(0x7f0000001380)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v57M/s55Z+1nvs+aZvfe739l802VojUY1qzYgIvhD8OKXBACIBYCBAHANAAQAUDaubFzGfHaJCX/sIOzP9VDyla6AXUnc/6yN+5+1cf+zNu5/1sb9z9q4/1kb9z9r4/4zlpVtnp7/Wr5l3Rtf/8/K+PX/v0h6ybFfrC15fVeAmH81hfv//z/8A7nc//9awb9yJ+5/1sb9z6pir3QB7H8BfvxnBdn+4Qz3P2vj/jOWlf3yWnAsXPnr0X/1DSL/yb+B+F4Xf8pXfp//cP+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFA5vhK18UYY4wxxhhjjLE/j892pStgjDHGGGOMMcbYfx6CAAkKAoiBbBAL2SEHCICYzPlrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/o/wXoAe8CD2hFyRAb+gDL0Ff6Af9YQAMhJdhELwCg+FVSIQhMBReg2HwOgyHN2AEjIRR8CaMhrdgDIyFcTAekmACTIS3YRK8A5NhCkyFaZAM02EGvAszYRbMhvdgDrwPc2EezIcFkAIfwEJYBKnwISyGjyANlsBSWAbLYQWshFWwGtbAWlgH62EDbIRNsBm2wFbYBtthB+yEj2EXfAK7YQ/shU9hH3z2b+af/rv8rggIKFCgQoUxGIOxGIs5MAfmxJyYC3NhBCMYh3GYG3NjHsyD+TAfxmM8FsSCaNAgIWEhLIRRjGIRLIJFsSgWx+Lo0GEpLIWl8WYsg2WwLJbFclgOy2MFrICVsBJWxspYBatgVayK1bAa1sAaeDfejb2xNtbGOlgH62LdzMtT2AAbYENsiI2wETbGxtgEm2AzbIYtsAW2xJbYClthG2yDbbEttsN22B7bYwfsgB2xI3bCTtgZO2MX7IJdsRt2S38hG+CL+CL2wmqiN/bBPtgXE7P1xwE4AF/GQfgKvoKvYiIOwaH4Gr6Gr+NwPIUjLozEUTgKK4u3cAyORRLjMQmTcCJOxEk4CSfjFJyC0zAZp+MMnIEzcRbOwvdwDr6P7+M8nIcLMAVTcCEuwlRMxcV4GtNwCS7FZbgcV+ByXIWrcRWuxXW4FjfgBtyEm3ALbsFtuA134A78GBUAfoJ7cA8m4j7ch/txPx7AA3gQD2I6puMhPISH8TAewSN4FI/iMTyOJ/A4nsSTeApP4xk8g+fwHJ7H5+K/avhxsTWJIDIooUSMiBGxIlbkEDlETpFT5BK5RERERJyIE7lFbpFH5BH5RD4RL+JFQVFQGGEEiTDjmUJERVQUEUVEUVFUFBfFhRNOlBKlRGlRWpQRZURZcasoJ24T5UUF0dpVEpVEZdHGVRF3iqqiqqgmqosaoqaoKWqJWqK2qC3qiDqirqgr6okHRH3RG/vjQyKjM43EEGwshmIT0VTIS89QLcVwbCVaizbiCTESR2A70dK1F0+LDmIMdhR/E2PxWdFZjMcu4nnRVXQT3cULoodo5XqKXmIy9hZ9xDTsK/qJ/mKAmInVxXs4J3sN8apIFEPEUPGaWICvi+HiKjFCjBSjxJtitHhLjBFjxTgxXiSJCWKieFtMEu+IyWKKmCqmiWQxXcwQ74qZYpaYLd4Tc8T7Yq6YJ+aLBSJFfCAWikUiVXwoFouPRJpYIpaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdoqPxS7xidgt9oi94lOxT3wm9ovPxQHxhTgovhTp4itxSHwtDotvxBHxrTgqvhPHxHFxQnwvToofxClxWpwRZ8U58aM4L34SF4QXIFEKKaWSgYyR2WSszC5zyKtkThlkPv/LOHmdzC2vl3lkXplP5pfxsoAsKLU00kqSoSwkC8uovEEWkTfKorKYLC5LSCdLylLyJlla3izLyFtkWXmrLCdvk+VlBVlRVpK3y8ryDgmRi8eoJqvLGrKmvFsmwD2ytrxX1pH3ybryfllPPiDrywdlA/mQbCgflo3kI7KxfFQ2kU1lM9lctpCPyZbycdlKtpZt5BOyrXxStpNPyfbyadlB+ku/Is/KzvI52UU+L7vKbrK7/ElekF72lL0k9AbZR74k+8p+sr8cIAfKl+Ug+YocLF+ViXKIHCpfk8Pk63K4fEOOkCPlKPmmHC3fkmPkWDlOjpdJcoKcKN+Wk+Q7crKcIqfKaTJZTpf9L600W8p/mv/27+QP/vnom+RmuUVuldvkdrlD7pQfy11yl9wtd8u9cq/cJ/fJ/XK/PCAPyIPyoEyX6fKQPCQPy8PyiDwij8qj8pg8Ls/K7+VJ+YM8JU/L0/KsPCfPyfOXfgagUAkllVKBilHZVKzKrnKoq1ROdbXKpa5REXWtilPXqdzqepVH5VX5VH4Vrwqogkoro6wiFapCqrCKqhvw0i+MKq5KKKdKqlLqpn8nXxVRN6qiqtiv8jPrS/gH9bVQLVRL1VK1Uq1UG9VGtVVtVTvVTrVX7VUH1UF1VB1VJ9VJdVadVRfVRXVVXVV31V31UD1UT9VTJagE1Ue9pPqqfqq/GqAGqpdFxh4Gq8EqUSWqoWqoGqaGqeFquBqhRqhRapQarUarMWqMGqfGqSSVpCaqiWqSmqQmq8lqqpqqklWymqFmqJlqppqtZqs5ao6aq+aq+Wq+SlEpaqFaqFJVqlqsFqs0tUQtUcvUMrVCrVCr1Cq1Rq1R69Q6tUFtUGlqs9qstqqtarvarnaqnWqX2qV2q91qr9qr9ql9ar/arw6oA+qgOqjSVbo6pA6pw+qwOqKOqKPqqDqmjqkT6oQ6qU6qU+qUOqPOqHPqnDqvzqsL6kLGaV8gAhGoQAUxQUwQG8QGOYIcQc4gZ5AryBVEgkgQF8QFuYPrgzxB3iBfkD+IDwoEBQMdmMAG4lLTo8ENQZHgxqBoUCwoHpQIXFAyKBXcFJQObg7KBLcEZYNbg3LBbUH5oEJQMagU3B5UDu4IqgR3BlWDu4JqQfWgRlAzuDuoFdwT1A7uDeoE9wV1g/uDesEDQf3gwaBB8FDQMHg4aBQ8EjQOHg2aBE2DZkHzoMWfur73p/I+7nrqXjpB99Z99Eu6r+6n++sBeqB+WQ/Sr+jB+lWdqIfoofo1PUy/rofrN/QIPVKP0m/q0fotPUaP1eP0eJ2kJ+iJ+m09Sb+jJ+speqqeppP1dD1Dv6tn6ll6tn5Pz9Hv67l6np6vF+gU/YFeqBfpVP2hXqw/0ml6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7XqH3qk/1rv0J3q33qP36k/1Pv2Z3q8/1wf0F/qg/lKn66/0If21Pqy/0Uf0t/qo/k4f08d1Gf29Pql/0Kf0aX1Gn9Xn9I/6vP5JX9A+4+Q+4+XdKKNMjIkxsSbW5DA5TE6T0+QyuUzEREyciTO5TW6Tx+Qx+Uw+E2/iTUFT0GQgQ6aQKWSiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5nZzu7nD3GHuNHeau8xdprqpbmqamqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkGpvGpolpYpqZZqaFaWFampamlWll2pg2pq1pa9qZdqa9aW86mA6mo+loOplOprPpbLqYLqar6Wq6m+6mh+lhepqeJsEkmD6mj+lr+pr+pr8ZaAaaQWaQGWwGm0STaIaaoWaYGWaGm+FmhBlpRmWcqJq3zBgz1owz402SSTITzUQzyUwyk81kM9VMNckm2cwwM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp9dKbWJvd5rBX2Zz2apvLXmP/Ps5n89t4W8AWtNrmsXl/FRtrbVFbzBa3JayzJW0pe9Nv4vK2gq1oK9nbbWV7h63ym7iWvcfWtvfaOvY+W9Pe/au4rr3f1rOP2PqIALapbWib20b2EdvYPmqb2Ka2mW1u29onbTv7lG1vn7Yd7DO/iRfaRXa1XWPX2nV2t91jz9iz9rD9xp6zP9qetpcdaF+2g+wrdrB91SbaIb+JR9k37Wj7lh1jx9pxdvxv4ql2mk220+0M+66daWf9Jk6xH9g5NtXOtfPsfLvg5zijplT7oV1sP7JpNoCldpldblfYlXbV/611md1gN9pNdpf9xG612+x2u8PuzDwRtnvsXvup3Wc/s4fs1/aA/cIetEdsuv3q5zhjf0fst/ao/c4es8ftCfu9PWl/UJnZGXv/3v5kL1hvgZCAJCkKKIayUSxlpxx0FeWkqykXXUMRupbi6DrKTddTHspL+Sg/xVMBKkiaDFkiCqkQFaYo3UCZ5RWnEuSoJJWim6g03Uxl6BYqS7dSObqNylMFqkiV6HaqTHdQFbqTqtJdVI2qUw2qSXdTLbqHatO9VIfuo7p0P9WjB6g+PUgN6CFqSA9TI3qEGtOj1ISaUjNqTi3oMWpJj1Mrak1t6AlqS09SO3qK2tPT1IGeoY70N+pEz1Jneo660PPUlbpRd3qBetCL1JN6UQL1pj70EvWlftSfBtBAepkG0Ss0mF6lRBpCQ+k1Gkav03B6g0bQSBpFb9JoeovG0FgaR+MpiSbQRHqbJtE7NJmm0FSaRsk0nWbQuzSTZtFseo/m0Ps0l+bRfFpAKfQBLaRFlEof0mL6iNJoCS2lZbScVtBKWkWraQ2tpXW0njbQRtpEm2kLbaVttJ120E76mHbRJ7Sb9tBe+pT20We0nz6nA/QFHaQvKZ2+okP0NR2mb+gIfet70Xd0jI7TCfqeTtIPdIpO0xk6S+foRzpPP9EF8gQhhiKUoQqDMCbMFsaG2cMc4VVhzvDqMFd4TRgJrw3jwuvC3OH1YZ4wb5gvzB/GhwXCgqEOTWhDCsOwUFg4jIY3hEXCG8OiYbGweFgidGHJsFR4U1g6vDksE94Slg1vDcuFt4XlwwrhI/dVCm8PK4d3hFXCO8Oq4V1htbB6WCOsGd4d1grvCWuH94Z1wvvCMuH9Yb3wgbB++GDYIHwobBg+HDYKHwkbh4+GTcKmYbOwedgifCxsGT4etgpbh23Cq8K24ZNhu/CpsH34dNghfObn+fsXZc4/8Zv5hLB32Cd8KXwp9P5eOT+6IJoS/SC6MLoomhr9MLo4+lE0LbokujS6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kep9zWzg0AknnXKBi3HZXKzL7nK4q1xOd7XL5a5xEXeti3PXudzuepfH5XX5XH4X7wq4gk4746wjF7pCrrCLuhtcEXejK+qKueKuhHOupCvlmrsWroVr6R53rVxr18Y94Z5wT7on3VPuKfe06+CecR3d31wn96zr7J5zz7nnXVfXzXV3L7gebkKui4/JBNfH9XF9XV/X3/V3A91AN8gNcoPdYJfoEt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NckktyE91EN8lNcpPdZDfVTXXJLtnNcDPcTDfTVZ518Shz3Vw33813KS7FLXQZ54ypbrFb7NJcmlvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+l2ul1ul9vtr7m4qNvn9rv97oA74A66L126+8odcl+7w+4bd8R9646679wxd9ydcN+7k+4Hd8qddmfcWXfO/ejOu5/cBeddUmRCZGLk7cikyDuRyZEpkamRaZHkyPTIjMi7kZmRWZHZkfcicyLvR+ZG5kXmRxZEUiIfRBZGFkVSIx9GFkc+iqRFlkSWRpZFlkdWRLwvsDX0hXxhH/U3+CL+Rl/UF/PFfQnvfElfyt/kS1+sO837W305f5sv7yv4iv5R38Q39c18c9/CP+Zb+sd9K9/at/FP+Lb+Sd/OP+Xb+6d9B/+M7+j/5jv5Z31n/5zv4p/3XX03392/4Hv4F31P38sn+N6+j3/J9/X9fH8/wA/0L/tB/hU/2L/qE/0QP9S/5of51/1w/4Yf4Uf6UTFv+tGZb5FhvE/yE/xE/7af5N/xk/0UP9VP88l+up/h3/Uz/Sw/27/n5/j3/Vw/z8/3C3yK/8Av9It8qv/QL/Yf+TS/JPOisV/pV/nVfo1f69f59X6D3+g3+c1+i9/qt/ntfoff6T/2u/wnfrff4/f6T/0+/5nf7z/3B/wX/qD/0qf7r/wh/7U/7L/xR/y3/qj/zh/zx/0J/70/6X/wp/xpf8af9ef8j/68/8lf4H+zxhhjjDH2L5lweSh+PXPxcn7v38kRv7hzHwC4elv+9F/OZ5xRrs9zcdxPxMdmfH26V5eHMm/VqiUkJFy6b5qEoPA8gMy/BGX4+aMHl+Il0AaehPbQGkr/bv39RLdz9E/Wj94KkOMXORkFZcaX1/8cABN+s99+4rEnRi0sF56J+3+sPw+gaOHLOdnhcrwE2vx8faU1lPkH9edt+U/qz/5FEkCrX+TkhMvx5fpLwePwDLT/1T0ZY4wxxhhjjLGL+omKnTLff2Z+4vP33p/Hq8s52eBy/M/enzPGGGOMMcYYY+zKe7Zb96cea9++dad/f1Dlf5T1Lw8aw39qZR787sB7gMzvKAD4gwsCZAzkX7mLLX/JsRIvPXT+fmr5WR/A/45W/hmDK/zExBhjjDHGGPvTXT7p//X31ZUqiDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYy4L+iv9O7ErvkTHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGLvS/k8AAAD///P/+v8=") r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 609.598795ms ago: executing program 7 (id=1092): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000880)=ANY=[@ANYBLOB="2400000003060102000000000000000000000002050001"], 0x24}}, 0x0) 600.739705ms ago: executing program 7 (id=1093): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0xfffffffd, 0x800003, {0x0, 0x0, 0x0, 0x0, 0xd126a8577c57125b, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x4c}}, 0x0) 551.739516ms ago: executing program 7 (id=1094): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x4, 0x4, 0x2, 0x4, 0xffffffffffffffff, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, &(0x7f0000000040), &(0x7f0000000140)=r3}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r4, &(0x7f0000000040)}, 0x20) 67.325148ms ago: executing program 3 (id=1095): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x2c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}}, 0x0) 61.366939ms ago: executing program 3 (id=1096): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000640)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) write(r0, &(0x7f0000000700)="ffffffffffff00aabbccddee080045000028000100004011f8cbd0000001e00101011000100000", 0x27) 11.71037ms ago: executing program 3 (id=1097): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10, {{@in=@multicast1=0xe0000002, @in6=@private2, 0x0, 0x0, 0x3, 0x0, 0xa, 0x0, 0x80, 0x6}, {0x0, 0x0, 0x1abe1019, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}, {}, 0x3, 0x6e6bb8, 0x0, 0x1, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) 11.61777ms ago: executing program 6 (id=1098): syz_usb_connect(0x0, 0x24, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1f7) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(0x0, 0xffffffffffffff9c, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r0, &(0x7f00000004c0)='\n', 0x1) 11.51834ms ago: executing program 3 (id=1099): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000300)={[{@shortname_winnt}, {@uni_xlate}, {@utf8}, {@shortname_lower}, {@shortname_lower}, {@shortname_win95}, {@rodir}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'macceltic'}}, {@fat=@codepage={'codepage', 0x3d, '775'}}, {@fat=@nfs}, {@shortname_mixed}, {@numtail}, {@shortname_win95}, {@shortname_lower}, {@shortname_mixed}]}, 0x3, 0x29e, &(0x7f0000000800)="$eJzs3c1qa1UUAOB1mn8dJANHItwDOnB0ufUJWuQKYkFQIqgDLd5ckCRcaCHQKsaOfAKfQPBtnIgv4AMoztqBeOT0JGnSnqSmlqTo9026utZe2ftk79JOsvv5a8P+sxfHz8++/jWazSR29mIvLpLoxE5MfRulfvm9PA8APHAXWRZ/ZIVGkTpZHFGL8u+rOxtZIABw7+Z//297LQDAZnz48Sfv7R8cPP0gTZsRw+9G3SSKr0V9/3l8GYPoxZNox58R2UwRv/PuwdOoprlOvDEcj7p55/Czn86LPyf2f4u47N+NdnTK+3fTwlz/eNStxUuT+fcG0Xv/h2jHK+X9b5X0R7ceb74+t/7H0Y6fv4gXMYhnk2ef9n+zm6ZvZ9+ff/Vpns37k/Go25iNm4yubHhrAAAAAAAAAAAAAAAAAAAAAAD4D3ucznQW79+ZXvxfFJuT8Qv1FfcDjefu53mSpmmWXO+vxqvVqG7ruQEAAAAAAAAAAAAAAAAAAOAhOT457R8OBr2jNYKPbpYqsZCZfqy/pD3+Wsw0ImKt2ReCR+t2RWWytEEScW1MPSJWtNeicdl5+1yV5aX8BW6UWvl6ekdJNfqHP2Z325TrQTLLtOZLj6KYK8+0imAu828nHTTjMpierv5hctvmNssOybKg8s/Xk5Ucv+Xt9bLTmysZ3Foxe/3lO711WXtJKYmI2uzNXP06tXvZwaufFAAAAAAAAAAAAAAAAAAAYMOuPvRbUjzbwoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAuu/v//GsF40nyjlLUjTk77WSXPVGNS2vIjAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8D/wdwAAAP//h9dhCg==") openat(0xffffffffffffff9c, &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2440, 0x0) 0s ago: executing program 3 (id=1100): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x0, {0xa, 0xfffe, 0x0, @local}}}, 0x32) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000000)={'sit0\x00'}) kernel console output (not intermixed with test programs): om 0 to 2048 [ 185.016649][ T2469] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,noblock_validity,mblk_io_submit,noinit_itable,noinit_itable,grpjquota=,jqfmt=vfsv1,max_dir_size_kb=0x0000000000000006,barrier=0x00000000000008022,errors=continue. Quota mode: writeback. [ 185.022600][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 185.063517][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 185.170564][ T446] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 185.180618][ T446] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 185.257794][ T2487] loop2: detected capacity change from 0 to 512 [ 185.999165][ T2500] loop3: detected capacity change from 0 to 16 [ 186.237948][ T2487] EXT4-fs error (device loop2): ext4_get_branch:178: inode #13: block 1024: comm syz.2.552: invalid block [ 186.249605][ T2487] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.552: invalid indirect mapped block 1024 (level 0) [ 186.260488][ T446] usb 7-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 186.373980][ T2500] erofs: (device loop3): mounted with root inode @ nid 36. [ 186.405370][ T2500] input: syz0 as /devices/virtual/input/input89 [ 186.863896][ T2508] loop1: detected capacity change from 0 to 16 [ 187.216976][ T2487] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.552: bg 0: block 35: padding at end of block bitmap is not set [ 187.230413][ T446] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.231561][ T2487] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 187.239043][ T446] usb 7-1: Product: syz [ 187.248222][ T2487] EXT4-fs (loop2): 1 truncate cleaned up [ 187.251932][ T446] usb 7-1: Manufacturer: syz [ 187.257774][ T2487] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noinit_itable,minixdf,,errors=continue. Quota mode: none. [ 187.268512][ T446] usb 7-1: SerialNumber: syz [ 187.568912][ T446] usb 7-1: config 0 descriptor?? [ 187.599791][ T2508] erofs: (device loop1): mounted with root inode @ nid 36. [ 187.788887][ T446] usb 7-1: can't set config #0, error -71 [ 187.815901][ T446] usb 7-1: USB disconnect, device number 6 [ 188.003892][ T2519] loop3: detected capacity change from 0 to 16 [ 188.950756][ T2519] erofs: (device loop3): mounted with root inode @ nid 36. [ 188.965382][ T2516] input: syz0 as /devices/virtual/input/input91 [ 189.058682][ T2525] loop2: detected capacity change from 0 to 128 [ 189.145803][ T2526] loop1: detected capacity change from 0 to 16 [ 189.522828][ T2526] erofs: (device loop1): mounted with root inode @ nid 36. [ 189.540103][ T2526] input: syz0 as /devices/virtual/input/input92 [ 189.592500][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 189.668278][ T2525] overlayfs: filesystem on './file0' not supported [ 189.697977][ T325] udevd[325]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 189.966321][ T2532] loop6: detected capacity change from 0 to 16 [ 189.988619][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 190.233066][ T2535] netlink: 20 bytes leftover after parsing attributes in process `syz.0.563'. [ 190.244336][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 191.111112][ T2536] loop3: detected capacity change from 0 to 16 [ 191.152972][ T2532] erofs: (device loop6): mounted with root inode @ nid 36. [ 191.183326][ T2536] erofs: (device loop3): mounted with root inode @ nid 36. [ 191.212916][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 191.228054][ T2539] loop0: detected capacity change from 0 to 512 [ 191.236551][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 191.247082][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 191.257750][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 191.258215][ T2541] loop1: detected capacity change from 0 to 512 [ 191.398340][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 191.411158][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 191.421539][ T2539] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 191.487788][ T2539] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 191.498865][ T2541] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 191.521591][ T2539] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 191.531760][ T2541] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802e02c, mo2=0002] [ 191.742307][ T2541] System zones: 1-12 [ 191.757265][ T2539] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3894: comm syz.0.563: Allocating blocks 41-42 which overlap fs metadata [ 191.866628][ T2541] EXT4-fs (loop1): orphan cleanup on readonly fs [ 191.884489][ T2539] Quota error (device loop0): write_blk: dquota write failed [ 191.977051][ T2539] Quota error (device loop0): find_free_dqentry: Can't write quota data block 5 [ 192.032141][ T2541] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.564: invalid indirect mapped block 12 (level 1) [ 192.090455][ T63] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 192.099579][ T2539] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3894: comm syz.0.563: Allocating blocks 41-42 which overlap fs metadata [ 192.234928][ T2539] Quota error (device loop0): write_blk: dquota write failed [ 192.244067][ T2541] EXT4-fs (loop1): Remounting filesystem read-only [ 192.250477][ T2539] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota [ 192.250678][ T2541] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.564: invalid indirect mapped block 2 (level 2) [ 192.274138][ T2541] EXT4-fs (loop1): Remounting filesystem read-only [ 192.280874][ T2539] EXT4-fs error (device loop0): ext4_acquire_dquot:6227: comm syz.0.563: Failed to acquire dquot type 1 [ 192.292578][ T2541] EXT4-fs (loop1): 1 truncate cleaned up [ 192.298331][ T2541] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000008000,jqfmt=vfsv1,max_batch_time=0x0000000000001000,errors=remount-ro,data_err=ignore. Quota mode: none. [ 192.330679][ T2539] EXT4-fs error (device loop0): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 192.418592][ T2539] EXT4-fs error (device loop0): ext4_do_update_inode:5260: inode #12: comm syz.0.563: corrupted inode contents [ 192.443447][ T2541] input: syz1 as /devices/virtual/input/input95 [ 192.446149][ T2539] EXT4-fs error (device loop0): ext4_dirty_inode:6118: inode #12: comm syz.0.563: mark_inode_dirty error [ 192.461593][ T2539] EXT4-fs error (device loop0): ext4_do_update_inode:5260: inode #12: comm syz.0.563: corrupted inode contents [ 192.483316][ T2539] EXT4-fs error (device loop0): __ext4_ext_dirty:183: inode #12: comm syz.0.563: mark_inode_dirty error [ 192.495537][ T2539] EXT4-fs error (device loop0): ext4_do_update_inode:5260: inode #12: comm syz.0.563: corrupted inode contents [ 192.515981][ T2566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.568'. [ 192.588797][ T2539] EXT4-fs error (device loop0) in ext4_orphan_del:303: Corrupt filesystem [ 192.615433][ T2539] EXT4-fs error (device loop0): ext4_do_update_inode:5260: inode #12: comm syz.0.563: corrupted inode contents [ 192.627567][ T63] usb 7-1: unable to get BOS descriptor or descriptor too short [ 192.638259][ T2539] EXT4-fs error (device loop0): ext4_truncate:4317: inode #12: comm syz.0.563: mark_inode_dirty error [ 192.649910][ T2539] EXT4-fs error (device loop0) in ext4_process_orphan:345: Corrupt filesystem [ 192.659239][ T2539] EXT4-fs (loop0): 1 truncate cleaned up [ 192.665099][ T2539] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,noblock_validity,mblk_io_submit,noinit_itable,noinit_itable,grpjquota=,jqfmt=vfsv1,max_dir_size_kb=0x0000000000000006,barrier=0x00000000000008022,errors=continue. Quota mode: writeback. [ 192.720476][ T63] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 192.721412][ T30] audit: type=1400 audit(1791403602.791:404): avc: denied { connect } for pid=2540 comm="syz.1.564" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 192.730777][ T63] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 192.759118][ T63] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 192.759742][ T2541] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #2: block 5: comm syz.1.564: lblock 0 mapped to illegal pblock 5 (length 1) [ 192.770711][ T30] audit: type=1400 audit(1791403602.831:405): avc: denied { read } for pid=2540 comm="syz.1.564" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 192.784153][ T2541] EXT4-fs warning (device loop1): dx_probe:823: inode #2: lblock 0: comm syz.1.564: error -117 reading directory block [ 192.866446][ T2575] loop0: detected capacity change from 0 to 128 [ 192.891090][ T2575] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 192.917326][ T1056] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 192.970575][ T63] usb 7-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 192.979743][ T63] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.987837][ T63] usb 7-1: Product: syz [ 193.360045][ T2583] loop1: detected capacity change from 0 to 16 [ 193.853650][ T2585] loop0: detected capacity change from 0 to 16 [ 193.877551][ T63] usb 7-1: Manufacturer: syz [ 193.884368][ T2585] erofs: (device loop0): mounted with root inode @ nid 36. [ 193.916025][ T2585] input: syz0 as /devices/virtual/input/input96 [ 193.963034][ T2583] erofs: (device loop1): mounted with root inode @ nid 36. [ 194.228564][ T2587] loop3: detected capacity change from 0 to 512 [ 194.243346][ T63] usb 7-1: SerialNumber: syz [ 194.427285][ T2589] FAULT_INJECTION: forcing a failure. [ 194.427285][ T2589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 194.442803][ T2589] CPU: 1 PID: 2589 Comm: syz.2.575 Not tainted syzkaller #0 [ 194.450115][ T2589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 194.460174][ T2589] Call Trace: [ 194.463448][ T2589] [ 194.466373][ T2589] __dump_stack+0x21/0x30 [ 194.470701][ T2589] dump_stack_lvl+0x110/0x170 [ 194.475373][ T2589] ? show_regs_print_info+0x20/0x20 [ 194.480661][ T2589] dump_stack+0x15/0x20 [ 194.484806][ T2589] should_fail+0x3ab/0x500 [ 194.489216][ T2589] should_fail_usercopy+0x1a/0x20 [ 194.494229][ T2589] _copy_to_user+0x20/0x90 [ 194.498636][ T2589] simple_read_from_buffer+0xe9/0x160 [ 194.504094][ T2589] proc_fail_nth_read+0x1a6/0x220 [ 194.509124][ T2589] ? proc_fault_inject_write+0x310/0x310 [ 194.514754][ T2589] ? security_file_permission+0x83/0xa0 [ 194.520295][ T2589] ? proc_fault_inject_write+0x310/0x310 [ 194.525923][ T2589] vfs_read+0x28c/0xc20 [ 194.530073][ T2589] ? kernel_read+0x1f0/0x1f0 [ 194.534660][ T2589] ? __kasan_check_write+0x14/0x20 [ 194.539766][ T2589] ? mutex_lock+0x9b/0x1c0 [ 194.544175][ T2589] ? wait_for_completion_killable_timeout+0x10/0x10 [ 194.550763][ T2589] ? __fget_files+0x2e1/0x340 [ 194.555431][ T2589] ? __fdget_pos+0x2d2/0x380 [ 194.560010][ T2589] ? ksys_read+0x70/0x260 [ 194.564333][ T2589] ksys_read+0x14a/0x260 [ 194.568576][ T2589] ? vfs_write+0xfd0/0xfd0 [ 194.572988][ T2589] ? __kasan_check_write+0x14/0x20 [ 194.578097][ T2589] ? switch_fpu_return+0x15d/0x2c0 [ 194.583204][ T2589] __x64_sys_read+0x7b/0x90 [ 194.587700][ T2589] x64_sys_call+0x96d/0x9a0 [ 194.592193][ T2589] do_syscall_64+0x4c/0xa0 [ 194.596603][ T2589] ? clear_bhb_loop+0x50/0xa0 [ 194.601276][ T2589] ? clear_bhb_loop+0x50/0xa0 [ 194.605950][ T2589] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 194.611801][ T2587] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 194.611830][ T2589] RIP: 0033:0x7f44141109ce [ 194.626709][ T2589] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 194.646330][ T2589] RSP: 002b:00007f4412ba8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 194.654721][ T2589] RAX: ffffffffffffffda RBX: 00007f4412ba96c0 RCX: 00007f44141109ce [ 194.662670][ T2589] RDX: 000000000000000f RSI: 00007f4412ba90a0 RDI: 0000000000000005 [ 194.670701][ T2589] RBP: 00007f4412ba9090 R08: 0000000000000000 R09: 0000000000000000 [ 194.678658][ T2589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.686614][ T2589] R13: 00007f44143d8038 R14: 00007f44143d7fa0 R15: 00007ffef16a2ab8 [ 194.694587][ T2589] [ 194.708560][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 194.717118][ T2597] loop6: detected capacity change from 0 to 128 [ 194.724951][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 194.734870][ T325] udevd[325]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 194.737460][ T2601] loop0: detected capacity change from 0 to 128 [ 194.746210][ T325] udevd[325]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 194.751620][ T1913] udevd[1913]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 194.770585][ T30] audit: type=1400 audit(1791403604.821:406): avc: denied { sys_module } for pid=2600 comm="syz.1.580" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 194.792766][ T63] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 194.811387][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 194.847640][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 194.860885][ T63] usb 7-1: USB disconnect, device number 7 [ 194.868334][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 194.878929][ T2605] SELinux: policydb magic number 0x6ac6a654 does not match expected magic number 0xf97cff8c [ 194.884927][ T2601] overlayfs: filesystem on './file0' not supported [ 194.892188][ T2605] SELinux: failed to load policy [ 194.921304][ T2607] loop6: detected capacity change from 0 to 512 [ 194.970305][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 194.984402][ T2609] loop2: detected capacity change from 0 to 16 [ 195.023818][ T343] udevd[343]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 195.036067][ T2609] erofs: (device loop2): mounted with root inode @ nid 36. [ 195.421024][ T2607] loop6: detected capacity change from 0 to 4096 [ 195.543913][ T2607] EXT4-fs (loop6): Test dummy encryption mode enabled [ 195.863517][ T2607] EXT4-fs (loop6): Quota format mount options ignored when QUOTA feature is enabled [ 195.880731][ T2607] EXT4-fs (loop6): Quota format mount options ignored when QUOTA feature is enabled [ 195.915229][ T2607] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=842c0a8, mo2=0003] [ 195.932303][ T2614] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 195.950755][ T2616] loop0: detected capacity change from 0 to 512 [ 195.967386][ T2607] EXT4-fs (loop6): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,delalloc,max_dir_size_kb=0x0000000000000008,noblock_validity,minixdf,sysvgroups,errors=remount-ro,jqfmt=vfsv0,acl,noinit_itable,jqfmt=vfsv1,. Quota mode: writeback. [ 196.013059][ T2611] loop1: detected capacity change from 0 to 40427 [ 196.020075][ T2614] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 196.054129][ T2611] F2FS-fs (loop1): invalid crc value [ 196.060983][ T2611] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 196.094213][ T2616] loop0: detected capacity change from 0 to 256 [ 196.108386][ T2611] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 196.130827][ T2626] attempt to access beyond end of device [ 196.130827][ T2626] loop1: rw=10241, want=45104, limit=40427 [ 196.134854][ T2616] exFAT-fs (loop0): Invalid boot checksum (boot checksum : 0x1119abd0, checksum : 0x0b1b2bd0) [ 196.276787][ T2629] loop3: detected capacity change from 0 to 16 [ 196.300777][ T2616] exFAT-fs (loop0): invalid boot region [ 196.306412][ T2616] exFAT-fs (loop0): failed to recognize exfat type [ 196.691919][ T2629] erofs: (device loop3): mounted with root inode @ nid 36. [ 197.721907][ T2622] attempt to access beyond end of device [ 197.721907][ T2622] loop1: rw=2049, want=45120, limit=40427 [ 198.240389][ T30] audit: type=1400 audit(1791403608.271:407): avc: denied { write } for pid=2615 comm="syz.0.584" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 198.712814][ T2651] erofs: (device loop3): mounted with root inode @ nid 36. [ 198.730346][ T2651] input: syz0 as /devices/virtual/input/input100 [ 198.980849][ T2653] overlayfs: filesystem on './file0' not supported [ 199.427766][ T2640] set_capacity_and_notify: 3 callbacks suppressed [ 199.427782][ T2640] loop0: detected capacity change from 0 to 256 [ 199.872328][ T2668] loop6: detected capacity change from 0 to 16 [ 200.654832][ T2670] loop1: detected capacity change from 0 to 16 [ 200.662852][ T2668] erofs: (device loop6): mounted with root inode @ nid 36. [ 200.733548][ T2670] erofs: (device loop1): mounted with root inode @ nid 36. [ 200.751953][ T2670] input: syz0 as /devices/virtual/input/input102 [ 200.804216][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 201.210678][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 201.228100][ T30] audit: type=1326 audit(1791403611.291:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2660 comm="syz.3.597" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 201.257879][ T2674] loop0: detected capacity change from 0 to 128 [ 201.257927][ T30] audit: type=1326 audit(1791403611.291:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2660 comm="syz.3.597" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 201.295795][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 201.311963][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 201.327933][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 201.338522][ T30] audit: type=1326 audit(1791403611.321:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2660 comm="syz.3.597" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=162 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 201.393691][ T30] audit: type=1326 audit(1791403611.451:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2660 comm="syz.3.597" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 201.419740][ T2677] loop6: detected capacity change from 0 to 256 [ 201.429076][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 201.457253][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 201.471430][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 201.491895][ T325] udevd[325]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 201.502276][ T30] audit: type=1326 audit(1791403611.451:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2660 comm="syz.3.597" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 201.511354][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 201.562011][ T30] audit: type=1400 audit(1791403611.551:413): avc: denied { create } for pid=2685 comm="syz.1.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 201.584055][ T2693] loop3: detected capacity change from 0 to 512 [ 201.589673][ T2695] loop0: detected capacity change from 0 to 512 [ 201.632202][ T2693] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,max_batch_time=0x0000000000000007,,errors=continue. Quota mode: writeback. [ 201.652076][ T2693] ext4 filesystem being mounted at /124/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 201.658067][ T30] audit: type=1400 audit(1791403611.721:414): avc: denied { bind } for pid=2703 comm="syz.6.610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 201.682803][ T30] audit: type=1400 audit(1791403611.731:415): avc: denied { ioctl } for pid=2703 comm="syz.6.610" path="socket:[24296]" dev="sockfs" ino=24296 ioctlcmd=0x48e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 201.715290][ T30] audit: type=1400 audit(1791403611.781:416): avc: denied { listen } for pid=2707 comm="syz.6.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 201.788156][ T2719] loop2: detected capacity change from 0 to 16 [ 201.832532][ T2719] erofs: (device loop2): mounted with root inode @ nid 36. [ 201.849686][ T2719] input: syz0 as /devices/virtual/input/input103 [ 202.633163][ T2722] loop0: detected capacity change from 0 to 1024 [ 202.940898][ T2722] EXT4-fs (loop0): Unrecognized mount option "fowner=00000000000000000000" or missing value [ 203.224809][ T2730] loop2: detected capacity change from 0 to 128 [ 203.429509][ T2734] FAULT_INJECTION: forcing a failure. [ 203.429509][ T2734] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 203.443577][ T2734] CPU: 1 PID: 2734 Comm: syz.6.621 Not tainted syzkaller #0 [ 203.450863][ T2734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 203.460914][ T2734] Call Trace: [ 203.464190][ T2734] [ 203.467116][ T2734] __dump_stack+0x21/0x30 [ 203.471442][ T2734] dump_stack_lvl+0x110/0x170 [ 203.476116][ T2734] ? show_regs_print_info+0x20/0x20 [ 203.481305][ T2734] ? __kasan_check_read+0x11/0x20 [ 203.486320][ T2734] ? free_unref_page_commit+0x187/0x3f0 [ 203.491851][ T2734] dump_stack+0x15/0x20 [ 203.496060][ T2734] should_fail+0x3ab/0x500 [ 203.500461][ T2734] should_fail_alloc_page+0x55/0x80 [ 203.505645][ T2734] prepare_alloc_pages+0x13f/0x590 [ 203.510743][ T2734] ? __alloc_pages_bulk+0xab0/0xab0 [ 203.515926][ T2734] ? release_pages+0x1264/0x12c0 [ 203.520853][ T2734] __alloc_pages+0x11d/0x460 [ 203.525424][ T2734] ? unlock_page_memcg+0x114/0x130 [ 203.530517][ T2734] ? prep_new_page+0x110/0x110 [ 203.535262][ T2734] ? page_remove_rmap+0xc6d/0xf40 [ 203.540265][ T2734] ? page_add_file_rmap+0x700/0x700 [ 203.545443][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.550538][ T2734] ? _raw_spin_lock+0x94/0xf0 [ 203.555200][ T2734] __get_free_pages+0x10/0x30 [ 203.559860][ T2734] __tlb_remove_page_size+0x18a/0x310 [ 203.565217][ T2734] unmap_page_range+0x1059/0x1e00 [ 203.570227][ T2734] ? finish_task_switch+0x209/0x790 [ 203.575418][ T2734] ? mmu_notifier_invalidate_range_end+0xe0/0xe0 [ 203.581747][ T2734] ? tokenize_frame_descr+0x90/0xc0 [ 203.586930][ T2734] ? preempt_schedule_common+0xbe/0xf0 [ 203.592390][ T2734] ? schedule_preempt_disabled+0x20/0x20 [ 203.598005][ T2734] unmap_vmas+0x26d/0x380 [ 203.602314][ T2734] ? unmap_page_range+0x1e00/0x1e00 [ 203.607495][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.612588][ T2734] ? tlb_gather_mmu_fullmm+0x144/0x1c0 [ 203.618033][ T2734] exit_mmap+0x412/0x8b0 [ 203.622266][ T2734] ? vm_brk+0x30/0x30 [ 203.626234][ T2734] ? mutex_unlock+0x8f/0x230 [ 203.630823][ T2734] ? uprobe_clear_state+0x2c6/0x320 [ 203.636004][ T2734] __mmput+0x92/0x300 [ 203.639979][ T2734] mmput+0x50/0x150 [ 203.643770][ T2734] do_exit+0xacc/0x29a0 [ 203.647907][ T2734] ? put_task_struct+0x90/0x90 [ 203.652653][ T2734] ? kstrtouint_from_user+0x1c4/0x220 [ 203.658047][ T2734] ? kstrtol_from_user+0x2a0/0x2a0 [ 203.663163][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.668257][ T2734] ? _raw_spin_lock_irq+0x95/0xf0 [ 203.673265][ T2734] do_group_exit+0x149/0x310 [ 203.677843][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.682935][ T2734] ? recalc_sigpending+0x1ac/0x230 [ 203.688029][ T2734] get_signal+0x64f/0x1430 [ 203.692431][ T2734] arch_do_signal_or_restart+0xe2/0x1100 [ 203.698044][ T2734] ? file_end_write+0x1b0/0x1b0 [ 203.702875][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.707966][ T2734] ? mutex_unlock+0x8f/0x230 [ 203.712538][ T2734] ? get_sigframe_size+0x10/0x10 [ 203.717457][ T2734] ? __se_sys_futex+0x135/0x330 [ 203.722289][ T2734] ? __kasan_check_write+0x14/0x20 [ 203.727388][ T2734] ? __ia32_sys_read+0x90/0x90 [ 203.732147][ T2734] exit_to_user_mode_loop+0xa7/0xe0 [ 203.737355][ T2734] exit_to_user_mode_prepare+0x87/0xd0 [ 203.742799][ T2734] syscall_exit_to_user_mode+0x1a/0x30 [ 203.748282][ T2734] do_syscall_64+0x58/0xa0 [ 203.752689][ T2734] ? clear_bhb_loop+0x50/0xa0 [ 203.757378][ T2734] ? clear_bhb_loop+0x50/0xa0 [ 203.762047][ T2734] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 203.767927][ T2734] RIP: 0033:0x7fcf6196d199 [ 203.772332][ T2734] Code: Unable to access opcode bytes at RIP 0x7fcf6196d16f. [ 203.779684][ T2734] RSP: 002b:00007fcf603c60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 203.788088][ T2734] RAX: 0000000000000001 RBX: 00007fcf61bf4fa8 RCX: 00007fcf6196d199 [ 203.796049][ T2734] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fcf61bf4fac [ 203.804010][ T2734] RBP: 00007fcf61bf4fa0 R08: 0016f5e6671141e0 R09: 0000000000000000 [ 203.811964][ T2734] R10: 000000000000004e R11: 0000000000000246 R12: 0000000000000000 [ 203.819917][ T2734] R13: 00007fcf61bf5038 R14: 00007fff492c7d20 R15: 00007fff492c7e08 [ 203.827876][ T2734] [ 203.832910][ T445] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 203.848947][ T2737] input: syz0 as /devices/virtual/input/input104 [ 203.865363][ T2730] EXT4-fs (loop2): mounted filesystem without journal. Opts: usrquota,barrier=0x0000000000000007,,errors=continue. Quota mode: writeback. [ 203.886130][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 203.886143][ T30] audit: type=1400 audit(1791403613.951:418): avc: denied { write } for pid=2744 comm="syz.6.626" name="functions" dev="configfs" ino=16754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 203.886569][ T2730] ext4 filesystem being mounted at /127/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 203.892586][ T30] audit: type=1400 audit(1791403613.951:419): avc: denied { add_name } for pid=2744 comm="syz.6.626" name="acm.usb0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 203.916284][ T2745] Need at least one configuration in g1. [ 203.952475][ T2745] udc dummy_udc.0: failed to start g1: -22 [ 203.963629][ T30] audit: type=1400 audit(1791403613.981:420): avc: denied { write } for pid=2744 comm="syz.6.626" name="UDC" dev="configfs" ino=24928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 203.986166][ T30] audit: type=1400 audit(1791403613.981:421): avc: denied { open } for pid=2744 comm="syz.6.626" path="/95/config/usb_gadget/g1/UDC" dev="configfs" ino=24928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 204.049513][ T2755] netlink: 20 bytes leftover after parsing attributes in process `syz.2.629'. [ 204.168637][ T2767] netlink: 32 bytes leftover after parsing attributes in process `syz.0.635'. [ 204.188224][ T2771] FAULT_INJECTION: forcing a failure. [ 204.188224][ T2771] name failslab, interval 1, probability 0, space 0, times 0 [ 204.210519][ T445] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 204.257808][ T2771] CPU: 1 PID: 2771 Comm: syz.2.638 Not tainted syzkaller #0 [ 204.265148][ T2771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 204.275224][ T2771] Call Trace: [ 204.278509][ T2771] [ 204.281445][ T2771] __dump_stack+0x21/0x30 [ 204.285780][ T2771] dump_stack_lvl+0x110/0x170 [ 204.290460][ T2771] ? show_regs_print_info+0x20/0x20 [ 204.295661][ T2771] ? avc_has_perm_noaudit+0x490/0x490 [ 204.301058][ T2771] ? unwind_get_return_address+0x4d/0x90 [ 204.306705][ T2771] dump_stack+0x15/0x20 [ 204.310869][ T2771] should_fail+0x3ab/0x500 [ 204.315322][ T2771] __should_failslab+0xa4/0xe0 [ 204.320095][ T2771] should_failslab+0x9/0x20 [ 204.324606][ T2771] slab_pre_alloc_hook+0x39/0xd0 [ 204.329556][ T2771] kmem_cache_alloc_trace+0x48/0x270 [ 204.334843][ T2771] ? proc_self_get_link+0xe6/0x180 [ 204.339957][ T2771] proc_self_get_link+0xe6/0x180 [ 204.344901][ T2771] ? proc_setup_self+0x310/0x310 [ 204.349841][ T2771] pick_link+0x711/0xe00 [ 204.354088][ T2771] step_into+0xac8/0xce0 [ 204.358431][ T2771] ? lookup_fast+0x2ad/0x720 [ 204.363029][ T2771] ? set_root+0x400/0x400 [ 204.367378][ T2771] walk_component+0x263/0x460 [ 204.372063][ T2771] link_path_walk+0x688/0xde0 [ 204.376753][ T2771] ? handle_lookup_down+0x130/0x130 [ 204.381962][ T2771] path_openat+0x282/0x2f80 [ 204.386479][ T2771] ? __kasan_slab_alloc+0xc9/0xe0 [ 204.391512][ T2771] ? __kasan_slab_alloc+0xb7/0xe0 [ 204.396544][ T2771] ? slab_post_alloc_hook+0x4f/0x2b0 [ 204.401839][ T2771] ? do_sys_openat2+0xeb/0x7f0 [ 204.406606][ T2771] ? __x64_sys_openat+0x136/0x160 [ 204.411648][ T2771] ? x64_sys_call+0x219/0x9a0 [ 204.416333][ T2771] ? do_syscall_64+0x4c/0xa0 [ 204.420932][ T2771] ? do_filp_open+0x400/0x400 [ 204.425618][ T2771] do_filp_open+0x1df/0x400 [ 204.430135][ T2771] ? vfs_tmpfile+0x2d0/0x2d0 [ 204.434738][ T2771] do_sys_openat2+0x15e/0x7f0 [ 204.439417][ T2771] ? __se_sys_futex+0x135/0x330 [ 204.444282][ T2771] ? do_sys_open+0xe0/0xe0 [ 204.448700][ T2771] ? __x64_sys_futex+0x100/0x100 [ 204.453645][ T2771] ? ksys_write+0x1fa/0x260 [ 204.458152][ T2771] __x64_sys_openat+0x136/0x160 [ 204.463007][ T2771] x64_sys_call+0x219/0x9a0 [ 204.467517][ T2771] do_syscall_64+0x4c/0xa0 [ 204.471934][ T2771] ? clear_bhb_loop+0x50/0xa0 [ 204.476626][ T2771] ? clear_bhb_loop+0x50/0xa0 [ 204.481312][ T2771] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 204.487212][ T2771] RIP: 0033:0x7f44141109ce [ 204.491636][ T2771] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 204.511248][ T2771] RSP: 002b:00007f4412ba8ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 204.519674][ T2771] RAX: ffffffffffffffda RBX: 00007f4412ba96c0 RCX: 00007f44141109ce [ 204.527672][ T2771] RDX: 0000000000000002 RSI: 00007f4412ba8f90 RDI: ffffffffffffff9c [ 204.535669][ T2771] RBP: 00007f44141e78e0 R08: 0000000000000000 R09: 0000000000000000 [ 204.543648][ T2771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 204.551630][ T2771] R13: 00007f44143d8038 R14: 00007f44143d7fa0 R15: 00007ffef16a2ab8 [ 204.559618][ T2771] [ 204.595968][ T2781] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0xa9436649, utbl_chksum : 0xe619d30d) [ 204.610480][ T445] usb 4-1: New USB device found, idVendor=0582, idProduct=009a, bcdDevice= 0.40 [ 204.629724][ T445] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.630545][ T402] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 204.638185][ T445] usb 4-1: Product: syz [ 204.652819][ T30] audit: type=1400 audit(1791403614.721:422): avc: denied { write } for pid=2780 comm="syz.0.640" name="/" dev="loop0" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 204.678971][ T2783] tipc: Started in network mode [ 204.685504][ T2783] tipc: Node identity 665aad67f563, cluster identity 4711 [ 204.692708][ T445] usb 4-1: Manufacturer: syz [ 204.698426][ T2783] tipc: Enabled bearer , priority 10 [ 204.705172][ T30] audit: type=1400 audit(1791403614.721:423): avc: denied { remove_name } for pid=2780 comm="syz.0.640" name="file1" dev="loop0" ino=1048743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 204.728143][ T445] usb 4-1: can't set config #1, error -71 [ 204.734189][ T2785] set_capacity_and_notify: 2 callbacks suppressed [ 204.740554][ T445] usb 4-1: USB disconnect, device number 11 [ 204.756057][ T2782] tipc: Resetting bearer [ 204.760584][ T2785] loop2: detected capacity change from 0 to 512 [ 204.771805][ T2782] tipc: Disabling bearer [ 204.778467][ T30] audit: type=1400 audit(1791403614.721:424): avc: denied { rename } for pid=2780 comm="syz.0.640" name="file1" dev="loop0" ino=1048743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 204.810465][ T30] audit: type=1400 audit(1791403614.721:425): avc: denied { add_name } for pid=2780 comm="syz.0.640" name="file2" dev="loop0" ino=1048744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 204.833466][ T30] audit: type=1400 audit(1791403614.721:426): avc: denied { unlink } for pid=2780 comm="syz.0.640" name="file2" dev="loop0" ino=1048744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 204.857843][ T2785] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 204.871822][ T30] audit: type=1400 audit(1791403614.861:427): avc: denied { create } for pid=2789 comm="syz.0.644" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 204.901292][ T2785] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 204.928192][ T2785] System zones: 1-12 [ 204.940348][ T2785] EXT4-fs error (device loop2): ext4_orphan_get:1436: comm syz.2.642: bad orphan inode 131072 [ 204.962707][ T2785] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,data=journal,norecovery,,errors=continue. Quota mode: none. [ 205.020539][ T402] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.052260][ T402] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 205.068484][ T2785] overlayfs: upper fs needs to support d_type. [ 205.090410][ T402] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 205.119667][ T402] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 205.130914][ T288] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 13: comm syz-executor: path /132/bus: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 205.139000][ T402] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.175358][ T402] usb 7-1: config 0 descriptor?? [ 205.259720][ T2818] netlink: 4 bytes leftover after parsing attributes in process `syz.3.654'. [ 205.689598][ T2833] mmap: syz.3.661 (2833): VmData 29089792 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 205.756983][ T2837] FAULT_INJECTION: forcing a failure. [ 205.756983][ T2837] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 205.770331][ T2837] CPU: 1 PID: 2837 Comm: syz.1.663 Not tainted syzkaller #0 [ 205.777627][ T2837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 205.787731][ T2837] Call Trace: [ 205.791012][ T2837] [ 205.793944][ T2837] __dump_stack+0x21/0x30 [ 205.798279][ T2837] dump_stack_lvl+0x110/0x170 [ 205.802957][ T2837] ? show_regs_print_info+0x20/0x20 [ 205.808161][ T2837] ? free_unref_page_commit+0x187/0x3f0 [ 205.813716][ T2837] dump_stack+0x15/0x20 [ 205.817876][ T2837] should_fail+0x3ab/0x500 [ 205.822297][ T2837] should_fail_alloc_page+0x55/0x80 [ 205.827496][ T2837] prepare_alloc_pages+0x13f/0x590 [ 205.832610][ T2837] ? __alloc_pages_bulk+0xab0/0xab0 [ 205.837825][ T2837] ? release_pages+0x1264/0x12c0 [ 205.842814][ T2837] __alloc_pages+0x11d/0x460 [ 205.847410][ T2837] ? unlock_page_memcg+0x114/0x130 [ 205.852547][ T2837] ? prep_new_page+0x110/0x110 [ 205.857321][ T2837] ? page_remove_rmap+0xc6d/0xf40 [ 205.862352][ T2837] ? page_add_file_rmap+0x700/0x700 [ 205.867556][ T2837] ? __kasan_check_write+0x14/0x20 [ 205.872676][ T2837] ? _raw_spin_lock+0x94/0xf0 [ 205.877360][ T2837] __get_free_pages+0x10/0x30 [ 205.882041][ T2837] __tlb_remove_page_size+0x18a/0x310 [ 205.887420][ T2837] unmap_page_range+0x1059/0x1e00 [ 205.892450][ T2837] ? mmu_notifier_invalidate_range_end+0xe0/0xe0 [ 205.898780][ T2837] ? lru_cache_add+0x7e0/0x7e0 [ 205.903547][ T2837] ? schedule_preempt_disabled+0x20/0x20 [ 205.909200][ T2837] unmap_vmas+0x26d/0x380 [ 205.913529][ T2837] ? unmap_page_range+0x1e00/0x1e00 [ 205.918729][ T2837] ? __kasan_check_write+0x14/0x20 [ 205.923844][ T2837] ? tlb_gather_mmu_fullmm+0x144/0x1c0 [ 205.929306][ T2837] exit_mmap+0x412/0x8b0 [ 205.933551][ T2837] ? vm_brk+0x30/0x30 [ 205.937537][ T2837] ? mutex_unlock+0x8f/0x230 [ 205.942128][ T2837] ? uprobe_clear_state+0x2c6/0x320 [ 205.947328][ T2837] __mmput+0x92/0x300 [ 205.951306][ T2837] mmput+0x50/0x150 [ 205.955112][ T2837] do_exit+0xacc/0x29a0 [ 205.959267][ T2837] ? _raw_spin_lock_irq+0xf0/0xf0 [ 205.964287][ T2837] ? put_task_struct+0x90/0x90 [ 205.969051][ T2837] ? __local_bh_enable_ip+0x58/0x80 [ 205.974258][ T2837] ? __kasan_check_write+0x14/0x20 [ 205.979365][ T2837] ? _raw_spin_lock_irq+0x95/0xf0 [ 205.984385][ T2837] do_group_exit+0x149/0x310 [ 205.988968][ T2837] ? __kasan_check_write+0x14/0x20 [ 205.994076][ T2837] ? recalc_sigpending+0x1ac/0x230 [ 205.999184][ T2837] get_signal+0x64f/0x1430 [ 206.003606][ T2837] arch_do_signal_or_restart+0xe2/0x1100 [ 206.009237][ T2837] ? __fget_files+0x2e1/0x340 [ 206.013919][ T2837] ? get_sigframe_size+0x10/0x10 [ 206.018852][ T2837] ? __se_sys_futex+0x135/0x330 [ 206.023708][ T2837] exit_to_user_mode_loop+0xa7/0xe0 [ 206.029167][ T2837] exit_to_user_mode_prepare+0x87/0xd0 [ 206.034623][ T2837] syscall_exit_to_user_mode+0x1a/0x30 [ 206.040082][ T2837] do_syscall_64+0x58/0xa0 [ 206.044536][ T2837] ? clear_bhb_loop+0x50/0xa0 [ 206.049208][ T2837] ? clear_bhb_loop+0x50/0xa0 [ 206.053882][ T2837] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 206.059771][ T2837] RIP: 0033:0x7fc8523ce199 [ 206.064180][ T2837] Code: Unable to access opcode bytes at RIP 0x7fc8523ce16f. [ 206.071537][ T2837] RSP: 002b:00007fc850e270e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 206.079955][ T2837] RAX: 0000000000000001 RBX: 00007fc852655fa8 RCX: 00007fc8523ce199 [ 206.087927][ T2837] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc852655fac [ 206.095896][ T2837] RBP: 00007fc852655fa0 R08: 002aa14cc0353898 R09: 0000000000000000 [ 206.103871][ T2837] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 206.111845][ T2837] R13: 00007fc852656038 R14: 00007ffc936bc730 R15: 00007ffc936bc818 [ 206.119824][ T2837] [ 206.141703][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.159261][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.176998][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.190507][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.203259][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.381202][ T2839] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.405111][ T2839] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.418285][ T2839] device bridge_slave_0 entered promiscuous mode [ 206.435315][ T2850] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 206.443384][ T2851] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 206.457694][ T2839] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.470427][ T2839] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.486115][ T2839] device bridge_slave_1 entered promiscuous mode [ 206.500628][ T2852] sch_tbf: burst 10 is lower than device lo mtu (65550) ! [ 206.647711][ T2839] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.654803][ T2839] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.662111][ T2839] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.669129][ T2839] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.729301][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.737034][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.744483][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.744695][ T1521] device bridge_slave_1 left promiscuous mode [ 206.751903][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.751926][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.751946][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.751966][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.751985][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.752002][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.752020][ T402] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 206.752243][ T402] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 206.763509][ T1521] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.768054][ T402] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 206.837367][ T1521] device bridge_slave_0 left promiscuous mode [ 206.841357][ T402] usb 7-1: USB disconnect, device number 8 [ 206.845148][ T1521] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.871165][ T2861] udevd[2861]: open /dev/null failed: No such file or directory [ 206.888009][ T1521] device veth1_macvtap left promiscuous mode [ 206.908152][ T1521] device veth0_vlan left promiscuous mode [ 206.989114][ T2866] binder: 2858:2866 ioctl 4018620d 0 returned -22 [ 206.995957][ T2866] binder: 2858:2866 ioctl c0306201 0 returned -14 [ 207.104344][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.113826][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.124427][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.134087][ T2871] loop0: detected capacity change from 0 to 512 [ 207.141368][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.149715][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 207.163105][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.171744][ T306] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.178805][ T306] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.186379][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.195013][ T306] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.202179][ T306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.215494][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.223706][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.232990][ T2871] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 207.252468][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.259498][ T2871] ext4 filesystem being mounted at /132/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.268945][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.332798][ T2839] device veth0_vlan entered promiscuous mode [ 207.472348][ T2890] loop6: detected capacity change from 0 to 256 [ 207.481220][ T2839] device veth1_macvtap entered promiscuous mode [ 207.492334][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 207.541471][ T2890] exfat: Deprecated parameter 'utf8' [ 207.551866][ T2890] exfat: Deprecated parameter 'namecase' [ 207.580516][ T2890] exfat: Deprecated parameter 'namecase' [ 207.599645][ T2890] exfat: Deprecated parameter 'utf8' [ 207.625285][ T2890] exFAT-fs (loop6): failed to load upcase table (idx : 0x00012153, chksum : 0x6a70c931, utbl_chksum : 0xe619d30d) [ 207.786911][ T2913] kvm: pic: non byte write [ 207.808731][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 207.817979][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 207.827096][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 207.835367][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 207.843913][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 207.852230][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 207.860580][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 207.876617][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 207.885173][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 207.893877][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 207.902526][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 207.911857][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 207.919554][ T1056] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 207.931676][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 207.952862][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 208.277976][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 208.343346][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 208.370038][ T2940] netlink: 8 bytes leftover after parsing attributes in process `syz.6.700'. [ 208.396552][ T2937] kvm: pic: non byte write [ 209.177874][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 209.177907][ T30] audit: type=1400 audit(1791403619.241:452): avc: denied { mounton } for pid=2950 comm="syz.6.705" path="/110/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 209.497251][ T30] audit: type=1400 audit(1791403619.561:453): avc: denied { bind } for pid=2975 comm="syz.0.714" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 209.532984][ T30] audit: type=1400 audit(1791403619.591:454): avc: denied { map } for pid=2975 comm="syz.0.714" path="socket:[26361]" dev="sockfs" ino=26361 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 209.626930][ T30] audit: type=1400 audit(1791403619.591:455): avc: denied { read write } for pid=2975 comm="syz.0.714" path="socket:[26361]" dev="sockfs" ino=26361 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 209.895967][ T2985] FAULT_INJECTION: forcing a failure. [ 209.895967][ T2985] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 209.909295][ T2985] CPU: 1 PID: 2985 Comm: syz.7.716 Not tainted syzkaller #0 [ 209.916587][ T2985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 209.926648][ T2985] Call Trace: [ 209.929934][ T2985] [ 209.932868][ T2985] __dump_stack+0x21/0x30 [ 209.937203][ T2985] dump_stack_lvl+0x110/0x170 [ 209.941891][ T2985] ? show_regs_print_info+0x20/0x20 [ 209.947098][ T2985] ? 0xffffffffa002a000 [ 209.951254][ T2985] dump_stack+0x15/0x20 [ 209.955407][ T2985] should_fail+0x3ab/0x500 [ 209.959825][ T2985] should_fail_alloc_page+0x55/0x80 [ 209.965024][ T2985] prepare_alloc_pages+0x13f/0x590 [ 209.970146][ T2985] ? __alloc_pages_bulk+0xab0/0xab0 [ 209.975342][ T2985] ? __update_load_avg_cfs_rq+0xb1/0x2e0 [ 209.980980][ T2985] __alloc_pages+0x11d/0x460 [ 209.985570][ T2985] ? unlock_page_memcg+0x114/0x130 [ 209.990683][ T2985] ? prep_new_page+0x110/0x110 [ 209.995448][ T2985] ? page_remove_rmap+0xc6d/0xf40 [ 210.000475][ T2985] ? page_add_file_rmap+0x700/0x700 [ 210.005666][ T2985] ? mark_page_accessed+0x3a8/0x8e0 [ 210.010876][ T2985] __get_free_pages+0x10/0x30 [ 210.015582][ T2985] __tlb_remove_page_size+0x18a/0x310 [ 210.020956][ T2985] unmap_page_range+0x1059/0x1e00 [ 210.025981][ T2985] ? mmu_notifier_invalidate_range_end+0xe0/0xe0 [ 210.032307][ T2985] ? lru_cache_add+0x7e0/0x7e0 [ 210.037071][ T2985] ? schedule_preempt_disabled+0x20/0x20 [ 210.042709][ T2985] unmap_vmas+0x26d/0x380 [ 210.047058][ T2985] ? unmap_page_range+0x1e00/0x1e00 [ 210.052252][ T2985] ? __kasan_check_write+0x14/0x20 [ 210.057461][ T2985] ? tlb_gather_mmu_fullmm+0x144/0x1c0 [ 210.063083][ T2985] exit_mmap+0x412/0x8b0 [ 210.067332][ T2985] ? vm_brk+0x30/0x30 [ 210.071316][ T2985] ? mutex_unlock+0x8f/0x230 [ 210.075911][ T2985] ? uprobe_clear_state+0x2c6/0x320 [ 210.081115][ T2985] __mmput+0x92/0x300 [ 210.081745][ T2989] loop3: detected capacity change from 0 to 512 [ 210.085133][ T2985] mmput+0x50/0x150 [ 210.085153][ T2985] do_exit+0xacc/0x29a0 [ 210.085170][ T2985] ? put_task_struct+0x90/0x90 [ 210.093058][ T30] audit: type=1400 audit(1791403620.131:456): avc: denied { setopt } for pid=2986 comm="syz.6.718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 210.095180][ T2985] ? __kasan_check_write+0x14/0x20 [ 210.100296][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 210.104073][ T2985] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 210.104093][ T2985] ? _raw_spin_lock+0xf0/0xf0 [ 210.104106][ T2985] ? __kasan_check_write+0x14/0x20 [ 210.104124][ T2985] ? _raw_spin_lock_irq+0x95/0xf0 [ 210.104139][ T2985] do_group_exit+0x149/0x310 [ 210.162772][ T2985] ? __kasan_check_write+0x14/0x20 [ 210.167868][ T2985] ? recalc_sigpending+0x1ac/0x230 [ 210.172960][ T2985] get_signal+0x64f/0x1430 [ 210.177376][ T2985] arch_do_signal_or_restart+0xe2/0x1100 [ 210.182989][ T2985] ? get_sigframe_size+0x10/0x10 [ 210.187919][ T2985] ? __se_sys_futex+0x135/0x330 [ 210.192770][ T2985] exit_to_user_mode_loop+0xa7/0xe0 [ 210.197963][ T2985] exit_to_user_mode_prepare+0x87/0xd0 [ 210.203406][ T2985] syscall_exit_to_user_mode+0x1a/0x30 [ 210.208846][ T2985] do_syscall_64+0x58/0xa0 [ 210.213239][ T2985] ? clear_bhb_loop+0x50/0xa0 [ 210.217896][ T2985] ? clear_bhb_loop+0x50/0xa0 [ 210.222585][ T2985] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 210.228455][ T2985] RIP: 0033:0x7f5334f26199 [ 210.232846][ T2985] Code: Unable to access opcode bytes at RIP 0x7f5334f2616f. [ 210.240193][ T2985] RSP: 002b:00007f533397f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 210.248583][ T2985] RAX: 0000000000000001 RBX: 00007f53351adfa8 RCX: 00007f5334f26199 [ 210.256532][ T2985] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f53351adfac [ 210.264504][ T2985] RBP: 00007f53351adfa0 R08: 0032f9877b294fa8 R09: 0000000000000000 [ 210.272454][ T2985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 210.280410][ T2985] R13: 00007f53351ae038 R14: 00007fffdae126d0 R15: 00007fffdae127b8 [ 210.288381][ T2985] [ 210.304594][ T2989] EXT4-fs error (device loop3): ext4_orphan_get:1436: comm syz.3.717: bad orphan inode 15 [ 210.317093][ T2989] ext4_test_bit(bit=14, block=5) = 0 [ 210.322490][ T2989] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,lazytime,journal_dev=0x0000000000000003,min_batch_time=0x000000000000004a,nobarrier,journal_ioprio=0x0000000000000003,nolazytime,noload,,errors=continue. Quota mode: none. [ 210.348992][ T2989] EXT4-fs error (device loop3): __ext4_new_inode:1084: comm syz.3.717: reserved inode found cleared - inode=1 [ 210.394754][ T2997] pit: kvm: requested 134095 ns i8254 timer period limited to 200000 ns [ 210.403466][ T2997] pit: kvm: requested 41066 ns i8254 timer period limited to 200000 ns [ 210.414704][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 210.418025][ T2997] pit: kvm: requested 43580 ns i8254 timer period limited to 200000 ns [ 210.432973][ T2997] pit: kvm: requested 154209 ns i8254 timer period limited to 200000 ns [ 210.441681][ T2997] pit: kvm: requested 122361 ns i8254 timer period limited to 200000 ns [ 210.453651][ T2997] pit: kvm: requested 64533 ns i8254 timer period limited to 200000 ns [ 210.453789][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 210.462225][ T2997] pit: kvm: requested 92190 ns i8254 timer period limited to 200000 ns [ 210.480159][ T2997] pit: kvm: requested 90514 ns i8254 timer period limited to 200000 ns [ 210.488843][ T2997] pit: kvm: requested 22628 ns i8254 timer period limited to 200000 ns [ 210.531714][ T3015] capability: warning: `syz.1.728' uses deprecated v2 capabilities in a way that may be insecure [ 210.651824][ T3030] ipvlan1: renamed from veth0_vlan [ 210.661068][ T3035] FAULT_INJECTION: forcing a failure. [ 210.661068][ T3035] name failslab, interval 1, probability 0, space 0, times 0 [ 210.673723][ T3035] CPU: 1 PID: 3035 Comm: syz.0.736 Not tainted syzkaller #0 [ 210.681103][ T3035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 210.691168][ T3035] Call Trace: [ 210.694450][ T3035] [ 210.697379][ T3035] __dump_stack+0x21/0x30 [ 210.701717][ T3035] dump_stack_lvl+0x110/0x170 [ 210.706410][ T3035] ? show_regs_print_info+0x20/0x20 [ 210.711614][ T3035] dump_stack+0x15/0x20 [ 210.715770][ T3035] should_fail+0x3ab/0x500 [ 210.720190][ T3035] ? inet6_rt_notify+0x293/0x480 [ 210.725127][ T3035] __should_failslab+0xa4/0xe0 [ 210.729898][ T3035] should_failslab+0x9/0x20 [ 210.734405][ T3035] slab_pre_alloc_hook+0x39/0xd0 [ 210.739348][ T3035] ? inet6_rt_notify+0x293/0x480 [ 210.744285][ T3035] ? inet6_rt_notify+0x293/0x480 [ 210.749231][ T3035] __kmalloc_track_caller+0x6c/0x2c0 [ 210.754517][ T3035] ? inet6_rt_notify+0x293/0x480 [ 210.759448][ T3035] ? inet6_rt_notify+0x293/0x480 [ 210.764386][ T3035] __alloc_skb+0x210/0x730 [ 210.768803][ T3035] inet6_rt_notify+0x293/0x480 [ 210.773556][ T3035] ? rt6_nh_dump_exceptions+0x6b0/0x6b0 [ 210.779085][ T3035] ? call_fib_notifiers+0xa0/0xc0 [ 210.784094][ T3035] fib6_add+0x223f/0x3d70 [ 210.788413][ T3035] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 210.794469][ T3035] ? fib6_update_sernum_stub+0x190/0x190 [ 210.800089][ T3035] ? __kasan_check_write+0x14/0x20 [ 210.805187][ T3035] ? _raw_spin_lock_bh+0x94/0xf0 [ 210.810111][ T3035] ip6_ins_rt+0xd3/0x130 [ 210.814341][ T3035] ? rt6_lookup+0x220/0x220 [ 210.818829][ T3035] ? _raw_spin_lock+0x94/0xf0 [ 210.823493][ T3035] ? _raw_spin_trylock_bh+0x150/0x150 [ 210.828848][ T3035] __ipv6_dev_ac_inc+0x65c/0x860 [ 210.833782][ T3035] ipv6_sock_ac_join+0x479/0x600 [ 210.838709][ T3035] ipv6_setsockopt+0x20db/0x3750 [ 210.843634][ T3035] ? ipv6_update_options+0x410/0x410 [ 210.848903][ T3035] ? __kasan_check_write+0x14/0x20 [ 210.854004][ T3035] ? wake_up_q+0x106/0x1b0 [ 210.858406][ T3035] ? futex_wake+0x64b/0x8f0 [ 210.862902][ T3035] ? futex_wait+0x8f0/0x8f0 [ 210.867389][ T3035] ? __asan_set_shadow_00+0xe/0x10 [ 210.872486][ T3035] ? avc_has_perm_noaudit+0x390/0x490 [ 210.877846][ T3035] ? memcpy+0x56/0x70 [ 210.881813][ T3035] ? avc_has_perm_noaudit+0x30a/0x490 [ 210.887168][ T3035] ? avc_denied+0x1b0/0x1b0 [ 210.891656][ T3035] ? avc_has_perm+0x163/0x250 [ 210.896316][ T3035] ? avc_has_perm_noaudit+0x490/0x490 [ 210.901672][ T3035] ? slab_post_alloc_hook+0x6d/0x2b0 [ 210.906944][ T3035] ? should_failslab+0x9/0x20 [ 210.911639][ T3035] ? selinux_socket_setsockopt+0x282/0x360 [ 210.917430][ T3035] ? selinux_socket_getsockopt+0x340/0x340 [ 210.923221][ T3035] ? __fget_files+0x2e1/0x340 [ 210.927880][ T3035] udpv6_setsockopt+0x92/0xb0 [ 210.932545][ T3035] sock_common_setsockopt+0xa0/0xb0 [ 210.937726][ T3035] ? sock_common_recvmsg+0x1c0/0x1c0 [ 210.943025][ T3035] __sys_setsockopt+0x2e9/0x470 [ 210.947859][ T3035] ? __ia32_sys_recv+0xb0/0xb0 [ 210.952605][ T3035] ? preempt_count_add+0x90/0x1b0 [ 210.957645][ T3035] ? __kasan_check_write+0x14/0x20 [ 210.962745][ T3035] __x64_sys_setsockopt+0xbf/0xd0 [ 210.967783][ T3035] x64_sys_call+0x982/0x9a0 [ 210.972268][ T3035] do_syscall_64+0x4c/0xa0 [ 210.976669][ T3035] ? clear_bhb_loop+0x50/0xa0 [ 210.981338][ T3035] ? clear_bhb_loop+0x50/0xa0 [ 210.985999][ T3035] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 210.991880][ T3035] RIP: 0033:0x7f523f839199 [ 210.996285][ T3035] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.015875][ T3035] RSP: 002b:00007f523e292028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 211.024391][ T3035] RAX: ffffffffffffffda RBX: 00007f523fac0fa0 RCX: 00007f523f839199 [ 211.032363][ T3035] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000004 [ 211.040331][ T3035] RBP: 00007f523f8d08e0 R08: 0000000000000014 R09: 0000000000000000 [ 211.048296][ T3035] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 211.056257][ T3035] R13: 00007f523fac1038 R14: 00007f523fac0fa0 R15: 00007fff961133c8 [ 211.064223][ T3035] [ 211.229921][ T3037] loop1: detected capacity change from 0 to 40427 [ 211.233526][ T3041] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 211.257100][ T3041] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2527804186 (323558935808 ns) > initial count (117850194176 ns). Using initial count to start timer. [ 211.284265][ T3037] F2FS-fs (loop1): invalid crc value [ 211.348429][ T3037] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 211.370427][ T63] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 211.371611][ T3037] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 211.640473][ T63] usb 7-1: Using ep0 maxpacket: 8 [ 212.071148][ T3077] xt_limit: Overflow, try lower: 1207959552/384 [ 213.080457][ T63] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 213.185852][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 213.203050][ T63] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 213.306389][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 213.405156][ T63] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 213.567087][ T63] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 213.716166][ T63] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 213.734502][ T63] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 213.744619][ T63] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.122985][ T445] usb 7-1: USB disconnect, device number 9 [ 214.479041][ T30] audit: type=1400 audit(1791403624.541:457): avc: denied { bind } for pid=3106 comm="syz.6.762" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 214.559054][ T3110] kvm: vcpu 0: requested 39424 ns lapic timer period limited to 200000 ns [ 214.567732][ T3110] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3659427032 (29275416256 ns) > initial count (200000 ns). Using initial count to start timer. [ 214.666998][ T3118] loop0: detected capacity change from 0 to 512 [ 214.674549][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 214.691441][ T3118] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 214.710469][ T3118] EXT4-fs (loop0): 1 truncate cleaned up [ 214.717313][ T3118] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,usrjquota=,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 215.054392][ T30] audit: type=1400 audit(1791403625.111:458): avc: denied { rename } for pid=3117 comm="syz.0.766" name="file0" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 215.098314][ T3124] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.766: invalid indirect mapped block 4294967295 (level 1) [ 215.112558][ T3124] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.766: invalid indirect mapped block 65535 (level 2) [ 215.143810][ T30] audit: type=1400 audit(1791403625.211:459): avc: denied { bind } for pid=3126 comm="syz.3.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 215.183128][ T3133] loop3: detected capacity change from 0 to 512 [ 215.191524][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 215.210683][ T3133] EXT4-fs (loop3): Test dummy encryption mode enabled [ 215.217504][ T3133] EXT4-fs (loop3): Ignoring removed oldalloc option [ 215.242608][ T3133] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption=v1,acl,oldalloc,debug_want_extra_isize=0x0000000000000008,,errors=continue. Quota mode: writeback. [ 215.268717][ T3133] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 215.325866][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 215.341549][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 215.355367][ T3151] loop6: detected capacity change from 0 to 4096 [ 215.363658][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 215.381732][ T3151] EXT4-fs (loop6): Test dummy encryption mode enabled [ 215.388563][ T3151] EXT4-fs (loop6): Ignoring removed orlov option [ 215.400242][ T3151] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,test_dummy_encryption,lazytime,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 215.453506][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 215.473414][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 215.473587][ T3171] loop6: detected capacity change from 0 to 256 [ 215.490104][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 215.523790][ T3171] exfat: Deprecated parameter 'namecase' [ 215.529464][ T3171] exfat: Unknown parameter 'keep_last_dots' [ 215.530269][ T3173] FAULT_INJECTION: forcing a failure. [ 215.530269][ T3173] name failslab, interval 1, probability 0, space 0, times 0 [ 215.548060][ T3173] CPU: 0 PID: 3173 Comm: syz.3.788 Not tainted syzkaller #0 [ 215.555346][ T3173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 215.565381][ T3173] Call Trace: [ 215.568643][ T3173] [ 215.571569][ T3173] __dump_stack+0x21/0x30 [ 215.575898][ T3173] dump_stack_lvl+0x110/0x170 [ 215.580571][ T3173] ? show_regs_print_info+0x20/0x20 [ 215.585750][ T3173] dump_stack+0x15/0x20 [ 215.589902][ T3173] should_fail+0x3ab/0x500 [ 215.594301][ T3173] __should_failslab+0xa4/0xe0 [ 215.599058][ T3173] should_failslab+0x9/0x20 [ 215.603547][ T3173] slab_pre_alloc_hook+0x39/0xd0 [ 215.608489][ T3173] ? append_filter_err+0x333/0x460 [ 215.613584][ T3173] __kmalloc_track_caller+0x6c/0x2c0 [ 215.618855][ T3173] ? append_filter_err+0x333/0x460 [ 215.623949][ T3173] kmemdup_nul+0x2c/0xa0 [ 215.628177][ T3173] append_filter_err+0x333/0x460 [ 215.633096][ T3173] apply_event_filter+0x160/0x560 [ 215.638107][ T3173] event_filter_write+0xda/0x150 [ 215.643032][ T3173] ? event_filter_read+0x270/0x270 [ 215.648152][ T3173] vfs_write+0x404/0xfd0 [ 215.652377][ T3173] ? debug_smp_processor_id+0x17/0x20 [ 215.657735][ T3173] ? file_end_write+0x1b0/0x1b0 [ 215.662572][ T3173] ? __kasan_check_write+0x14/0x20 [ 215.667670][ T3173] ? mutex_lock+0x9b/0x1c0 [ 215.672069][ T3173] ? wait_for_completion_killable_timeout+0x10/0x10 [ 215.678645][ T3173] ? __fget_files+0x2e1/0x340 [ 215.683315][ T3173] ? __fdget_pos+0x2d2/0x380 [ 215.687888][ T3173] ? ksys_write+0x70/0x260 [ 215.692289][ T3173] ksys_write+0x14a/0x260 [ 215.696620][ T3173] ? __ia32_sys_read+0x90/0x90 [ 215.701389][ T3173] ? __kasan_check_write+0x14/0x20 [ 215.706593][ T3173] ? switch_fpu_return+0x15d/0x2c0 [ 215.711705][ T3173] __x64_sys_write+0x7b/0x90 [ 215.716281][ T3173] x64_sys_call+0x8ef/0x9a0 [ 215.720770][ T3173] do_syscall_64+0x4c/0xa0 [ 215.725173][ T3173] ? clear_bhb_loop+0x50/0xa0 [ 215.729859][ T3173] ? clear_bhb_loop+0x50/0xa0 [ 215.734522][ T3173] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 215.740404][ T3173] RIP: 0033:0x7fc2b9f00199 [ 215.744827][ T3173] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 215.764547][ T3173] RSP: 002b:00007fc2b8959028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 215.772958][ T3173] RAX: ffffffffffffffda RBX: 00007fc2ba187fa0 RCX: 00007fc2b9f00199 [ 215.780922][ T3173] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 215.788874][ T3173] RBP: 00007fc2b9f978e0 R08: 0000000000000000 R09: 0000000000000000 [ 215.796832][ T3173] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 215.804788][ T3173] R13: 00007fc2ba188038 R14: 00007fc2ba187fa0 R15: 00007ffc96ccf898 [ 215.812748][ T3173] [ 215.830103][ T3175] loop0: detected capacity change from 0 to 256 [ 215.858016][ T3179] loop6: detected capacity change from 0 to 512 [ 215.869789][ T30] audit: type=1400 audit(1791403625.931:460): avc: denied { write } for pid=3185 comm="syz.3.793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 215.893189][ T3175] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 215.904646][ T3188] netlink: 20 bytes leftover after parsing attributes in process `syz.1.794'. [ 215.908851][ T3192] FAULT_INJECTION: forcing a failure. [ 215.908851][ T3192] name failslab, interval 1, probability 0, space 0, times 0 [ 215.927553][ T3192] CPU: 1 PID: 3192 Comm: syz.3.796 Not tainted syzkaller #0 [ 215.934853][ T3192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 215.944906][ T3192] Call Trace: [ 215.948180][ T3192] [ 215.951101][ T3192] __dump_stack+0x21/0x30 [ 215.955425][ T3192] dump_stack_lvl+0x110/0x170 [ 215.960091][ T3192] ? show_regs_print_info+0x20/0x20 [ 215.965307][ T3192] dump_stack+0x15/0x20 [ 215.969452][ T3192] should_fail+0x3ab/0x500 [ 215.973852][ T3192] __should_failslab+0xa4/0xe0 [ 215.978606][ T3192] should_failslab+0x9/0x20 [ 215.983098][ T3192] slab_pre_alloc_hook+0x39/0xd0 [ 215.988025][ T3192] kmem_cache_alloc_trace+0x48/0x270 [ 215.993298][ T3192] ? device_create+0x13a/0x300 [ 215.998050][ T3192] device_create+0x13a/0x300 [ 216.002640][ T3192] ? root_device_unregister+0x80/0x80 [ 216.007996][ T3192] ? vsnprintf+0x189d/0x1990 [ 216.012572][ T3192] bdi_register_va+0x90/0x5f0 [ 216.017235][ T3192] super_setup_bdi_name+0xf2/0x200 [ 216.022339][ T3192] ? vfs_get_tree+0x260/0x260 [ 216.027001][ T3192] ? _raw_spin_unlock+0x4d/0x70 [ 216.031832][ T3192] ? fuse_dev_install+0x176/0x1b0 [ 216.036841][ T3192] fuse_fill_super_common+0x9f4/0x1980 [ 216.042284][ T3192] ? up_write+0x7b/0x290 [ 216.046534][ T3192] ? register_shrinker_prepared+0xd7/0x100 [ 216.052331][ T3192] fuse_fill_super+0xd2/0x250 [ 216.057012][ T3192] get_tree_nodev+0xb3/0x160 [ 216.061590][ T3192] ? fuse_reconfigure+0xb0/0xb0 [ 216.066425][ T3192] fuse_get_tree+0x2d6/0x4e0 [ 216.071017][ T3192] vfs_get_tree+0x89/0x260 [ 216.075422][ T3192] do_new_mount+0x251/0xb40 [ 216.079910][ T3192] ? security_capable+0x87/0xb0 [ 216.084744][ T3192] path_mount+0x640/0xff0 [ 216.089061][ T3192] __se_sys_mount+0x320/0x390 [ 216.093808][ T3192] ? __x64_sys_mount+0xd0/0xd0 [ 216.098556][ T3192] ? __kasan_check_write+0x14/0x20 [ 216.103656][ T3192] __x64_sys_mount+0xbf/0xd0 [ 216.108229][ T3192] x64_sys_call+0x6bf/0x9a0 [ 216.112807][ T3192] do_syscall_64+0x4c/0xa0 [ 216.117210][ T3192] ? clear_bhb_loop+0x50/0xa0 [ 216.121870][ T3192] ? clear_bhb_loop+0x50/0xa0 [ 216.126528][ T3192] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 216.132427][ T3192] RIP: 0033:0x7fc2b9f00199 [ 216.136828][ T3192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.156424][ T3192] RSP: 002b:00007fc2b8959028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 216.164823][ T3192] RAX: ffffffffffffffda RBX: 00007fc2ba187fa0 RCX: 00007fc2b9f00199 [ 216.172780][ T3192] RDX: 0000200000002100 RSI: 00002000000001c0 RDI: 0000000000000000 [ 216.180736][ T3192] RBP: 00007fc2b9f978e0 R08: 00002000000002c0 R09: 0000000000000000 [ 216.188720][ T3192] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 216.196677][ T3192] R13: 00007fc2ba188038 R14: 00007fc2ba187fa0 R15: 00007ffc96ccf898 [ 216.204642][ T3192] [ 216.208060][ T3179] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 216.228840][ T3179] EXT4-fs (loop6): 1 truncate cleaned up [ 216.235060][ T3179] EXT4-fs (loop6): mounted filesystem without journal. Opts: bsddf,usrquota,resuid=0x0000000000000000,barrier=0x00000000000000e1,journal_ioprio=0x0000000000000004,max_batch_time=0x0000000000000003,,errors=continue. Quota mode: writeback. [ 216.321446][ T3204] loop0: detected capacity change from 0 to 512 [ 216.377627][ T3204] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #2: comm syz.0.801: missing EA_INODE flag [ 216.395788][ T3204] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.801: error while reading EA inode 2 err=-117 [ 216.420165][ T3204] EXT4-fs (loop0): 1 orphan inode deleted [ 216.438026][ T3204] EXT4-fs (loop0): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue. Quota mode: writeback. [ 216.792215][ T3215] FAULT_INJECTION: forcing a failure. [ 216.792215][ T3215] name failslab, interval 1, probability 0, space 0, times 0 [ 216.813327][ T3215] CPU: 0 PID: 3215 Comm: syz.0.803 Not tainted syzkaller #0 [ 216.820643][ T3215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 216.830708][ T3215] Call Trace: [ 216.834049][ T3215] [ 216.836986][ T3215] __dump_stack+0x21/0x30 [ 216.841324][ T3215] dump_stack_lvl+0x110/0x170 [ 216.846005][ T3215] ? show_regs_print_info+0x20/0x20 [ 216.851210][ T3215] dump_stack+0x15/0x20 [ 216.855371][ T3215] should_fail+0x3ab/0x500 [ 216.859798][ T3215] __should_failslab+0xa4/0xe0 [ 216.864577][ T3215] should_failslab+0x9/0x20 [ 216.869089][ T3215] slab_pre_alloc_hook+0x39/0xd0 [ 216.874071][ T3215] __kmalloc+0x6d/0x2c0 [ 216.878234][ T3215] ? mpi_resize+0x7f/0x1e0 [ 216.882666][ T3215] mpi_resize+0x7f/0x1e0 [ 216.886919][ T3215] mpi_powm+0xb94/0x23a0 [ 216.891175][ T3215] ? mpihelp_release_karatsuba_ctx+0x160/0x160 [ 216.897339][ T3215] ? mpihelp_cmp+0xc0/0xe0 [ 216.901763][ T3215] rsa_enc+0x28f/0x3c0 [ 216.905841][ T3215] ? rsa_exit+0x30/0x30 [ 216.910002][ T3215] ? memset+0x35/0x40 [ 216.913985][ T3215] pkcs1pad_verify+0x4b2/0x680 [ 216.918754][ T3215] public_key_verify_signature+0x992/0xec0 [ 216.924570][ T3215] ? key_create_or_update+0x430/0x9c0 [ 216.929953][ T3215] ? __se_sys_add_key+0x34b/0x410 [ 216.934995][ T3215] ? public_key_free+0x80/0x80 [ 216.939770][ T3215] x509_check_for_self_signed+0x35e/0x460 [ 216.945502][ T3215] x509_cert_parse+0x684/0x8b0 [ 216.950273][ T3215] x509_key_preparse+0x63/0x650 [ 216.955128][ T3215] asymmetric_key_preparse+0x9e/0xe0 [ 216.960425][ T3215] key_create_or_update+0x430/0x9c0 [ 216.965639][ T3215] ? key_type_put+0x20/0x20 [ 216.970146][ T3215] ? lookup_user_key_possessed+0x40/0x40 [ 216.975790][ T3215] ? __kasan_check_write+0x14/0x20 [ 216.980910][ T3215] __se_sys_add_key+0x34b/0x410 [ 216.985771][ T3215] ? __x64_sys_add_key+0xd0/0xd0 [ 216.990721][ T3215] ? __kasan_check_write+0x14/0x20 [ 216.995837][ T3215] __x64_sys_add_key+0xbf/0xd0 [ 217.000612][ T3215] x64_sys_call+0x713/0x9a0 [ 217.005120][ T3215] do_syscall_64+0x4c/0xa0 [ 217.009523][ T3215] ? clear_bhb_loop+0x50/0xa0 [ 217.014191][ T3215] ? clear_bhb_loop+0x50/0xa0 [ 217.018850][ T3215] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 217.024728][ T3215] RIP: 0033:0x7f523f839199 [ 217.029127][ T3215] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.048728][ T3215] RSP: 002b:00007f523e292028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 217.057139][ T3215] RAX: ffffffffffffffda RBX: 00007f523fac0fa0 RCX: 00007f523f839199 [ 217.065100][ T3215] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 217.073059][ T3215] RBP: 00007f523f8d08e0 R08: 000000000429170b R09: 0000000000000000 [ 217.081036][ T3215] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 217.088993][ T3215] R13: 00007f523fac1038 R14: 00007f523fac0fa0 R15: 00007fff961133c8 [ 217.096957][ T3215] [ 217.143459][ T3221] loop0: detected capacity change from 0 to 256 [ 217.172166][ T3223] netlink: 8 bytes leftover after parsing attributes in process `syz.6.806'. [ 217.181372][ T3221] FAT-fs (loop0): Unrecognized mount option "nfs=swKtale_rw" or missing value [ 217.224555][ T30] audit: type=1400 audit(1791403627.291:461): avc: denied { mounton } for pid=3228 comm="syz.6.809" path="/130/file0" dev="tmpfs" ino=764 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 217.340852][ T30] audit: type=1400 audit(1791403883.411:462): avc: denied { read write } for pid=3234 comm="syz.7.812" name="tun" dev="sda1" ino=2053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:mnt_t tclass=chr_file permissive=1 [ 217.344986][ T3235] tipc: Started in network mode [ 217.362870][ T30] audit: type=1400 audit(1791403883.411:463): avc: denied { open } for pid=3234 comm="syz.7.812" path="/dev/net/tun" dev="sda1" ino=2053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:mnt_t tclass=chr_file permissive=1 [ 217.391873][ T3235] tipc: Node identity 26ab0cc3abef, cluster identity 4711 [ 217.399661][ T3235] tipc: Enabled bearer , priority 0 [ 217.606645][ T30] audit: type=1400 audit(1791403883.411:464): avc: denied { ioctl } for pid=3234 comm="syz.7.812" path="/dev/net/tun" dev="sda1" ino=2053 ioctlcmd=0x54ca scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:mnt_t tclass=chr_file permissive=1 [ 217.642977][ T3235] device syzkaller0 entered promiscuous mode [ 217.661817][ T3234] tipc: Resetting bearer [ 217.675287][ T3234] tipc: Disabling bearer [ 217.870418][ T3264] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.878363][ T3264] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.111134][ T3266] loop1: detected capacity change from 0 to 40427 [ 218.155070][ T3266] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 218.162805][ T3266] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 218.175210][ T3266] F2FS-fs (loop1): invalid crc value [ 218.379990][ T3266] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 218.401643][ T3266] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 218.408727][ T3266] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 218.482303][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 218.493266][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 218.512820][ T30] audit: type=1400 audit(1791403884.581:465): avc: denied { append } for pid=3276 comm="syz.3.826" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 218.627523][ T3283] tipc: Enabled bearer , priority 0 [ 218.646647][ T3283] device syzkaller0 entered promiscuous mode [ 218.664417][ T3282] tipc: Resetting bearer [ 218.678577][ T3282] tipc: Disabling bearer [ 218.939928][ T3301] xt_limit: Overflow, try lower: 1207959552/384 [ 219.877855][ T3317] loop1: detected capacity change from 0 to 16 [ 219.893237][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 220.207202][ T3317] erofs: (device loop1): mounted with root inode @ nid 36. [ 220.241271][ T3317] input: syz0 as /devices/virtual/input/input106 [ 220.248946][ T26] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 220.771283][ T3319] netlink: 20 bytes leftover after parsing attributes in process `syz.6.842'. [ 220.811842][ T3321] bridge0: adding interface bridge_slave_0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 220.835397][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 220.855899][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 220.944437][ T3323] SELinux: failed to load policy [ 220.950545][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.961922][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.976357][ T26] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 220.991043][ T26] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 221.000999][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.013094][ T26] usb 4-1: config 0 descriptor?? [ 221.035987][ T3338] loop1: detected capacity change from 0 to 128 [ 221.073391][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 221.104229][ T3338] overlayfs: filesystem on './file0' not supported [ 221.123005][ T3346] loop0: detected capacity change from 0 to 512 [ 221.181852][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 221.190210][ T3349] fuse: Bad value for 'fd' [ 221.204850][ T30] audit: type=1400 audit(1791403887.271:466): avc: denied { execute } for pid=3348 comm="syz.7.851" name="file0" dev="tmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 221.229997][ T3346] fscrypt (loop0, inode 2): Error -61 getting encryption context [ 221.237850][ T3346] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -61 [ 221.246306][ T3346] EXT4-fs error (device loop0): ext4_orphan_get:1410: inode #13: comm syz.0.853: iget: bad i_size value: 12154757448730 [ 221.269070][ T3346] EXT4-fs error (device loop0): ext4_orphan_get:1415: comm syz.0.853: couldn't read orphan inode 13 (err -117) [ 221.281198][ T3346] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,nojournal_checksum,noload,noinit_itable,usrjquota=,grpjquota=.subj_type=á[]*:[,,errors=continue. Quota mode: writeback. [ 221.357360][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 221.363852][ T30] audit: type=1400 audit(1791403887.421:467): avc: denied { setopt } for pid=3359 comm="syz.1.858" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 221.369733][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 221.713346][ T446] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 221.733834][ T30] audit: type=1400 audit(1791403887.691:468): avc: denied { view } for pid=3361 comm="syz.1.859" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 221.757483][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.773125][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.782565][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.790109][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.798906][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.806813][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.815979][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.823964][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.832126][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.839856][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.847717][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.855323][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.862970][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.870391][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.877827][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.886033][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 221.895767][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.903193][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.910654][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.918051][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.925604][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.933066][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.936108][ T3372] Disabled LAPIC found during irq injection [ 221.940508][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.953822][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.961802][ T26] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 221.969408][ T26] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 221.978222][ T26] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 221.986200][ T3377] bridge0: port 3(vlan2) entered blocking state [ 221.996954][ T3377] bridge0: port 3(vlan2) entered disabled state [ 221.999676][ T26] usb 4-1: USB disconnect, device number 12 [ 222.006803][ T3377] device vlan2 entered promiscuous mode [ 222.013718][ T1056] Bluetooth: hci0: Frame reassembly failed (-84) [ 222.036389][ T30] audit: type=1400 audit(1791403888.101:469): avc: denied { read } for pid=3379 comm="syz.7.863" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 222.044360][ T3377] bridge0: port 3(vlan2) entered blocking state [ 222.062402][ T3377] bridge0: port 3(vlan2) entered forwarding state [ 222.072927][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 222.083854][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 222.092590][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 222.101022][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 222.109287][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 222.117457][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 222.135260][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 222.143572][ T1521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 222.162990][ T446] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 222.172242][ T446] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.298107][ T3389] loop0: detected capacity change from 0 to 16 [ 222.375646][ T3389] erofs: (device loop0): mounted with root inode @ nid 36. [ 222.482908][ T446] cdc_acm 7-1:1.0: ttyACM0: USB ACM device [ 222.714237][ T446] usb 7-1: USB disconnect, device number 10 [ 223.215447][ T30] audit: type=1400 audit(1791403889.281:470): avc: denied { map } for pid=3402 comm="syz.0.873" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 223.259617][ T3403] loop0: detected capacity change from 0 to 2048 [ 223.599295][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 223.687353][ T3403] EXT4-fs (loop0): mounted filesystem without journal. Opts: dioread_lock,,errors=continue. Quota mode: none. [ 223.770445][ T30] audit: type=1400 audit(1791403889.801:471): avc: denied { map } for pid=3402 comm="syz.0.873" path="/171/file1/file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 223.841264][ T446] Bluetooth: hci0: command 0x1003 tx timeout [ 223.849313][ T3370] Bluetooth: hci0: sending frame failed (-49) [ 224.224366][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 224.240403][ T30] audit: type=1400 audit(1791403889.811:472): avc: denied { create } for pid=3402 comm="syz.0.873" name=E91F7189591E9233614B scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=sock_file permissive=1 [ 224.283067][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 224.300826][ T30] audit: type=1400 audit(1791403889.811:473): avc: denied { unlink } for pid=3402 comm="syz.0.873" name=E91F7189591E9233614B dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=sock_file permissive=1 [ 224.324393][ T30] audit: type=1400 audit(1791403890.341:474): avc: denied { create } for pid=3413 comm="syz.0.874" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 224.354962][ T3417] netlink: 8 bytes leftover after parsing attributes in process `syz.6.877'. [ 224.413092][ T3422] loop0: detected capacity change from 0 to 2048 [ 224.428418][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 224.444849][ T3426] lo: Caught tx_queue_len zero misconfig [ 224.470911][ T3422] EXT4-fs (loop0): Ignoring removed orlov option [ 224.481855][ T3422] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,orlov,i_version,init_itable,,errors=continue. Quota mode: none. [ 224.503375][ T3428] netlink: 20 bytes leftover after parsing attributes in process `syz.7.882'. [ 224.520625][ T3422] ext4 filesystem being mounted at /174/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 224.533795][ T3422] fs-verity: sha512 using implementation "sha512-avx2" [ 224.615605][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 224.629509][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 224.675848][ T3437] tmpfs: Unknown parameter 'usrquota' [ 224.719504][ T3443] loop3: detected capacity change from 0 to 2048 [ 224.727154][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 224.747887][ T3444] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 224.771862][ T3443] EXT4-fs (loop3): mounted filesystem without journal. Opts: dioread_lock,,errors=continue. Quota mode: none. [ 224.868945][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 224.880117][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 225.807675][ T3467] loop3: detected capacity change from 0 to 512 [ 225.831898][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 225.871665][ T3467] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 225.890617][ T3467] ext4 filesystem being mounted at /191/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 225.912283][ T3467] Quota error (device loop3): do_check_range: Getting dqdh_next_free 4294967294 out of range 0-8 [ 225.922983][ T446] Bluetooth: hci0: command 0x1001 tx timeout [ 225.930087][ T3370] Bluetooth: hci0: sending frame failed (-49) [ 225.940178][ T3467] EXT4-fs error (device loop3): ext4_acquire_dquot:6227: comm syz.3.897: Failed to acquire dquot type 0 [ 226.076857][ T3483] kvm: pic: non byte write [ 227.782675][ T3489] loop0: detected capacity change from 0 to 40427 [ 227.788958][ T3493] loop6: detected capacity change from 0 to 40427 [ 227.827178][ T3489] F2FS-fs (loop0): Found nat_bits in checkpoint [ 227.831581][ T3493] F2FS-fs (loop6): invalid crc value [ 227.880266][ T3493] F2FS-fs (loop6): Found nat_bits in checkpoint [ 227.929726][ T3489] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 227.938382][ T3493] F2FS-fs (loop6): Cannot turn on quotas: -2 on 0 [ 228.007457][ T3514] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(8) [ 228.021240][ T3514] device veth3 entered promiscuous mode [ 228.041285][ T446] Bluetooth: hci0: command 0x1009 tx timeout [ 228.060664][ T286] attempt to access beyond end of device [ 228.060664][ T286] loop0: rw=2049, want=45104, limit=40427 [ 228.093823][ T3493] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 228.117627][ T1037] attempt to access beyond end of device [ 228.117627][ T1037] loop6: rw=2049, want=45104, limit=40427 [ 228.134579][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 228.134598][ T30] audit: type=1400 audit(1791403894.181:475): avc: denied { create } for pid=3492 comm="syz.6.905" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 228.458724][ T3532] loop3: detected capacity change from 0 to 16 [ 228.754767][ T3532] erofs: (device loop3): mounted with root inode @ nid 36. [ 228.791485][ T3532] input: syz0 as /devices/virtual/input/input108 [ 228.838311][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 228.858620][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 229.072570][ T343] udevd[343]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 229.351290][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 229.387646][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 229.468612][ T3550] loop6: detected capacity change from 0 to 1024 [ 229.479493][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 229.492478][ T3550] EXT4-fs (loop6): fragment/cluster size (16384) != block size (1024) [ 229.570124][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 229.585218][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 230.445281][ T3568] FAULT_INJECTION: forcing a failure. [ 230.445281][ T3568] name failslab, interval 1, probability 0, space 0, times 0 [ 230.458141][ T3568] CPU: 1 PID: 3568 Comm: syz.3.931 Not tainted syzkaller #0 [ 230.465438][ T3568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 230.475495][ T3568] Call Trace: [ 230.478770][ T3568] [ 230.481688][ T3568] __dump_stack+0x21/0x30 [ 230.486027][ T3568] dump_stack_lvl+0x110/0x170 [ 230.490707][ T3568] ? show_regs_print_info+0x20/0x20 [ 230.495908][ T3568] ? debug_smp_processor_id+0x17/0x20 [ 230.501285][ T3568] ? kasan_quarantine_put+0x34/0x190 [ 230.506574][ T3568] dump_stack+0x15/0x20 [ 230.510730][ T3568] should_fail+0x3ab/0x500 [ 230.515153][ T3568] __should_failslab+0xa4/0xe0 [ 230.519918][ T3568] should_failslab+0x9/0x20 [ 230.524424][ T3568] slab_pre_alloc_hook+0x39/0xd0 [ 230.529365][ T3568] __kmalloc+0x6d/0x2c0 [ 230.533524][ T3568] ? x509_key_preparse+0x255/0x650 [ 230.538637][ T3568] x509_key_preparse+0x255/0x650 [ 230.543594][ T3568] asymmetric_key_preparse+0x9e/0xe0 [ 230.548882][ T3568] key_create_or_update+0x430/0x9c0 [ 230.554081][ T3568] ? key_type_put+0x20/0x20 [ 230.558595][ T3568] ? lookup_user_key_possessed+0x40/0x40 [ 230.564237][ T3568] ? __kasan_check_write+0x14/0x20 [ 230.569349][ T3568] __se_sys_add_key+0x34b/0x410 [ 230.574205][ T3568] ? __x64_sys_add_key+0xd0/0xd0 [ 230.579144][ T3568] ? ksys_write+0x1fa/0x260 [ 230.583652][ T3568] ? __kasan_check_write+0x14/0x20 [ 230.588766][ T3568] __x64_sys_add_key+0xbf/0xd0 [ 230.593530][ T3568] x64_sys_call+0x713/0x9a0 [ 230.598032][ T3568] do_syscall_64+0x4c/0xa0 [ 230.602446][ T3568] ? clear_bhb_loop+0x50/0xa0 [ 230.607129][ T3568] ? clear_bhb_loop+0x50/0xa0 [ 230.611804][ T3568] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 230.617698][ T3568] RIP: 0033:0x7fc2b9f00199 [ 230.622115][ T3568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.641748][ T3568] RSP: 002b:00007fc2b8959028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 230.650166][ T3568] RAX: ffffffffffffffda RBX: 00007fc2ba187fa0 RCX: 00007fc2b9f00199 [ 230.658128][ T3568] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 230.666082][ T3568] RBP: 00007fc2b9f978e0 R08: 00000000077f1846 R09: 0000000000000000 [ 230.674055][ T3568] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 230.682029][ T3568] R13: 00007fc2ba188038 R14: 00007fc2ba187fa0 R15: 00007ffc96ccf898 [ 230.690003][ T3568] [ 230.964945][ T3574] loop3: detected capacity change from 0 to 32768 [ 230.981598][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 231.015849][ T30] audit: type=1400 audit(1791403897.081:476): avc: denied { connect } for pid=3578 comm="syz.7.935" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 231.021049][ T3574] loop3: p1 p3 < p5 p6 > [ 231.041952][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 231.072783][ T3584] device bridge0 entered promiscuous mode [ 231.189267][ T3603] FAULT_INJECTION: forcing a failure. [ 231.189267][ T3603] name fail_futex, interval 1, probability 0, space 0, times 1 [ 231.203422][ T3603] CPU: 1 PID: 3603 Comm: syz.7.946 Not tainted syzkaller #0 [ 231.210731][ T3603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 231.220795][ T3603] Call Trace: [ 231.224079][ T3603] [ 231.227016][ T3603] __dump_stack+0x21/0x30 [ 231.231362][ T3603] dump_stack_lvl+0x110/0x170 [ 231.236051][ T3603] ? show_regs_print_info+0x20/0x20 [ 231.241253][ T3603] ? preempt_schedule_common+0xbe/0xf0 [ 231.246718][ T3603] dump_stack+0x15/0x20 [ 231.250883][ T3603] should_fail+0x3ab/0x500 [ 231.255306][ T3603] get_futex_key+0x143/0xb60 [ 231.259905][ T3603] ? try_to_wake_up+0x632/0x1150 [ 231.264855][ T3603] ? futex_wait_restart+0x250/0x250 [ 231.270062][ T3603] ? __kasan_check_write+0x14/0x20 [ 231.275181][ T3603] futex_wake+0x133/0x8f0 [ 231.279524][ T3603] ? arch_stack_walk+0xee/0x140 [ 231.284395][ T3603] ? futex_wait+0x8f0/0x8f0 [ 231.288909][ T3603] ? __stack_depot_save+0x34/0x480 [ 231.294024][ T3603] ? path_openat+0x284f/0x2f80 [ 231.298810][ T3603] do_futex+0xd8d/0x2800 [ 231.303056][ T3603] ? kasan_set_track+0x4a/0x70 [ 231.307819][ T3603] ? kmem_cache_free+0x100/0x320 [ 231.312758][ T3603] ? do_sys_openat2+0x6df/0x7f0 [ 231.317610][ T3603] ? x64_sys_call+0x219/0x9a0 [ 231.322300][ T3603] ? do_syscall_64+0x4c/0xa0 [ 231.326899][ T3603] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 231.332971][ T3603] ? _kstrtoull+0x3af/0x4c0 [ 231.337478][ T3603] ? futex_exit_release+0x1e0/0x1e0 [ 231.342679][ T3603] ? kstrtouint_from_user+0x1e4/0x220 [ 231.348052][ T3603] ? kstrtol_from_user+0x2a0/0x2a0 [ 231.353168][ T3603] ? proc_fail_nth_write+0xa1/0x200 [ 231.358367][ T3603] ? proc_fail_nth_read+0x220/0x220 [ 231.363564][ T3603] ? security_file_permission+0x79/0xa0 [ 231.369112][ T3603] ? security_file_permission+0x83/0xa0 [ 231.374669][ T3603] ? vfs_write+0xc72/0xfd0 [ 231.379083][ T3603] ? file_end_write+0x1b0/0x1b0 [ 231.383931][ T3603] ? __kasan_check_write+0x14/0x20 [ 231.389044][ T3603] ? mutex_unlock+0x8f/0x230 [ 231.393636][ T3603] __se_sys_futex+0x135/0x330 [ 231.398313][ T3603] ? __kasan_check_write+0x14/0x20 [ 231.403426][ T3603] ? __x64_sys_futex+0x100/0x100 [ 231.408370][ T3603] ? ksys_write+0x1fa/0x260 [ 231.412873][ T3603] ? __ia32_sys_read+0x90/0x90 [ 231.417635][ T3603] __x64_sys_futex+0xe5/0x100 [ 231.422310][ T3603] x64_sys_call+0x251/0x9a0 [ 231.426811][ T3603] do_syscall_64+0x4c/0xa0 [ 231.431224][ T3603] ? clear_bhb_loop+0x50/0xa0 [ 231.435901][ T3603] ? clear_bhb_loop+0x50/0xa0 [ 231.440576][ T3603] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 231.446464][ T3603] RIP: 0033:0x7f5334f26199 [ 231.450880][ T3603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.470481][ T3603] RSP: 002b:00007f533397f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 231.478878][ T3603] RAX: ffffffffffffffda RBX: 00007f53351adfa8 RCX: 00007f5334f26199 [ 231.486834][ T3603] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f53351adfac [ 231.494806][ T3603] RBP: 00007f53351adfa0 R08: 00089b37f54f4360 R09: 0000000000000000 [ 231.502754][ T3603] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 231.510705][ T3603] R13: 00007f53351ae038 R14: 00007fffdae126d0 R15: 00007fffdae127b8 [ 231.518678][ T3603] [ 231.735189][ T3620] device bridge0 entered promiscuous mode [ 232.452148][ T3639] fuse: Bad value for 'fd' [ 232.553785][ T3648] FAULT_INJECTION: forcing a failure. [ 232.553785][ T3648] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.570756][ T3648] CPU: 1 PID: 3648 Comm: syz.7.964 Not tainted syzkaller #0 [ 232.578066][ T3648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 232.588123][ T3648] Call Trace: [ 232.591408][ T3648] [ 232.594341][ T3648] __dump_stack+0x21/0x30 [ 232.598678][ T3648] dump_stack_lvl+0x110/0x170 [ 232.603361][ T3648] ? show_regs_print_info+0x20/0x20 [ 232.608564][ T3648] dump_stack+0x15/0x20 [ 232.612720][ T3648] should_fail+0x3ab/0x500 [ 232.617144][ T3648] should_fail_usercopy+0x1a/0x20 [ 232.622169][ T3648] strncpy_from_user+0x24/0x2d0 [ 232.627029][ T3648] ? kmem_cache_alloc+0xf7/0x260 [ 232.631989][ T3648] getname_flags+0xf5/0x510 [ 232.636499][ T3648] getname+0x19/0x20 [ 232.640401][ T3648] __se_sys_quotactl+0x213/0x710 [ 232.645343][ T3648] ? __se_sys_futex+0x135/0x330 [ 232.650202][ T3648] ? __x64_sys_quotactl+0xb0/0xb0 [ 232.655231][ T3648] ? __x64_sys_futex+0x100/0x100 [ 232.660173][ T3648] ? ksys_write+0x1fa/0x260 [ 232.664684][ T3648] ? __kasan_check_write+0x14/0x20 [ 232.669800][ T3648] ? switch_fpu_return+0x15d/0x2c0 [ 232.674919][ T3648] __x64_sys_quotactl+0x9b/0xb0 [ 232.679790][ T3648] x64_sys_call+0x69c/0x9a0 [ 232.684297][ T3648] do_syscall_64+0x4c/0xa0 [ 232.688717][ T3648] ? clear_bhb_loop+0x50/0xa0 [ 232.693394][ T3648] ? clear_bhb_loop+0x50/0xa0 [ 232.698075][ T3648] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 232.703970][ T3648] RIP: 0033:0x7f5334f26199 [ 232.708386][ T3648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.727997][ T3648] RSP: 002b:00007f533397f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3 [ 232.736421][ T3648] RAX: ffffffffffffffda RBX: 00007f53351adfa0 RCX: 00007f5334f26199 [ 232.741171][ T445] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 232.744407][ T3648] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffff80000802 [ 232.744426][ T3648] RBP: 00007f5334fbd8e0 R08: 0000000000000000 R09: 0000000000000000 [ 232.767884][ T3648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.775862][ T3648] R13: 00007f53351ae038 R14: 00007f53351adfa0 R15: 00007fffdae127b8 [ 232.783849][ T3648] [ 232.844561][ T3656] loop6: detected capacity change from 0 to 512 [ 232.891397][ T3656] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 232.915540][ T3656] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802e02c, mo2=0002] [ 232.930937][ T3656] System zones: 1-12 [ 232.936931][ T3656] EXT4-fs (loop6): orphan cleanup on readonly fs [ 232.947732][ T3656] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.968: invalid indirect mapped block 12 (level 1) [ 232.961630][ T3656] EXT4-fs (loop6): Remounting filesystem read-only [ 232.968189][ T3656] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.968: invalid indirect mapped block 2 (level 2) [ 232.981776][ T3656] EXT4-fs (loop6): Remounting filesystem read-only [ 232.988534][ T3656] EXT4-fs (loop6): 1 truncate cleaned up [ 232.994411][ T3656] EXT4-fs (loop6): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000008000,jqfmt=vfsv1,max_batch_time=0x0000000000001000,errors=remount-ro,data_err=ignore. Quota mode: none. [ 233.056759][ T3656] input: syz1 as /devices/virtual/input/input109 [ 233.057479][ T3651] loop3: detected capacity change from 0 to 40427 [ 233.131576][ T3651] F2FS-fs (loop3): invalid crc value [ 233.140477][ T445] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 233.153691][ T445] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.181264][ T3651] F2FS-fs (loop3): Found nat_bits in checkpoint [ 233.197637][ T3656] EXT4-fs error (device loop6): ext4_map_blocks:632: inode #2: block 5: comm syz.6.968: lblock 0 mapped to illegal pblock 5 (length 1) [ 233.227426][ T3656] EXT4-fs warning (device loop6): dx_probe:823: inode #2: lblock 0: comm syz.6.968: error -117 reading directory block [ 233.228301][ T3651] F2FS-fs (loop3): Cannot turn on quotas: -2 on 0 [ 233.260797][ T3651] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 233.291151][ T287] attempt to access beyond end of device [ 233.291151][ T287] loop3: rw=2049, want=45104, limit=40427 [ 233.362590][ T3685] FAULT_INJECTION: forcing a failure. [ 233.362590][ T3685] name failslab, interval 1, probability 0, space 0, times 0 [ 233.394724][ T3685] CPU: 0 PID: 3685 Comm: syz.6.977 Not tainted syzkaller #0 [ 233.402061][ T3685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 233.412128][ T3685] Call Trace: [ 233.415419][ T3685] [ 233.418358][ T3685] __dump_stack+0x21/0x30 [ 233.422697][ T3685] dump_stack_lvl+0x110/0x170 [ 233.427383][ T3685] ? show_regs_print_info+0x20/0x20 [ 233.432600][ T3685] dump_stack+0x15/0x20 [ 233.436761][ T3685] should_fail+0x3ab/0x500 [ 233.441186][ T3685] __should_failslab+0xa4/0xe0 [ 233.445959][ T3685] should_failslab+0x9/0x20 [ 233.450472][ T3685] slab_pre_alloc_hook+0x39/0xd0 [ 233.455416][ T3685] ? getname_flags+0xba/0x510 [ 233.460088][ T3685] kmem_cache_alloc+0x44/0x260 [ 233.464840][ T3685] getname_flags+0xba/0x510 [ 233.469328][ T3685] getname+0x19/0x20 [ 233.473208][ T3685] __se_sys_quotactl+0x213/0x710 [ 233.478138][ T3685] ? __se_sys_futex+0x135/0x330 [ 233.482976][ T3685] ? __x64_sys_quotactl+0xb0/0xb0 [ 233.487984][ T3685] ? __x64_sys_futex+0x100/0x100 [ 233.492910][ T3685] ? ksys_write+0x1fa/0x260 [ 233.497423][ T3685] ? __kasan_check_write+0x14/0x20 [ 233.502527][ T3685] ? switch_fpu_return+0x15d/0x2c0 [ 233.507627][ T3685] __x64_sys_quotactl+0x9b/0xb0 [ 233.512464][ T3685] x64_sys_call+0x69c/0x9a0 [ 233.516953][ T3685] do_syscall_64+0x4c/0xa0 [ 233.521356][ T3685] ? clear_bhb_loop+0x50/0xa0 [ 233.526021][ T3685] ? clear_bhb_loop+0x50/0xa0 [ 233.530682][ T3685] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 233.536563][ T3685] RIP: 0033:0x7fcf6196d199 [ 233.540966][ T3685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.560564][ T3685] RSP: 002b:00007fcf603c6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3 [ 233.568966][ T3685] RAX: ffffffffffffffda RBX: 00007fcf61bf4fa0 RCX: 00007fcf6196d199 [ 233.576924][ T3685] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffff80000802 [ 233.584883][ T3685] RBP: 00007fcf61a048e0 R08: 0000000000000000 R09: 0000000000000000 [ 233.592837][ T3685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 233.600811][ T3685] R13: 00007fcf61bf5038 R14: 00007fcf61bf4fa0 R15: 00007fff492c7e08 [ 233.608771][ T3685] [ 233.614050][ T445] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 233.802620][ T30] audit: type=1400 audit(1791403899.871:477): avc: denied { append } for pid=3632 comm="syz.1.955" name="ttyACM0" dev="devtmpfs" ino=1625 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 233.885333][ T445] usb 2-1: USB disconnect, device number 11 [ 234.048344][ T26] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 234.620642][ T26] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 234.684168][ T26] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 234.694880][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.884953][ T3710] loop1: detected capacity change from 0 to 256 [ 234.894781][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 234.963082][ T26] usb 4-1: USB disconnect, device number 13 [ 234.976537][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 234.995180][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 235.069570][ T3712] loop6: detected capacity change from 0 to 40427 [ 235.109127][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 235.200600][ T3712] F2FS-fs (loop6): Invalid log_blocksize (268), supports only 12 [ 235.216680][ T3712] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 235.243583][ T3712] F2FS-fs (loop6): invalid crc value [ 235.370705][ T3712] F2FS-fs (loop6): Found nat_bits in checkpoint [ 235.444980][ T3712] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 235.456448][ T3712] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 235.834149][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 235.854349][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 235.924788][ T3747] loop0: detected capacity change from 0 to 16 [ 235.944376][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 235.983239][ T3747] erofs: (device loop0): mounted with root inode @ nid 36. [ 236.018921][ T3747] input: syz0 as /devices/virtual/input/input110 [ 236.329543][ T3749] loop3: detected capacity change from 0 to 256 [ 236.370248][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 236.980058][ T3762] loop6: detected capacity change from 0 to 2048 [ 236.987723][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop6, 10) failed: No such file or directory [ 237.004278][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 237.019243][ T3765] WARNING! power/level is deprecated; use power/control instead [ 237.192539][ T30] audit: type=1400 audit(1791403903.261:478): avc: denied { map } for pid=3757 comm="syz.7.1006" path="socket:[29277]" dev="sockfs" ino=29277 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 237.307000][ T30] audit: type=1400 audit(1791403903.261:479): avc: denied { read } for pid=3757 comm="syz.7.1006" path="socket:[29277]" dev="sockfs" ino=29277 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 237.423951][ T3762] EXT4-fs (loop6): mounted filesystem without journal. Opts: dioread_lock,,errors=continue. Quota mode: none. [ 237.527989][ T30] audit: type=1400 audit(1791403903.591:480): avc: denied { ioctl } for pid=3771 comm="syz.0.1009" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 237.715897][ T3786] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 238.188382][ T3797] loop3: detected capacity change from 0 to 512 [ 238.256064][ T30] audit: type=1400 audit(1791403904.291:481): avc: denied { ioctl } for pid=3787 comm="syz.0.1012" path="pid:[4026532286]" dev="nsfs" ino=4026532286 ioctlcmd=0xb702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 238.314852][ T3797] EXT4-fs (loop3): 1 orphan inode deleted [ 238.320692][ T3797] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 238.332028][ T3797] ext4 filesystem being mounted at /215/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 238.485875][ T3804] loop6: detected capacity change from 0 to 1024 [ 238.548190][ T3816] loop0: detected capacity change from 0 to 2048 [ 238.558072][ T3804] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 238.573967][ T30] audit: type=1400 audit(1791403904.641:482): avc: denied { reparent } for pid=3802 comm="syz.6.1015" name="file1" dev="loop6" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 238.598264][ T3804] EXT4-fs warning (device loop6): ext4_rmdir:3245: inode #11: comm syz.6.1015: empty directory 'file0' has too many links (111) [ 238.623232][ T3816] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 239.281546][ T3831] using random self ethernet address [ 239.286907][ T3831] using random host ethernet address [ 239.342793][ T3838] loop1: detected capacity change from 0 to 256 [ 239.463148][ T3838] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x0612b11d, utbl_chksum : 0xe619d30d) [ 240.259154][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 240.274674][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 240.276021][ T3851] FAULT_INJECTION: forcing a failure. [ 240.276021][ T3851] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 240.297480][ T3851] CPU: 0 PID: 3851 Comm: syz.0.1031 Not tainted syzkaller #0 [ 240.304852][ T3851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 240.314902][ T3851] Call Trace: [ 240.318180][ T3851] [ 240.321103][ T3851] __dump_stack+0x21/0x30 [ 240.325436][ T3851] dump_stack_lvl+0x110/0x170 [ 240.330108][ T3851] ? show_regs_print_info+0x20/0x20 [ 240.335305][ T3851] ? free_unref_page_commit+0x187/0x3f0 [ 240.340848][ T3851] dump_stack+0x15/0x20 [ 240.345000][ T3851] should_fail+0x3ab/0x500 [ 240.349431][ T3851] should_fail_alloc_page+0x55/0x80 [ 240.354733][ T3851] prepare_alloc_pages+0x13f/0x590 [ 240.359875][ T3851] ? __alloc_pages_bulk+0xab0/0xab0 [ 240.365085][ T3851] ? release_pages+0x1264/0x12c0 [ 240.370024][ T3851] __alloc_pages+0x11d/0x460 [ 240.374617][ T3851] ? unlock_page_memcg+0x114/0x130 [ 240.379730][ T3851] ? prep_new_page+0x110/0x110 [ 240.384493][ T3851] ? page_remove_rmap+0xc6d/0xf40 [ 240.389516][ T3851] ? page_add_file_rmap+0x700/0x700 [ 240.394717][ T3851] ? __kasan_check_write+0x14/0x20 [ 240.399846][ T3851] ? _raw_spin_lock+0x94/0xf0 [ 240.404523][ T3851] __get_free_pages+0x10/0x30 [ 240.409204][ T3851] __tlb_remove_page_size+0x18a/0x310 [ 240.414586][ T3851] unmap_page_range+0x1059/0x1e00 [ 240.419619][ T3851] ? mmu_notifier_invalidate_range_end+0xe0/0xe0 [ 240.425950][ T3851] ? lru_cache_add+0x7e0/0x7e0 [ 240.430721][ T3851] unmap_vmas+0x26d/0x380 [ 240.435062][ T3851] ? unmap_page_range+0x1e00/0x1e00 [ 240.440259][ T3851] ? __kasan_check_write+0x14/0x20 [ 240.445373][ T3851] ? tlb_gather_mmu_fullmm+0x144/0x1c0 [ 240.450831][ T3851] exit_mmap+0x412/0x8b0 [ 240.455075][ T3851] ? vm_brk+0x30/0x30 [ 240.459056][ T3851] ? mutex_unlock+0x8f/0x230 [ 240.463644][ T3851] ? uprobe_clear_state+0x2c6/0x320 [ 240.468848][ T3851] __mmput+0x92/0x300 [ 240.472827][ T3851] mmput+0x50/0x150 [ 240.476632][ T3851] do_exit+0xacc/0x29a0 [ 240.480792][ T3851] ? put_task_struct+0x90/0x90 [ 240.485553][ T3851] ? __kasan_check_write+0x14/0x20 [ 240.490663][ T3851] ? _raw_spin_lock_irq+0x95/0xf0 [ 240.495695][ T3851] do_group_exit+0x149/0x310 [ 240.500286][ T3851] ? __kasan_check_write+0x14/0x20 [ 240.505395][ T3851] ? recalc_sigpending+0x1ac/0x230 [ 240.510514][ T3851] get_signal+0x64f/0x1430 [ 240.514937][ T3851] arch_do_signal_or_restart+0xe2/0x1100 [ 240.520566][ T3851] ? btf_new_fd+0x5c7/0x930 [ 240.525073][ T3851] ? get_sigframe_size+0x10/0x10 [ 240.530011][ T3851] ? __se_sys_futex+0x135/0x330 [ 240.534869][ T3851] exit_to_user_mode_loop+0xa7/0xe0 [ 240.539709][ T3857] loop3: detected capacity change from 0 to 512 [ 240.540067][ T3851] exit_to_user_mode_prepare+0x87/0xd0 [ 240.540089][ T3851] syscall_exit_to_user_mode+0x1a/0x30 [ 240.555166][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 240.557181][ T3851] do_syscall_64+0x58/0xa0 [ 240.557201][ T3851] ? clear_bhb_loop+0x50/0xa0 [ 240.575822][ T3851] ? clear_bhb_loop+0x50/0xa0 [ 240.580533][ T3851] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 240.586429][ T3851] RIP: 0033:0x7f523f839199 [ 240.590846][ T3851] Code: Unable to access opcode bytes at RIP 0x7f523f83916f. [ 240.598204][ T3851] RSP: 002b:00007f523e2920e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 240.606622][ T3851] RAX: fffffffffffffe00 RBX: 00007f523fac0fa8 RCX: 00007f523f839199 [ 240.614602][ T3851] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f523fac0fa8 [ 240.622574][ T3851] RBP: 00007f523fac0fa0 R08: 0000000000000000 R09: 0000000000000000 [ 240.630639][ T3851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.638611][ T3851] R13: 00007f523fac1038 R14: 00007fff961132e0 R15: 00007fff961133c8 [ 240.646566][ T3851] [ 240.688064][ T3857] EXT4-fs (loop3): Ignoring removed bh option [ 240.698858][ T3873] loop1: detected capacity change from 0 to 512 [ 240.707283][ T3857] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 240.718299][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 240.718985][ T3857] EXT4-fs warning (device loop3): dx_probe:881: Enable large directory feature to access it [ 240.738946][ T3857] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.1036: Corrupt directory, running e2fsck is recommended [ 240.752385][ T3857] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -117 [ 240.760716][ T3857] EXT4-fs error (device loop3): ext4_iget_extra_inode:4604: inode #15: comm syz.3.1036: corrupted in-inode xattr [ 240.773038][ T3873] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 240.773126][ T3857] EXT4-fs error (device loop3): ext4_orphan_get:1415: comm syz.3.1036: couldn't read orphan inode 15 (err -117) [ 240.811191][ T3857] EXT4-fs (loop3): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,grpquota,jqfmt=vfsold,nolazytime,grpjquota=.dax=always,resuid=0x0000000000000000,bh,minixdf,,,errors=continue. Quota mode: writeback. [ 240.858206][ T3873] EXT4-fs (loop1): 1 truncate cleaned up [ 240.950532][ T3873] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,usrjquota=,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 240.998692][ T3857] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 241.010429][ T3857] EXT4-fs warning (device loop3): dx_probe:881: Enable large directory feature to access it [ 241.020707][ T3857] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.1036: Corrupt directory, running e2fsck is recommended [ 241.034800][ T3857] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 241.046499][ T3857] EXT4-fs warning (device loop3): dx_probe:881: Enable large directory feature to access it [ 241.056874][ T3857] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.1036: Corrupt directory, running e2fsck is recommended [ 241.071516][ T3857] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 241.087284][ T3857] EXT4-fs warning (device loop3): dx_probe:881: Enable large directory feature to access it [ 241.097958][ T3857] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.1036: Corrupt directory, running e2fsck is recommended [ 241.112385][ T3857] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 241.125164][ T3857] EXT4-fs error (device loop3): ext4_empty_dir:3147: inode #2: block 3: comm syz.3.1036: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=4294967295, rec_len=17, size=1024 fake=0 [ 241.151498][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 241.167693][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 241.212539][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 241.224076][ T3890] loop3: detected capacity change from 0 to 16 [ 241.229206][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 241.252224][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 241.303294][ T1912] udevd[1912]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 241.314358][ T30] audit: type=1326 audit(1791403907.381:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.355601][ T30] audit: type=1326 audit(1791403907.411:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.380767][ T30] audit: type=1326 audit(1791403907.411:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.417273][ T30] audit: type=1400 audit(1791403907.411:486): avc: denied { connect } for pid=3892 comm="syz.6.1049" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 241.437108][ T30] audit: type=1326 audit(1791403907.411:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=92 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.537823][ T30] audit: type=1326 audit(1791403907.411:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.563121][ T30] audit: type=1326 audit(1791403907.411:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.588551][ T30] audit: type=1326 audit(1791403907.411:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.613448][ T30] audit: type=1326 audit(1791403907.411:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.655305][ T30] audit: type=1326 audit(1791403907.411:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.3.1047" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fc2b9f00199 code=0x7ffc0000 [ 241.761129][ T3917] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 241.817128][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 241.829347][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 241.854033][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 241.889067][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 241.914959][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 241.940752][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 241.966008][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 241.993621][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 242.413792][ T3942] loop6: detected capacity change from 0 to 256 [ 242.546469][ T3952] FAULT_INJECTION: forcing a failure. [ 242.546469][ T3952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 242.559691][ T3952] CPU: 1 PID: 3952 Comm: syz.3.1073 Not tainted syzkaller #0 [ 242.567075][ T3952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 242.577133][ T3952] Call Trace: [ 242.580449][ T3952] [ 242.583382][ T3952] __dump_stack+0x21/0x30 [ 242.587715][ T3952] dump_stack_lvl+0x110/0x170 [ 242.592393][ T3952] ? show_regs_print_info+0x20/0x20 [ 242.597592][ T3952] dump_stack+0x15/0x20 [ 242.601752][ T3952] should_fail+0x3ab/0x500 [ 242.606170][ T3952] should_fail_usercopy+0x1a/0x20 [ 242.611196][ T3952] _copy_from_user+0x20/0xd0 [ 242.615784][ T3952] strndup_user+0xb1/0x150 [ 242.620200][ T3952] __se_sys_request_key+0x184/0x350 [ 242.625397][ T3952] ? __x64_sys_request_key+0xb0/0xb0 [ 242.630688][ T3952] ? __kasan_check_write+0x14/0x20 [ 242.635805][ T3952] ? switch_fpu_return+0x15d/0x2c0 [ 242.640923][ T3952] __x64_sys_request_key+0x9b/0xb0 [ 242.646038][ T3952] x64_sys_call+0x6f7/0x9a0 [ 242.650541][ T3952] do_syscall_64+0x4c/0xa0 [ 242.654967][ T3952] ? clear_bhb_loop+0x50/0xa0 [ 242.659655][ T3952] ? clear_bhb_loop+0x50/0xa0 [ 242.664311][ T3952] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 242.670183][ T3952] RIP: 0033:0x7fc2b9f00199 [ 242.674585][ T3952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.694191][ T3952] RSP: 002b:00007fc2b8959028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 242.702601][ T3952] RAX: ffffffffffffffda RBX: 00007fc2ba187fa0 RCX: 00007fc2b9f00199 [ 242.710656][ T3952] RDX: 00002000000001c0 RSI: 0000200000000180 RDI: 00002000000000c0 [ 242.718646][ T3952] RBP: 00007fc2b9f978e0 R08: 0000000000000000 R09: 0000000000000000 [ 242.726596][ T3952] R10: 0000000006bfb8dc R11: 0000000000000246 R12: 0000000000000000 [ 242.734572][ T3952] R13: 00007fc2ba188038 R14: 00007fc2ba187fa0 R15: 00007ffc96ccf898 [ 242.742530][ T3952] [ 242.846494][ T3958] xt_hashlimit: max too large, truncated to 1048576 [ 242.936357][ T3962] loop1: detected capacity change from 0 to 128 [ 242.996939][ T3962] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 243.010351][ T3962] ext4 filesystem being mounted at /180/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 243.638687][ T3984] mmap: syz.1.1081 (3984) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 243.763907][ T3997] device syzkaller0 entered promiscuous mode [ 243.772476][ T3997] tipc: Enabled bearer , priority 0 [ 243.781033][ T3997] tipc: Resetting bearer [ 243.787958][ T3996] tipc: Resetting bearer [ 243.794310][ T3996] tipc: Disabling bearer [ 243.960445][ T446] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 244.516830][ T446] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 244.526393][ T446] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.534654][ T446] usb 2-1: Product: syz [ 244.538861][ T446] usb 2-1: Manufacturer: syz [ 244.543683][ T446] usb 2-1: SerialNumber: syz [ 244.580158][ T4018] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1097'. [ 244.581835][ T4020] UDC core: couldn't find an available UDC or it's busy: -19 [ 244.599514][ T4022] loop3: detected capacity change from 0 to 256 [ 244.665779][ T306] ================================================================== [ 244.665905][ T4023] ------------[ cut here ]------------ [ 244.673883][ T306] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xcd/0x3d0 [ 244.673910][ T306] Read of size 8 at addr ffff8881298c0880 by task kworker/u4:3/306 [ 244.673925][ T306] [ 244.673930][ T306] CPU: 1 PID: 306 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 244.673946][ T306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 244.679470][ T4023] WARNING: CPU: 0 PID: 4023 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 244.686985][ T306] Workqueue: l2tp l2tp_tunnel_del_work [ 244.687005][ T306] Call Trace: [ 244.687012][ T306] [ 244.687019][ T306] __dump_stack+0x21/0x30 [ 244.695553][ T4023] Modules linked in: [ 244.697205][ T306] dump_stack_lvl+0x110/0x170 [ 244.704814][ T4023] [ 244.714673][ T306] ? show_regs_print_info+0x20/0x20 [ 244.714696][ T306] ? load_image+0x3f0/0x3f0 [ 244.714710][ T306] print_address_description+0x7f/0x2c0 [ 244.714725][ T306] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 244.725106][ T4023] CPU: 0 PID: 4023 Comm: syz.3.1100 Not tainted syzkaller #0 [ 244.730204][ T306] kasan_report+0x10f/0x150 [ 244.733643][ T4023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 244.736393][ T306] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 244.736416][ T306] __asan_report_load8_noabort+0x14/0x20 [ 244.740957][ T4023] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 244.744589][ T306] l2tp_tunnel_del_work+0xcd/0x3d0 [ 244.749246][ T4023] Code: 5d c3 e8 3c ac 0a fd be 02 00 00 00 eb 0a e8 30 ac 0a fd be 01 00 00 00 4c 89 f7 e8 73 2e f1 fd e9 0f ff ff ff e8 19 ac 0a fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 08 ac 0a fd 4c 89 f7 be 03 [ 244.751562][ T306] process_one_work+0x6c8/0xbb0 [ 244.751587][ T306] worker_thread+0xaa0/0x1250 [ 244.751606][ T306] kthread+0x3f5/0x4f0 [ 244.751622][ T306] ? worker_clr_flags+0x190/0x190 [ 244.757263][ T4023] RSP: 0018:ffffc900023c7d10 EFLAGS: 00010293 [ 244.761286][ T306] ? kthread_blkcg+0xd0/0xd0 [ 244.761309][ T306] ret_from_fork+0x1f/0x30 [ 244.761325][ T306] [ 244.761332][ T306] [ 244.767147][ T4023] [ 244.772113][ T306] Allocated by task 4024: [ 244.772124][ T306] __kasan_kmalloc+0xd4/0x100 [ 244.772141][ T306] __kmalloc+0x13d/0x2c0 [ 244.779747][ T4023] RAX: ffffffff845f2f47 RBX: ffff888112a99000 RCX: ffff888117e6bc00 [ 244.783964][ T306] l2tp_session_create+0x39/0xb60 [ 244.783985][ T306] pppol2tp_connect+0xbf5/0x1640 [ 244.783998][ T306] __sys_connect+0x3cb/0x450 [ 244.784011][ T306] __x64_sys_connect+0x7a/0x90 [ 244.794519][ T4023] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 244.799302][ T306] x64_sys_call+0x7c/0x9a0 [ 244.805122][ T4023] RBP: ffffc900023c7d30 R08: ffff888112a99083 R09: 1ffff11022553210 [ 244.811207][ T306] do_syscall_64+0x4c/0xa0 [ 244.811225][ T306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 244.811241][ T306] [ 244.811245][ T306] Freed by task 4024: [ 244.816612][ T4023] R10: dffffc0000000000 R11: ffffed1022553211 R12: dffffc0000000000 [ 244.835909][ T306] kasan_set_track+0x4a/0x70 [ 244.835928][ T306] kasan_set_free_info+0x23/0x40 [ 244.835942][ T306] ____kasan_slab_free+0x125/0x160 [ 244.835956][ T306] __kasan_slab_free+0x11/0x20 [ 244.835968][ T306] slab_free_freelist_hook+0xc2/0x190 [ 244.835979][ T306] kfree+0xc4/0x270 [ 244.841200][ T4023] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881298c0800 [ 244.845472][ T306] l2tp_session_put+0xaf/0x1a0 [ 244.849515][ T4023] FS: 00005555652f7500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 244.854514][ T306] pppol2tp_ioctl+0x748/0x960 [ 244.854527][ T306] pppox_ioctl+0x1e1/0x440 [ 244.854543][ T306] sock_do_ioctl+0x103/0x310 [ 244.854559][ T306] sock_ioctl+0x459/0x6d0 [ 244.860956][ T4023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 244.865162][ T306] __se_sys_ioctl+0x121/0x1a0 [ 244.869557][ T4023] CR2: 000000110c2842cc CR3: 000000011709c000 CR4: 00000000003526b0 [ 244.872559][ T306] __x64_sys_ioctl+0x7b/0x90 [ 244.872575][ T306] x64_sys_call+0x2f/0x9a0 [ 244.872589][ T306] do_syscall_64+0x4c/0xa0 [ 244.872603][ T306] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 244.872619][ T306] [ 244.872622][ T306] Last potentially related work creation: [ 244.872629][ T306] kasan_save_stack+0x3a/0x60 [ 244.875495][ T4023] Call Trace: [ 244.877239][ T306] __kasan_record_aux_stack+0xd2/0x100 [ 244.881718][ T4023] [ 244.886192][ T306] kasan_record_aux_stack_noalloc+0xb/0x10 [ 244.886212][ T306] call_rcu+0x10b/0xf60 [ 244.890669][ T4023] pppol2tp_release+0x150/0x2b0 [ 244.898390][ T306] in_dev_finish_destroy+0x123/0x170 [ 244.903631][ T4023] sock_close+0xb8/0x200 [ 244.908297][ T306] inetdev_event+0x84c/0x1060 [ 244.912998][ T4023] ? sock_mmap+0xa0/0xa0 [ 244.917596][ T306] raw_notifier_call_chain+0x90/0x100 [ 244.917615][ T306] unregister_netdevice_many+0x103d/0x1a00 [ 244.925807][ T4023] __fput+0x22b/0x900 [ 244.929961][ T306] ip6_tnl_exit_batch_net+0x3eb/0x440 [ 244.938142][ T4023] ____fput+0x15/0x20 [ 244.942313][ T306] cleanup_net+0x605/0xae0 [ 244.942328][ T306] process_one_work+0x6c8/0xbb0 [ 244.942344][ T306] worker_thread+0xaa0/0x1250 [ 244.948483][ T4023] task_work_run+0x127/0x190 [ 244.950526][ T306] kthread+0x3f5/0x4f0 [ 244.950541][ T306] ret_from_fork+0x1f/0x30 [ 244.950556][ T306] [ 244.954730][ T4023] exit_to_user_mode_loop+0xd0/0xe0 [ 244.962453][ T306] Second to last potentially related work creation: [ 244.962460][ T306] kasan_save_stack+0x3a/0x60 [ 244.962476][ T306] __kasan_record_aux_stack+0xd2/0x100 [ 244.962491][ T306] kasan_record_aux_stack_noalloc+0xb/0x10 [ 244.962505][ T306] kvfree_call_rcu+0xb6/0x860 [ 244.962519][ T306] neigh_destroy+0x44f/0x590 [ 244.967420][ T4023] exit_to_user_mode_prepare+0x87/0xd0 [ 244.971992][ T306] neigh_cleanup_and_release+0x76/0x1a0 [ 244.972011][ T306] neigh_periodic_work+0x891/0xaa0 [ 244.972026][ T306] process_one_work+0x6c8/0xbb0 [ 244.977396][ T4023] syscall_exit_to_user_mode+0x1a/0x30 [ 244.981843][ T306] worker_thread+0xaa0/0x1250 [ 244.981861][ T306] kthread+0x3f5/0x4f0 [ 244.981875][ T306] ret_from_fork+0x1f/0x30 [ 244.987508][ T4023] do_syscall_64+0x58/0xa0 [ 244.991005][ T306] [ 244.991010][ T306] The buggy address belongs to the object at ffff8881298c0800 [ 244.991010][ T306] which belongs to the cache kmalloc-512 of size 512 [ 244.991023][ T306] The buggy address is located 128 bytes inside of [ 244.991023][ T306] 512-byte region [ffff8881298c0800, ffff8881298c0a00) [ 244.991039][ T306] The buggy address belongs to the page: [ 244.999313][ T4023] ? clear_bhb_loop+0x50/0xa0 [ 245.003739][ T306] page:ffffea0004a63000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1298c0 [ 245.003759][ T306] head:ffffea0004a63000 order:2 compound_mapcount:0 compound_pincount:0 [ 245.012888][ T4023] ? clear_bhb_loop+0x50/0xa0 [ 245.017308][ T306] flags: 0x4000000000010200(slab|head|zone=1) [ 245.021846][ T4023] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 245.026276][ T306] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100042f00 [ 245.026292][ T306] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 245.030819][ T4023] RIP: 0033:0x7fc2b9f00199 [ 245.037149][ T306] page dumped because: kasan: bad access detected [ 245.041980][ T4023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.049753][ T306] page_owner tracks the page as allocated [ 245.055463][ T4023] RSP: 002b:00007ffc96ccf9f8 EFLAGS: 00000246 [ 245.058704][ T306] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 287, ts 22598167310, free_ts 0 [ 245.063378][ T4023] ORIG_RAX: 00000000000001b4 [ 245.069143][ T306] post_alloc_hook+0x192/0x1b0 [ 245.069176][ T306] prep_new_page+0x1c/0x110 [ 245.069191][ T306] get_page_from_freelist+0x2c3a/0x2cd0 [ 245.071846][ T4023] RAX: 0000000000000000 RBX: 00007ffc96ccfae0 RCX: 00007fc2b9f00199 [ 245.077191][ T306] __alloc_pages+0x1a2/0x460 [ 245.082122][ T4023] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 245.085108][ T306] new_slab+0xa0/0x4d0 [ 245.090731][ T4023] RBP: 000000000003bb9a R08: 0000000000000001 R09: 0000000000000000 [ 245.093456][ T306] ___slab_alloc+0x3ac/0x840 [ 245.093476][ T306] __slab_alloc+0x49/0x90 [ 245.099319][ T4023] R10: 0000001b2db20000 R11: 0000000000000246 R12: 00007ffc96ccfb20 [ 245.103426][ T306] __kmalloc+0x16a/0x2c0 [ 245.103443][ T306] fib6_info_alloc+0x34/0xe0 [ 245.103457][ T306] ip6_route_info_create+0x51b/0x14d0 [ 245.108680][ T4023] R13: 00007fc2ba187fac R14: 000000000003bbcd R15: 00007fc2ba187fa0 [ 245.113541][ T306] addrconf_f6i_alloc+0x19c/0x3f0 [ 245.113558][ T306] addrconf_permanent_addr+0x237/0x940 [ 245.113573][ T306] addrconf_notify+0x752/0xe00 [ 245.113587][ T306] raw_notifier_call_chain+0x90/0x100 [ 245.118086][ T4023] [ 245.122459][ T306] __dev_notify_flags+0x2f4/0x5b0 [ 245.122478][ T306] dev_change_flags+0xe3/0x1a0 [ 245.126865][ T4023] ---[ end trace 9560205401280d35 ]--- [ 245.132049][ T306] page_owner free stack trace missing [ 245.132057][ T306] [ 245.132060][ T306] Memory state around the buggy address: [ 245.132070][ T306] ffff8881298c0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 245.132081][ T306] ffff8881298c0800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.132090][ T306] >ffff8881298c0880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.132098][ T306] ^ [ 245.582268][ T306] ffff8881298c0900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.590314][ T306] ffff8881298c0980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.598350][ T306] ================================================================== [ 245.606385][ T306] Disabling lock debugging due to kernel taint [ 245.613201][ T306] ------------[ cut here ]------------ [ 245.620535][ T306] refcount_t: underflow; use-after-free. [ 245.626381][ T306] WARNING: CPU: 1 PID: 306 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 245.635867][ T306] Modules linked in: [ 245.639798][ T306] CPU: 1 PID: 306 Comm: kworker/u4:3 Tainted: G B W syzkaller #0 [ 245.648842][ T306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 245.659084][ T306] Workqueue: l2tp l2tp_tunnel_del_work [ 245.664636][ T306] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 245.670999][ T306] Code: 04 01 48 c7 c7 60 57 63 85 e8 8c 4f 5b 02 0f 0b eb c3 e8 a3 7c 19 ff c6 05 a1 d9 95 04 01 48 c7 c7 c0 57 63 85 e8 70 4f 5b 02 <0f> 0b eb a7 e8 87 7c 19 ff c6 05 82 d9 95 04 01 48 c7 c7 00 57 63 [ 245.690660][ T306] RSP: 0018:ffffc900077d7c40 EFLAGS: 00010246 [ 245.696736][ T306] RAX: 4c04a0ac07b41e00 RBX: 0000000000000003 RCX: ffff88810def2800 [ 245.704717][ T306] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 245.712828][ T306] RBP: ffffc900077d7c50 R08: ffff8881f7127493 R09: 1ffff1103ee24e92 [ 245.720881][ T306] R10: dffffc0000000000 R11: ffffed103ee24e93 R12: ffff88812f03fc20 [ 245.728861][ T306] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 245.736872][ T306] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 245.745822][ T306] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 245.752580][ T306] CR2: 00007fc2ba1532f8 CR3: 0000000126436000 CR4: 00000000003526a0 [ 245.760592][ T306] Call Trace: [ 245.763862][ T306] [ 245.766773][ T306] l2tp_session_put+0xc8/0x1a0 [ 245.771558][ T306] l2tp_session_delete+0x3a9/0x4a0 [ 245.776665][ T306] l2tp_tunnel_del_work+0x180/0x3d0 [ 245.782045][ T306] process_one_work+0x6c8/0xbb0 [ 245.786893][ T306] worker_thread+0xaa0/0x1250 [ 245.791575][ T306] kthread+0x3f5/0x4f0 [ 245.795638][ T306] ? worker_clr_flags+0x190/0x190 [ 245.800661][ T306] ? kthread_blkcg+0xd0/0xd0 [ 245.805242][ T306] ret_from_fork+0x1f/0x30 [ 245.809636][ T306] [ 245.812673][ T306] ---[ end trace 9560205401280d36 ]--- [ 246.582285][ T313] usb 2-1: USB disconnect, device number 12