last executing test programs:

1m54.343715588s ago: executing program 1 (id=186):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000002c0)=@newtfilter={0x38, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xa, 0x7}}]}}]}, 0x38}}, 0x0)
close(0x3)

1m53.682534654s ago: executing program 4 (id=188):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newtfilter={0x58, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x28, 0x2, [@TCA_CGROUP_EMATCHES={0x24, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x14, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}]}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008080}, 0x40010)

1m53.648255765s ago: executing program 1 (id=189):
syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000240)='./sys\x00', 0x3010050, &(0x7f0000000600)=ANY=[], 0x41, 0x14fe, &(0x7f0000001c00)="$eJzs3Au0ztXWMPA511p/NklPkvuaa/55kssiSXJJSCRJkiS5JSRJkoTEJrckJCH3JPeQ3GIn9/st9yQ5kiQJCUnWN3Q6n/e8nfftnO+c7/V9Z8/fGGvsNff/mfNZa889nv9ljL2/7Ti4av1qlesyM/xT8M9fUgEgBQD6AcA1ABABQKlspbIBDoNMGlP/uTcR/1oPTbvSKxBXkvQ/fZP+p2/S//RN+p++Sf/TN+l/+ib9T9+k/0KkZ1un575WRvod/3PP/0Ge//8/R87//0YOFxvz5fpi13f6B1Kk/+mb9D99k/6nb9L/9E36n75J///NRQCV/pvD0v/0TfovRHp2pZ8/y7iy40r//gkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESB/OhcsMAPxlfqXXJYQQQgghhBBCiH+dkPFKr0AIIYQQQgghhBD/9yEo0GAgggyQEVIgE2SGqyALXA1Z4RpIwLWQDa6D7HA95ICckAtyQx7IC/nAAoEDhhjyQwFIwg1QEG6EQlAYikBR8FAMisNNUAJuhpJwC5SCW6E03AZloCyUg/JwO1SAO6AiVILKcCdUgbugKlSDu6E63AM14F6oCfdBLbgfasMDUAcehLrwENSDh6E+PAIN4FFoCI2gMTSBpv9H+S9CV3gJukF3SIUe0BNehl7QG/pAX+gHr0B/eBUGwGswEAbBYHgdhsAbMBTehGEwHEbAWzASRsFoGANjYRyMh7dhArwDE+FdmASTYQpMhWkwHWbAezATZsFseB/mwAcwF+bBfFgAC+FDWASLIQ0+giXwMSyFZbAcVsBKWAWrYQ2shXWwHjbARtgEm2ELbIVPYBtshx2wE3bBbtgDn8Je+Az2weewH774B/PP/qf8TggIqFChQYMZMAOmYApmxsyYBbNgVsyKCUxgNsyG2TE75sAcmAtzYR7Mg/kwHxISMjLmx/yYxCQWxIJYCAthESyCHj0Wx+JYAm/GklgSS2EpLI2lsQyWxbJYHstjBayAFbEiVsbKWAWrYFWsinfj3XgP1sAaWBNrYi2shbWxNtbBOlgX62I9rIf1sT42wAbYEBtiY2yMTbEpNsNm2BybY0tsia2wFbbG1tgG22BbbIvtsB22x/bYATtgR+yInbAzdsYX8UV8CV/C7lhF9cCe2BN7YS/sg32xL76C/fFVfBVfw4E4CAfj6/g6voFD8QwOw+E4AkdgBTUKR+MYZDUOx+N4nIATcCJOxEk4GSfjVJyG03EGzsCZOAtn4fs4Bz/AD3AezsMFuBAX4iJcjGmYhkvwLC7FZbgcV+BKXIUrcQ2uxTW4HjfgetyEm3ALbsFP8BPcjttxJ+7E3bgbP8VP8TP8DAfiftyPB/AAHsSDeAgP4WE8jEfwCB7Fo3gMj+FxPI4n8CSewpN4Gk/jGTyL5/AcnsfzeAGfz/N1vd2F1w0EdYlRRmVQGVSKSlGZVWaVRWVRWVVWlVAJlU1lU9lVdpVD5VC5VC6VR+VR+VQ+RYoUq1jlV/lVUiVVQVVQFVKFVBFVRHnlVXFVXJVQJVRJVVKVUreq0uo2VUaVVS18eVVeVVAtfUVVSVVWlVUVdZeqqqqpaqq6qq5qqBqqpqqpaqlaqrZ6QNVRPbAPPqQudaa+GoQN1GBsqBqpxqqJegMfU83UUGyuWqiW6gk1HIdha9XMt1FPq7ZqNLZTz6ox+JzqoMZhR/WC6qQ6qy7qRdVVNffdMvz2EaimYi/VW/VRfdVMvEtd6lhV9ZoaqAapwep1tQDfUEPVm2qYGq5GqLfUSDVKjVZj1Fg1To1Xb6sJ6h01Ub2rJqnJaoqaqqap6WqGek/NVLPUbPW+mqM+UHPVPDVfLVAL1YdqkVqs0tRHaon6WC1Vy9RytUKtVKvUarVGrVXr1Hq1QW1Um9RmtUVtVZ+obWq72qF2ql1qt9qjPlV71Wdqn/pc7VdfqAPqT+qg+lIdUl+pw+prdUR9o46qb9Ux9Z06rr5XJ9RJdUr9oE6rH9UZdVadUz+p8+pndUH9oi6qoECjVlproyOdQWfUKTqTzqyv0ln01TqrvkYn9LU6m75OZ9fX6xw6p86lc+s8Oq/Op60m7TTrWOfXBXRS36AL6ht1IV1YF9FFtdfFdHF9ky6hb9Yl9S26lL5Vl9a36TK6rC6ny+vbdQV9h66oK+nK+k5dRd+lq+pq+m5dXd+ja+h7dU19n66l79e19QO6jn5Q19UP6Xr6YV1fP6Ib6Ed1Q91IN9ZNdFP9mG6mH9fNdQvdUj+hW+kndWv9lG6jn9Zt9TO6nX5Wt9fP6Q76ed1Rv6A76c66i/5FX9RBd9PddaruoXvql3Uv3Vv30X11P/2K7q9f1QP0a3qgHqQH69f1EP2GHqrf1MP0cD1Cv6VH6lF6tB6jx+pxerx+W0/Q7+iJ+l09SU/WU/RUPU1P131+qzT778h/52/kD/j13bforfoTvU1v1zv0Tr1L79Z79B69V+/V+/Q+vV/v1wf0AX1QH9SH9CF9WB/WR/QRfVQf1cf0MX1cH9cn9En9k/5Bn9Y/6jP6rD6rf9Ln9Xl94befARg0ymhjTGQymIwmxWQymc1VJou52mQ115iEudZkM9eZ7OZ6k8PkNLlMbpPH5DX5jDVknGETm/ymgEmaG0xBc6MpZAqbIqao8aaYKW5u+qfz/2h9TU1T08w0M81Nc9PStDStTCvT2rQ2bUwb09a0Ne1MO9PetDcdTAfT0XQ0nUwn08V0MV1NV9PNdDOpJtX0NC+bXqa36WP6mn7mFdPf9DcDzAAz0Aw0g81gM8QMMUPNUDPMDDMjzAgz0ow0o81oM9aMNePNeDPBTDATzUQzyUwyU8wUM81MMzPMDDPTzDSzzWwzx8wxc81cM9/MNwvNQrPILDJpJs0sMUvMUrPMLDMrzAqzyqwya8was86sMxvMBrPJbDJLzVaz1Wwz28wOs8PsMrvMHrPH7DV7zT6zz+w3+80Bc8AcNAfNIXPIHDaHzRFzxBw1R80xc8wcN8fNCXPCnDKnzGlz2pwxZ8w5c86cN+fNBXPBXDQXL132RSpSkYlMlCHKEKVEKVHmKHOUJcoSZY2yRokoEWWLskXZo+ujHFHOKFeUO8oT5Y1SwUYUuYijOMofFYiS0Q1RwejGqFBUOCoSFY18VCwqHt0UlYhujkpGt0Sloluj0tFtUZmobFQuKh/dHlWI7ogqRpWiytGdUZXorqhqVC26O6oe3RPViO6Nakb3RbWi+6Pa0QNRnejBqG70UFQvejiqHz0SNYgejRpGjaLGUZOo6b+0fghncj7uu9nuNtX2sD3ty7aX7W372L62n33F9rev2gH2NTvQDrKD7et2iH3DDrVv2mF2uB1h37Ij7Sg72o6xY+04O96+bSfYd+xE+66dZCfbKXaqnWan2xn2PTvTzrKz7ft2jv3AzrXz7Hy7wC60H9pFdrFNsx/ZJfZju9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFrvVfmK32e12h91pd9nddo/91O61n9l99nO7335hD9g/2YP2S3vIfmUP26/tEfuNPWq/tcfsd/a4/d6esCftKfuDPW1/tGfsWXvO/mTP25/tBfuLvWjDpYv7S6d3MmQoA2WgFEqhzJSZslAWykpZKUEJykbZKDtlpxyUg3JRLspDeSgf5aNLmJjyU35KUpIKUkEqRIWoCBUhT56KU3EqQSWoJJWkUlSKSlNpKkNlqByVo9vpdrqD7qBKVInupDvpLrqLqlE1qk7VqQbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpATWghtSQGlNjakpNqRk1o+bUnFpSS2pFrag1taY21IbaUltqR+2oPbWnDtSBOlJH6kSdqAt1oa7UlbpRN0qlVOpJPakX9aI+1If6UT/qT/1pAA2ggTSQBtNgGkJDaCgNpWE0nEbQWzSSRtFoGkNjaRyNp/E0gSbQRJpIk2gSTaEpNI2m0QyaQTNpJs2m2TSH5tBcmkvzaT4tpIW0iBZRGqXRElpCS2kpLafltJJW0mpaTWtpLa2n9bSRNtJm2kxbaStto220g3bQLtpFe2gP7aW9tI/20X7aTwfoAB2kg3SIDtFhOkxH6AgdpaN0jI7RcTpOJ+gEnaJTdJpO0xk6Q+foHJ2nn+kC/UIXKVCKU5DZXeWyuKtdVneNS3GZ3KU4AoBLcS6X2+VxeV0+Z10Ol/OvYnLOFXKFXRFX1HlXzBV3N/0uLuPKunKuvLvdVXB3uIq/i6u7e1wNd6+r6e5z1dzdfxXXcve72u4RV8c96uq6Rq6ea+Lqu0dcA/eoa+gaucauiWvlnnSt3VOujXvatXXP/C5e5Ba7tW6dW+82uL3uM3fO/eSOum/defez6+a6u37uFdffveoGuNfcQDfod/EI95Yb6Ua50W6MG+vG/S6e4qa6aW66m+HeczPdrN/FC92Hbo5Lc3PdPDffLfg1vrSmNPeRW+I+dkvdMrfcrXAr3Sq32q3532td4Ta5zW6L2+M+ddvcdrfD7XS73O5f40v72Oc+d/vdF+6I+8YddF+6Q+6YO+y+/jW+tL9j7jt33H3vTriT7pT7wZ12P7oz7uyv+7+09x/cL+6iCw4YWbFmwxFn4Iycwpk4M1/FWfhqzsrXcIKv5Wx8HWfn6zkH5+RcnJvzcF7Ox5aJHTPHnJ8LcJJv4IJ8IxfiwlyEi7LnYlycb+ISfDOX5Fu4FN/Kpfk2LsNluRyX59u5At/BFbkSV+Y7uUoIXJWr8d1cne/hGnwv1+T7uBbfz7X5Aa7DD3Jdfojr8cNcnx/hBvwoN+RG3JibcFN+jJvx49ycW3BLfoJb8ZPcmp/iNvw0t+VnuB0/y+35Oe7Az3NHfoE7cWfuwi9yV36Ju3F3TuUe3JNf5l7cm/twX+7Hr3B/fpUH8Gs8kAfxYH6dh/AbPJTf5GE8nEfwWzySR/FoHsNjeRyP57d5Ar/DE/ldnsSTeQpP5Wk8nWfwezyTZ/Fsfp/n8Ac8l+fxfF7AC/lDXsSLOY0/4iX8MS/lZbycV/BKXsWreQ2v5XW8njfwRt7Em3kLb+VPeBtv5x28k3fxbt7Dn/Je/oz38ee8n7/gA/wnPshf8iH+ig/z13yEv+Gj/C0f4+/4OH/PJ/gkn+If+DT/yGf4LJ/jn/g8/8wX+Be+yIEhxljFOjZxFGeIM8YpcaY4c3xVnCW+Os4aXxMn4mvjbPF1cfb4+jhHnDPOFeeO88R543yxjSl2McdxnD8uECfjG+KC8Y1xobhwXCQuGvu4WFw8vikuEd8cl4xviUvFt8al49viMnHZ+JH7yse3xxXiO+KKcaW4cnxnXCW+K64aV4vvjqvH98Q14nvjmvF9ccn4/rh2/EBcJ34wrhs/FNeLH47rx4/EDeJH44Zxo7hx3CRuGj8WN4sfj5vHLeKW8RNxq/jJuHX8VNwmfjpuGz/zh8dT4x5xz/jl+OU4hHv1/OSC5MLkh8lFycXJtORHySXJj5NLk8uSy5MrkiuTq5Krk2uSa5PrkuuTG5Ibk5uSm5NbkiFUywgevfLaGx/5DD6jT/GZfGZ/lc/ir/ZZ/TU+4a/12fx1Pru/3ufwOX0un9vn8Xl9Pm89eefZxz6/L+CT/gZf0N/oC/nCvogv6r0v5ov7Jr6pb+qb+cd9c9/Ct/RP+Cf8k/5J/5R/yj/t2/pnfDv/rG/vn/Md/PP+ef+C7+Q7+y7+Rd/Vv+S7+e4+1af6nr6n7+V7+T6+j+/n+/n+vr8f4Af4gX6gH+wH+yF+iB/qh/phfpgf4Uf4kX6kH+1H+7F+rB/vx/sJfoKf6Cf6SX6Sn+Kn+Gl+mp/hZ/iZfqaf7Wf7OYXm+Ll+rp/v5/uFfqFf5Bf5NJ/ml/glfqlf6pf75X6lX+lX+9V+rV/r1/v1fqPf6Df7zX6r3+q3+W1+h9/hd/ldfo/f4/f6vX6f3+f3+/3+gD/gD/qD/pD/yh/2X/sj/ht/1H/rj/nv/HH/vT/hT/pT/gd/2v/oz/iz/pz/yZ/3P/sL/hd/0Qc/PvF2YkLincTExLuJSYnJiSmJqYlpiemJGYn3EjMTsxKzE+8n5iQ+SMxNzEvMTyxILEx8mFiUWJxIS3yUWJL4OLE0sSyxPLEisTKxKhFC3m1xyB8KhGS4IRQMN4ZCoXAoEooGH4qF4uGmUCLcHEqGW0KpcGsoHW4LZULZUC48GhqGRqFxaBKahsdCs/B4aB5ahJbhidAqPBlah6dCm/B0aBueCe3Cs6F9eC50CM+HjuGF0Cl0Dl3Ci6FreCl0C91DaugReoaXQ6/QO/QJfUO/8EroH14NA8JrYWAYFAaH18OQ8EYYGt4Mw8LwMCK8FUaGUWF0GBPGhnFhfHg7TAjvhInh3TApTA5TwtQwLUwPM8J7YWaYFWaH98Oc8EGYG+aF+WFBWBg+DIvC4pAWPgpLwsdhaVgWlocVYWVYFVaHNWFtWBfWhw1hY9gUNoctYWv4JGwL28OOsDPsCrvDnvBp2Bs+C/vC52F/+CIcCH8KB8OX4VD4KhwOX4cj4ZtwNHwbjoXvwvHwfTgRToZT4YdwOvwYzoSz4Vz4KZwPP4cL4ZdwUf5mTQghhBDi76L/4HiPv/G9DACgfpv3BICrt+c+/J9rbszx53lvladVAgCe7t7xob+MKlVSU1N/e+1SDVGBeQCQ+Ov6f4mXQUt4EtpACyjxN9fXW3U+z39QP3krQOb/kJMCl+PL9W/+L+o/9sSIRaXjc9n+m/rzAAoVuJyTCS7Hl+uX/C/q52z2B+vP9OV4gOb/IScLXI4v1y8Oj8Mz0OavXimEEEIIIYQQQvxZb1Wu/R/dP1+6P89jLudkhMvxH92fCyGEEEIIIYQQ4sp7rnOXpx5r06ZF+79vgr89F/jHsmQiE5n8fza50p9MQgghhBBCiH+1yxf9V3olQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFE+vU/8e/ErvQehRBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiCvtfwUAAP//luw5aQ==")
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
syz_mount_image$exfat(0x0, &(0x7f0000000080)='./bus\x00', 0x24806, 0x0, 0xfd, 0x0, &(0x7f0000000000))
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x380007b, 0x0, 0x1, 0x0, &(0x7f0000000140))
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
rename(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000480)='./file2\x00')

1m53.107623178s ago: executing program 1 (id=191):
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000340)="04", 0x1)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xaa9a}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa0000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x15}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x236a, 0x4)
setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0x400000b2, 0x4)
sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c, 0x0}}], 0x1, 0x0)
recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/35, 0x23}, 0x7}], 0x40000cb, 0x12141, 0x0)

1m52.987991751s ago: executing program 4 (id=192):
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8183)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x1, 0x1, 0x400}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x1, 0x1, 0x400}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)

1m52.869955524s ago: executing program 1 (id=194):
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000001c0)='./file0\x00', 0x2048c5, &(0x7f0000000b00)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee00, @ANYBLOB="2c73686f72746e616d653d77696e6e742c6e6f6e756d7461696c3d302c757365667265652c756e695f786c6174653d312c726f6469722c756d61736b3d30303030303030303030303031343537363137333737352c6e66733d7374616c655f72772c73686f77657865632c6e6f636173652c6572726f72733d72656d6f756e742d726f2c757466383d302c757466383d312c0043cc2364e7cd23b31e5f53c642e6af35e90d17982f932ed18129baaa22f1e74dd9fc3ded15ed04c3d16b14c3c28855d1ce9dcf134cd44ec195ea73380cb6d87bbc7b25a0cedba680db3a21410c489b557c96ddf5656a22d9d687fedf72fc3e92bba2699e8b4c2ba67449c6b5c621f0f0eda16468425e0b86aa97a0059559d313715dcbb0ee9a7c78fe860d81369889fbd736c7b0c9ad9edfb91b02d5bf6c1d98c171861b9652fe629fb73c85e1de8969a906848a868e7ddb5703b4a767430e7ab81d52313552d3fbf0ec7ce6629d818b7747eb947aa26f75559932e215e3559dce4a6036fa3adcfe5ffaf4f8c3b4074dbb2808"], 0x0, 0x29f, &(0x7f0000000840)="$eJzs3UFrE1sYxvGnSdukKW2yKBfuhct9uW50M7TxEwRpQQwotRF1IUztREPGpGRiJCK2O7d+juLSlYL6Bbpx517cFEFw04UYaZKxaRswra1Tzf8HYU7OOe/MmZyZ8M5AJlvXn94rFwOn6NYVS5pi0rq2pcxOqWuku4y1y+Pqta5zk5/f/Xv1xs1LuXx+ftFsIbd0Pmtm0/+9evDo2f9v6pPXnk+/TGgzc2vrU/b95l+bf299XQrXXpVcW65W6+6y79lKKSg7Zld8zw08K1UCr1a3nvaiX11dbZpbWZlKrda8IDC30rSy17R61eq1prl33FLFHMexqZSGTfzQEYWNxUU3dyKDQRQm+lXWajk33rexsPErBgUAAE6XqPL/u6XASoFVqnvy+4P5f0yHyP+loc7/D4/8fxjs5P+p7vm7F/k/AAAAAAAAAAAAAAAAAAAAAAC/g+1WK91qtdLhMnwlJCUlhe+jHidOBvM/3Hp+uJeU/CeNQqPQWXbac0WV5MvT7Jj0pX08dHXKCxfz87PWltFrf60bv9YoxJUI40OZ/vFznXjrjV/TmFK9288qrZn+8dk+8Y3CuM6eaSW6W/bkKK23t1WVr5X2cb0b/3jO7MLl/L74iXY/AAAAAAD+BI59d+D6vd3uWPjYkH3tncrd+wNK/+D+wL7r61H9MxrdfgMAAAAAMEyC5sOy6/tebQgK4f8fHMsKo//okoN2HpXUrXlxWuZikEJM0lHD4z83yx8l7amZiXy6j6Pw4X7nDBikc5TfSgAAAABOQpj0j0Q9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhtigDw8L+x/l2WM9m4tHs5cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA6fAtAAD//2kbF4o=")
r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00')
mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0)
mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x11080, 0x0)
mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0)
read$FUSE(r0, &(0x7f0000000b00)={0x2020}, 0x17f5)

1m52.749127017s ago: executing program 4 (id=195):
syz_mount_image$erofs(&(0x7f00000003c0), &(0x7f0000000880)='./file0\x00', 0x18000c6, &(0x7f0000000200)=ANY=[@ANYRES16=0x0, @ANYRES16], 0x0, 0x17d, &(0x7f0000001ac0)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA")
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000000)='./bus\x00')
rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)='./bus\x00')
rmdir(&(0x7f00000000c0)='./bus\x00')

1m52.428511944s ago: executing program 1 (id=199):
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev\x00', 0x1df)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0xf000, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)

1m52.20395799s ago: executing program 4 (id=200):
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x101091, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x104000, 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x2125099, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00')
ppoll(&(0x7f00000000c0)=[{r0, 0x208}, {r0, 0x18c}], 0x2, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='ramfs\x00', 0x10010, 0x0)

1m51.953112686s ago: executing program 4 (id=201):
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", <r2=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", <r3=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r3, <r4=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f00000000c0)=0x402)
ioctl$SYNC_IOC_FILE_INFO(r4, 0xc0383e04, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0})

1m51.948149796s ago: executing program 1 (id=202):
syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000000, &(0x7f0000003f40), 0xfe, 0x2a4, &(0x7f0000000a80)="$eJzs3bFrJFUcB/DfzO4mxjuOUxsrEUREA+EsBMFGGw8O5BARQQ9O5LRRLkJM2qyVjYW9SiqbIFYaBRuxCTb+AVFTxMYmWBgUTDGyO7Oy2Ww2s+7srGQ/H9jZN5s3eW/Jft9MmJl9AcytqxHxbEQ0ImI5IloRkfRXeDh/XC1Wt5Z2b0dk2Uu/J916+Xqut92liGhHxNMRzd7PNnZeO/hz7/pjH663Hv1s59Wlut5fv8OD/ReOPr35wVc3ntxIi9cuF8/976NKyZDXmknE/dNo7H8iaZasuDjljnCOL37q5P6BiHikm/9WpEVkP1pb+L4VT3wyfLuFo3r7CUxDlrU6+8B2BsydtHsMnKQrEZGX03RlJT+G/7mRxDura+8tv7W6fvfOrEcq4FxfHmfZ6BpJO/+/d//5bxa/vjSQ/98aef5LeaqKDgN16+T/5Re3f+mUjxqz7g1Qg297hU7+l1/ffDzkHy6UMifX5B8umrInXuUf5tlY+U/r6RMwplHZHXF9lf0/zC/5h/lVNv/tGvsEVKTVKwxP8OT7/7+KKwj/exeBul3pLh3/w/wayH9xyUBxt2q5g/7rb955e3odBKp2q1fozz8AMF+yxRnfgAzMzKzHHwAAAAAAAAAAAAAAAAAA4LStpd3bvUddbf7wccThc/m0Rf3t59MWNIppR+7pLu/9Izkxu1Ey1mxHw92acPtJfV7x3dc3R8z3MMyVX6ttv/xfZKG7/PGhqtvPvX9y9czp8DbvRrQ7la81m6c//0nZaW/O/P33nbNh641yDVQlGVh/5pV62x90vD3b9m/sRXzXGX+uDRv/0niw+zx8/Lnc/xXL8e9Heizv/j1J7wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjTPwEAAP//d/F4Hg==")
syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140))
mkdir(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
creat(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x185)
syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40))
r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x20)
getdents(r0, &(0x7f0000001fc0)=""/184, 0x2000208e)

1m51.460078028s ago: executing program 32 (id=202):
syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000000, &(0x7f0000003f40), 0xfe, 0x2a4, &(0x7f0000000a80)="$eJzs3bFrJFUcB/DfzO4mxjuOUxsrEUREA+EsBMFGGw8O5BARQQ9O5LRRLkJM2qyVjYW9SiqbIFYaBRuxCTb+AVFTxMYmWBgUTDGyO7Oy2Ww2s+7srGQ/H9jZN5s3eW/Jft9MmJl9AcytqxHxbEQ0ImI5IloRkfRXeDh/XC1Wt5Z2b0dk2Uu/J916+Xqut92liGhHxNMRzd7PNnZeO/hz7/pjH663Hv1s59Wlut5fv8OD/ReOPr35wVc3ntxIi9cuF8/976NKyZDXmknE/dNo7H8iaZasuDjljnCOL37q5P6BiHikm/9WpEVkP1pb+L4VT3wyfLuFo3r7CUxDlrU6+8B2BsydtHsMnKQrEZGX03RlJT+G/7mRxDura+8tv7W6fvfOrEcq4FxfHmfZ6BpJO/+/d//5bxa/vjSQ/98aef5LeaqKDgN16+T/5Re3f+mUjxqz7g1Qg297hU7+l1/ffDzkHy6UMifX5B8umrInXuUf5tlY+U/r6RMwplHZHXF9lf0/zC/5h/lVNv/tGvsEVKTVKwxP8OT7/7+KKwj/exeBul3pLh3/w/wayH9xyUBxt2q5g/7rb955e3odBKp2q1fozz8AMF+yxRnfgAzMzKzHHwAAAAAAAAAAAAAAAAAA4LStpd3bvUddbf7wccThc/m0Rf3t59MWNIppR+7pLu/9Izkxu1Ey1mxHw92acPtJfV7x3dc3R8z3MMyVX6ttv/xfZKG7/PGhqtvPvX9y9czp8DbvRrQ7la81m6c//0nZaW/O/P33nbNh641yDVQlGVh/5pV62x90vD3b9m/sRXzXGX+uDRv/0niw+zx8/Lnc/xXL8e9Heizv/j1J7wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjTPwEAAP//d/F4Hg==")
syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140))
mkdir(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
creat(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x185)
syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40))
r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x20)
getdents(r0, &(0x7f0000001fc0)=""/184, 0x2000208e)

1m51.439116148s ago: executing program 4 (id=204):
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', 0x800000, &(0x7f0000000000)={[{@fat=@allow_utime={'allow_utime', 0x3d, 0xe467}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'default'}}, {@shortname_winnt}, {@iocharset={'iocharset', 0x3d, 'macturkish'}}, {@iocharset={'iocharset', 0x3d, 'euc-jp'}}, {@iocharset={'iocharset', 0x3d, 'cp860'}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'utf8'}}, {}, {@shortname_mixed}, {@shortname_win95}, {@shortname_lower}, {@utf8no}]}, 0xff, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==")
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94)
r0 = open(&(0x7f0000000040)='./file2\x00', 0x8c000, 0x0)
preadv2(r0, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80)
sendfile(r1, r1, 0x0, 0x7a680000)

1m51.000914669s ago: executing program 33 (id=204):
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', 0x800000, &(0x7f0000000000)={[{@fat=@allow_utime={'allow_utime', 0x3d, 0xe467}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'default'}}, {@shortname_winnt}, {@iocharset={'iocharset', 0x3d, 'macturkish'}}, {@iocharset={'iocharset', 0x3d, 'euc-jp'}}, {@iocharset={'iocharset', 0x3d, 'cp860'}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'utf8'}}, {}, {@shortname_mixed}, {@shortname_win95}, {@shortname_lower}, {@utf8no}]}, 0xff, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==")
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94)
r0 = open(&(0x7f0000000040)='./file2\x00', 0x8c000, 0x0)
preadv2(r0, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80)
sendfile(r1, r1, 0x0, 0x7a680000)

58.849082224s ago: executing program 5 (id=430):
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
r3 = dup3(r2, r1, 0x0)
r4 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmmsg(r4, &(0x7f00000035c0)=[{{0x0, 0x0, 0x0}, 0xfffffffb}], 0x1, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0)
read$FUSE(r0, &(0x7f0000005180)={0x2020}, 0x2020)

57.77339138s ago: executing program 5 (id=437):
r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@wr_drn={0x68, 0x20, {0x7, 0x2000}}, @wr_drn={0x68, 0x20, {0x0, 0x1}}], 0x40})
ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000100)={0x10001})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

56.871189721s ago: executing program 5 (id=442):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x8401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5)
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x3)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x34, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe64, 0x1ff, @mcast1, 0x4}, 0x1c)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

56.200524437s ago: executing program 5 (id=446):
syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4040, &(0x7f00000015c0)=ANY=[], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='pids.current\x00', 0x275a, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
symlinkat(&(0x7f00000000c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1800000, 0x0, 0xb7, 0x0, &(0x7f00000003c0))
openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x101341, 0xaf)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0)
syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0)

55.414510656s ago: executing program 5 (id=451):
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0x8f, 0x4)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000b80)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d500891e58a3f851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7bebc905a984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38", 0xf4}, {&(0x7f0000000cc0)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9af", 0x32}], 0x2}}], 0x1, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4)
sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0)

54.609176396s ago: executing program 5 (id=456):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0)
close(r2)
write(r0, 0x0, 0x0)
mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000003, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0x15, 0x5, 0x0)
getsockopt(r4, 0x200000000114, 0x271e, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9)

54.196188946s ago: executing program 34 (id=456):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0)
close(r2)
write(r0, 0x0, 0x0)
mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000003, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0x15, 0x5, 0x0)
getsockopt(r4, 0x200000000114, 0x271e, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9)

22.779868192s ago: executing program 6 (id=608):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x7f})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f00000000c0)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f00000007c0)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50)
io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2b, &(0x7f0000000400)={0x0, {{0xa, 0xfffc, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0x0, @loopback, 0xfffffffe}}}, 0x11f)
write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0x217, @time={0x65757100, 0x5}, 0x0, {}, 0x67, 0x2})

22.388482672s ago: executing program 6 (id=611):
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
syz_emit_ethernet(0x6e, &(0x7f0000000100)={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00\'$', 0x38, 0x3a, 0x1, @dev={0xfe, 0x80, '\x00', 0x24}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x6, 0x6, ':yE', 0x2, 0x3a, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, [], "8029335287b7a081"}}}}}}}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000001740)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2000, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_ublk_setup_io_uring(0x22, 0x0, &(0x7f0000000000), 0x0, 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x200000000000, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x6, 0x24, &(0x7f0000000080)=ANY=[], 0x0)
ioctl$EVIOCRMFF(r0, 0x40095505, 0x0)

12.298628994s ago: executing program 6 (id=626):
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)=0x6)
ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000140)=0x2)
write$dsp(r0, &(0x7f0000000200)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000)
ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000000080)=0x1)
ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000000080))
ioctl$SNDRV_PCM_IOCTL_RESUME(r0, 0x4147, 0x0)
r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000400), 0x109801, 0x0)
write$dsp(r1, &(0x7f0000000500)='`', 0x88020)
ioctl$SNDRV_PCM_IOCTL_PAUSE(r1, 0x40044145, &(0x7f0000000080)=0x1)
ioctl$SNDRV_PCM_IOCTL_PAUSE(r1, 0x40044145, &(0x7f0000000080))
ioctl$SNDRV_PCM_IOCTL_RESUME(r1, 0x4147, 0x0)

12.08467769s ago: executing program 3 (id=628):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_emit_ethernet(0x7d, &(0x7f00000000c0)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "a70002", 0x47, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x2}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9900, [], "0080d5"}, {}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x14}, 0x1, {0x7b40}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x80000003, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}}, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil})
r3 = dup(r2)
ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000240)={0x3, 0x2c5, 0x4, 0x7, 0x4, 0x6})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0x0, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0xe7, 0x0, 0x2, 0x4, 0x0, 0x7, 0x4, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11.594407711s ago: executing program 3 (id=633):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
r1 = gettid()
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$int_in(r2, 0x5452, &(0x7f0000000180)=0xffffffffffffffff)
readv(r3, &(0x7f0000001840)=[{&(0x7f00000001c0)=""/255, 0xff}], 0x1)
fcntl$setsig(r2, 0xa, 0x12)
dup2(r2, r3)
fcntl$setown(r3, 0x8, r1)
r4 = gettid()
tkill(r4, 0x13)

11.282986529s ago: executing program 3 (id=635):
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl(r0, 0x40186f40, &(0x7f0000000100)="ffffffff00"/24)
nanosleep(&(0x7f0000000c00)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./dev\x00', 0x1ff)
mount(&(0x7f0000000f00)=@filename='devtmpfs\x00', &(0x7f0000000e00)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, &(0x7f0000000800)='\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ubi0\x00', 0x2, 0x0)
ioctl(r1, 0x40986f00, &(0x7f0000000300)="00000000010000000000000200000000030007000000000074657374766f6c00"/156)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dir0\x00', 0x1ff)
mount(&(0x7f0000000600)=@filename='ubi0:testvol\x00', &(0x7f0000000500)='./dir0\x00', &(0x7f0000000700)='ubifs\x00', 0x0, &(0x7f0000000800)='\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dir0\x00', 0x20000, 0x0)
openat(r2, &(0x7f0000000900)='file0\x00', 0x400002, 0x1ff)

11.048484954s ago: executing program 7 (id=637):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r3, r3}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={'streebog256\x00'}})

10.823902029s ago: executing program 0 (id=638):
r0 = epoll_create1(0x80000)
r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local})
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100))
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e})
r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x90000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000240)={@hyper})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0xfffffffffffffff9})
close(r2)

9.883865172s ago: executing program 7 (id=639):
syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f0000000400)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@barrier}, {@auto_da_alloc}, {@nodioread_nolock}, {@bh}]}, 0x1, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x6042, 0x1)
openat(0xffffffffffffff9c, 0x0, 0x22042, 0x20)
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r1, 0x0)
syz_mount_image$ext4(&(0x7f0000000900)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f00000000c0), 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66")
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff2, 0x4012011, r2, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
sendfile(r0, r0, 0x0, 0xe3aa6ea)

9.882239902s ago: executing program 3 (id=640):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2ff8}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000d40)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0})

9.753257795s ago: executing program 0 (id=641):
dup(0xffffffffffffffff)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$kcm(0x11, 0x3, 0x0)
setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56)
sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r3, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000088a8ffff86ddee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x80)

9.425046553s ago: executing program 2 (id=642):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x40842, 0x0)
write(r0, &(0x7f0000000380)='10000', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='0', 0x1)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_smc(0x2b, 0x1, 0x0)

9.309465306s ago: executing program 2 (id=643):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_emit_ethernet(0x7d, &(0x7f00000000c0)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "a70002", 0x47, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x2}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9900, [], "0080d5"}, {}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x14}, 0x1, {0x7b40}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x80000003, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}}, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil})
r3 = dup(r2)
ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000240)={0x3, 0x2c5, 0x4, 0x7, 0x4, 0x6})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0x0, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0xe7, 0x0, 0x2, 0x4, 0x0, 0x7, 0x4, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

9.309164306s ago: executing program 3 (id=644):
syz_open_procfs$namespace(0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x200048d4)
sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r3, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r5, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x1f}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800)

9.238796108s ago: executing program 0 (id=645):
renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4)
io_uring_setup(0x31b0, &(0x7f0000000040)={0x0, 0x2f86, 0x1da64, 0x5, 0xc1})
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0)
preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0)
ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0xffff, 0x2, 0x2, '\x00', 0x654})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

9.13304549s ago: executing program 7 (id=646):
writev(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000340)={@map, 0xffffffffffffffff, 0x26, 0x5}, 0x20)
sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect(0x3, 0x39, 0x0, 0x0)
mknod$loop(0x0, 0xfff, 0x1)
setxattr$security_capability(0x0, 0x0, &(0x7f0000000180)=@v2={0x2000000, [{0x8000, 0x3}, {0x3, 0xff}]}, 0x14, 0x1)
write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0)
accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80000)
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {}, 0xfe}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18)
sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5)

8.983484854s ago: executing program 2 (id=647):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='\n', 0x1)

8.926352535s ago: executing program 3 (id=648):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0)
write$P9_RGETLOCK(r3, 0x0, 0xffffff20)
write(r0, 0x0, 0x0)
ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
munmap(&(0x7f0000691000/0x10000)=nil, 0x10000)

8.853585467s ago: executing program 6 (id=649):
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0)
setsockopt$packet_int(r0, 0x107, 0x16, 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', r2, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x80, 0x0, 0x0, 0x0, 0x2c, '\x00', r2, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r4, r2, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c)
syz_emit_ethernet(0x10e80, &(0x7f00000000c0)=ANY=[], 0x0)

8.704487561s ago: executing program 2 (id=650):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r3, r3}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={'streebog256\x00'}})

8.610767273s ago: executing program 6 (id=651):
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000)
r1 = socket$nl_sock_diag(0x10, 0x3, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$lock(r2, 0x6, &(0x7f0000002000)={0x1})
fcntl$lock(r2, 0x26, &(0x7f0000000140)={0x1})
fcntl$lock(r2, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3})
fcntl$lock(r2, 0x26, &(0x7f0000000180))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa9525000)
close_range(r1, 0xffffffffffffffff, 0x0)

7.809950292s ago: executing program 0 (id=652):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2ff8}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000d40)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0})

7.653610516s ago: executing program 2 (id=653):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
getpid()
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r1 = getpgrp(0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000001040108000000000000000200000001080005400000000105000100010000000800034000002fdb08000440000000030a0002"], 0x40}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000)

7.597083377s ago: executing program 7 (id=654):
syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x8, 0x64, 0xd, 0x8, 0x1b3d, 0x1a8, 0x7c5c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xce, 0xc0, 0x15, "", [{{0x9, 0x4, 0x67, 0x5, 0x2, 0xe2, 0x0, 0x8d, 0x3, [], [{{0x9, 0x5, 0x6, 0x3, 0x8, 0x1, 0xff, 0xa}}, {{0x9, 0x5, 0xd, 0x3, 0x20, 0xc, 0x0, 0x32}}]}}]}}]}}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x80c}}]})
bpf$MAP_CREATE(0x0, 0x0, 0x48)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0})
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xedafb000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3)

6.684293169s ago: executing program 2 (id=655):
r0 = socket$pppoe(0x18, 0x1, 0x0)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, 0x0)
mknodat$loop(0xffffffffffffff9c, 0x0, 0x1004, 0x1)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r1, 0x4)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x20, r6, 0x7, 0x3, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48040}, 0x0)

6.456380494s ago: executing program 0 (id=656):
write$binfmt_script(0xffffffffffffffff, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000050000008bca30000000000002403000040feffff7b1af0ff0000000079a4f0ff000000001f030000000000002e030200000000002604fdffffff000e61141100000000001d430000000000007a0a00fe0000001f61142000000000004603f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f2440000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c9494963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c88629a6c921c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fbf05b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71ca3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94)
sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x2000, &(0x7f0000000100)={&(0x7f00000001c0)=@ipv4_delroute={0x24, 0x18, 0x901, 0x0, 0x1, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xff, 0x7}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x0)

3.541096825s ago: executing program 7 (id=657):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0)
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x1208000, 0x0, 0x8245f874673c990a, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
fsopen(&(0x7f0000000080)='virtiofs\x00', 0x0)

8.48417ms ago: executing program 0 (id=658):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x24, r4, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0xf}}}, 0x24}}, 0x4000000)

8.0839ms ago: executing program 7 (id=659):
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x2, 0x2, 0x4, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0)
r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r4}, 0x4)
shutdown(0xffffffffffffffff, 0x7ffffffe)

0s ago: executing program 6 (id=660):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='\n', 0x1)

kernel console output (not intermixed with test programs):

ort 6081 - 0
[   84.215061][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   84.227153][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[   84.236268][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   84.245585][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   84.254793][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   84.294032][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   84.309019][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.323388][ T4281] batman_adv: batadv0: Interface activated: batadv_slave_0
[   84.338691][ T4273] device veth0_macvtap entered promiscuous mode
[   84.356603][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[   84.366729][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   84.376091][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   84.385352][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   84.394205][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   84.403356][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   84.414614][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[   84.423656][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   84.432982][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   84.441952][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   84.450807][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   84.459124][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   84.467419][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   84.478012][ T4279] device veth0_vlan entered promiscuous mode
[   84.492938][ T4273] device veth1_macvtap entered promiscuous mode
[   84.509412][ T4271] device veth0_vlan entered promiscuous mode
[   84.524976][ T4281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   84.536603][ T4281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.548479][ T4281] batman_adv: batadv0: Interface activated: batadv_slave_1
[   84.562209][ T4279] device veth1_vlan entered promiscuous mode
[   84.580260][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   84.588417][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   84.606874][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   84.620473][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   84.635170][ T4271] device veth1_vlan entered promiscuous mode
[   84.672846][ T4281] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   84.690348][ T4281] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   84.699269][ T4281] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   84.709045][ T4281] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   84.770152][ T4301] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   84.778779][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   84.780198][ T4301] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   84.792035][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.811772][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   84.822650][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.834613][ T4273] batman_adv: batadv0: Interface activated: batadv_slave_0
[   84.861973][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   84.875105][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   84.884385][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   84.909393][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   84.921360][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.931732][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   84.942869][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   84.954300][ T4273] batman_adv: batadv0: Interface activated: batadv_slave_1
[   84.963719][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   84.973220][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   84.982133][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   84.991542][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   85.003460][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   85.012705][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   85.023492][ T4279] device veth0_macvtap entered promiscuous mode
[   85.032081][ T4271] device veth0_macvtap entered promiscuous mode
[   85.051749][ T4273] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.060893][ T4273] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.071147][ T4273] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.082893][ T4273] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   85.102544][ T4271] device veth1_macvtap entered promiscuous mode
[   85.120394][ T4301] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   85.131797][ T4301] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   85.152617][ T4279] device veth1_macvtap entered promiscuous mode
[   85.176761][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   85.185353][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   85.195071][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   85.204768][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   85.214745][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   85.237652][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.261634][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.273857][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.285598][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.299314][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.311318][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.331739][ T4271] batman_adv: batadv0: Interface activated: batadv_slave_0
[   85.368852][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   85.386623][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   85.397638][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.411559][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.422314][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.435446][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.448662][ T4271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.460141][ T4271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.473789][ T4271] batman_adv: batadv0: Interface activated: batadv_slave_1
[   85.488087][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.508028][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.519412][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.555192][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.567249][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.579535][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.589837][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.601120][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.613214][ T4279] batman_adv: batadv0: Interface activated: batadv_slave_0
[   85.630796][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   85.651772][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   85.664055][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   85.676243][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   85.695955][ T4271] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.739775][ T4271] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.748726][ T4271] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.763447][ T4271] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   85.787623][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.804293][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.825918][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.838014][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.849142][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.861448][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.874514][ T4279] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.888436][ T4279] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.905575][ T4279] batman_adv: batadv0: Interface activated: batadv_slave_1
[   85.943330][   T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   85.977162][   T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   85.987708][ T4365] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3)
[   85.994860][ T4365] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[   86.007367][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   86.018841][ T4365] vhci_hcd vhci_hcd.0: Device attached
[   86.020783][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   86.043307][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   86.052935][ T4280] Bluetooth: hci2: command 0x0419 tx timeout
[   86.080041][ T4279] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.092889][ T4279] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.102483][ T4279] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.112823][ T4279] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.120028][   T49] Bluetooth: hci3: command 0x0419 tx timeout
[   86.128469][   T49] Bluetooth: hci0: command 0x0419 tx timeout
[   86.135243][ T4280] Bluetooth: hci4: command 0x0419 tx timeout
[   86.135267][ T4289] Bluetooth: hci1: command 0x0419 tx timeout
[   86.156421][ T4301] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.181119][ T4301] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.205378][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   86.240741][   T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.253649][   T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.295156][   T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.300037][ T4325] usb 5-1: new low-speed USB device number 2 using dummy_hcd
[   86.304698][ T4301] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.311134][ T2168] usb 41-1: new low-speed USB device number 2 using vhci_hcd
[   86.332626][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   86.345462][   T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.351720][ T4301] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.362250][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   86.375506][   T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   86.437999][   T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.474833][   T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.534857][   T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   86.547170][ T4325] usb 5-1: config 0 has no interfaces?
[   86.570867][ T4325] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[   86.589693][    T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.598007][    T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.619589][ T4325] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   86.643648][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   86.676578][ T4325] usb 5-1: config 0 descriptor??
[   86.741291][   T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.792384][   T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.821985][   T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   86.903372][ T4366] usb 41-1: recv xbuf, 0
[   86.909928][   T47] vhci_hcd: stop threads
[   86.914285][   T47] vhci_hcd: release socket
[   86.937625][   T26] cfg80211: failed to load regulatory.db
[   86.942596][ T4383] loop1: detected capacity change from 0 to 128
[   86.967162][   T47] vhci_hcd: disconnect device
[   86.985625][  T128] usb 5-1: USB disconnect, device number 2
[   87.041252][ T4383] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[   87.086458][ T4383] ext4 filesystem being mounted at /1/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[   87.309994][ T4273] EXT4-fs (loop1): unmounting filesystem.
[   87.572787][ T4395] loop1: detected capacity change from 0 to 64
[   88.120345][ T4319] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   88.138446][ T4402] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   88.333671][ T4319] usb 1-1: Using ep0 maxpacket: 8
[   88.353471][ T4319] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[   88.406648][ T4319] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[   88.459495][ T4319] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   88.490384][ T4319] usb 1-1: config 0 descriptor??
[   88.714612][ T4319] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0
[   88.909592][  T125] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   89.139682][  T125] usb 4-1: Using ep0 maxpacket: 8
[   89.149036][  T125] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   89.180256][  T125] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2
[   89.209588][  T125] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10
[   89.340658][  T125] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024
[   89.369642][  T125] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00
[   89.380088][  T125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   89.423932][  T125] hub 4-1:1.0: bad descriptor, ignoring hub
[   89.465005][  T125] hub: probe of 4-1:1.0 failed with error -5
[   89.575464][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   89.595160][ T4424] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw'
[   90.103092][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   90.108927][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   90.123118][  T125] cdc_wdm 4-1:1.0: cdc-wdm1: USB WDM device
[   90.129293][  T125] cdc_wdm 4-1:1.0: Unknown control protocol
[   90.151250][    C0] iowarrior 1-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19
[   90.160741][    T7] usb 1-1: USB disconnect, device number 2
[   90.229814][ T4430] loop1: detected capacity change from 0 to 512
[   90.257532][ T4430] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   90.324079][ T4430] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck.
[   90.379480][  T125] usb 4-1: USB disconnect, device number 2
[   90.408161][ T4432] overlayfs: failed to resolve './bus': -2
[   90.455570][ T4430] EXT4-fs (loop1): 1 truncate cleaned up
[   90.477439][ T4430] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[   90.711236][ T4273] EXT4-fs (loop1): unmounting filesystem.
[   90.809674][  T125] usb 4-1: new low-speed USB device number 3 using dummy_hcd
[   91.010431][ T4428] loop2: detected capacity change from 0 to 40427
[   91.022306][  T125] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   91.052572][ T4428] F2FS-fs (loop2): invalid crc value
[   91.058491][  T125] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2
[   91.073658][ T4428] F2FS-fs (loop2): Found nat_bits in checkpoint
[   91.081152][  T125] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8
[   91.109628][  T125] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00
[   91.119201][  T125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   91.156921][ T4414] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[   91.174002][  T125] hub 4-1:1.0: bad descriptor, ignoring hub
[   91.188341][  T125] hub: probe of 4-1:1.0 failed with error -5
[   91.203837][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   91.209141][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   91.209726][ T2168] usb 1-1: new low-speed USB device number 3 using dummy_hcd
[   91.224129][ T4428] F2FS-fs (loop2): Start checkpoint disabled!
[   91.229781][ T4446] loop4: detected capacity change from 0 to 128
[   91.244593][  T125] cdc_wdm 4-1:1.0: skipping garbage
[   91.266059][  T125] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device
[   91.274311][  T125] cdc_wdm 4-1:1.0: Unknown control protocol
[   91.287093][ T4428] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6
[   91.331054][ T4446] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[   91.350155][ T4446] ext4 filesystem being mounted at /7/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[   91.421576][ T2168] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[   91.450920][ T2168] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[   91.486905][ T2168] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[   91.527977][ T2168] usb 1-1: string descriptor 0 read error: -22
[   91.544932][ T2168] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice= 0.03
[   91.572406][ T2168] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   91.607542][ T2168] adutux 1-1:168.0: interrupt endpoints not found
[   91.640216][ T2168] usb 4-1: USB disconnect, device number 3
[   91.699263][ T4272] EXT4-fs (loop4): unmounting filesystem.
[   91.708391][ T4345] kworker/u4:8: attempt to access beyond end of device
[   91.708391][ T4345] loop2: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[   91.875469][ T2168] usb 1-1: USB disconnect, device number 3
[   91.917354][ T4453] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4)
[   91.924162][ T4453] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
[   91.944647][ T4454] vhci_hcd: xmit failed -107
[   91.959267][ T4453] vhci_hcd vhci_hcd.0: Device attached
[   91.970148][ T4301] vhci_hcd: stop threads
[   91.974554][ T4301] vhci_hcd: release socket
[   91.986879][ T4301] vhci_hcd: disconnect device
[   92.202149][ T4460] loop5: detected capacity change from 0 to 7
[   92.212083][ T4461] loop1: detected capacity change from 0 to 512
[   92.236087][ T4357] Dev loop5: unable to read RDB block 7
[   92.242983][ T4461] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled
[   92.251364][ T4357]  loop5: AHDI p1 p2 p3
[   92.277914][ T4357] loop5: partition table partially beyond EOD, truncated
[   92.311543][ T4461] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[   92.314200][ T4357] loop5: p1 start 5472580 is beyond EOD, 
[   92.332354][ T4461] ext4 filesystem being mounted at /9/bus supports timestamps until 2038-01-19 (0x7fffffff)
[   92.350737][ T4357] truncated
[   92.353972][ T4357] loop5: p2 start 167772160 is beyond EOD, truncated
[   92.357756][ T4466] loop2: detected capacity change from 0 to 256
[   92.387181][ T4460] Dev loop5: unable to read RDB block 7
[   92.397041][ T4460]  loop5: AHDI p1 p2 p3
[   92.416670][ T4460] loop5: partition table partially beyond EOD, truncated
[   92.433414][   T27] audit: type=1800 audit(1787030051.566:2): pid=4461 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.35" name="file1" dev="loop1" ino=15 res=0 errno=0
[   92.458206][ T4466] =======================================================
[   92.458206][ T4466] WARNING: The mand mount option has been deprecated and
[   92.458206][ T4466]          and is ignored by this kernel. Remove the mand
[   92.458206][ T4466]          option from the mount to silence this warning.
[   92.458206][ T4466] =======================================================
[   92.509251][ T4460] loop5: p1 start 5472580 is beyond EOD, truncated
[   92.516414][ T4460] loop5: p2 start 167772160 is beyond EOD, truncated
[   92.548147][ T4466] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[   92.587024][ T4466] exFAT-fs (loop2): Medium has reported failures. Some data may be lost.
[   92.673991][ T4466] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xdd68b5da, utbl_chksum : 0xe619d30d)
[   92.747899][ T4273] EXT4-fs (loop1): unmounting filesystem.
[   93.212649][ T4457] loop4: detected capacity change from 0 to 32768
[   93.398082][ T4457] XFS (loop4): Mounting V5 Filesystem
[   93.485107][ T4457] XFS (loop4): Ending clean mount
[   93.659379][ T4496] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[   93.703377][ T4457] XFS (loop4): EXPERIMENTAL online scrub feature in use. Use at your own risk!
[   93.746178][ T4496] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   93.755345][ T4494] loop3: detected capacity change from 0 to 8192
[   93.888501][ T4494] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   93.951615][ T4272] XFS (loop4): Unmounting Filesystem
[   93.973268][ T4494] REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal
[   94.004313][ T4494] REISERFS (device loop3): using ordered data mode
[   94.011178][ T4494] reiserfs: using flush barriers
[   94.071218][ T4494] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[   94.138283][ T4494] REISERFS (device loop3): checking transaction log (loop3)
[   94.200622][ T4494] REISERFS (device loop3): Using r5 hash to sort names
[   94.226747][ T4494] REISERFS (device loop3): using 3.5.x disk format
[   94.275690][ T4494] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
[   94.910103][ T4501] loop2: detected capacity change from 0 to 32768
[   95.076967][ T4501] XFS (loop2): Mounting V5 Filesystem
[   95.113833][ T4508] loop1: detected capacity change from 0 to 32768
[   95.225344][ T4501] XFS (loop2): Ending clean mount
[   95.239085][ T4508] XFS (loop1): Mounting V5 Filesystem
[   95.361478][ T4550] loop0: detected capacity change from 0 to 1024
[   95.383098][ T4508] XFS (loop1): Ending clean mount
[   95.533562][ T4281] XFS (loop2): Unmounting Filesystem
[   95.684381][   T27] audit: type=1800 audit(1787030054.806:3): pid=4551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.55" name="file1" dev="loop0" ino=27 res=0 errno=0
[   95.707803][ T4273] XFS (loop1): Unmounting Filesystem
[   95.975822][ T4555] loop3: detected capacity change from 0 to 8
[   96.030406][ T4341] hfsplus: b-tree write err: -5, ino 25
[   96.036667][ T4341] hfsplus: b-tree write err: -5, ino 4
[   96.086981][ T4341] hfsplus: b-tree write err: -5, ino 2
[   96.115353][ T4341] hfsplus: b-tree write err: -5, ino 26
[   96.123481][ T4555] SQUASHFS error: lzo decompression failed, data probably corrupt
[   96.156177][ T4341] hfsplus: b-tree write err: -5, ino 27
[   96.172143][ T4555] SQUASHFS error: Failed to read block 0x202: -5
[   96.188063][   T27] audit: type=1800 audit(1787030055.316:4): pid=4557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.59" name="in_ports" dev="configfs" ino=34595 res=0 errno=0
[   96.205711][ T4555] SQUASHFS error: Unable to read metadata cache entry [200]
[   96.699565][ T4325] usb 1-1: new full-speed USB device number 4 using dummy_hcd
[   96.899786][ T4325] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea
[   96.919530][ T4325] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   96.937863][ T4325] usb 1-1: Product: syz
[   96.943908][ T4325] usb 1-1: Manufacturer: syz
[   96.948856][ T4325] usb 1-1: SerialNumber: syz
[   96.965013][ T4325] usb 1-1: config 0 descriptor??
[   97.049567][ T4319] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   97.185566][ T4325] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[   97.261720][ T4319] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   97.278491][ T4319] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   97.293595][ T4319] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00
[   97.302946][ T4319] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   97.343458][ T4319] usb 3-1: config 0 descriptor??
[   97.670777][    T7] thunderbolt 0000:00:01.0: error -EINVAL: cannot obtain PCI resources, aborting
[   97.681038][ T4592] thunderbolt: probe of 0000:00:01.0 failed with error -22
[   97.807218][ T4595] loop4: detected capacity change from 0 to 512
[   97.859548][ T2168] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[   97.981626][ T4319] usb 3-1: language id specifier not provided by device, defaulting to English
[   98.000783][ T4325] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -71
[   98.031084][ T4325] usb 1-1: USB disconnect, device number 4
[   98.052790][ T2168] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   98.095099][ T2168] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 6
[   98.120947][ T4595] EXT4-fs: Ignoring removed bh option
[   98.122750][ T2168] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   98.129082][ T4595] EXT4-fs (loop4): Test dummy encryption mode enabled
[   98.143650][ T2168] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00
[   98.154357][ T4595] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[   98.161541][ T2168] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   98.176413][ T4595] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[   98.178113][ T2168] usb 4-1: Product: syz
[   98.192918][ T2168] usb 4-1: Manufacturer: syz
[   98.197662][ T2168] usb 4-1: SerialNumber: syz
[   98.214131][ T4590] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22
[   98.225111][ T4595] EXT4-fs error (device loop4): ext4_orphan_get:1405: inode #15: comm syz.4.73: inode has both inline data and extents flags
[   98.235463][ T2168] usbserial_generic 4-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes.
[   98.258563][ T4595] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.73: couldn't read orphan inode 15 (err -117)
[   98.259769][ T2168] usbserial_generic 4-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver.
[   98.281052][ T4595] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[   98.283104][ T2168] usbserial_generic 4-1:1.0: generic converter detected
[   98.303103][ T2168] usb 4-1: generic converter now attached to ttyUSB0
[   98.408063][ T4319] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0001/input/input5
[   98.490786][   T27] audit: type=1800 audit(1787030057.626:5): pid=4594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.73" name="file3" dev="loop4" ino=16 res=0 errno=0
[   98.551025][ T4319] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0001/input/input6
[   98.552079][   T27] audit: type=1804 audit(1787030057.626:6): pid=4594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.73" name="/newroot/14/bus/file2" dev="loop4" ino=16 res=1 errno=0
[   98.589284][ T4319] input: HID 256c:006d Touch Strip as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0001/input/input7
[   98.601267][ T4272] EXT4-fs (loop4): unmounting filesystem.
[   98.668032][ T4319] input: HID 256c:006d Dial as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0001/input/input8
[   98.692891][ T4610] loop0: detected capacity change from 0 to 136
[   98.767153][ T4319] uclogic 0003:256C:006D.0001: input,hiddev0,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.2-1/input0
[   98.859099][ T4319] usb 3-1: USB disconnect, device number 2
[   98.939726][  T125] usb 4-1: USB disconnect, device number 4
[   98.995353][  T125] generic ttyUSB0: generic converter now disconnected from ttyUSB0
[   99.034779][  T125] usbserial_generic 4-1:1.0: device disconnected
[   99.324525][ T4619] fido_id[4619]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory
[   99.351653][ T4626] netlink: 144 bytes leftover after parsing attributes in process `syz.0.80'.
[   99.522819][ T4630] loop2: detected capacity change from 0 to 512
[   99.584543][ T4630] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[   99.616341][ T4636] i2c i2c-0: new_device: Instantiated device anx7411 at 0x2c
[   99.670819][ T4630] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   99.941917][  T125] smpboot: CPU 1 is now offline
[  100.051530][ T4647] x86: Booting SMP configuration:
[  100.092995][ T4647] smpboot: Booting Node 0 Processor 1 APIC 0x1
[  100.110133][ T4653] Illegal XDP return value 4294966772 on prog  (id 5) dev syz_tun, expect packet loss!
[  100.454954][ T4281] EXT4-fs (loop2): unmounting filesystem.
[  101.132835][ T4670] loop2: detected capacity change from 0 to 2048
[  101.156187][ T4646] loop3: detected capacity change from 0 to 40427
[  101.206272][ T4646] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64)
[  101.228997][ T4646] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  101.245988][ T4670] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found
[  101.259550][ T4670] UDF-fs: Scanning with blocksize 512 failed
[  101.286436][ T4672] loop4: detected capacity change from 0 to 2048
[  101.293217][ T4646] F2FS-fs (loop3): invalid crc value
[  101.311320][ T4646] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109)
[  101.341435][ T4670] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  101.392433][ T4672] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  101.536848][ T4659] loop1: detected capacity change from 0 to 40427
[  101.578630][ T4646] F2FS-fs (loop3): Start checkpoint disabled!
[  101.585298][ T4659] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12
[  101.607920][ T4659] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[  101.657015][ T4659] F2FS-fs (loop1): invalid crc value
[  101.665902][ T4646] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  101.694670][ T4646] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6
[  101.773414][ T4659] F2FS-fs (loop1): Found nat_bits in checkpoint
[  101.948681][    C0] vcan0: j1939_tp_rxtimer: 0xffff888056c10c00: rx timeout, send abort
[  101.960851][    C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888056c10c00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[  102.000780][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.000780][ T4426] loop2: rw=1, sector=2048, nr_sectors = 2 limit=2048
[  102.030062][ T4426] Buffer I/O error on dev loop2, logical block 1024, lost async page write
[  102.038994][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.038994][ T4426] loop2: rw=1, sector=2048, nr_sectors = 2 limit=2048
[  102.076174][ T4659] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[  102.097264][ T4659] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  102.150377][ T4426] Buffer I/O error on dev loop2, logical block 1024, lost async page write
[  102.159177][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.159177][ T4426] loop2: rw=1, sector=2050, nr_sectors = 2 limit=2048
[  102.199597][ T4426] Buffer I/O error on dev loop2, logical block 1025, lost async page write
[  102.216339][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.216339][ T4426] loop2: rw=1, sector=2050, nr_sectors = 2 limit=2048
[  102.255139][ T4426] Buffer I/O error on dev loop2, logical block 1025, lost async page write
[  102.311161][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.311161][ T4426] loop2: rw=1, sector=2052, nr_sectors = 2 limit=2048
[  102.333567][ T4426] Buffer I/O error on dev loop2, logical block 1026, lost async page write
[  102.346939][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.346939][ T4426] loop2: rw=1, sector=2052, nr_sectors = 2 limit=2048
[  102.366988][ T4426] Buffer I/O error on dev loop2, logical block 1026, lost async page write
[  102.376125][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.376125][ T4426] loop2: rw=1, sector=2054, nr_sectors = 2 limit=2048
[  102.396561][ T4426] Buffer I/O error on dev loop2, logical block 1027, lost async page write
[  102.407473][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.407473][ T4426] loop2: rw=1, sector=2054, nr_sectors = 2 limit=2048
[  102.431082][ T4426] Buffer I/O error on dev loop2, logical block 1027, lost async page write
[  102.443282][ T4659] syz.1.92: attempt to access beyond end of device
[  102.443282][ T4659] loop1: rw=2049, sector=40960, nr_sectors = 24 limit=40427
[  102.445819][ T4426] kworker/u4:9: attempt to access beyond end of device
[  102.445819][ T4426] loop2: rw=1, sector=2056, nr_sectors = 2 limit=2048
[  102.500393][ T4426] Buffer I/O error on dev loop2, logical block 1028, lost async page write
[  102.509210][ T4426] Buffer I/O error on dev loop2, logical block 1028, lost async page write
[  102.766752][ T4692] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4)
[  102.773450][ T4692] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
[  102.836093][ T4694] vhci_hcd: xmit failed -107
[  102.836990][ T4692] vhci_hcd vhci_hcd.0: Device attached
[  102.872117][ T4344] vhci_hcd: stop threads
[  102.876706][ T4344] vhci_hcd: release socket
[  102.890278][ T4344] vhci_hcd: disconnect device
[  103.192526][ T4705] loop0: detected capacity change from 0 to 128
[  103.223640][ T4706] syz.2.108 uses obsolete (PF_INET,SOCK_PACKET)
[  103.259268][ T4702] loop3: detected capacity change from 0 to 4096
[  103.301281][ T4702] EXT4-fs: Ignoring removed orlov option
[  103.353975][ T4702] EXT4-fs (loop3): Test dummy encryption mode enabled
[  103.467621][ T4702] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  103.764172][ T4715] loop1: detected capacity change from 0 to 2048
[  103.844209][ T4715] "syz.1.104" (4715) uses obsolete ecb(arc4) skcipher
[  104.048576][ T4702] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni"
[  104.307227][ T4736] loop2: detected capacity change from 0 to 1024
[  104.330592][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  104.380841][ T4736] EXT4-fs: Ignoring removed orlov option
[  104.440696][ T4739] device pim6reg1 entered promiscuous mode
[  104.452593][ T4736] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  104.903408][ T4281] EXT4-fs (loop2): unmounting filesystem.
[  105.137001][ T4755] loop3: detected capacity change from 0 to 40427
[  105.173779][ T4755] F2FS-fs (loop3): invalid crc value
[  105.187302][ T4755] F2FS-fs (loop3): Found nat_bits in checkpoint
[  105.234628][ T4755] F2FS-fs (loop3): Start checkpoint disabled!
[  105.266665][ T4755] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6
[  105.889728][ T4284] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  105.936618][ T4741] loop0: detected capacity change from 0 to 32768
[  106.007982][ T4741] XFS (loop0): Mounting V5 Filesystem
[  106.089541][ T4284] usb 5-1: Using ep0 maxpacket: 8
[  106.096557][ T4284] usb 5-1: config index 0 descriptor too short (expected 301, got 45)
[  106.148466][ T4284] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  106.207568][ T4284] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  106.248391][ T4284] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  106.278947][ T4284] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  106.323269][ T4284] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  106.352326][ T4284] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  106.400057][ T4741] XFS (loop0): Ending clean mount
[  106.591778][ T4271] XFS (loop0): Unmounting Filesystem
[  106.614860][ T4284] usb 5-1: usb_control_msg returned -32
[  106.620784][ T4284] usbtmc 5-1:16.0: can't read capabilities
[  107.074694][ T4790] jffs2: notice: (4790) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  107.349562][ T4796] usbtmc 5-1:16.0: usb_control_msg returned -32
[  107.539101][ T4319] usb 5-1: USB disconnect, device number 3
[  108.249758][ T4284] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[  108.460814][ T4284] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  108.502646][ T4284] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  108.541092][ T4284] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00
[  108.581958][ T4284] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  108.632279][ T4284] usb 1-1: config 0 descriptor??
[  109.065311][ T4847] device syzkaller0 entered promiscuous mode
[  109.093483][ T4284] cm6533_jd 0003:0D8C:0022.0002: unknown main item tag 0x0
[  109.111088][ T4284] cm6533_jd 0003:0D8C:0022.0002: unknown main item tag 0x0
[  109.139866][    T7] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  109.148840][ T4284] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0002/input/input9
[  109.209317][ T4284] cm6533_jd 0003:0D8C:0022.0002: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0
[  109.349232][    T7] usb 2-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00
[  109.375483][ T4815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  109.387871][    T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  109.417163][    T7] usb 2-1: Product: syz
[  109.422567][ T4815] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  109.434942][    T7] usb 2-1: Manufacturer: syz
[  109.446871][    T7] usb 2-1: SerialNumber: syz
[  109.463137][ T4319] usb 1-1: USB disconnect, device number 5
[  109.673529][ T4861] loop4: detected capacity change from 0 to 128
[  109.728347][ T4861] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only
[  109.758934][ T4861] hpfs: filesystem error: improperly stopped
[  109.782299][ T4861] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[  109.802676][ T4861] hpfs: You really don't want any checks? You are crazy...
[  109.819001][ T4861] hpfs: Code page index out of array
[  109.824934][ T4861] hpfs: code page support is disabled
[  109.832761][ T4861] hpfs: hpfs_map_4sectors(): unaligned read
[  109.849899][ T4861] hpfs: hpfs_map_4sectors(): unaligned read
[  109.861622][ T4861] hpfs: filesystem error: unable to find root dir
[  110.298276][    T7] kalmia 2-1:1.0 wwan0: register 'kalmia' at usb-dummy_hcd.1-1, Samsung Kalmia LTE USB dongle, d2:32:39:98:66:03
[  110.419518][ T4319] usb 1-1: new full-speed USB device number 6 using dummy_hcd
[  110.612247][ T4319] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 4
[  110.625780][ T4881] loop3: detected capacity change from 0 to 128
[  110.633145][ T4319] usb 1-1: config 0 interface 0 has no altsetting 0
[  110.662493][ T4319] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  110.690490][ T4881] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none.
[  110.699804][ T4319] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[  110.708207][ T4319] usb 1-1: Product: syz
[  110.714422][ T4881] ext4 filesystem being mounted at /32/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  110.745655][ T4319] usb 1-1: Manufacturer: syz
[  110.767135][ T4319] usb 1-1: SerialNumber: syz
[  110.805296][ T4319] usb 1-1: config 0 descriptor??
[  110.847201][ T4319] usb 1-1: selecting invalid altsetting 0
[  110.896812][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  111.206486][ T4284] usb 1-1: USB disconnect, device number 6
[  111.212868][    C0] usb 1-1: Unable to submit urb #0: -19 at snd_usb_queue_pending_output_urbs
[  111.222774][ T4867] usb 1-1: cannot submit urb 0, error -19: no device
[  111.243986][    C0] dummy_hcd dummy_hcd.0: timer fired with no URBs pending?
[  111.359658][    T7] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  111.553775][    T7] usb 4-1: New USB device found, idVendor=046d, idProduct=0900, bcdDevice= 0.00
[  111.563550][    T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.571788][    T7] usb 4-1: Product: syz
[  111.576280][    T7] usb 4-1: Manufacturer: syz
[  111.581160][    T7] usb 4-1: SerialNumber: syz
[  111.600987][    T7] gspca_main: spca500-2.14.0 probing 046d:0900
[  111.900827][ T4284] usb 2-1: USB disconnect, device number 2
[  111.922176][ T4284] kalmia 2-1:1.0 wwan0: unregister 'kalmia' usb-dummy_hcd.1-1, Samsung Kalmia LTE USB dongle
[  112.082040][ T4849] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  112.110331][    T7] gspca_spca500: reg write: error -32
[  112.118087][    T7] gspca_spca500: reg write: error -32
[  112.160954][    T7] gspca_spca500: reg write: error -32
[  112.173879][ T4894] loop0: detected capacity change from 0 to 128
[  112.203651][    T7] gspca_spca500: reg write: error -32
[  112.240573][    T7] gspca_spca500: reg write: error -32
[  112.270797][    T7] gspca_spca500: reg write: error -32
[  112.298200][ T4897] Bluetooth: MGMT ver 1.22
[  112.305409][    T7] gspca_spca500: reg write: error -32
[  112.317824][ T4894] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  112.349206][    T7] gspca_spca500: reg write: error -32
[  112.363221][ T4894] ext4 filesystem being mounted at /31/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  112.404196][    T7] gspca_spca500: reg write: error -32
[  112.448713][    T7] gspca_spca500: reg write: error -32
[  112.494134][    T7] gspca_spca500: reg write: error -32
[  112.537662][    T7] gspca_spca500: reg write: error -32
[  112.575734][    T7] gspca_spca500: reg write: error -32
[  112.604563][    T7] gspca_spca500: reg write: error -32
[  112.748728][ T4910] loop4: detected capacity change from 0 to 512
[  112.787102][ T4910] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  112.855809][ T4910] EXT4-fs (loop4): 1 truncate cleaned up
[  112.922038][ T4910] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[  112.948648][  T125] usb 4-1: USB disconnect, device number 5
[  113.062922][ T4910] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:511: comm syz.4.170: Block bitmap for bg 0 marked uninitialized
[  113.166306][ T4910] EXT4-fs (loop4): Remounting filesystem read-only
[  113.210993][ T4271] EXT4-fs (loop0): unmounting filesystem.
[  113.265406][ T4919] loop1: detected capacity change from 0 to 8
[  113.342465][ T4272] EXT4-fs (loop4): unmounting filesystem.
[  113.434159][ T4919] process 'syz.1.171' launched './file0' with NULL argv: empty string added
[  113.817741][ T4933] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  113.874984][ T4933] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  114.042376][ T4905] loop2: detected capacity change from 0 to 32768
[  114.091004][ T4905] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.169 (4905)
[  114.233398][ T4905] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  114.283273][ T4905] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm
[  114.339623][ T4905] BTRFS info (device loop2): using free space tree
[  114.417284][ T4948] loop4: detected capacity change from 0 to 512
[  114.467762][ T4948] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  114.579782][ T4948] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  114.650474][ T4948] ext4 filesystem being mounted at /39/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  114.783113][ T4905] BTRFS info (device loop2): enabling ssd optimizations
[  115.008082][ T4272] EXT4-fs (loop4): unmounting filesystem.
[  115.138760][ T4991] capability: warning: `syz.1.184' uses deprecated v2 capabilities in a way that may be insecure
[  115.230407][ T4993] loop4: detected capacity change from 0 to 256
[  115.239711][  T125] usb 1-1: new high-speed USB device number 7 using dummy_hcd
[  115.287598][ T4993] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  115.330897][ T4993] exFAT-fs (loop4): Medium has reported failures. Some data may be lost.
[  115.409098][ T4993] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  115.429522][  T125] usb 1-1: Using ep0 maxpacket: 16
[  115.438144][  T125] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  115.465513][ T4997] loop3: detected capacity change from 0 to 1024
[  115.489902][  T125] usb 1-1: config 0 interface 0 has no altsetting 0
[  115.507381][ T4997] EXT4-fs: Ignoring removed nomblk_io_submit option
[  115.522535][  T125] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[  115.547405][  T125] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  115.569047][  T125] usb 1-1: config 0 descriptor??
[  115.594797][ T4997] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  115.617209][ T4281] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  116.002188][  T125] nzxt-smart2 0003:1E71:2009.0003: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0
[  116.191328][ T5010] loop1: detected capacity change from 0 to 256
[  116.238514][ T5010] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  116.251089][ T5010] exFAT-fs (loop1): Medium has reported failures. Some data may be lost.
[  116.284570][ T5010] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  116.425776][ T5014] usb 1-1: USB disconnect, device number 7
[  116.492201][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  116.947705][ T5029] loop1: detected capacity change from 0 to 128
[  117.088102][ T5033] loop4: detected capacity change from 0 to 16
[  117.158452][ T5033] erofs: (device loop4): mounted with root inode @ nid 36.
[  117.649750][    T7] usb 1-1: new full-speed USB device number 8 using dummy_hcd
[  117.857831][    T7] usb 1-1: unable to get BOS descriptor or descriptor too short
[  117.873984][    T7] usb 1-1: unable to read config index 0 descriptor/start: -71
[  117.889160][    T7] usb 1-1: can't read configurations, error -71
[  117.894353][ T4341] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  117.926107][ T5040] loop3: detected capacity change from 0 to 32768
[  118.156740][ T4341] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.311384][ T4341] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.437806][ T4341] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  119.129532][ T5007] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[  119.150626][ T4289] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  119.161376][ T4289] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  119.174103][ T4289] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  119.182724][ T4289] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  119.190847][ T4289] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  119.198714][ T4289] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  119.239730][    T7] usb 1-1: new high-speed USB device number 10 using dummy_hcd
[  119.319721][ T5007] usb 4-1: Using ep0 maxpacket: 16
[  119.328620][ T5007] usb 4-1: unable to get BOS descriptor or descriptor too short
[  119.348160][ T5007] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  119.369123][ T5007] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  119.392180][ T5007] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40
[  119.413723][ T5007] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  119.430372][    T7] usb 1-1: Using ep0 maxpacket: 16
[  119.437579][ T5007] usb 4-1: Product: syz
[  119.444053][    T7] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  119.455411][ T5007] usb 4-1: Manufacturer: syz
[  119.460789][ T5007] usb 4-1: SerialNumber: syz
[  119.465785][    T7] usb 1-1: config 0 interface 0 has no altsetting 0
[  119.474943][    T7] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[  119.500779][    T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  119.537151][    T7] usb 1-1: config 0 descriptor??
[  119.538152][ T4287] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  119.571052][ T4287] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  119.581923][ T4287] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  119.590550][ T4287] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  119.598351][ T4287] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  119.606039][ T4287] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  119.899638][ T5007] usb 4-1: cannot find UAC_HEADER
[  119.969103][    T7] nzxt-smart2 0003:1E71:2009.0004: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0
[  120.004959][ T5007] snd-usb-audio: probe of 4-1:1.0 failed with error -22
[  120.056773][ T4364] udevd[4364]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  120.105812][    T7] usb 4-1: USB disconnect, device number 6
[  120.208424][ T5053] chnl_net:caif_netlink_parms(): no params data found
[  120.433930][    T7] usb 1-1: USB disconnect, device number 10
[  120.473900][ T5060] chnl_net:caif_netlink_parms(): no params data found
[  120.702181][ T5053] bridge0: port 1(bridge_slave_0) entered blocking state
[  120.721879][ T5053] bridge0: port 1(bridge_slave_0) entered disabled state
[  120.731006][ T5053] device bridge_slave_0 entered promiscuous mode
[  120.908055][ T5053] bridge0: port 2(bridge_slave_1) entered blocking state
[  120.920859][ T5053] bridge0: port 2(bridge_slave_1) entered disabled state
[  120.937682][ T5053] device bridge_slave_1 entered promiscuous mode
[  121.004488][ T4341] device hsr_slave_0 left promiscuous mode
[  121.011800][ T4341] device hsr_slave_1 left promiscuous mode
[  121.018570][ T4341] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  121.026966][ T4341] batman_adv: batadv0: Removing interface: batadv_slave_0
[  121.036396][ T4341] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  121.044342][ T4341] batman_adv: batadv0: Removing interface: batadv_slave_1
[  121.082428][ T4341] device bridge_slave_1 left promiscuous mode
[  121.090724][ T4341] bridge0: port 2(bridge_slave_1) entered disabled state
[  121.106224][ T4341] device bridge_slave_0 left promiscuous mode
[  121.116677][ T4341] bridge0: port 1(bridge_slave_0) entered disabled state
[  121.198869][ T4341] device veth1_macvtap left promiscuous mode
[  121.211691][ T4341] device veth0_macvtap left promiscuous mode
[  121.218176][ T4341] device veth1_vlan left promiscuous mode
[  121.239675][ T4287] Bluetooth: hci1: command 0x0409 tx timeout
[  121.250961][ T4341] device veth0_vlan left promiscuous mode
[  121.646084][ T4287] Bluetooth: hci2: command 0x0409 tx timeout
[  122.166890][ T4341] team0 (unregistering): Port device team_slave_1 removed
[  122.218326][ T4341] team0 (unregistering): Port device team_slave_0 removed
[  122.265572][ T4341] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  122.315688][ T4341] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  122.682992][ T4341] bond0 (unregistering): Released all slaves
[  122.882524][ T5053] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  122.942488][ T5053] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  122.997605][ T5053] team0: Port device team_slave_0 added
[  123.017577][ T5060] bridge0: port 1(bridge_slave_0) entered blocking state
[  123.027702][ T5060] bridge0: port 1(bridge_slave_0) entered disabled state
[  123.047123][ T5060] device bridge_slave_0 entered promiscuous mode
[  123.074377][ T5053] team0: Port device team_slave_1 added
[  123.128212][ T5060] bridge0: port 2(bridge_slave_1) entered blocking state
[  123.146987][ T5060] bridge0: port 2(bridge_slave_1) entered disabled state
[  123.158101][ T5060] device bridge_slave_1 entered promiscuous mode
[  123.225899][ T5053] batman_adv: batadv0: Adding interface: batadv_slave_0
[  123.254986][ T5053] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  123.281546][ T5053] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  123.298115][ T5060] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  123.319229][ T5060] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  123.328910][ T4287] Bluetooth: hci1: command 0x041b tx timeout
[  123.358323][ T5053] batman_adv: batadv0: Adding interface: batadv_slave_1
[  123.365759][ T5053] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  123.392297][ T5053] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  123.461003][ T5060] team0: Port device team_slave_0 added
[  123.496828][ T5060] team0: Port device team_slave_1 added
[  123.581041][ T5053] device hsr_slave_0 entered promiscuous mode
[  123.588147][ T5053] device hsr_slave_1 entered promiscuous mode
[  123.595763][ T5053] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  123.604836][ T5053] Cannot create hsr debugfs directory
[  123.611403][ T5060] batman_adv: batadv0: Adding interface: batadv_slave_0
[  123.618504][ T5060] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  123.647509][ T5060] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  123.681170][ T5060] batman_adv: batadv0: Adding interface: batadv_slave_1
[  123.688351][ T5060] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  123.715445][ T5060] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  123.726483][ T4287] Bluetooth: hci2: command 0x041b tx timeout
[  123.756238][ T5086] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  123.797060][ T5060] device hsr_slave_0 entered promiscuous mode
[  123.823048][ T5060] device hsr_slave_1 entered promiscuous mode
[  123.825317][ T5127] loop2: detected capacity change from 0 to 32768
[  123.836644][ T5060] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  123.852626][ T5060] Cannot create hsr debugfs directory
[  123.932864][ T5127] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.215 (5127)
[  124.049282][ T5127] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  124.076874][ T5132] loop0: detected capacity change from 0 to 256
[  124.097930][ T5127] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm
[  124.133030][ T4341] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.183783][ T5127] BTRFS info (device loop2): using free space tree
[  124.325718][ T4341] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.397956][ T5127] BTRFS info (device loop2): enabling ssd optimizations
[  124.621694][ T5160] loop3: detected capacity change from 0 to 16
[  124.636003][ T4341] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.670166][ T5160] erofs: (device loop3): mounted with root inode @ nid 36.
[  124.872907][ T4341] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  125.031584][ T5161] BTRFS info (device loop2): balance: start -d -m -s
[  125.075419][ T5161] BTRFS info (device loop2): relocating block group 8519680 flags data|metadata
[  125.121040][ T5053] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  125.310912][ T5053] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  125.320874][ T5053] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  125.369668][ T5053] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  125.388254][ T5161] BTRFS info (device loop2): relocating block group 1048576 flags system
[  125.399737][ T4287] Bluetooth: hci1: command 0x040f tx timeout
[  125.399802][    T7] usb 1-1: new high-speed USB device number 11 using dummy_hcd
[  125.425163][ T5161] BTRFS info (device loop2): 2 enospc errors during balance
[  125.454602][ T5161] BTRFS info (device loop2): balance: canceled
[  125.464086][ T5179] loop3: detected capacity change from 0 to 1024
[  125.501804][ T5060] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  125.592389][ T5179] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none.
[  125.632224][    T7] usb 1-1: New USB device found, idVendor=07ca, idProduct=a801, bcdDevice= 0.00
[  125.661323][    T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  125.720782][    T7] usb 1-1: Product: syz
[  125.725205][    T7] usb 1-1: Manufacturer: syz
[  125.773563][ T5184] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Corrupt filesystem
[  125.799983][ T4289] Bluetooth: hci2: command 0x040f tx timeout
[  125.829154][    T7] dvb-usb: found a 'AVerMedia AverTV DVB-T USB 2.0 (A800)' in warm state.
[  125.889961][ T4281] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  125.913397][ T5184] EXT4-fs (loop3): Remounting filesystem read-only
[  125.923334][    T7] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  125.926622][ T5060] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  125.961066][    T7] dvbdev: DVB: registering new adapter (AVerMedia AverTV DVB-T USB 2.0 (A800))
[  125.991899][    T7] usb 1-1: media controller created
[  126.076347][    T7] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  126.192727][ T5182] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:477: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0
[  126.237165][ T5182] EXT4-fs (loop3): Remounting filesystem read-only
[  126.289296][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  126.371051][ T5060] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  126.433444][ T5060] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  126.750165][ T5053] 8021q: adding VLAN 0 to HW filter on device bond0
[  126.812896][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  126.821688][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  126.864857][ T5053] 8021q: adding VLAN 0 to HW filter on device team0
[  126.977956][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  126.990884][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  127.015879][ T4426] bridge0: port 1(bridge_slave_0) entered blocking state
[  127.023358][ T4426] bridge0: port 1(bridge_slave_0) entered forwarding state
[  127.068688][ T5060] 8021q: adding VLAN 0 to HW filter on device bond0
[  127.137866][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  127.151279][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  127.166869][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  127.178825][ T4426] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.186678][ T4426] bridge0: port 2(bridge_slave_1) entered forwarding state
[  127.214306][ T5208] loop2: detected capacity change from 0 to 512
[  127.215822][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  127.238705][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  127.282950][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  127.324001][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  127.354414][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  127.406805][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  127.472901][ T5060] 8021q: adding VLAN 0 to HW filter on device team0
[  127.480238][ T4289] Bluetooth: hci1: command 0x0419 tx timeout
[  127.501652][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  127.511502][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  127.543868][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  127.598122][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  127.653878][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  127.753191][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  127.771010][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  127.790467][ T4345] bridge0: port 1(bridge_slave_0) entered blocking state
[  127.797891][ T4345] bridge0: port 1(bridge_slave_0) entered forwarding state
[  127.827739][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  127.851533][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  127.874589][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  127.879625][ T4287] Bluetooth: hci2: command 0x0419 tx timeout
[  127.917356][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  127.956846][ T4345] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.964247][ T4345] bridge0: port 2(bridge_slave_1) entered forwarding state
[  128.007109][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  128.017863][ T5053] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  128.101095][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  128.120609][    T7] dvb-usb: bulk message failed: -110 (6/0)
[  128.218464][    T7] dvb-usb: bulk message failed: -71 (6/0)
[  128.227143][    T7] dvb-usb: no frontend was attached by 'AVerMedia AverTV DVB-T USB 2.0 (A800)'
[  128.487041][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  128.507748][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  128.559669][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  128.598026][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  128.608996][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  128.609709][    T7] rc_core: IR keymap rc-avermedia-m135a not found
[  128.659575][    T7] Registered IR keymap rc-empty
[  128.686793][    T7] rc rc0: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0
[  128.740818][    T7] input: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input11
[  128.800885][    T7] dvb-usb: schedule remote query interval to 150 msecs.
[  128.828774][    T7] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully initialized and connected.
[  128.869834][    T7] usb 1-1: USB disconnect, device number 11
[  129.022464][ T5060] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  129.023665][    T7] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully deinitialized and disconnected.
[  129.041679][ T5060] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  129.067010][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  129.083793][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  129.103989][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  129.116792][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  129.134100][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  129.375516][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  129.501428][ T4341] device hsr_slave_0 left promiscuous mode
[  129.511754][ T4341] device hsr_slave_1 left promiscuous mode
[  129.522300][ T4341] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  129.535938][ T4341] batman_adv: batadv0: Removing interface: batadv_slave_0
[  129.556023][ T4341] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  129.566683][ T4341] batman_adv: batadv0: Removing interface: batadv_slave_1
[  129.589229][ T4341] device bridge_slave_1 left promiscuous mode
[  129.605857][ T4341] bridge0: port 2(bridge_slave_1) entered disabled state
[  129.620140][ T4341] device bridge_slave_0 left promiscuous mode
[  129.626450][ T4341] bridge0: port 1(bridge_slave_0) entered disabled state
[  129.727852][ T4341] device veth1_macvtap left promiscuous mode
[  129.739925][ T4341] device veth0_macvtap left promiscuous mode
[  129.746308][ T4341] device veth1_vlan left promiscuous mode
[  129.770077][ T4341] device veth0_vlan left promiscuous mode
[  129.815254][ T5260] loop2: detected capacity change from 0 to 256
[  129.861679][ T5260] exfat: Deprecated parameter 'namecase'
[  129.882380][ T5260] exfat: Deprecated parameter 'namecase'
[  129.888160][ T5260] exfat: Deprecated parameter 'namecase'
[  129.963648][ T5262] loop3: detected capacity change from 0 to 16
[  130.019997][ T5262] erofs: (device loop3): mounted with root inode @ nid 36.
[  130.031941][ T5260] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d)
[  130.826497][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888056dc8c00: rx timeout, send abort
[  131.118530][ T5276] loop0: detected capacity change from 0 to 32768
[  131.209902][ T4341] team0 (unregistering): Port device team_slave_1 removed
[  131.222137][ T5276] XFS (loop0): Mounting V5 Filesystem
[  131.293267][ T5276] XFS (loop0): Ending clean mount
[  131.326956][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888056dcac00: rx timeout, send abort
[  131.329504][ T4341] team0 (unregistering): Port device team_slave_0 removed
[  131.337137][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888056dc8c00: abort rx timeout. Force session deactivation
[  131.415187][ T5276] XFS (loop0): Quotacheck needed: Please wait.
[  131.510415][ T5276] XFS (loop0): Quotacheck: Done.
[  131.524079][ T4341] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  131.593296][ T4341] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  131.727350][ T1279] ieee802154 phy0 wpan0: encryption failed: -22
[  131.734469][ T1279] ieee802154 phy1 wpan1: encryption failed: -22
[  131.835644][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888056dcac00: abort rx timeout. Force session deactivation
[  132.060184][ T4271] XFS (loop0): Unmounting Filesystem
[  132.274048][ T4341] bond0 (unregistering): Released all slaves
[  132.446120][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  132.461292][ T4301] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  132.486829][ T5274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.245'.
[  132.687492][ T5053] 8021q: adding VLAN 0 to HW filter on device batadv0
[  136.429845][ T5231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  136.437657][ T5231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  136.576307][ T5060] 8021q: adding VLAN 0 to HW filter on device batadv0
[  137.084321][ T5192] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  137.296653][ T5192] usb 4-1: Using ep0 maxpacket: 16
[  137.312676][ T5192] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  137.332616][ T5192] usb 4-1: config 0 interface 0 has no altsetting 0
[  137.339489][ T5192] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[  137.348708][ T5192] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  137.368806][ T5192] usb 4-1: config 0 descriptor??
[  137.806197][ T5192] nzxt-smart2 0003:1E71:2009.0005: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0
[  138.306553][ T5192] usb 4-1: USB disconnect, device number 7
[  140.525896][ T5009] smpboot: CPU 1 is now offline
[  140.916419][ T5393] x86: Booting SMP configuration:
[  140.925325][ T5441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  141.100729][ T5393] smpboot: Booting Node 0 Processor 1 APIC 0x1
[  141.147885][   T27] audit: type=1800 audit(1787030100.276:7): pid=5397 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.262" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0
[  141.182128][ T5441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  141.626506][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  141.661533][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  141.724701][ T5053] device veth0_vlan entered promiscuous mode
[  141.737036][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  141.753782][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  141.813751][ T5053] device veth1_vlan entered promiscuous mode
[  141.947187][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  141.964062][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  142.001156][ T5053] device veth0_macvtap entered promiscuous mode
[  142.033071][ T5053] device veth1_macvtap entered promiscuous mode
[  142.053784][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  142.092211][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  142.140402][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  142.196365][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  142.292332][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  142.310908][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  142.356021][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  142.390853][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  142.436750][ T5060] device veth0_vlan entered promiscuous mode
[  142.466578][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  142.500226][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.519520][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  142.554911][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.599584][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  142.623205][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.661532][ T5053] batman_adv: batadv0: Interface activated: batadv_slave_0
[  142.672883][ T5060] device veth1_vlan entered promiscuous mode
[  142.706426][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  142.717801][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  142.748987][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  142.807076][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  142.839443][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.859447][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  142.879878][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.939496][ T5053] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  142.954360][ T5053] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  142.968614][ T5053] batman_adv: batadv0: Interface activated: batadv_slave_1
[  142.982307][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  142.998611][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  143.012788][ T5053] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  143.031659][ T5053] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  143.045531][ T5053] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  143.057242][ T5053] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  143.118926][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  143.132132][ T4345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  143.158538][ T5060] device veth0_macvtap entered promiscuous mode
[  143.253884][ T5060] device veth1_macvtap entered promiscuous mode
[  143.327431][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.338759][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.391856][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.439605][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.459888][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.494121][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.521537][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.548641][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.575832][ T5060] batman_adv: batadv0: Interface activated: batadv_slave_0
[  143.603127][ T4345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  143.632237][ T4345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  143.654634][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  143.671308][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  143.685299][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  143.724198][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  143.745960][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  143.775548][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.814790][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.839824][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.872952][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.926590][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.969619][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  144.001799][ T5060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  144.016787][ T5060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  144.036468][ T5060] batman_adv: batadv0: Interface activated: batadv_slave_1
[  144.077496][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  144.092602][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  144.119333][ T5060] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  144.145176][ T5060] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  144.160443][ T5060] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  144.174459][ T5060] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  144.205043][ T5014] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  144.218393][ T4341] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  144.242796][ T4341] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  144.343601][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  144.411538][ T5014] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  144.424635][ T5434] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  144.437677][ T5014] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  144.460411][ T5434] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  144.490412][ T5442] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  144.497718][ T5014] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66
[  144.530738][ T5014] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  144.589546][ T5442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  144.590330][ T5014] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  144.597414][ T5442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  144.614670][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  144.695164][ T5014] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  144.734963][ T5515] loop5: detected capacity change from 0 to 4096
[  144.745674][ T5014] usb 1-1: Product: syz
[  144.771934][ T5014] usb 1-1: Manufacturer: syz
[  144.810311][ T5014] cdc_wdm 1-1:1.0: skipping garbage
[  144.843697][ T5014] cdc_wdm 1-1:1.0: skipping garbage
[  144.886452][ T5014] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device
[  144.906573][ T5014] cdc_wdm 1-1:1.0: Unknown control protocol
[  144.950091][ T5522] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  145.074566][ T5014] usb 1-1: USB disconnect, device number 12
[  145.659660][ T5014] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  145.780716][ T4369] NILFS (loop5): DAT doesn't have a block to manage vblocknr = 648518346341351424
[  145.791745][ T4369] NILFS error (device loop5): nilfs_bmap_truncate: broken bmap (inode number=12)
[  145.829921][ T4369] Remounting filesystem read-only
[  145.835116][ T4369] NILFS (loop5): error -5 truncating bmap (ino=12)
[  145.852129][ T5014] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  145.870078][ T4325] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[  145.877553][ T5014] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  145.901479][ T5014] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66
[  145.914848][ T5014] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  145.956930][ T5014] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  145.992651][ T5014] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  146.018436][ T5014] usb 1-1: Product: syz
[  146.034354][ T5014] usb 1-1: Manufacturer: syz
[  146.076466][ T5014] cdc_wdm 1-1:1.0: skipping garbage
[  146.089290][ T5014] cdc_wdm 1-1:1.0: skipping garbage
[  146.089465][ T4325] usb 7-1: Using ep0 maxpacket: 16
[  146.102444][ T5014] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device
[  146.116452][ T4325] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  146.124595][ T5014] cdc_wdm 1-1:1.0: Unknown control protocol
[  146.143492][ T4325] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  146.179121][ T4325] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  146.202347][ T4325] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  146.265455][ T4325] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  146.310518][ T4325] usb 7-1: config 0 descriptor??
[  146.529845][ T5562] loop2: detected capacity change from 0 to 2048
[  146.724685][ T4325] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0
[  146.756121][ T4325] microsoft 0003:045E:07DA.0006: ignoring exceeding usage max
[  146.815867][ T4325] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0006/input/input12
[  146.829893][    C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71
[  146.836884][    C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes
[  146.855866][ T5562] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  146.865770][ T5192] usb 1-1: USB disconnect, device number 13
[  146.879469][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.889474][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.899490][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.909494][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.929452][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.939474][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.959648][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.969478][    T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!!
[  146.981981][ T4325] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0
[  147.009454][    T0] NOHZ tick-stop error: local softirq work is pending, handler #392!!!
[  147.039456][    T0] NOHZ tick-stop error: local softirq work is pending, handler #392!!!
[  147.078023][ T4325] usb 7-1: USB disconnect, device number 2
[  147.433810][ T5579] fido_id[5579]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory
[  148.356512][ T5610] loop5: detected capacity change from 0 to 7
[  148.405757][ T5610] Dev loop5: unable to read RDB block 7
[  148.443258][ T5610]  loop5: AHDI p1 p2 p3
[  148.447510][ T5610] loop5: partition table partially beyond EOD, truncated
[  148.466325][ T5610] loop5: p1 start 1818582900 is beyond EOD, truncated
[  148.477148][ T5610] loop5: p3 start 335544320 is beyond EOD, truncated
[  149.298212][ T5646] loop5: detected capacity change from 0 to 512
[  149.356630][ T5646] EXT4-fs: inline encryption not supported
[  149.396243][ T5646] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  149.502550][ T5646] EXT4-fs (loop5): 1 truncate cleaned up
[  149.519787][ T5646] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none.
[  149.754859][ T4364] udevd[4364]: incorrect ext4 checksum on /dev/loop5
[  150.085634][ T5053] EXT4-fs (loop5): unmounting filesystem.
[  150.110313][ T4364] udevd[4364]: incorrect ext4 checksum on /dev/loop5
[  150.799700][ T4369] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[  151.001440][ T4369] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  151.057716][ T4369] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  151.088736][ T4369] usb 7-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af
[  151.119094][ T4369] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  151.228855][ T4369] usb 7-1: config 0 descriptor??
[  151.663361][ T4369] playstation 0003:054C:0DF2.0007: unknown main item tag 0x0
[  151.689739][ T4369] playstation 0003:054C:0DF2.0007: unknown main item tag 0x0
[  151.712974][ T4369] playstation 0003:054C:0DF2.0007: unknown main item tag 0x0
[  151.725718][ T4369] playstation 0003:054C:0DF2.0007: unknown main item tag 0x0
[  151.772140][ T4369] playstation 0003:054C:0DF2.0007: unknown main item tag 0x0
[  151.809175][ T4369] playstation 0003:054C:0DF2.0007: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.6-1/input0
[  152.334048][ T4369] playstation 0003:054C:0DF2.0007: Invalid gyro calibration data for axis (3), disabling calibration.
[  152.368728][ T4369] playstation 0003:054C:0DF2.0007: Invalid gyro calibration data for axis (5), disabling calibration.
[  152.418078][ T4369] playstation 0003:054C:0DF2.0007: Invalid accelerometer calibration data for axis (0), disabling calibration.
[  152.470507][ T4369] playstation 0003:054C:0DF2.0007: Invalid accelerometer calibration data for axis (2), disabling calibration.
[  152.503564][ T4369] input: HID 054c:0df2 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:054C:0DF2.0007/input/input13
[  152.562491][ T4369] input: HID 054c:0df2 Motion Sensors as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:054C:0DF2.0007/input/input14
[  152.644448][ T4369] input: HID 054c:0df2 Touchpad as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:054C:0DF2.0007/input/input15
[  152.659639][ T5009] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  152.742385][ T5685] loop0: detected capacity change from 0 to 32768
[  152.753227][ T4369] playstation 0003:054C:0DF2.0007: Registered DualSense controller hw_version=0x00000000 fw_version=0x00000000
[  152.806769][ T4369] usb 7-1: USB disconnect, device number 3
[  152.819720][ T5685] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.327 (5685)
[  152.859456][ T5009] usb 4-1: Using ep0 maxpacket: 32
[  152.869295][ T5009] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[  152.936495][ T5685] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  152.949200][ T5009] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[  152.988584][ T5009] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[  152.998104][ T5685] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[  153.035630][ T5009] usb 4-1: Product: syz
[  153.041674][ T5685] BTRFS info (device loop0): using free space tree
[  153.048336][ T5009] usb 4-1: Manufacturer: syz
[  153.068645][ T5009] usb 4-1: SerialNumber: syz
[  153.096271][ T5009] usb 4-1: config 0 descriptor??
[  153.108977][ T5701] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  153.387686][ T5708] fido_id[5708]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory
[  153.403236][ T5685] BTRFS info (device loop0): enabling ssd optimizations
[  153.710336][ T5743] BTRFS info (device loop0): balance: start -d -m -s
[  153.868786][ T5014] usb 4-1: USB disconnect, device number 8
[  153.886124][ T5743] BTRFS info (device loop0): relocating block group 8519680 flags data|metadata
[  154.007704][ T5192] smpboot: CPU 1 is now offline
[  154.093144][ T5743] BTRFS info (device loop0): relocating block group 1048576 flags system
[  154.107907][ T5749] x86: Booting SMP configuration:
[  154.162784][ T5749] smpboot: Booting Node 0 Processor 1 APIC 0x1
[  154.187146][ T5743] BTRFS info (device loop0): 2 enospc errors during balance
[  154.225507][ T5743] BTRFS info (device loop0): balance: canceled
[  154.461472][ T4271] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  154.733453][ T4364] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 16 /dev/loop0 scanned by udevd (4364)
[  155.093103][ T5766] loop3: detected capacity change from 0 to 1024
[  155.150573][ T5766] EXT4-fs: Ignoring removed orlov option
[  155.277768][ T5766] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  155.863362][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  157.081425][ T5188] smpboot: CPU 1 is now offline
[  157.160053][ T5808] x86: Booting SMP configuration:
[  157.174956][ T5808] smpboot: Booting Node 0 Processor 1 APIC 0x1
[  160.976226][ T5843] loop5: detected capacity change from 0 to 40427
[  161.000987][ T5843] F2FS-fs (loop5): invalid crc value
[  161.047285][ T5843] F2FS-fs (loop5): Found nat_bits in checkpoint
[  161.095496][ T5843] F2FS-fs (loop5): Start checkpoint disabled!
[  161.132259][ T5843] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6
[  161.267201][   T20] IRQ fixup: irq 33 move in progress, old vector 49
[  161.277088][ T5187] smpboot: CPU 1 is now offline
[  161.323690][ T5859] x86: Booting SMP configuration:
[  161.328833][ T5859] smpboot: Booting Node 0 Processor 1 APIC 0x1
[  161.862546][ T5872] jffs2: notice: (5872) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  162.115908][ T4341] bio_check_eod: 15 callbacks suppressed
[  162.115927][ T4341] kworker/u4:6: attempt to access beyond end of device
[  162.115927][ T4341] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[  162.538245][ T5886] loop2: detected capacity change from 0 to 7
[  162.576837][ T5886]  loop2:
[  162.591058][ T5886] loop2: partition table partially beyond EOD, truncated
[  162.857515][ T5878] bridge0: port 2(bridge_slave_1) entered disabled state
[  162.867678][ T5878] bridge0: port 1(bridge_slave_0) entered disabled state
[  163.601134][ T5903] loop6: detected capacity change from 0 to 128
[  163.703653][ T5903] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only
[  163.785702][ T5903] hpfs: filesystem error: improperly stopped
[  163.826222][ T5903] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[  163.864834][ T5903] hpfs: You really don't want any checks? You are crazy...
[  163.905392][ T5903] hpfs: Code page index out of array
[  163.934839][ T5903] hpfs: code page support is disabled
[  163.961755][ T5903] hpfs: hpfs_map_4sectors(): unaligned read
[  163.995887][ T5903] hpfs: hpfs_map_4sectors(): unaligned read
[  164.025778][ T5903] hpfs: filesystem error: unable to find root dir
[  164.257985][ T5878] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  164.400120][ T5878] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  164.682343][ T5917] loop5: detected capacity change from 0 to 512
[  164.784912][ T5917] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: comm syz.5.378: inode #1: comm syz.5.378: iget: illegal inode #
[  164.903761][ T5917] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.378: error while reading EA inode 1 err=-117
[  164.957260][ T5917] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: comm syz.5.378: inode #1: comm syz.5.378: iget: illegal inode #
[  165.036699][ T5917] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.378: error while reading EA inode 1 err=-117
[  165.090434][ T5917] EXT4-fs (loop5): 1 orphan inode deleted
[  165.113806][ T5917] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none.
[  165.219646][ T5917] EXT4-fs error (device loop5): ext4_resize_begin:62: comm syz.5.378: resize_inode disabled but reserved GDT blocks non-zero
[  165.381256][ T5878] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  165.395316][ T5878] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  165.424451][ T5878] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  165.447951][ T5878] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  165.949994][ T5053] EXT4-fs (loop5): unmounting filesystem.
[  166.509087][ T5961] loop0: detected capacity change from 0 to 256
[  167.022059][ T5974] netlink: 'syz.0.392': attribute type 4 has an invalid length.
[  167.670823][ T5986] loop5: detected capacity change from 0 to 2048
[  167.732248][ T5986]  loop5: p2 < > p3 < p5 > p4
[  167.737191][ T5986] loop5: partition table partially beyond EOD, truncated
[  167.783390][ T5986] loop5: p2 start 4278190080 is beyond EOD, truncated
[  167.823080][ T5986] loop5: p4 size 8192 extends beyond EOD, truncated
[  167.867526][ T5986] loop5: p5 size 8192 extends beyond EOD, truncated
[  167.962103][ T3639]  loop5: p2 < > p3 < p5 > p4
[  167.966963][ T3639] loop5: partition table partially beyond EOD, truncated
[  167.993955][ T3639] loop5: p2 start 4278190080 is beyond EOD, truncated
[  168.029757][ T3639] loop5: p4 size 8192 extends beyond EOD, truncated
[  168.046331][ T3639] loop5: p5 size 8192 extends beyond EOD, truncated
[  168.130550][ T4364] udevd[4364]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory
[  168.157054][ T4611] udevd[4611]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory
[  168.180850][ T4621] udevd[4621]: inotify_add_watch(7, /dev/loop5p5, 10) failed: No such file or directory
[  168.255202][ T4611] udevd[4611]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory
[  168.256685][ T4621] udevd[4621]: inotify_add_watch(7, /dev/loop5p5, 10) failed: No such file or directory
[  168.268426][ T4364] udevd[4364]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory
[  169.854589][ T6058] Zero length message leads to an empty skb
[  170.479559][ T4358] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  170.671339][ T4358] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  170.713017][ T4358] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  170.769568][ T4358] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af
[  170.809501][ T4358] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  170.857587][ T4358] usb 1-1: config 0 descriptor??
[  171.011270][ T6102] binder: 6101:6102 ioctl c0306201 0 returned -14
[  171.114688][ T6105] binder: 6101:6105 ioctl c0306201 0 returned -14
[  171.297741][ T4358] playstation 0003:054C:0DF2.0008: unknown main item tag 0x0
[  171.323916][ T4358] playstation 0003:054C:0DF2.0008: unknown main item tag 0x0
[  171.359971][ T4358] playstation 0003:054C:0DF2.0008: unknown main item tag 0x0
[  171.395633][ T4358] playstation 0003:054C:0DF2.0008: unknown main item tag 0x0
[  171.437231][ T4358] playstation 0003:054C:0DF2.0008: unknown main item tag 0x0
[  171.473626][ T4358] playstation 0003:054C:0DF2.0008: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0
[  172.005479][ T4358] playstation 0003:054C:0DF2.0008: Invalid gyro calibration data for axis (3), disabling calibration.
[  172.053630][ T4358] playstation 0003:054C:0DF2.0008: Invalid gyro calibration data for axis (5), disabling calibration.
[  172.117092][ T4358] playstation 0003:054C:0DF2.0008: Invalid accelerometer calibration data for axis (0), disabling calibration.
[  172.190342][ T4358] playstation 0003:054C:0DF2.0008: Invalid accelerometer calibration data for axis (2), disabling calibration.
[  172.254944][ T4358] input: HID 054c:0df2 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:054C:0DF2.0008/input/input16
[  172.320635][ T4358] input: HID 054c:0df2 Motion Sensors as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:054C:0DF2.0008/input/input17
[  172.377484][ T4358] input: HID 054c:0df2 Touchpad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:054C:0DF2.0008/input/input18
[  172.463202][ T4358] playstation 0003:054C:0DF2.0008: Registered DualSense controller hw_version=0x00000000 fw_version=0x00000000
[  172.486428][ T6145] loop3: detected capacity change from 0 to 1024
[  172.539988][ T6145] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  172.563997][ T4358] usb 1-1: USB disconnect, device number 14
[  172.713887][ T6145] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  173.086399][ T6147] fido_id[6147]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory
[  173.317650][ T6145] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 44 with max blocks 4 with error 28
[  173.431065][ T6145] EXT4-fs (loop3): This should not happen!! Data will be lost
[  173.431065][ T6145] 
[  173.484837][ T6145] EXT4-fs (loop3): Total free blocks count 0
[  173.535979][ T6145] EXT4-fs (loop3): Free/Dirty block details
[  173.560263][ T6145] EXT4-fs (loop3): free_blocks=0
[  173.593815][ T6145] EXT4-fs (loop3): dirty_blocks=0
[  173.637896][ T6145] EXT4-fs (loop3): Block reservation details
[  173.669540][ T6145] EXT4-fs (loop3): i_reserved_data_blocks=0
[  173.697492][ T6179] loop5: detected capacity change from 0 to 2048
[  173.808536][ T6179] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  173.886143][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  174.369922][ T5053] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 1366: 0x4b != 0xa7
[  174.457347][ T5053] UDF-fs: error (device loop5): udf_read_inode: (ino 1366) failed !bh
[  174.521683][ T5053] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 1366: 0x4b != 0xa7
[  174.587903][ T5053] UDF-fs: error (device loop5): udf_read_inode: (ino 1366) failed !bh
[  174.673713][ T6199] bcache: register_bcache() error : Not a bcache superblock (bad offset)
[  175.178569][ T5421] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  175.372933][ T5421] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  175.594683][ T5421] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  175.767675][ T5421] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  176.292650][ T6228] loop6: detected capacity change from 0 to 16
[  176.390876][ T6228] erofs: (device loop6): erofs_read_inode: unsupported datalayout 5 of nid 36
[  176.424892][ T4287] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  176.457039][ T4287] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  176.466433][ T4287] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  176.482909][ T4287] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  176.492275][ T4287] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  176.510550][ T4287] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  176.624173][ T6224] loop6: detected capacity change from 0 to 1024
[  176.698283][ T6224] hfsplus: unable to parse mount options
[  177.641735][ T6230] chnl_net:caif_netlink_parms(): no params data found
[  178.172457][ T6230] bridge0: port 1(bridge_slave_0) entered blocking state
[  178.181684][ T6230] bridge0: port 1(bridge_slave_0) entered disabled state
[  178.196504][ T6230] device bridge_slave_0 entered promiscuous mode
[  178.267047][ T6230] bridge0: port 2(bridge_slave_1) entered blocking state
[  178.298254][ T6230] bridge0: port 2(bridge_slave_1) entered disabled state
[  178.345314][ T6230] device bridge_slave_1 entered promiscuous mode
[  178.599702][ T4289] Bluetooth: hci1: command 0x0409 tx timeout
[  178.669015][ T6230] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  178.758076][ T5421] device hsr_slave_0 left promiscuous mode
[  178.794341][ T5421] device hsr_slave_1 left promiscuous mode
[  178.810353][ T5421] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  178.838596][ T5421] batman_adv: batadv0: Removing interface: batadv_slave_0
[  178.871959][ T5421] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  178.897065][ T5421] batman_adv: batadv0: Removing interface: batadv_slave_1
[  178.940127][ T5421] device bridge_slave_1 left promiscuous mode
[  178.946704][ T5421] bridge0: port 2(bridge_slave_1) entered disabled state
[  178.981393][ T5421] device bridge_slave_0 left promiscuous mode
[  179.007431][ T5421] bridge0: port 1(bridge_slave_0) entered disabled state
[  179.118696][ T5421] device veth1_macvtap left promiscuous mode
[  179.186380][ T5421] device veth0_macvtap left promiscuous mode
[  179.196720][ T5421] device veth1_vlan left promiscuous mode
[  179.226949][ T5421] device veth0_vlan left promiscuous mode
[  179.603081][ T6306] loop0: detected capacity change from 0 to 512
[  179.657581][ T6306] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  179.990603][ T6306] EXT4-fs (loop0): orphan cleanup on readonly fs
[  180.025183][ T6306] EXT4-fs error (device loop0): ext4_orphan_get:1431: comm syz.0.474: bad orphan inode 15
[  180.100322][ T6306] ext4_test_bit(bit=14, block=18) = 1
[  180.118178][ T6306] is_bad_inode(inode)=0
[  180.159685][ T6306] NEXT_ORPHAN(inode)=1023
[  180.164100][ T6306] max_ino=32
[  180.167461][ T6306] i_nlink=0
[  180.186995][ T6288] loop3: detected capacity change from 0 to 32768
[  180.227153][ T6306] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2918: inode #15: comm syz.0.474: corrupted xattr block 19
[  180.275913][ T6288] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop3 scanned by syz.3.470 (6288)
[  180.310748][ T6306] EXT4-fs warning (device loop0): ext4_evict_inode:301: xattr delete (err -117)
[  180.360310][ T6306] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  180.371084][ T6288] BTRFS info (device loop3): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  180.415440][ T6288] BTRFS info (device loop3): using blake2b (blake2b-256-generic) checksum algorithm
[  180.439475][ T6288] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10)
[  180.466953][ T6288] BTRFS info (device loop3): use zstd compression, level 3
[  180.502563][ T6288] BTRFS info (device loop3): using free space tree
[  180.517335][ T6302] udc dummy_udc.0: failed to start g1: -4
[  180.554286][ T6302] configfs-gadget.g1: probe of gadget.0 failed with error -4
[  180.638096][ T6302] UDC core: g1: couldn't find an available UDC or it's busy
[  180.661655][ T6303] UDC core: g1: couldn't find an available UDC or it's busy
[  180.685692][ T4289] Bluetooth: hci1: command 0x041b tx timeout
[  180.815094][ T4271] EXT4-fs (loop0): unmounting filesystem.
[  180.846505][ T6288] BTRFS info (device loop3): enabling ssd optimizations
[  181.026689][   T27] audit: type=1800 audit(1787030140.156:8): pid=6346 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.470" name="bus" dev="loop3" ino=263 res=0 errno=0
[  181.127873][   T27] audit: type=1800 audit(1787030140.256:9): pid=6288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.470" name="bus" dev="loop3" ino=263 res=0 errno=0
[  182.000008][ T4279] BTRFS info (device loop3): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  182.080395][ T5421] team0 (unregistering): Port device team_slave_1 removed
[  182.750497][ T5421] team0 (unregistering): Port device team_slave_0 removed
[  182.759741][ T4289] Bluetooth: hci1: command 0x040f tx timeout
[  182.849283][ T5421] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  182.934929][ T5421] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  183.952682][ T5421] bond0 (unregistering): Released all slaves
[  184.171337][ T6230] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  184.528096][ T6323] bridge0: port 2(bridge_slave_1) entered disabled state
[  184.536747][ T6323] bridge0: port 1(bridge_slave_0) entered disabled state
[  184.632932][ T6387] loop3: detected capacity change from 0 to 2048
[  184.664395][ T6387] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  184.839642][ T4289] Bluetooth: hci1: command 0x0419 tx timeout
[  185.024501][ T6323] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  185.072817][ T6323] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  185.410562][ T6323] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  185.420436][ T6323] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  185.430613][ T6323] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  185.439780][ T6323] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  185.629768][ T6230] team0: Port device team_slave_0 added
[  185.657708][ T6230] team0: Port device team_slave_1 added
[  185.926005][ T6230] batman_adv: batadv0: Adding interface: batadv_slave_0
[  185.995901][ T6230] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  186.119563][ T6230] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  186.197613][ T6230] batman_adv: batadv0: Adding interface: batadv_slave_1
[  186.280191][ T6230] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  186.349108][ T6230] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  186.427743][ T6230] device hsr_slave_0 entered promiscuous mode
[  186.437780][ T6230] device hsr_slave_1 entered promiscuous mode
[  186.791100][ T6230] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  186.810129][ T6230] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  186.829427][ T6230] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  186.848413][ T6230] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  186.919409][    C0] sched: RT throttling activated
[  187.480870][ T6230] 8021q: adding VLAN 0 to HW filter on device bond0
[  187.574628][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  187.586983][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  187.630879][ T6230] 8021q: adding VLAN 0 to HW filter on device team0
[  187.700010][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  187.746090][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  187.763819][ T5432] bridge0: port 1(bridge_slave_0) entered blocking state
[  187.771036][ T5432] bridge0: port 1(bridge_slave_0) entered forwarding state
[  187.869178][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  187.894541][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  187.928144][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  187.966481][ T5432] bridge0: port 2(bridge_slave_1) entered blocking state
[  187.973915][ T5432] bridge0: port 2(bridge_slave_1) entered forwarding state
[  188.355566][ T6453] overlayfs: overlapping lowerdir path
[  189.083548][ T6441] bridge0: port 2(bridge_slave_1) entered disabled state
[  189.091582][ T6441] bridge0: port 1(bridge_slave_0) entered disabled state
[  189.797930][ T6441] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  189.862121][ T6441] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  190.423924][ T6441] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  190.438052][ T6441] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  190.466269][ T6441] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  190.489652][ T6441] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  190.660810][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  190.670423][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  190.798166][ T6230] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  190.879210][ T6230] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  190.957340][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  190.975456][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  190.987105][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  191.014279][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  191.045349][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  191.056148][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  191.071690][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  191.085907][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  191.125514][ T6499] binder: 6498:6499 ioctl c0306201 200000000100 returned -14
[  191.141066][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  191.186061][ T5432] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  191.769639][  T125] usb 1-1: new high-speed USB device number 15 using dummy_hcd
[  191.981364][  T125] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47
[  192.006635][ T6230] 8021q: adding VLAN 0 to HW filter on device batadv0
[  192.019488][  T125] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  192.036232][ T5423] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  192.057613][ T5423] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  192.066542][  T125] usb 1-1: config 0 descriptor??
[  192.089964][  T125] gspca_main: STV06xx-2.14.0 probing 046d:0870
[  192.594920][ T6504] loop6: detected capacity change from 0 to 40427
[  192.643821][ T6504] F2FS-fs (loop6): Unrecognized mount option "a9��A�ݳ����F$:�yJ���
���a)��/��?�+nfϹ�U(�S=���!���~�"N�C�N
\��_G���`�J	�x��o�?�����1844674407370955161518446744073709551615��������0xffffffffffffffff" or missing value
[  192.700421][ T6548] loop3: detected capacity change from 0 to 128
[  192.858222][ T6548] syz.3.522: attempt to access beyond end of device
[  192.858222][ T6548] loop3: rw=2049, sector=145, nr_sectors = 176 limit=128
[  193.095301][ T5442] kworker/u4:26: attempt to access beyond end of device
[  193.095301][ T5442] loop3: rw=1, sector=150, nr_sectors = 1 limit=128
[  193.139848][ T5442] buffer_io_error: 13 callbacks suppressed
[  193.139865][ T5442] Buffer I/O error on dev loop3, logical block 150, lost async page write
[  193.246735][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  193.261236][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  193.351285][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  193.385892][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  193.409249][ T6230] device veth0_vlan entered promiscuous mode
[  193.427531][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  193.466306][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  193.470706][ T6564] ubi0: attaching mtd0
[  193.492571][  T125] gspca_stv06xx: HDCS-1020 sensor detected
[  193.505800][ T6230] device veth1_vlan entered promiscuous mode
[  193.540949][ T6564] ubi0: scanning is finished
[  193.545652][ T6564] ubi0 error: ubi_read_volume_table: the layout volume was not found
[  193.631585][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  193.654365][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  193.680741][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  193.708473][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  193.742576][ T6230] device veth0_macvtap entered promiscuous mode
[  193.777979][  T125] STV06xx: probe of 1-1:0.0 failed with error -71
[  193.778181][ T6230] device veth1_macvtap entered promiscuous mode
[  193.797480][  T125] usb 1-1: USB disconnect, device number 15
[  193.847076][ T6564] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22
[  193.912153][ T6230] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  193.951883][ T6230] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  193.980115][ T6230] batman_adv: batadv0: Interface activated: batadv_slave_0
[  193.988567][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  194.023060][ T6559] ftl_cs: FTL header not found.
[  194.030395][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  194.080053][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  194.089095][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  194.123721][ T6559] block2mtd: mtd1: [/dev/loop0] erase_size = 128KiB [131072]
[  194.135620][ T6230] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.181407][ T6230] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.223105][ T6230] batman_adv: batadv0: Interface activated: batadv_slave_1
[  194.275350][ T5423] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  194.330546][ T5423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  194.391231][ T6230] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  194.417995][ T6230] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  194.438099][ T6230] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  194.448074][ T1279] ieee802154 phy0 wpan0: encryption failed: -22
[  194.454443][ T1279] ieee802154 phy1 wpan1: encryption failed: -22
[  194.476497][ T6230] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  194.739352][ T5434] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  194.765737][ T5434] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  194.786776][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  194.803070][ T6586] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found
[  194.852448][ T5434] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  194.871010][ T5434] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  194.893633][ T5425] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  195.256431][ T6599] loop3: detected capacity change from 0 to 512
[  195.382074][ T6599] EXT4-fs error (device loop3): ext4_xattr_inode_iget:397: comm syz.3.532: Parent and EA inode have the same ino 15
[  195.535679][ T6599] EXT4-fs (loop3): 1 orphan inode deleted
[  195.585094][ T6599] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  195.791469][ T6599] capability: warning: `syz.3.532' uses 32-bit capabilities (legacy support in use)
[  196.036400][ T4279] EXT4-fs (loop3): unmounting filesystem.
[  196.338122][ T6630] loop6: detected capacity change from 0 to 164
[  197.693418][ T6664] kvm: pic: non byte write
[  197.823736][ T6677] netlink: 'syz.2.551': attribute type 1 has an invalid length.
[  197.832004][ T4358] usb 1-1: new high-speed USB device number 16 using dummy_hcd
[  197.941829][ T6677] 8021q: adding VLAN 0 to HW filter on device bond1
[  198.031564][ T4358] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47
[  198.055803][ T4358] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  198.100535][ T4358] usb 1-1: config 0 descriptor??
[  198.157076][ T4358] gspca_main: STV06xx-2.14.0 probing 046d:0870
[  198.166701][ T6680] bond1: (slave gretap1): making interface the new active one
[  198.187800][ T6680] bond1: (slave gretap1): Enslaving as an active interface with an up link
[  198.211934][ T6683] netlink: 'syz.2.551': attribute type 10 has an invalid length.
[  198.230473][ T6683] netlink: 40 bytes leftover after parsing attributes in process `syz.2.551'.
[  198.257114][ T6683] device dummy0 entered promiscuous mode
[  198.276301][ T5421] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready
[  198.591317][ T6696] overlayfs: failed to verify origin (43/file1, ino=268, err=-116)
[  198.614484][ T6696] overlayfs: failed to verify origin (43/file1, ino=268, err=-116)
[  199.337682][ T6717] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100
[  199.768477][ T4358] gspca_stv06xx: I2C: Read error writing address: -71
[  199.781393][ T4358] usb 1-1: USB disconnect, device number 16
[  200.326166][ T6752] mmap: syz.3.565 (6752) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  200.635075][ T6762] binder: 6761:6762 ioctl c0306201 200000000680 returned -14
[  200.987400][ T6780] loop3: detected capacity change from 0 to 1024
[  201.189618][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.215519][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.269990][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.294345][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.365084][ T6792] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.414528][ T6792] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.503431][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.581561][ T6780] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.612340][ T6797] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.640050][ T4287] Bluetooth: hci4: command 0x0406 tx timeout
[  201.646273][ T4287] Bluetooth: hci0: command 0x0406 tx timeout
[  201.652704][ T4289] Bluetooth: hci3: command 0x0406 tx timeout
[  201.655902][ T6797] hfsplus: request for non-existent node 33423360 in B*Tree
[  201.990876][ T6798] hfsplus: request for non-existent node 33423360 in B*Tree
[  202.060324][ T6798] hfsplus: request for non-existent node 33423360 in B*Tree
[  202.122793][ T6815] binder: 6812:6815 ioctl c0306201 200000000080 returned -14
[  202.164422][ T6815] binder: 6812:6815 ioctl c0306201 2000000003c0 returned -14
[  204.590389][ T6882] device syzkaller0 entered promiscuous mode
[  204.993208][ T6891] loop6: detected capacity change from 0 to 128
[  205.085066][ T6891] syz.6.597: attempt to access beyond end of device
[  205.085066][ T6891] loop6: rw=2049, sector=138, nr_sectors = 2 limit=128
[  205.112297][ T6891] syz.6.597: attempt to access beyond end of device
[  205.112297][ T6891] loop6: rw=2049, sector=140, nr_sectors = 2 limit=128
[  205.125881][ T6891] Buffer I/O error on dev loop6, logical block 70, lost async page write
[  205.134576][ T6891] syz.6.597: attempt to access beyond end of device
[  205.134576][ T6891] loop6: rw=2049, sector=142, nr_sectors = 2 limit=128
[  205.148595][ T6891] Buffer I/O error on dev loop6, logical block 71, lost async page write
[  205.157553][ T6891] syz.6.597: attempt to access beyond end of device
[  205.157553][ T6891] loop6: rw=2049, sector=144, nr_sectors = 2 limit=128
[  205.171389][ T6891] Buffer I/O error on dev loop6, logical block 72, lost async page write
[  205.180239][ T6891] syz.6.597: attempt to access beyond end of device
[  205.180239][ T6891] loop6: rw=2049, sector=146, nr_sectors = 104 limit=128
[  205.394064][   T27] audit: type=1800 audit(1787030164.526:10): pid=6897 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.598" name="zone_size" dev="configfs" ino=46143 res=0 errno=0
[  205.473478][   T27] audit: type=1800 audit(1787030164.536:11): pid=6897 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.598" name="power" dev="configfs" ino=46144 res=0 errno=0
[  205.629907][ T6897] null_blk: disk nullb1 created
[  206.545690][ T6919] I/O error, dev loop3, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1
[  206.606046][ T6917] device ip6gre1 entered promiscuous mode
[  206.632966][ T5014] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  206.651656][ T6930] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  206.663526][ T5014] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  206.691466][ T5014] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  207.032936][ T6943] loop6: detected capacity change from 0 to 128
[  207.049749][ T5014] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  207.162283][ T6943] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none.
[  207.202397][ T6943] ext4 filesystem being mounted at /54/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  207.329898][ T5060] EXT4-fs (loop6): unmounting filesystem.
[  208.298900][ T5014] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  208.897975][ T6975] socket: no more sockets
[  208.963453][ T6978] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[  210.519586][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  213.029480][ T5014] usb 4-1: new high-speed USB device number 9 using dummy_hcd
[  218.218144][ T7047] input: syz0 as /devices/virtual/input/input19
[  218.561865][ T7059] ubi0: attaching mtd0
[  218.567383][ T7059] ubi0: scanning is finished
[  218.602957][ T7059] ubi0 error: ubi_read_volume_table: the layout volume was not found
[  218.738258][ T7066] UBIFS error (pid: 7066): cannot open "ubi0:testvol", error -19
[  218.759534][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  218.803793][ T7059] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22
[  219.865663][ T7077] loop7: detected capacity change from 0 to 1024
[  219.917192][ T7077] EXT4-fs: Ignoring removed bh option
[  220.001353][ T7077] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none.
[  220.020642][ T7080] binder_alloc: 7078: binder_alloc_buf size 1024 failed, no address space
[  220.029913][ T7077] ext4 filesystem being mounted at /26/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  220.087376][ T7080] binder_alloc: allocated: 12288 (num: 2 largest: 12280), free: 0 (num: 0 largest: 0)
[  220.090577][   T27] audit: type=1800 audit(1787030179.216:12): pid=7077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.639" name="file1" dev="loop7" ino=15 res=0 errno=0
[  220.099691][ T7084] device syzkaller0 entered promiscuous mode
[  220.318430][ T7077] EXT4-fs error (device loop7): __ext4_get_inode_loc:4520: comm syz.7.639: Invalid inode table block 0 in block_group 0
[  220.374144][ T7077] EXT4-fs error (device loop7) in ext4_reserve_inode_write:5952: Corrupt filesystem
[  220.410879][ T7077] EXT4-fs error (device loop7): ext4_dirty_inode:6156: inode #15: comm syz.7.639: mark_inode_dirty error
[  220.440441][ T7086] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #15: block 2: comm syz.7.639: lblock 6 mapped to illegal pblock 2 (length 1)
[  220.603260][ T4341] EXT4-fs error (device loop7): __ext4_get_inode_loc:4520: comm kworker/u4:6: Invalid inode table block 0 in block_group 0
[  220.659267][ T6230] EXT4-fs (loop7): unmounting filesystem.
[  223.042481][ T7136] binder_alloc: 7133: binder_alloc_buf size 1024 failed, no address space
[  223.089558][ T7136] binder_alloc: allocated: 12288 (num: 2 largest: 12280), free: 0 (num: 0 largest: 0)
[  230.082648][ T7237] ==================================================================
[  230.090813][ T7237] BUG: KASAN: use-after-free in pn_bind+0x102/0xb10
[  230.097548][ T7237] Write of size 8 at addr ffff888024c446c8 by task syz.6.660/7237
[  230.105571][ T7237] 
[  230.108006][ T7237] CPU: 0 PID: 7237 Comm: syz.6.660 Not tainted syzkaller #0
[  230.115505][ T7237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  230.126071][ T7237] Call Trace:
[  230.129372][ T7237]  <TASK>
[  230.132324][ T7237]  dump_stack_lvl+0x188/0x24e
[  230.137066][ T7237]  ? __lock_acquire+0x7c40/0x7c40
[  230.142150][ T7237]  ? show_regs_print_info+0x12/0x12
[  230.147656][ T7237]  ? load_image+0x410/0x410
[  230.152288][ T7237]  ? _raw_spin_lock_irqsave+0xbc/0x100
[  230.157890][ T7237]  ? __virt_addr_valid+0x188/0x540
[  230.163581][ T7237]  ? __virt_addr_valid+0x467/0x540
[  230.168841][ T7237]  ? pn_bind+0x102/0xb10
[  230.173258][ T7237]  print_report+0xa8/0x210
[  230.177764][ T7237]  kasan_report+0x10b/0x140
[  230.182337][ T7237]  ? pn_bind+0x102/0xb10
[  230.186632][ T7237]  pn_bind+0x102/0xb10
[  230.190835][ T7237]  usb_add_function+0x2d9/0x980
[  230.195737][ T7237]  ? check_remote_wakeup_config+0x54/0x1b0
[  230.201725][ T7237]  configfs_composite_bind+0xa02/0xf60
[  230.207554][ T7237]  ? os_desc_qw_sign_store+0x100/0x100
[  230.213390][ T7237]  gadget_bind_driver+0x2af/0x760
[  230.219179][ T7237]  ? gadget_match_driver+0x130/0x130
[  230.224486][ T7237]  really_probe+0x24a/0xb40
[  230.229087][ T7237]  ? pm_runtime_barrier+0x147/0x1c0
[  230.234295][ T7237]  __driver_probe_device+0x1f5/0x390
[  230.239600][ T7237]  driver_probe_device+0x4f/0x420
[  230.244749][ T7237]  __driver_attach+0x43d/0x6c0
[  230.249520][ T7237]  ? driver_attach+0x40/0x40
[  230.254387][ T7237]  bus_for_each_dev+0x182/0x1f0
[  230.259245][ T7237]  ? __lock_acquire+0x7c40/0x7c40
[  230.264466][ T7237]  ? bus_remove_file+0xd0/0xd0
[  230.269328][ T7237]  ? do_raw_spin_unlock+0x11d/0x230
[  230.274708][ T7237]  bus_add_driver+0x324/0x5d0
[  230.279594][ T7237]  driver_register+0x32d/0x430
[  230.284740][ T7237]  usb_gadget_register_driver_owner+0xf5/0x260
[  230.290931][ T7237]  gadget_dev_desc_UDC_store+0x1c3/0x2e0
[  230.296844][ T7237]  configfs_write_iter+0x30b/0x400
[  230.302532][ T7237]  ? gadget_dev_desc_UDC_show+0x80/0x80
[  230.308313][ T7237]  vfs_write+0x482/0x9a0
[  230.312584][ T7237]  ? file_end_write+0x250/0x250
[  230.317455][ T7237]  ? __fget_files+0x3fc/0x460
[  230.322153][ T7237]  ? __fdget_pos+0x2ae/0x360
[  230.326840][ T7237]  ? ksys_write+0x70/0x260
[  230.331282][ T7237]  ksys_write+0x14d/0x260
[  230.335890][ T7237]  ? __ia32_sys_read+0x80/0x80
[  230.340767][ T7237]  ? lockdep_hardirqs_on+0x94/0x140
[  230.346512][ T7237]  do_syscall_64+0x4c/0xa0
[  230.351318][ T7237]  ? clear_bhb_loop+0x60/0xb0
[  230.356185][ T7237]  ? clear_bhb_loop+0x60/0xb0
[  230.360887][ T7237]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  230.366790][ T7237] RIP: 0033:0x7fece059e0d9
[  230.371212][ T7237] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  230.391438][ T7237] RSP: 002b:00007fece14eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  230.399859][ T7237] RAX: ffffffffffffffda RBX: 00007fece0825fa0 RCX: 00007fece059e0d9
[  230.408055][ T7237] RDX: 000000000000000b RSI: 0000200000000280 RDI: 0000000000000003
[  230.416292][ T7237] RBP: 00007fece0635024 R08: 0000000000000000 R09: 0000000000000000
[  230.424295][ T7237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  230.432380][ T7237] R13: 00007fece0826038 R14: 00007fece0825fa0 R15: 00007ffe83ebc0a8
[  230.441181][ T7237]  </TASK>
[  230.444204][ T7237] 
[  230.446537][ T7237] Allocated by task 3934:
[  230.450923][ T7237]  kasan_set_track+0x4b/0x70
[  230.455702][ T7237]  __kasan_kmalloc+0x8e/0xa0
[  230.460306][ T7237]  __kmalloc_node+0xb2/0x240
[  230.465081][ T7237]  kvmalloc_node+0x6c/0x180
[  230.469596][ T7237]  seq_read_iter+0x1de/0xc50
[  230.474375][ T7237]  vfs_read+0x471/0x960
[  230.478542][ T7237]  ksys_read+0x14d/0x260
[  230.482880][ T7237]  do_syscall_64+0x4c/0xa0
[  230.487322][ T7237]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  230.493503][ T7237] 
[  230.495832][ T7237] Freed by task 3934:
[  230.499994][ T7237]  kasan_set_track+0x4b/0x70
[  230.504593][ T7237]  kasan_save_free_info+0x27/0x40
[  230.509617][ T7237]  ____kasan_slab_free+0x126/0x1f0
[  230.514743][ T7237]  slab_free_freelist_hook+0x133/0x1b0
[  230.520215][ T7237]  __kmem_cache_free+0xb6/0x200
[  230.525159][ T7237]  seq_release+0x53/0x70
[  230.529587][ T7237]  kernfs_fop_release+0x135/0x190
[  230.534620][ T7237]  __fput+0x20a/0x8b0
[  230.538611][ T7237]  task_work_run+0x1d0/0x260
[  230.543213][ T7237]  exit_to_user_mode_loop+0xe6/0x110
[  230.548506][ T7237]  exit_to_user_mode_prepare+0xee/0x180
[  230.554160][ T7237]  syscall_exit_to_user_mode+0x16/0x40
[  230.559641][ T7237]  do_syscall_64+0x58/0xa0
[  230.564170][ T7237]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  230.570075][ T7237] 
[  230.572407][ T7237] The buggy address belongs to the object at ffff888024c44000
[  230.572407][ T7237]  which belongs to the cache kmalloc-cg-4k of size 4096
[  230.586990][ T7237] The buggy address is located 1736 bytes inside of
[  230.586990][ T7237]  4096-byte region [ffff888024c44000, ffff888024c45000)
[  230.601009][ T7237] 
[  230.603431][ T7237] The buggy address belongs to the physical page:
[  230.610069][ T7237] page:ffffea0000931000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24c40
[  230.620331][ T7237] head:ffffea0000931000 order:3 compound_mapcount:0 compound_pincount:0
[  230.628857][ T7237] memcg:ffff888077f19dc1
[  230.633118][ T7237] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  230.641293][ T7237] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff88801744c280
[  230.650133][ T7237] raw: 0000000000000000 0000000000040004 00000001ffffffff ffff888077f19dc1
[  230.658945][ T7237] page dumped because: kasan: bad access detected
[  230.665627][ T7237] page_owner tracks the page as allocated
[  230.671866][ T7237] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6287, tgid 6287 (syz.0.471), ts 179138245978, free_ts 178986734303
[  230.694993][ T7237]  post_alloc_hook+0x173/0x1a0
[  230.699958][ T7237]  get_page_from_freelist+0x206b/0x2180
[  230.705518][ T7237]  __alloc_pages+0x1ec/0x4f0
[  230.710203][ T7237]  alloc_slab_page+0x5d/0x180
[  230.714971][ T7237]  new_slab+0x87/0x2d0
[  230.719046][ T7237]  ___slab_alloc+0xbc5/0x1240
[  230.724256][ T7237]  __kmem_cache_alloc_node+0x126/0x270
[  230.729814][ T7237]  kmalloc_trace+0x26/0xe0
[  230.734239][ T7237]  kvm_uevent_notify_change+0xc6/0x3a0
[  230.739791][ T7237]  kvm_put_kvm+0x96/0x1a10
[  230.744305][ T7237]  kvm_vm_release+0x42/0x50
[  230.749020][ T7237]  __fput+0x20a/0x8b0
[  230.753187][ T7237]  task_work_run+0x1d0/0x260
[  230.758070][ T7237]  exit_to_user_mode_loop+0xe6/0x110
[  230.763381][ T7237]  exit_to_user_mode_prepare+0xee/0x180
[  230.769386][ T7237]  syscall_exit_to_user_mode+0x16/0x40
[  230.775656][ T7237] page last free stack trace:
[  230.780527][ T7237]  free_unref_page_prepare+0x8e5/0x9e0
[  230.786011][ T7237]  free_unref_page+0x2e/0x3f0
[  230.790754][ T7237]  __unfreeze_partials+0x188/0x1e0
[  230.795915][ T7237]  put_cpu_partial+0x17c/0x250
[  230.801255][ T7237]  qlist_free_all+0x76/0xe0
[  230.805941][ T7237]  kasan_quarantine_reduce+0x144/0x160
[  230.811506][ T7237]  __kasan_slab_alloc+0x1e/0x80
[  230.816392][ T7237]  slab_post_alloc_hook+0x4b/0x490
[  230.822439][ T7237]  kmem_cache_alloc_lru+0x182/0x2e0
[  230.828102][ T7237]  __d_alloc+0x2e/0x6e0
[  230.832462][ T7237]  d_alloc_cursor+0x40/0xd0
[  230.837525][ T7237]  dcache_dir_open+0x37/0x70
[  230.842254][ T7237]  do_dentry_open+0x7dd/0x10b0
[  230.847121][ T7237]  path_openat+0x2674/0x2f10
[  230.852094][ T7237]  do_filp_open+0x1ee/0x420
[  230.857523][ T7237]  do_sys_openat2+0x14b/0x4f0
[  230.862323][ T7237] 
[  230.864659][ T7237] Memory state around the buggy address:
[  230.870465][ T7237]  ffff888024c44580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  230.878711][ T7237]  ffff888024c44600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  230.887070][ T7237] >ffff888024c44680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  230.895523][ T7237]                                               ^
[  230.902779][ T7237]  ffff888024c44700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  230.910960][ T7237]  ffff888024c44780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  230.919218][ T7237] ==================================================================
[  231.905584][ T7237] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  231.913241][ T7237] CPU: 0 PID: 7237 Comm: syz.6.660 Not tainted syzkaller #0
[  231.920650][ T7237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  231.930931][ T7237] Call Trace:
[  231.934245][ T7237]  <TASK>
[  231.937393][ T7237]  dump_stack_lvl+0x188/0x24e
[  231.942128][ T7237]  ? memcpy+0x3c/0x60
[  231.946250][ T7237]  ? show_regs_print_info+0x12/0x12
[  231.951605][ T7237]  ? load_image+0x410/0x410
[  231.956249][ T7237]  panic+0x2d3/0x710
[  231.960280][ T7237]  ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[  231.966757][ T7237]  ? bpf_jit_dump+0xd0/0xd0
[  231.971370][ T7237]  ? _raw_spin_unlock_irqrestore+0x10d/0x120
[  231.977358][ T7237]  ? _raw_spin_unlock+0x40/0x40
[  231.982312][ T7237]  check_panic_on_warn+0x80/0xa0
[  231.987259][ T7237]  ? pn_bind+0x102/0xb10
[  231.991791][ T7237]  end_report+0x66/0x110
[  231.996043][ T7237]  kasan_report+0x118/0x140
[  232.000562][ T7237]  ? pn_bind+0x102/0xb10
[  232.004910][ T7237]  pn_bind+0x102/0xb10
[  232.008995][ T7237]  usb_add_function+0x2d9/0x980
[  232.013849][ T7237]  ? check_remote_wakeup_config+0x54/0x1b0
[  232.019959][ T7237]  configfs_composite_bind+0xa02/0xf60
[  232.025556][ T7237]  ? os_desc_qw_sign_store+0x100/0x100
[  232.031067][ T7237]  gadget_bind_driver+0x2af/0x760
[  232.036115][ T7237]  ? gadget_match_driver+0x130/0x130
[  232.041407][ T7237]  really_probe+0x24a/0xb40
[  232.045940][ T7237]  ? pm_runtime_barrier+0x147/0x1c0
[  232.051239][ T7237]  __driver_probe_device+0x1f5/0x390
[  232.056707][ T7237]  driver_probe_device+0x4f/0x420
[  232.061834][ T7237]  __driver_attach+0x43d/0x6c0
[  232.066814][ T7237]  ? driver_attach+0x40/0x40
[  232.071416][ T7237]  bus_for_each_dev+0x182/0x1f0
[  232.076274][ T7237]  ? __lock_acquire+0x7c40/0x7c40
[  232.081595][ T7237]  ? bus_remove_file+0xd0/0xd0
[  232.086420][ T7237]  ? do_raw_spin_unlock+0x11d/0x230
[  232.091636][ T7237]  bus_add_driver+0x324/0x5d0
[  232.096324][ T7237]  driver_register+0x32d/0x430
[  232.101096][ T7237]  usb_gadget_register_driver_owner+0xf5/0x260
[  232.107359][ T7237]  gadget_dev_desc_UDC_store+0x1c3/0x2e0
[  232.113040][ T7237]  configfs_write_iter+0x30b/0x400
[  232.118614][ T7237]  ? gadget_dev_desc_UDC_show+0x80/0x80
[  232.124267][ T7237]  vfs_write+0x482/0x9a0
[  232.128551][ T7237]  ? file_end_write+0x250/0x250
[  232.133413][ T7237]  ? __fget_files+0x3fc/0x460
[  232.138200][ T7237]  ? __fdget_pos+0x2ae/0x360
[  232.143237][ T7237]  ? ksys_write+0x70/0x260
[  232.147931][ T7237]  ksys_write+0x14d/0x260
[  232.152361][ T7237]  ? __ia32_sys_read+0x80/0x80
[  232.157320][ T7237]  ? lockdep_hardirqs_on+0x94/0x140
[  232.163012][ T7237]  do_syscall_64+0x4c/0xa0
[  232.167454][ T7237]  ? clear_bhb_loop+0x60/0xb0
[  232.172232][ T7237]  ? clear_bhb_loop+0x60/0xb0
[  232.176923][ T7237]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  232.182827][ T7237] RIP: 0033:0x7fece059e0d9
[  232.187335][ T7237] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  232.207229][ T7237] RSP: 002b:00007fece14eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  232.215839][ T7237] RAX: ffffffffffffffda RBX: 00007fece0825fa0 RCX: 00007fece059e0d9
[  232.223950][ T7237] RDX: 000000000000000b RSI: 0000200000000280 RDI: 0000000000000003
[  232.232019][ T7237] RBP: 00007fece0635024 R08: 0000000000000000 R09: 0000000000000000
[  232.240183][ T7237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  232.248252][ T7237] R13: 00007fece0826038 R14: 00007fece0825fa0 R15: 00007ffe83ebc0a8
[  232.256498][ T7237]  </TASK>
[  232.259866][ T7237] Kernel Offset: disabled
[  232.264223][ T7237] Rebooting in 86400 seconds..