last executing test programs: 5m15.924381185s ago: executing program 0 (id=239): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x44040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x80000100008b}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000340)=""/102400, 0x19000) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e21, 0x3, @empty, 0xffffff0e}, 0x1c) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x40, &(0x7f0000000140)=0x7, 0x4) process_vm_writev(r1, &(0x7f000001a480)=[{&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000019340)=""/156, 0x9c}, {&(0x7f0000019400)=""/4096, 0x1000}], 0x3, &(0x7f000001a5c0)=[{&(0x7f000001a4c0)=""/249, 0xf9}], 0x1, 0x0) 5m6.280433803s ago: executing program 0 (id=255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000180)='./bus\x00', 0x3090000, &(0x7f00000000c0)={[{@usrquota}]}, 0xfe, 0x580, &(0x7f0000000800)="$eJzs3d9vU1UcAPDv7X4AG8JICFEfzBIexCAd2/yBiQ/4aJRIou+4bGUh6yhZO8ImCfAgL74YYmKMROMf4LuPRP8A/woSJSGGLPrggzW3u91K127dGKzQzye5cM4993Lu6b3fwzk9bRpAzxpN/8hFvBIRXycRhxvK+iMrHF09buXR9el0S6Ja/fSvJJJsX/34JPt7OMu8HBG/fhlxMrex3vLS8txUsVhYyPJjlfkrY+Wl5VOX5qdmC7OFyxOTk2fenpx47913Np68b2dtfeP8P999cu/DM18dX/n25wdH7iRxNg5mZY3teAI3GzOjMZq9JgNxtunA8V2orJske30B7EhfFucDkfYBh6Mvi3rgxXcjIqpAj0rEP/So1RlAanVuv+k8uPrizfIefrA6Aaq3fb39yep7I7G/NjcaWkkemxmlr8TILtSf1vHLn3fvpFvs3vsQAFu6eSsiTvf3P9b/HYqG/m/nTndwTHMd+j94du6l458397UY/+TWxj/RYvwz3CJ2d2Lr+M89aH3mDheBmqTjv/ej1fhvbdFqpC/LvVQb8w0kFy8VC2nflnaTJ2JgX5rfbD3nzMr9aruyxvFfuqX118eC2XU86G9q6sxUZepJ2tzo4a2IV7cY/yYt7n/6epzvsI5jhbuvtSvbuv1PV/WniNdb3v/1uU6y+frkWO15GKs/FRv9ffvY7y0LblT3vP3p/R/avP0jSeN6bXn7dfy4/99Cu7LRJFs03ebzP5h8VksPZvuuTVUqC+MRg8nHzfvXzvuhftzE+vFp+08cbx3/68//4Ibn/0BEfN5h+28fvd320G64/zPbuv9tEtWkbdH9j774vl39nfV/b9VSJ7I9nfR/ra90KCt9kqcZAAAAAAAAulcuIg5GksuvpXO5fH718x1HYyhXLJUrJy+WFi/PRO27siMxkKuvdA83fB5iPPs8bD0/0ZSfjIgjEfFN34FaPj9dKs7sdeMBAAAAAAAAAAAAAAAAAACgSwy3+f5/6o++vb464Knzk9/Qk36b7yT+d+OXnoCu5P9/6F3iH3qX+IfeJf6hd4l/6F3iH3qX+Ifetb3411sAAAAAAAAAAAAAAAAAAAAAAAAAAADAFs6fO5du1ZVH16fT/MzVpcW50tVTM4XyXH5+cTo/XVq4kp8tlWaLhfx0aX6rf69YKl0Zn4jFa2OVQlIZKy8tX5gvLV6uXLg0PzVbuFAYeCatAgAAAAAAAAAAAAAAAAAAgOdL+b/q3FSxWFgoLy2/QIlc1ryOzzqUndANF/98JfpzXXEZEruc2MNOCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACa/B8AAP//J3ctUQ==") ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x13, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x9, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m58.632841465s ago: executing program 0 (id=272): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f00000006c0)='.\x00', 0x40001a2) r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f0000000300)={{0x6, 0x0, 0x4, 0x0, '\x00', 0x1ff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) sendfile(r1, r1, &(0x7f0000000100)=0x4, 0x8112) 4m58.39924509s ago: executing program 0 (id=274): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) 4m57.384666945s ago: executing program 0 (id=276): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x8005, 0x0, 0x0, 0x12, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) socket$nl_netfilter(0x10, 0x3, 0xc) open(0x0, 0x145142, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0) 4m56.123293624s ago: executing program 0 (id=278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f00000008c0)='./file1\x00', 0x800010, &(0x7f0000000940)=ANY=[@ANYBLOB="646d61736b3d30303030303030303030303030303030303030303030302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c726f6469722c666d61736b3d30303030303030303030303030303030e3a513334f6f9a6a6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c648bb5e16f733178666c6f7070792c726f6469722c756e695f786c6174653d312c71756965742c0016a3b6cfc30a6b6ea8fea18cfc48fdd94c0591b42f43fe4be411b5eba2b809955bea57e386f8294c57f39de988284b07250e04596d1625907104c7f7796ae6f91c4a546cb460e8b2c9f6166ae1ff7a5e66800828d764d89a7151af89d574fa143d4284ea55977cb7d4b018aee77791a5e50d85c1613c85812975fd5e3d04fd210f76395f7105bf864c063699d12dd45cc1460e03464dc0d782ea786b15ba648d54b57be073d0eeb56c7d2c5af204a735e18b4d736bf0c43c8c9a9778e1e7952cc6c38049d08f73b01e70c6b5c24fea92b569adeb26efdef668541efc1e32038bd2498b929710e0be39045a86e3f654705943bcaecd1cf6a32d51da0a12de44dd93c1cc98711ac512d7dade70b92f7c4e34d987f0c5af374a9baaa8644fa97bc143ea5a761e234dcf880549870e770adf64caa7cc4cf759c182820600000000"], 0xf5, 0x2f4, &(0x7f0000001000)="$eJzs3ctrE1scwPFf3kl7e9PF5XK5qBwqiCIdmoA7FxZpQQwobSNYQZjaqYZMk5IJhYjYLgS3rl104VIEEdy5EXHbjX+Br1033VmwODKZmXSajmla6dPvZ9Gczvn95pyZc6aP02Zm5eKT2fKMpX234xLUL1GJeeVFOfd+6dPJ8Xd/uZ8rNTo8kcsrFRWRWw9eDLyt9954/feblCz3315ZzX9dPjEh8mPinkRVyVIV27ZtNVWt1iNO8nTJKmtKXTcN3TJUqWIZtbrSm/X6lGmoGbM6N9dQemW6r2euZliW0isNVTYaql5V9VpD6Xf1UkVpmqb6egTNwfJFt9RFOiUWn6/Ztqw6A5RaFNu2Q6IX/ULCe039XmdxmLSNf8fYLZMjtpc9w35Ys+Ot8U9uM/44ftzr//PTbq5/HD/jNyevDhcKI2NKpUVmH88X54vuq1v/sVdKYoohS2PnJ9fFmSMeiTgfR68URoZUU7+cmV3w8hfmi+43h+EZLz8nWefnlEC++Pk5N19tzk9ITzA/L1n5Jzw/7+dLNJCflLOnA/maZOXDHamKKdPi5G7kP8wpdflaoa39TDMOAAAAAAAAAICjSFMtG+v3kdafejOalmr+x0erPuNsduLcgNb6+pBkZT18fX4odH0/Lv/HD/DAAQAAAAD4g1iN+2XdNI3a3hRizzIdmkiIiFMQeTTgdKbjDv/1etxd68lTYQcY69zEpkLmgruDl2Nex2QvT9QuC1ERCW5x36yRdM7lKz8mI2Hp0R1NgMFk6JlP7+shSzfBkt7dxE51PbXaC5F1f8t/oTF2ZPv92LqZcLf4F+Z2rV/a0eXwy0K6/UQNfnH3a3b4ovGttcQHAAAA4AgJ/OIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyK5uHubft39zlXiPiN96S7b258Rz338AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh9DPAAAA///EKa42") sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) socket$packet(0x11, 0x3, 0x300) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x20) read$msr(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x4004) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x5b8, 0x0, 0x0, 0x428, 0x428, 0x428, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r4, 0x5412, 0x0) 4m40.107230153s ago: executing program 32 (id=278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f00000008c0)='./file1\x00', 0x800010, &(0x7f0000000940)=ANY=[@ANYBLOB="646d61736b3d30303030303030303030303030303030303030303030302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c726f6469722c666d61736b3d30303030303030303030303030303030e3a513334f6f9a6a6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c648bb5e16f733178666c6f7070792c726f6469722c756e695f786c6174653d312c71756965742c0016a3b6cfc30a6b6ea8fea18cfc48fdd94c0591b42f43fe4be411b5eba2b809955bea57e386f8294c57f39de988284b07250e04596d1625907104c7f7796ae6f91c4a546cb460e8b2c9f6166ae1ff7a5e66800828d764d89a7151af89d574fa143d4284ea55977cb7d4b018aee77791a5e50d85c1613c85812975fd5e3d04fd210f76395f7105bf864c063699d12dd45cc1460e03464dc0d782ea786b15ba648d54b57be073d0eeb56c7d2c5af204a735e18b4d736bf0c43c8c9a9778e1e7952cc6c38049d08f73b01e70c6b5c24fea92b569adeb26efdef668541efc1e32038bd2498b929710e0be39045a86e3f654705943bcaecd1cf6a32d51da0a12de44dd93c1cc98711ac512d7dade70b92f7c4e34d987f0c5af374a9baaa8644fa97bc143ea5a761e234dcf880549870e770adf64caa7cc4cf759c182820600000000"], 0xf5, 0x2f4, &(0x7f0000001000)="$eJzs3ctrE1scwPFf3kl7e9PF5XK5qBwqiCIdmoA7FxZpQQwobSNYQZjaqYZMk5IJhYjYLgS3rl104VIEEdy5EXHbjX+Br1033VmwODKZmXSajmla6dPvZ9Gczvn95pyZc6aP02Zm5eKT2fKMpX234xLUL1GJeeVFOfd+6dPJ8Xd/uZ8rNTo8kcsrFRWRWw9eDLyt9954/feblCz3315ZzX9dPjEh8mPinkRVyVIV27ZtNVWt1iNO8nTJKmtKXTcN3TJUqWIZtbrSm/X6lGmoGbM6N9dQemW6r2euZliW0isNVTYaql5V9VpD6Xf1UkVpmqb6egTNwfJFt9RFOiUWn6/Ztqw6A5RaFNu2Q6IX/ULCe039XmdxmLSNf8fYLZMjtpc9w35Ys+Ot8U9uM/44ftzr//PTbq5/HD/jNyevDhcKI2NKpUVmH88X54vuq1v/sVdKYoohS2PnJ9fFmSMeiTgfR68URoZUU7+cmV3w8hfmi+43h+EZLz8nWefnlEC++Pk5N19tzk9ITzA/L1n5Jzw/7+dLNJCflLOnA/maZOXDHamKKdPi5G7kP8wpdflaoa39TDMOAAAAAAAAAICjSFMtG+v3kdafejOalmr+x0erPuNsduLcgNb6+pBkZT18fX4odH0/Lv/HD/DAAQAAAAD4g1iN+2XdNI3a3hRizzIdmkiIiFMQeTTgdKbjDv/1etxd68lTYQcY69zEpkLmgruDl2Nex2QvT9QuC1ERCW5x36yRdM7lKz8mI2Hp0R1NgMFk6JlP7+shSzfBkt7dxE51PbXaC5F1f8t/oTF2ZPv92LqZcLf4F+Z2rV/a0eXwy0K6/UQNfnH3a3b4ovGttcQHAAAA4AgJ/OIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyK5uHubft39zlXiPiN96S7b258Rz338AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh9DPAAAA///EKa42") sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) socket$packet(0x11, 0x3, 0x300) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x20) read$msr(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x4004) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x5b8, 0x0, 0x0, 0x428, 0x428, 0x428, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r4, 0x5412, 0x0) 3m38.696101338s ago: executing program 1 (id=437): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0200000004000000080000000f00000000000000", @ANYRES32, @ANYBLOB='\b\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r2}, 0x4) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r0, 0x58, &(0x7f0000000540)}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x8ccbf000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113380000000000bf1000000000000025000200091b00003d200000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200000300000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x48) 3m37.472695847s ago: executing program 1 (id=439): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) r4 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) r5 = fsmount(r4, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r6, 0x1ba2, 0x0) r7 = inotify_init1(0x80000) inotify_add_watch(r7, &(0x7f0000000140)='.\x00', 0x1000401) getdents64(r6, 0x0, 0x0) 3m33.674990367s ago: executing program 1 (id=447): socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/pids.max\x00', 0xc8442, 0x11) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0xffffffffffffff8b}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) pipe(&(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3m30.288571437s ago: executing program 1 (id=454): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) 3m28.732704684s ago: executing program 1 (id=455): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xf8f}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f0000000080)='GPL\x00', 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f00000003c0)="c274386d178550cb864bd57221bc", 0x0, 0x1200000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3m25.10466838s ago: executing program 1 (id=469): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) r4 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) r5 = fsmount(r4, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r6, 0x1ba2, 0x0) r7 = inotify_init1(0x80000) inotify_add_watch(r7, &(0x7f0000000140)='.\x00', 0x1000401) getdents64(r6, 0x0, 0x0) 3m25.058273361s ago: executing program 33 (id=469): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) r4 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) r5 = fsmount(r4, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r6, 0x1ba2, 0x0) r7 = inotify_init1(0x80000) inotify_add_watch(r7, &(0x7f0000000140)='.\x00', 0x1000401) getdents64(r6, 0x0, 0x0) 47.0648314s ago: executing program 3 (id=963): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010026bd70f14223a29f6036310008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 46.898055224s ago: executing program 3 (id=965): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50) bpf$BPF_GET_MAP_INFO(0x3, 0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xebdf4000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffffffffffee9, &(0x7f00000000c0)=0x10000000003) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) write(r0, &(0x7f0000000100)="306663353a313232373a620afaf6379a248d1d6534518f10951005a36965", 0x1e) syz_usb_connect(0x1, 0x77, &(0x7f0000000000)=ANY=[@ANYBLOB="120100022e1b484021048f00bddd010203010902650001fd08100309"], 0x0) 43.803152809s ago: executing program 3 (id=970): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="060000000400000004000000"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541c, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) readv(r2, &(0x7f0000003a00)=[{&(0x7f0000003840)=""/150, 0x96}], 0x1) readv(r2, &(0x7f0000002180)=[{&(0x7f0000001000)=""/4096, 0x1000}], 0x1) getpgid(0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000000)={0x30, r3, 0x1, 0x70bd27, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x30}}, 0x804) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0423"], 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000000)={'team_slave_1\x00', @random="013701329eff"}) 36.041952487s ago: executing program 3 (id=992): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) writev(r3, &(0x7f0000000440)=[{&(0x7f00000000c0)="5d1c063bc04021", 0x1762}], 0x1) 35.139494909s ago: executing program 3 (id=1000): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x7aef, 0x3}) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x659f, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$binfmt_script(r0, &(0x7f00000000c0), 0x28) 34.183553142s ago: executing program 3 (id=1004): r0 = socket$igmp6(0xa, 0x3, 0x2) listen(0xffffffffffffffff, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0xc, @remote, 0x9}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c05c}}], 0x1, 0x2000c080) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="92b696", 0x3}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 23.328715135s ago: executing program 5 (id=1048): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) writev(r3, &(0x7f0000000440)=[{&(0x7f00000000c0)="5d1c063bc04021", 0x1762}], 0x1) 22.124740034s ago: executing program 5 (id=1053): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r2, @ANYBLOB="0100000002"], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000440)={r3, &(0x7f0000000340)}, 0x20) 21.808435512s ago: executing program 5 (id=1054): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x11, &(0x7f0000000100)=0x6a7d, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e24, 0x10000008, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) 20.436781805s ago: executing program 5 (id=1056): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 19.691544033s ago: executing program 5 (id=1068): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 18.124559191s ago: executing program 34 (id=1004): r0 = socket$igmp6(0xa, 0x3, 0x2) listen(0xffffffffffffffff, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0xc, @remote, 0x9}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c05c}}], 0x1, 0x2000c080) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="92b696", 0x3}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 16.91971768s ago: executing program 5 (id=1066): socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xf, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup\x00', 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000140)={r1, r2, 0x6, 0x0, @val=@tracing={0x0, 0x1}}, 0x20) syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x3f) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1) getsockopt$inet_opts(r3, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)) r4 = socket$netlink(0x10, 0x3, 0xc) unshare(0x62020600) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x18) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x40047438, 0x5333578052521f3b) r6 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/12/smp_affinity\x00', 0x1, 0x0) write$binfmt_misc(r7, &(0x7f0000000340)="55f7ee03ccaa274c4081", 0xa) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @empty}, 0x2a0}) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, 0x0) syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x20404a, &(0x7f00000003c0)=ANY=[], 0xfd, 0x1e1, &(0x7f0000000140)="$eJzslr+v0lAUx7/3tilgNCaOLg6SqIOlLWpcTGRxcjDxB3EwkWglCEoCDEJikPgHuJs4OLj7D5jo6h9h0MkFN5c3vL7cH6X3EQo8+oDhnU/C4dtyenruOTfnAoIgTix/fv8fR8hLfRpF5PT9v1biww3/X/l/b3/cvVP98OTLz9zYLcyLGUWrv98G8L1ioTd99vDTRf39AHyqH4LjitZVMLhaPwXHI61DMDzW+qWh28LfdV80WqH7rO1ACE8YX5hAmPJsfpMRw3MjP2b83u0PmrVWK+xsUCyr36TCccvIz+yXC5WtZ9TPB4evdRkM97W+iVxcG1USY/3n7SS+tXD9DjKt9v1yH5HKESKfO5PaKgfAeqkCbBrwEzI1GO/0lt3kHkoRFqSIO3pMka0trUJs9CU+sLdeVZatmOv04ttt9Ux8Jxqqa+lzNiVgNFzxFQ7WqUYyn6LPDJeM+aRGyUd51IgWlrr9wdXGq1o9rIevg6B8w7vmedeDkhxEyi6YfwU5n04l8eeeSQKHOXhT6/U6vrT74qiRKlB23sTlAJ+MOC5fVNeiuc5M3Lyhmf7YsMHU7G1+Tc2eIAhid1wA24s0diz0aQLjv+69HeZIEARBEARBEARBEEQ2DgIAAP//h/pGVw==") openat(0xffffffffffffff9c, 0x0, 0x80000, 0x40) creat(&(0x7f0000000180)='./file3\x00', 0x200) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000040)=0x1, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000380), 0x4, 0x404800) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0x11, 0x148, 0x238, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x8800, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@socket2={{0x28}}, @common=@inet=@hashlimit3={{0x158}, {'bridge0\x00', {0x6, 0x6, 0x40, 0x6, 0x0, 0x1000003, 0x5, 0x8, 0x0, 0x20}, {0x5}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2000, 0xfffffffe}}}, {{@ip={@multicast2, @remote, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 15.339096828s ago: executing program 6 (id=1073): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x44040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000340)=""/102400, 0x19000) socket$inet6(0xa, 0x800000000000002, 0x0) mlockall(0x2) process_vm_writev(r1, &(0x7f000001a480)=[{&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000019340)=""/156, 0x9c}, {&(0x7f0000019400)=""/4096, 0x1000}], 0x3, &(0x7f000001a5c0)=[{&(0x7f000001a4c0)=""/249, 0xf9}], 0x1, 0x0) 9.600053408s ago: executing program 4 (id=1086): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 9.372745473s ago: executing program 4 (id=1087): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) writev(r3, &(0x7f0000000440)=[{&(0x7f00000000c0)="5d1c063bc04021", 0x1762}], 0x1) 9.368341943s ago: executing program 6 (id=1088): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, &(0x7f0000000000), &(0x7f0000000040)=r0}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1, 0xffffffffffffffff, 0x2000000}, 0xc) 8.874153615s ago: executing program 6 (id=1092): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2010008, &(0x7f0000000300)={[{@jqfmt_vfsold}, {@discard}, {@nodelalloc}, {@minixdf}, {@min_batch_time={'min_batch_time', 0x3d, 0x2}}, {@noinit_itable}, {@norecovery}]}, 0xff, 0x562, &(0x7f0000000c80)="$eJzs3cFvHFcZAPBvxl7HSZzaBQ5QqaWiRUkF8cY1bSwOpUgITpUQ5R6MvbGsrL2RvW5jq4L1X4CEECBxggsXJP4AJBSJC0eEVAnOIBWBEKQgwaF00OzOxulm1t6m693Y/v2kybz3dna+79mZ8czO25kAzqxnI+LViHg/y7IXImK2aE+LKVqdKV/u3XtvreRTEln2+j+SSIq2fLEsy7LuOi8Wb5uOiG98LeLbyQMBp4v57t6t5Xq9tlVUq82N29Xt3b2r6xvLa7W12ubi4sLLS9eXXlq6NpR+XoqIV77ylx9+7+dffeXXn3/zzzf+duU7eVozxevdfjyCycNe7HS9cm665w1bjxjscZT3p/JeUTlfskDycNP+cScFAECp/Bj/YxHxmYh4IWZj4vDDWQAAAOAEyr40E+8lnet3Jab6tAMAAAAnSNoeA5uk88VYgJlI0/n5zhjeT8SFtN7Ybn7uZmNnc7UzVnYuKunN9XrtWjFWeC4qSV5faJcP6i/21Bcj4smI+MHs+XZ9fqVRXx33hx8AAABwRlzsOf//92zn/P9wJV/oBAAAAB5vc4MvOn2ceQAAAADH50Oc/wMAAAAnT2XcCQAAAADH7uuvvZZPWff516tv7O7carxxdbW2fWt+Y2dlfqWxdXt+rdFYa9+zb+Oo9dUbjdtfiM2dO9VmbbtZvbS7d2OjsbPZvLHuqwMAAAAwLk9++u4fk4hoffF8e8pNjTspYCQm75e69/Qs2fr/9ERn/s6IkgJGYmKAZd45V97uOAFOtsnehj7bOnD6GP8PHPVEj76Dd37XmaVDzgcAABi+y58qv/5/9PF8yyE/nHA2Yji7eq7/Z7PjSgQYufb1/0EH8jhYgFOlcsgIwOsjzQQYl496/f9oWfahEgIAAIZupj0l6Xzx8d5MpGl+LnCp/VjASnJzvV67FhFPRMQfZivn8vpC+53JkecMAAAAAAAAAAAAAAAAAAAAAAAAAEBHliWRAQAAAKdaRPrX5Dede/lfnn1+pvfzgankv+1HAk9FxJs/ef1Hd5abza2FvP2f99ubPy7aXzzq04ZBHzQKAAAAfBTd8/T2/D/jzgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA0+bde2+tdKcBFj8/rLh//3JEzJXFn4zp9nw6KhFx4V9JTD7wviQiJoYQv7UfEZ8si5/kad0PWRZ/GD+E1n7SytpK48dc8VPojZ9GxMUhxIez7G6+/3m1bPtP49n2vHz7m4z4QP1R9d//xf3930Sf/c+lAWM89fYvq33j70c8NVm+/+vGT/rEf26g6JX41jf39vq9mv004nL37097j/dghINStblxu7q9u3d1fWN5rbZW21xcXHh56frSS0vXqjfX67Xi39IY33/6V+8f1v8LpX//kiKb/v1/vmR9EyX5/2//zr2Pdyuth+Nfea4k/m9/VizxcPy0iPPZopy/frlbbnXKD3rmF79/5rD+rx70vzLI73+iiHml30p7PbShPD3Yfx0A4Fhs7+7dWq7Xa1untpCfpT8GaTxKYSoeizRGXLie/8JGE+u7eeHtYa0wy7IsypO/GxGDrCeJIfc0PchnunSZvnuAce+ZAACAYTs46B93JgAAAAAAAAAAAAAAAAAAAHB2jeIua70xD26BnAzjFtoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEPx/wAAAP//wsTZzg==") socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000380)={[], [{@uid_eq}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@dont_hash}, {@pcr={'pcr', 0x3d, 0x13}}, {@euid_eq}, {@seclabel}, {@measure}]}, 0xfd, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0xd) fchdir(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82) preadv2(r5, &(0x7f00000018c0)=[{&(0x7f0000000000)=""/217, 0xd9}], 0x1, 0x2, 0x40, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x4880) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, 0x0, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r8, 0x8004587d, 0x0) getdents64(r8, &(0x7f0000000500)=""/138, 0x8a) 7.968765537s ago: executing program 4 (id=1094): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x900, 0x0) 6.62341498s ago: executing program 6 (id=1095): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32, @ANYBLOB="0100000002"], 0x40) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r2, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000440)={r3, &(0x7f0000000340)}, 0x20) 6.332726757s ago: executing program 2 (id=1096): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 5.206911614s ago: executing program 2 (id=1097): syz_mount_image$hfsplus(&(0x7f0000002000), &(0x7f0000000200)='./file0\x00', 0xa00010, &(0x7f0000000840)=ANY=[@ANYBLOB='nodecompose,decompose,nobarrier,gid=', @ANYRESHEX=0xee01, @ANYBLOB="2c6e6c733d69736f383835392d310000000072726965722c00bcd0f0b5c4e2957974ff5d7ea3c3dcee087e4983684e8a4c4e4e87b134e30ce77162b12885b964b3506ff3eae0f3599447b17861d19be78079e5dd7bdc7f1eb36e31ac14de48349767164f5f6431bbdeaef96a4f2bce64b5cfa76ce3a2c4302374bc5535d7e2eb8dfb2e5d58a37b7e37836597c21f51bcdf6df4cad825cfd9ef5ee9e89e04b15cd3cea9e152d67b9a7eedc5dfe6d85a3ce7c342da8cc969b552197cb8bcc4a1009f38f4a85b7c742101ba5bc03115feca2b994c699812"], 0x6, 0x635, &(0x7f0000000c80)="$eJzs3c1rHOcdB/DvrFZryQVHSezELYGKGNJSUVsvKK16iVtK0SGUkB56FrYcC6+VIClFCaWo79BTD/kD0oNuPRV6N6Tn9parjoFCLznppjKzs9LaWil6s1ZqPx/z7PM888w888xvZ2Zndi0mwP+t+Yk0n6TI/MTb62V9a3OmvbU5c6Vubicpy42k2clSLCfFZ8nddFK+Xk6s5y8OWs8nS3Pvfv7l1hedWrNO1fyNw5Y7mo06ZTzJUJ0/o/Wn4/Q33CmU/dzr398xFLtbWAbsVjdwMGg7+2wcZ/FTHrfARVB0Pjf3GUuuJhmprwNSnx0a5zu6s3essxwAAABcUi9sZzvruTbocQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBlUj//v6hTo1seT9F9/n+rnpa6fKk9GfQAAAAAAAAAAOAMfHM721nPtW59p6h+83+9qlyvXr+WD7OaxazkdtazkLWsZSVTScZ6OmqtL6ytrUwdYcnpvktOn8/2AgAAAAAAAMD/qN9kfu/3fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGKShOi86xaJO17vlsTSaSUaStMr5NpJ/dcuXRNFv4pPzHwcAAACcysgJlnlhO9tZz7Vufaeo7vlfqe6XR/JhlrOWpaylncXcr++hy7v+xtbmTHtrc+Zxmfb3+8P/HGsYVY+7X0P0W/PNao7RPMhSNeV27lWDuZ9GtWTpZnc8/cf163JMxVu1I47sfp2XK/vzQd8iDMRYFZHh3YhM1mMro/Hi4ZH4yneneeiaptLY/ebn+nOI+dU6L7fnDxcz5o1UkZju2fteOTwSybf+/tefP2wvP3r4YHXi4mzSCT27T8z0ROLVSx2J5jHnn6wicWO3Pp+f5GeZyHjeyUqW8ossZC2L2anbF+r9uXwdOzxSd5+qvfNVI2nV70vnLHqUMY3nx1VpIa9Xy17LUoq8n/tZzJvVv+lM5XuZzWzmet7hGweOu9q26qhvHO+ov/XtujCa5I91Pmidj9Qyri/2xLX3nDtWtfVO2YvSS2d/bmx+oy6U6/htnV8Mz0ZiqicSLx8eib9Ux8Zqe/nRysOFDw7of+OZ+ht1Xu5xv79QnxLl/vJSRuozydN7R9n28u5Z5ul4tepfXDptjX1tN6q2ougeqT898Eht1ddw+3uartpe7ds2U7Xd7Gl76nor76e9ez0EwAV29TtXW6P/Hv3n6Kejvxt9OPr2yI+ufP/Ka60M/2P4B83JoTcarxV/y6f51d79PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHKrH338aKHdXlzpX2gc3HS2haJ+kM95rEth0IXuQwRP3eHdC7E5l7owlKRfU/0WneThosClcGft8Qd3Vj/6+LtLjxfeW3xvcXl4dnZucm72zZk7D5bai5Od10GPEnge9j70+7cXF+oBmwAAAAAAAAAAAECO9vc2O/X//zvxXxoMehsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAy21+Is0nKTI1eXuyrG9tzrTL1C3vzdlM0mgkxS+T4rPkbjopYz3dFW8dsJ5Plube/fzLrS/2+mpW85ed1vkpbNQp40mG6vys+rt36v6K3S0sA3arGzgYtP8GAAD//+IHAOM=") mknod$loop(&(0x7f0000001280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) unlink(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 5.043554198s ago: executing program 4 (id=1098): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x44040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000340)=""/102400, 0x19000) socket$inet6(0xa, 0x800000000000002, 0x0) mlockall(0x2) process_vm_writev(r1, &(0x7f000001a480)=[{&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000019340)=""/156, 0x9c}, {&(0x7f0000019400)=""/4096, 0x1000}], 0x3, &(0x7f000001a5c0)=[{&(0x7f000001a4c0)=""/249, 0xf9}], 0x1, 0x0) 4.914981961s ago: executing program 2 (id=1099): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x6004, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x88) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x2400c805) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0x30}}, 0x4090) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x300}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="05000000010000000400000004"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000005000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f0000000080)={0xffffffff, 0xa000}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00'}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv6/conf/all/disable_ipv6\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='1', 0x1) 3.614027132s ago: executing program 6 (id=1100): syz_open_dev$sndctrl(0x0, 0x20000000, 0x0) fsopen(0x0, 0x1) symlink(0x0, 0x0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) 2.681109685s ago: executing program 2 (id=1101): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="05000000070000000800000005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, 0xffffffffffffffff, 0x2000000}, 0xc) 2.325142313s ago: executing program 4 (id=1102): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000000d80)={0x0, [{0x1, 0x0, 0x7, 0x0}, {0x1, 0x0, 0x8, 0x0}, {0x3, 0x0, 0x9, 0x0}, {0x2, 0x0, 0x1, 0x0}, {0x1, 0x0, 0xe0, 0x0}, {0x3, 0x0, 0x9, 0x0}, {0x3, 0x0, 0x8, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x2, 0x0, 0xca, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x13f, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x1, 0x0, 0xffffffbc, 0x0}, {0x3, 0x0, 0x1, 0x0}, {0x1, 0x0, 0x7, 0x0}, {0x1, 0x10, 0x0, &(0x7f0000000d00)="cbfd"}]}) 1.888720204s ago: executing program 6 (id=1103): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf}, 0x94) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) writev(r3, &(0x7f0000000440)=[{&(0x7f00000000c0)="5d1c063bc04021", 0x1762}], 0x1) 1.874667764s ago: executing program 35 (id=1066): socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xf, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup\x00', 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000140)={r1, r2, 0x6, 0x0, @val=@tracing={0x0, 0x1}}, 0x20) syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x3f) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1) getsockopt$inet_opts(r3, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)) r4 = socket$netlink(0x10, 0x3, 0xc) unshare(0x62020600) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x18) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x40047438, 0x5333578052521f3b) r6 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/12/smp_affinity\x00', 0x1, 0x0) write$binfmt_misc(r7, &(0x7f0000000340)="55f7ee03ccaa274c4081", 0xa) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @empty}, 0x2a0}) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, 0x0) syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x20404a, &(0x7f00000003c0)=ANY=[], 0xfd, 0x1e1, &(0x7f0000000140)="$eJzslr+v0lAUx7/3tilgNCaOLg6SqIOlLWpcTGRxcjDxB3EwkWglCEoCDEJikPgHuJs4OLj7D5jo6h9h0MkFN5c3vL7cH6X3EQo8+oDhnU/C4dtyenruOTfnAoIgTix/fv8fR8hLfRpF5PT9v1biww3/X/l/b3/cvVP98OTLz9zYLcyLGUWrv98G8L1ioTd99vDTRf39AHyqH4LjitZVMLhaPwXHI61DMDzW+qWh28LfdV80WqH7rO1ACE8YX5hAmPJsfpMRw3MjP2b83u0PmrVWK+xsUCyr36TCccvIz+yXC5WtZ9TPB4evdRkM97W+iVxcG1USY/3n7SS+tXD9DjKt9v1yH5HKESKfO5PaKgfAeqkCbBrwEzI1GO/0lt3kHkoRFqSIO3pMka0trUJs9CU+sLdeVZatmOv04ttt9Ux8Jxqqa+lzNiVgNFzxFQ7WqUYyn6LPDJeM+aRGyUd51IgWlrr9wdXGq1o9rIevg6B8w7vmedeDkhxEyi6YfwU5n04l8eeeSQKHOXhT6/U6vrT74qiRKlB23sTlAJ+MOC5fVNeiuc5M3Lyhmf7YsMHU7G1+Tc2eIAhid1wA24s0diz0aQLjv+69HeZIEARBEARBEARBEEQ2DgIAAP//h/pGVw==") openat(0xffffffffffffff9c, 0x0, 0x80000, 0x40) creat(&(0x7f0000000180)='./file3\x00', 0x200) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000040)=0x1, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000380), 0x4, 0x404800) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0x11, 0x148, 0x238, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x8800, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@socket2={{0x28}}, @common=@inet=@hashlimit3={{0x158}, {'bridge0\x00', {0x6, 0x6, 0x40, 0x6, 0x0, 0x1000003, 0x5, 0x8, 0x0, 0x20}, {0x5}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2000, 0xfffffffe}}}, {{@ip={@multicast2, @remote, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 1.795029286s ago: executing program 2 (id=1105): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xe4776000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000002900)='./file1\x00', 0x10000, &(0x7f00000022c0)=ANY=[], 0x1, 0x6d4, &(0x7f0000001840)="$eJzs3cFvHFcdB/DvrNeON1TBbZM2QkVYiVSQIhInVgrhgkEI5VChqhx6thKnsbpJqsRFaYXABQQnJA79AwqSbxwQEvegcOFSbr36WAmJS8QhKodFMztr79prr53Gawc+n2j83pv35s1v3ryZ8a6z2gD/t66eS/NBilw99/r9sry+Nt9eX5s/Vle3k5T5RtLsJiluJ8XDZKGsL/qW9KXbfLR85c1PH61/1i0166VqP7HbdkMMabtaL5mt+5sduuXkXnexWoeX55Jcq9NBU3vta6BhOWhn6xQOXWeb1f1svp/rFjhiek+novvc3GYmOZ5kevP3gEpjfBEejH3d5QAAAOAZ9cmdw44AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnj319/8X9dKo08ym6H3//1RvXZ0/ghb23PLBgcYBAAAAAAAAAOPxtcd5nPs50St3iupv/meqwsl83km+lPdyL0u5m/O5n8WsZCV3czHJTF9HU/cXV1buXtzYsjR8y0tDt7w0riMGAAAAAAAAgP9Jv0hr8+//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwFBTJRDeplpN1mpk0mtmsy2ryjyRThx3vPhTDVj4YfxwAAADwhUw/wTZffpzHuZ8TvXKnqF7zv1S9Xp7Oe7mdlSxnJe0s5Xr9Grp81d9YX5tvr6/N3yqXsjzY7/f+ta8wpuoeJqrSsD2frlq0ciPL1ZrzuVYFcz2N7r7PJqd78fTF1efDMqbiu7U9Rtash7Xc2e92ehfhqRh8K6KxS8vWZnDJxojM1bE18p+6eq2o3qhJto7EyLNTdZzJujRT9Tq5saeLaWy883PyAMb8eJ2Wx/PrAx3z/doYiUaqkbhUnadqjPPS7iORfP0vf3zrZvv2Ozdv3Dt3dA5phIkd1m+dE/NpbNyAXn6mR6K5z/Zz1Uic2ihfzQ/z45zLbN7I3SznJ1nMSpbSqesX6/lc/pzZfaQWBkpvjIpkqj4v3XO2l5hm84Mqt5gz1bYnspwid3I9S3mt+ncpF/OtXM7lXOndaZOc2jHu6tiqq76x9arvnem/Dg3+7DfqTHl3+83mXW5htyPeaXY+Ld0ZXY7r833j2p31jzZaPd93Hcz1jdILvdGZHNr5k9wbm1+pM+U+fjniOTFeM/VIlBdQ7ynRi+7F7kg0q2fR9nn++071rGnf7nRuLr67Q/+rW8qv1mk5rda+Oqp1z/BT8XSV8+WFTNd3ksHZUda9uHGX6avrbM7lbt3gE7fc7lRVVxS9K/VHuVNNgO1X6lT9O9z2ni5VdS8PrZuv6k731Q38vpU7aef6GMYPgCfx97c2sjM5PtX6Z+uT1setX7Vutl6f/v6xbx97ZSqTf5v8TnNu4tXGK8Wf83F+tvn6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHL33v/gncV2e+nu8Exj56qBTCtb14zqeUumqL/QZ39bHd3MdJKBNdX3HI09jNbWMLZlOj9Pxj4+vS8RHN7mt2WmuW1GDcssDKz50/YOP9xnhMXerosDzDQy3p1OZPgEOMSbEjAWF1ZuvXvh3vsffHP51uLbS28v3Z68fPnK3JXLr81fuLHcXprr/jzsKIGDsPnQP+xIAAAAAAAAAAAAgL0a9sGAM8+N+tDInj7j4X8WAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE/F1XNpPkiRi3Pn58ry+tp8u1x6+c2WzSSNRlL8NCkeJgvpLpnp667IHx6mM2Q/Hy1fefPTR+ufbfbV7LZPGnW6s91rk6zWS2aTTNTpjqZGdTfY37VR/Y1U/Lt3DOWAfd7pdBa+UH/wlPw3AAD//7Yx8wk=") write(r0, &(0x7f0000000080)='4', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x9, 0x5, 0x9}) 1.62102888s ago: executing program 4 (id=1106): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0x200008, 0x8, 0x20001}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r1], 0x4c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) 1.22209554s ago: executing program 7 (id=1062): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000600), 0x0, 0x0) read$msr(r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000dc0)={&(0x7f0000000c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@const]}}, 0x0, 0x26}, 0x20) 0s ago: executing program 2 (id=1107): mount$bpf(0x0, &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x3a85821, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) kernel console output (not intermixed with test programs): comes ready [ 72.160642][ T2289] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.168628][ T2289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.169760][ T309] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.198800][ T309] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.219539][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.243372][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.297906][ T2289] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.323077][ T2289] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.326810][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.382041][ T309] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.382064][ T309] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.382251][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.500277][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 72.510285][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 72.520262][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 72.530269][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 72.540254][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 72.550263][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 72.560265][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 72.570262][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 72.580273][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 72.680282][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 73.982175][ T4267] Bluetooth: hci0: command 0x0419 tx timeout [ 74.135726][ T4175] Bluetooth: hci1: command 0x0419 tx timeout [ 74.135803][ T4175] Bluetooth: hci2: command 0x0419 tx timeout [ 74.135855][ T4175] Bluetooth: hci3: command 0x0419 tx timeout [ 74.135905][ T4175] Bluetooth: hci4: command 0x0419 tx timeout [ 74.267335][ T4283] xt_CT: You must specify a L4 protocol and not use inversions on it [ 75.872497][ T4294] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 75.995207][ T4292] loop3: detected capacity change from 0 to 2048 [ 76.081482][ T4292] EXT4-fs (loop3): mounted filesystem without journal. Opts: barrier=0x0000000000000000,resuid=0x0000000000000000,auto_da_alloc=0x000000000000ffff,noblock_validity,,errors=continue. Quota mode: none. [ 76.154755][ T4301] capability: warning: `syz.1.8' uses 32-bit capabilities (legacy support in use) [ 78.596932][ T4310] 9pnet: Insufficient options for proto=fd [ 80.812369][ T4321] loop3: detected capacity change from 0 to 512 [ 80.953016][ T4321] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 81.016885][ T4321] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 81.029157][ T4321] EXT4-fs (loop3): 1 truncate cleaned up [ 81.034909][ T4321] EXT4-fs (loop3): mounted filesystem without journal. Opts: usrquota,usrjquota="data=ordered,noload,delalloc,grpjquota="init_itable,jqfmt=vfsold,noblock_validity,,errors=continue. Quota mode: writeback. [ 81.085108][ T4321] EXT4-fs error (device loop3): ext4_append:79: inode #2: comm syz.3.15: Logical block already allocated [ 82.879070][ T4331] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 83.309458][ T4337] loop1: detected capacity change from 0 to 512 [ 83.352675][ T4339] loop3: detected capacity change from 0 to 512 [ 84.124950][ T4337] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 84.621398][ T4337] EXT4-fs error (device loop1): ext4_orphan_get:1432: comm syz.1.18: bad orphan inode 13 [ 84.632659][ T4337] ext4_test_bit(bit=12, block=18) = 1 [ 84.638075][ T4337] is_bad_inode(inode)=0 [ 84.642942][ T4337] NEXT_ORPHAN(inode)=0 [ 84.647042][ T4337] max_ino=32 [ 84.652722][ T4337] i_nlink=1 [ 84.656056][ T4337] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 84.718984][ T4337] Zero length message leads to an empty skb [ 84.750001][ T4339] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ec01c, mo2=0003] [ 84.782513][ T4339] System zones: 1-2, 4-12, 8-8 [ 84.788695][ T4339] EXT4-fs error (device loop3): ext4_orphan_get:1406: inode #15: comm syz.3.21: iget: bad i_size value: 38620345925642 [ 84.840790][ T4339] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.21: couldn't read orphan inode 15 (err -117) [ 85.824280][ T4339] EXT4-fs (loop3): mounted filesystem without journal. Opts: quota,delalloc,data_err=ignore,debug,usrjquota=,bsdgroups,,errors=continue. Quota mode: writeback. [ 85.954599][ T4339] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.21: bg 0: block 5: invalid block bitmap [ 86.030730][ T4339] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28 [ 86.079048][ T4339] EXT4-fs (loop3): This should not happen!! Data will be lost [ 86.079048][ T4339] [ 86.150460][ T4339] EXT4-fs (loop3): Total free blocks count 0 [ 86.156532][ T4339] EXT4-fs (loop3): Free/Dirty block details [ 86.200467][ T4339] EXT4-fs (loop3): free_blocks=0 [ 86.371234][ T4339] EXT4-fs (loop3): dirty_blocks=2 [ 86.471806][ T4339] EXT4-fs (loop3): Block reservation details [ 86.625512][ T4339] EXT4-fs (loop3): i_reserved_data_blocks=2 [ 86.743983][ T1111] cfg80211: failed to load regulatory.db [ 92.431333][ T4407] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4190] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4407] [ 92.469105][ T4407] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 92.491643][ T4202] Bluetooth: Wrong link type (-22) [ 93.267183][ T4409] loop0: detected capacity change from 0 to 128 [ 93.499746][ T4409] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 93.510583][ T4409] ext4 filesystem being mounted at /7/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 95.197190][ T4421] binder: 4420:4421 ioctl c0306201 200000000080 returned -14 [ 95.254922][ T4421] binder: 4420:4421 ioctl c0306201 2000000003c0 returned -14 [ 95.634769][ T4427] loop3: detected capacity change from 0 to 1024 [ 95.721244][ T4427] ======================================================= [ 95.721244][ T4427] WARNING: The mand mount option has been deprecated and [ 95.721244][ T4427] and is ignored by this kernel. Remove the mand [ 95.721244][ T4427] option from the mount to silence this warning. [ 95.721244][ T4427] ======================================================= [ 95.872819][ T4427] EXT4-fs (loop3): Ignoring removed bh option [ 95.952776][ T4429] loop2: detected capacity change from 0 to 1024 [ 95.983161][ T4427] EXT4-fs (loop3): mounted filesystem without journal. Opts: barrier,nodioread_nolock,noquota,barrier,auto_da_alloc,grpid,bh,,errors=continue. Quota mode: none. [ 96.095362][ T4427] ext4 filesystem being mounted at /12/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 96.193168][ T4427] EXT4-fs (loop3): shut down requested (0) [ 96.241043][ T4429] EXT4-fs error (device loop2): ext4_map_blocks:631: inode #3: block 2: comm syz.2.32: lblock 2 mapped to illegal pblock 2 (length 1) [ 96.361905][ T4429] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 96.370093][ T4429] EXT4-fs error (device loop2): ext4_map_blocks:631: inode #3: block 48: comm syz.2.32: lblock 0 mapped to illegal pblock 48 (length 1) [ 96.400478][ T4436] loop0: detected capacity change from 0 to 512 [ 96.493874][ T4436] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ec01c, mo2=0003] [ 96.513897][ T4436] System zones: 1-2, 4-12, 8-8 [ 96.546997][ T4429] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 96.556640][ T4429] EXT4-fs error (device loop2): ext4_acquire_dquot:6236: comm syz.2.32: Failed to acquire dquot type 0 [ 96.579023][ T4429] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 96.591263][ T4429] EXT4-fs error (device loop2): ext4_evict_inode:284: inode #11: comm syz.2.32: mark_inode_dirty error [ 96.668764][ T4436] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.37: iget: bad i_size value: 38620345925642 [ 96.674251][ T4429] EXT4-fs warning (device loop2): ext4_evict_inode:287: couldn't mark inode dirty (err -117) [ 96.696649][ T4436] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.37: couldn't read orphan inode 15 (err -117) [ 96.740584][ T4429] EXT4-fs (loop2): 1 orphan inode deleted [ 96.746407][ T4429] EXT4-fs (loop2): mounted filesystem without journal. Opts: nodioread_nolock,noblock_validity,data_err=ignore,max_batch_time=0x0000000000000007,nodiscard,stripe=0x0000000000000004,noauto_da_alloc,,errors=continue. Quota mode: none. [ 96.768964][ T4436] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,delalloc,data_err=ignore,debug,usrjquota=,bsdgroups,,errors=continue. Quota mode: writeback. [ 96.859457][ T9] EXT4-fs error (device loop2): ext4_map_blocks:631: inode #3: block 1: comm kworker/u4:0: lblock 1 mapped to illegal pblock 1 (length 1) [ 96.878137][ T4436] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.37: bg 0: block 5: invalid block bitmap [ 96.940403][ T9] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 96.971302][ T9] EXT4-fs error (device loop2): ext4_release_dquot:6272: comm kworker/u4:0: Failed to release dquot type 0 [ 97.022186][ T4436] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28 [ 97.051134][ T4436] EXT4-fs (loop0): This should not happen!! Data will be lost [ 97.051134][ T4436] [ 97.095869][ T4436] EXT4-fs (loop0): Total free blocks count 0 [ 97.125281][ T4436] EXT4-fs (loop0): Free/Dirty block details [ 97.161048][ T4436] EXT4-fs (loop0): free_blocks=0 [ 97.168095][ T4442] loop1: detected capacity change from 0 to 1024 [ 97.200468][ T4436] EXT4-fs (loop0): dirty_blocks=2 [ 97.218199][ T144] EXT4-fs error (device loop2): ext4_map_blocks:631: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 97.227263][ T4436] EXT4-fs (loop0): Block reservation details [ 97.286135][ T144] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 97.294923][ T4436] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 97.336582][ T4442] EXT4-fs error (device loop1): ext4_orphan_get:1432: comm syz.1.33: bad orphan inode 134217728 [ 97.353854][ T144] EXT4-fs error (device loop2): ext4_release_dquot:6272: comm kworker/u4:1: Failed to release dquot type 0 [ 97.380380][ T13] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 97.408241][ T4186] EXT4-fs error (device loop2): __ext4_get_inode_loc:4334: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 97.445995][ T4442] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 97.459271][ T4186] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 97.521927][ T4186] EXT4-fs error (device loop2): ext4_quota_off:6542: inode #3: comm syz-executor: mark_inode_dirty error [ 97.670378][ T13] usb 4-1: Using ep0 maxpacket: 8 [ 97.820540][ T13] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.844662][ T13] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 97.864497][ T13] usb 4-1: too many endpoints for config 1 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 97.905307][ T13] usb 4-1: config 1 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 97.925513][ T13] usb 4-1: config 1 interface 1 has no altsetting 0 [ 100.545977][ T4458] netlink: 12 bytes leftover after parsing attributes in process `syz.1.47'. [ 101.240475][ T13] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 101.270335][ T13] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.278398][ T13] usb 4-1: Product: syz [ 102.697971][ T13] usb 4-1: Manufacturer: syz [ 102.781516][ T13] usb 4-1: can't set config #1, error -71 [ 102.850859][ T13] usb 4-1: USB disconnect, device number 2 [ 103.120621][ T4475] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4476] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4475] [ 106.001747][ T4489] netlink: 8 bytes leftover after parsing attributes in process `syz.0.61'. [ 106.688363][ T4499] binder: 4498:4499 ioctl c0306201 200000000080 returned -14 [ 106.717505][ T4499] binder: 4498:4499 ioctl c0306201 2000000003c0 returned -14 [ 108.196006][ T7] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 108.500819][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 108.620410][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.650327][ T7] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 108.659363][ T7] usb 1-1: too many endpoints for config 1 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 108.706347][ T7] usb 1-1: config 1 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 108.739784][ T7] usb 1-1: config 1 interface 1 has no altsetting 0 [ 109.910390][ T7] usb 1-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 109.919521][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.970319][ T7] usb 1-1: Product: syz [ 110.020403][ T7] usb 1-1: can't set config #1, error -71 [ 110.061683][ T7] usb 1-1: USB disconnect, device number 2 [ 115.783700][ T4237] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 116.071680][ T4237] usb 3-1: Using ep0 maxpacket: 8 [ 116.212202][ T4237] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 116.232322][ T4237] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 116.257416][ T4237] usb 3-1: too many endpoints for config 1 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 116.296750][ T4237] usb 3-1: config 1 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 116.346105][ T4237] usb 3-1: config 1 interface 1 has no altsetting 0 [ 116.550464][ T4237] usb 3-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 116.581191][ T4237] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.605257][ T4237] usb 3-1: Product: syz [ 116.609478][ T4237] usb 3-1: Manufacturer: syz [ 116.646222][ T4237] usb 3-1: SerialNumber: syz [ 118.610450][ T4237] usb 3-1: can't set config #1, error -71 [ 118.625484][ T4237] usb 3-1: USB disconnect, device number 2 [ 118.975682][ T4579] Core dump to core aborted: cannot preserve file permissions [ 125.898994][ T4608] loop4: detected capacity change from 0 to 1024 [ 126.730735][ T4612] netlink: 'syz.1.87': attribute type 3 has an invalid length. [ 126.739057][ T4612] netlink: 'syz.1.87': attribute type 3 has an invalid length. [ 128.252748][ T4616] loop4: detected capacity change from 0 to 512 [ 128.683410][ T4616] EXT4-fs (loop4): Test dummy encryption mode enabled [ 128.690646][ T4616] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 128.703713][ T4616] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 128.745147][ T4616] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.104: bad orphan inode 131083 [ 128.756044][ T4616] EXT4-fs (loop4): mounted filesystem without journal. Opts: test_dummy_encryption,init_itable,noload,,errors=continue. Quota mode: none. [ 128.999907][ T4637] loop3: detected capacity change from 0 to 128 [ 129.223881][ T4639] xt_CT: You must specify a L4 protocol and not use inversions on it [ 129.519316][ T4637] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 129.566037][ T4637] ext4 filesystem being mounted at /27/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 129.669777][ T4647] loop1: detected capacity change from 0 to 1024 [ 129.779763][ T4647] EXT4-fs (loop1): mounted filesystem without journal. Opts: barrier,nodioread_nolock,noquota,barrier,block_validity,nodioread_nolock,nodelalloc,auto_da_alloc=0x000000000000000a,noload,,errors=continue. Quota mode: none. [ 129.876684][ T4647] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 130.085198][ T4653] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4655] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4653] [ 132.329625][ T4632] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 132.736982][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.743382][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.062569][ T4676] ODEBUG: Out of memory. ODEBUG disabled [ 140.886419][ T4719] loop0: detected capacity change from 0 to 512 [ 142.472190][ T4719] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 142.540144][ T4719] ext4 filesystem being mounted at /36/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 144.791201][ T4738] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 147.449236][ T4774] xt_CT: You must specify a L4 protocol and not use inversions on it [ 147.855819][ T4770] loop0: detected capacity change from 0 to 1024 [ 148.350272][ T4237] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 149.351819][ T4237] usb 2-1: Using ep0 maxpacket: 8 [ 149.470532][ T4237] usb 2-1: config 0 interface 0 has no altsetting 0 [ 149.477212][ T4237] usb 2-1: New USB device found, idVendor=056a, idProduct=00e5, bcdDevice= 0.00 [ 149.496679][ T4237] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.533681][ T4237] usb 2-1: config 0 descriptor?? [ 151.237911][ T26] audit: type=1326 audit(1786292646.732:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.210632][ T26] audit: type=1326 audit(1786292646.732:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.280554][ T4237] usbhid 2-1:0.0: can't add hid device: -71 [ 152.286831][ T4237] usbhid: probe of 2-1:0.0 failed with error -71 [ 152.330389][ T26] audit: type=1326 audit(1786292646.732:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.356902][ T4237] usb 2-1: USB disconnect, device number 2 [ 152.449242][ T26] audit: type=1326 audit(1786292646.732:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.483089][ T4832] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.542842][ T4832] blk_update_request: I/O error, dev loop0, sector 256 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.555978][ T26] audit: type=1326 audit(1786292646.732:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.680512][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 152.694536][ T4832] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.706096][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 152.716068][ T4832] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 152.723943][ T4832] UDF-fs: Scanning with blocksize 512 failed [ 152.740841][ T4832] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.755272][ T4832] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.766789][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 152.777605][ T4832] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.850123][ T26] audit: type=1326 audit(1786292646.732:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 152.881914][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 152.918298][ T4832] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 152.947869][ T4832] UDF-fs: Scanning with blocksize 1024 failed [ 152.962477][ T4832] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 152.983011][ T26] audit: type=1326 audit(1786292646.732:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 153.024397][ T4832] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 153.045995][ T26] audit: type=1326 audit(1786292646.732:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 153.080275][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 153.106019][ T4832] blk_update_request: I/O error, dev loop0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 153.121271][ T26] audit: type=1326 audit(1786292646.732:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 153.163768][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 153.182655][ T26] audit: type=1326 audit(1786292646.732:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4819 comm="syz.0.167" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f266dd690d9 code=0x7ffc0000 [ 153.216064][ T4832] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 153.244621][ T4832] UDF-fs: Scanning with blocksize 2048 failed [ 153.252706][ T4832] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 153.264453][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 153.274917][ T4832] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 153.285581][ T4832] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 153.293577][ T4832] UDF-fs: Scanning with blocksize 4096 failed [ 153.299695][ T4832] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) [ 153.938357][ T4844] netlink: 32 bytes leftover after parsing attributes in process `syz.2.174'. [ 159.604468][ T4873] loop1: detected capacity change from 0 to 2048 [ 160.522030][ T4873] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 160.822846][ T26] kauditd_printk_skb: 32 callbacks suppressed [ 160.822862][ T26] audit: type=1800 audit(1786292656.322:44): pid=4886 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.178" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 160.903967][ T4891] loop4: detected capacity change from 0 to 2048 [ 161.050843][ T4891] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable=0x0000000000000001,errors=remount-ro,resgid=0x0000000000000000,barrier,quota,delalloc,. Quota mode: writeback. [ 161.130516][ T4891] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 161.268017][ T154] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm kworker/u4:2: bg 0: block 345: padding at end of block bitmap is not set [ 161.307372][ T4901] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4902] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4901] [ 161.343544][ T154] EXT4-fs (loop4): Remounting filesystem read-only [ 161.369846][ T13] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 164.980331][ T13] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 164.987967][ T13] usb 2-1: can't read configurations, error -71 [ 165.102829][ T4921] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.453044][ T4921] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 167.085034][ T4929] loop0: detected capacity change from 0 to 128 [ 167.791456][ T4921] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 167.873345][ T4929] UDF-fs: bad mount option "a;gR#򓻙" or missing value [ 168.098356][ T4939] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4940] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4939] [ 168.190435][ T21] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 171.332697][ T4955] loop4: detected capacity change from 0 to 1024 [ 173.421353][ T4967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.180563][ T4980] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4981] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[4980] [ 179.201067][ T5005] loop0: detected capacity change from 0 to 1024 [ 180.162204][ T5005] hfsplus: unable to parse mount options [ 180.537997][ T5013] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5014] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5013] [ 181.844733][ T5016] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 181.873159][ T5016] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 181.902188][ T5016] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 184.408724][ T5041] loop1: detected capacity change from 0 to 256 [ 184.491282][ T5041] FAT-fs (loop1): Unrecognized mount option "shoiǨme=mixed" or missing value [ 184.675721][ T5041] loop1: detected capacity change from 0 to 128 [ 186.050484][ T26] audit: type=1800 audit(1786292681.552:45): pid=5041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.229" name="file1" dev="loop1" ino=1048590 res=0 errno=0 [ 191.683990][ T4194] Bluetooth: hci0: command 0x0406 tx timeout [ 191.700222][ T4194] Bluetooth: hci1: command 0x0406 tx timeout [ 191.748024][ T4194] Bluetooth: hci2: command 0x0406 tx timeout [ 191.805834][ T4194] Bluetooth: hci3: command 0x0406 tx timeout [ 191.917831][ T4194] Bluetooth: hci4: command 0x0406 tx timeout [ 194.227372][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.499833][ T5105] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5106] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5105] [ 195.584265][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.795725][ T4175] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 199.704626][ T5141] loop0: detected capacity change from 0 to 1024 [ 204.574578][ T5171] loop0: detected capacity change from 0 to 1024 [ 204.684215][ T5171] EXT4-fs (loop0): Ignoring removed bh option [ 204.761149][ T5171] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,bh,init_itable,. Quota mode: none. [ 205.149532][ T5177] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5180] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5177] [ 205.650676][ T5171] loop_set_status: loop0 () has still dirty pages (nrpages=2) [ 205.761346][ T4190] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2809: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 205.827389][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 205.850328][ T4347] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 206.047015][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 206.063375][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 206.524712][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 206.551673][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 206.875569][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 206.910363][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 206.947106][ T26] audit: type=1326 audit(1786292702.442:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 206.987114][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 207.016503][ T26] audit: type=1326 audit(1786292702.442:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.055266][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.067943][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 207.094665][ T26] audit: type=1326 audit(1786292702.472:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.110669][ T4347] usb 5-1: unable to get BOS descriptor or descriptor too short [ 207.137440][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.149710][ T26] audit: type=1326 audit(1786292702.472:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.179783][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 207.206625][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.213314][ T26] audit: type=1326 audit(1786292702.482:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.221095][ T4347] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.257733][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 207.278353][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 207.298681][ T4347] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 207.309564][ T26] audit: type=1326 audit(1786292702.482:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.346011][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.352852][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 207.380594][ T26] audit: type=1326 audit(1786292702.482:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.440610][ T26] audit: type=1326 audit(1786292702.482:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.466619][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.480449][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 207.500554][ T4347] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 207.501911][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 207.516323][ T26] audit: type=1326 audit(1786292702.482:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.531052][ T4347] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.568025][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 207.590293][ T26] audit: type=1326 audit(1786292702.502:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.1.280" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f1a33b910d9 code=0x7ffc0000 [ 207.599897][ T4347] usb 5-1: Product: syz [ 207.642089][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 207.659789][ T4347] usb 5-1: Manufacturer: syz [ 207.688349][ T5200] loop1: detected capacity change from 0 to 1024 [ 207.694891][ T4347] usb 5-1: SerialNumber: syz [ 207.992402][ T4347] usb 5-1: selecting invalid altsetting 1 [ 208.214622][ T4347] usb 5-1: unit 0 not found! [ 208.347712][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 208.480245][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 209.466320][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 209.570035][ T4347] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 209.616451][ T4347] usb 5-1: USB disconnect, device number 2 [ 209.621570][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 209.726974][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 209.993619][ T5219] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5220] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5219] [ 211.104445][ T4190] EXT4-fs error: 11 callbacks suppressed [ 211.104468][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 211.171539][ T4190] EXT4-fs: 11 callbacks suppressed [ 211.171558][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 211.340988][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 212.145567][ T5225] loop4: detected capacity change from 0 to 512 [ 212.184891][ T4353] udevd[4353]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 212.212066][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 212.218840][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 212.341867][ T5225] EXT4-fs (loop4): Test dummy encryption mode enabled [ 212.348944][ T5225] EXT4-fs (loop4): Encoding requested by superblock is unknown [ 212.370659][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 212.377222][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 212.470788][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 212.600276][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 212.606923][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 212.720644][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 212.744860][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 212.847348][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 212.976019][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 213.217647][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 214.947790][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 215.001722][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 215.084684][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 215.100462][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 215.163617][ T5239] netlink: 36 bytes leftover after parsing attributes in process `syz.4.298'. [ 215.180692][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 215.187241][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 215.250562][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 215.322137][ T5242] netlink: 79 bytes leftover after parsing attributes in process `syz.2.288'. [ 215.332452][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 215.351252][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 215.407034][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 215.448986][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 215.497330][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 215.531630][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 216.480598][ T4190] EXT4-fs error: 14 callbacks suppressed [ 216.480622][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 216.540705][ T4190] EXT4-fs: 14 callbacks suppressed [ 216.540718][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 216.573264][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 216.710648][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 216.717592][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 217.140648][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.189306][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 217.436285][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 217.490866][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.512644][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 217.563002][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.576460][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 217.618120][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.634860][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 217.677510][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 217.716078][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.727804][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 217.769926][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.782510][ T4190] EXT4-fs error (device loop0): empty_inline_dir:1881: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 217.851827][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 217.862308][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 217.901800][ T4190] EXT4-fs error (device loop0): ext4_read_inline_dir:1626: inode #12: block 7: comm syz-executor: path /64/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 218.150323][ T4190] EXT4-fs (loop0): Remounting filesystem read-only [ 218.172589][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 218.209352][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 218.274110][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 218.426061][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 218.527969][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 218.666443][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 219.391573][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 219.421778][ T4190] EXT4-fs warning (device loop0): empty_inline_dir:1888: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 223.110414][ T4175] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 224.710499][ T4242] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.841313][ T4242] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.851231][ T4175] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 224.870281][ T4175] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.908090][ T4175] usb 5-1: config 0 descriptor?? [ 224.957297][ T4175] cp210x 5-1:0.0: cp210x converter detected [ 224.998494][ T4242] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.050312][ T4232] Bluetooth: hci1: command 0x0409 tx timeout [ 225.099680][ T4242] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.270509][ T4175] cp210x 5-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 226.278071][ T4175] cp210x 5-1:0.0: querying part number failed [ 226.296395][ T4175] usb 5-1: cp210x converter now attached to ttyUSB0 [ 226.308625][ T4175] usb 5-1: USB disconnect, device number 3 [ 226.320544][ T4175] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 226.328986][ T4175] cp210x 5-1:0.0: device disconnected [ 226.368486][ T5303] chnl_net:caif_netlink_parms(): no params data found [ 226.428295][ T5322] netlink: 104 bytes leftover after parsing attributes in process `syz.4.325'. [ 227.462786][ T4175] Bluetooth: hci1: command 0x041b tx timeout [ 227.747936][ T5303] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.772593][ T5330] loop4: detected capacity change from 0 to 2048 [ 227.851201][ T5303] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.881616][ T5303] device bridge_slave_0 entered promiscuous mode [ 227.931207][ T5303] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.990303][ T5303] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.376148][ T5303] device bridge_slave_1 entered promiscuous mode [ 229.402527][ T5303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.416088][ T5303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 229.518922][ T5303] team0: Port device team_slave_0 added [ 229.610270][ T4347] Bluetooth: hci1: command 0x040f tx timeout [ 229.730138][ T5303] team0: Port device team_slave_1 added [ 229.808645][ T5303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 229.820387][ T5303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.931241][ T5303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 229.973068][ T5303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 229.980101][ T5303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.081541][ T5303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 230.255959][ T5303] device hsr_slave_0 entered promiscuous mode [ 230.271912][ T5359] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 230.312719][ T5303] device hsr_slave_1 entered promiscuous mode [ 230.340308][ T5303] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 230.348048][ T5303] Cannot create hsr debugfs directory [ 231.690302][ T4232] Bluetooth: hci1: command 0x0419 tx timeout [ 232.607750][ T5303] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 232.773714][ T5303] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 232.961173][ T5391] loop4: detected capacity change from 0 to 128 [ 233.027259][ T5303] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 233.067259][ T5303] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 233.179153][ T5396] usb usb8: usbfs: process 5396 (syz.1.342) did not claim interface 0 before use [ 233.354279][ T4242] device hsr_slave_0 left promiscuous mode [ 233.370999][ T4242] device hsr_slave_1 left promiscuous mode [ 233.450830][ T4242] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 233.458393][ T4242] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 233.485392][ T4242] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 233.496726][ T4242] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 234.501345][ T4242] device bridge_slave_1 left promiscuous mode [ 234.508998][ T4242] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.563681][ T4242] device bridge_slave_0 left promiscuous mode [ 234.575438][ T4242] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.659787][ T4242] device veth1_macvtap left promiscuous mode [ 234.679202][ T4242] device veth0_macvtap left promiscuous mode [ 234.689499][ T4242] device veth1_vlan left promiscuous mode [ 234.709585][ T4242] device veth0_vlan left promiscuous mode [ 236.587806][ T4242] team0 (unregistering): Port device team_slave_1 removed [ 236.605972][ T5424] loop3: detected capacity change from 0 to 4096 [ 236.616593][ T4242] team0 (unregistering): Port device team_slave_0 removed [ 236.669905][ T5424] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 236.670079][ T4242] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 236.789570][ T4242] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 239.175659][ T4242] bond0 (unregistering): Released all slaves [ 239.329245][ T5404] device syzkaller0 entered promiscuous mode [ 239.540357][ T5303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.596835][ T5303] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.622872][ T4248] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 239.647587][ T4248] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 239.675438][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 240.664495][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 240.700203][ T2289] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.707356][ T2289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.753041][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 240.809444][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 240.853562][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 240.880009][ T2289] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.887180][ T2289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.954494][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 240.977249][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 241.598787][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 241.649607][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 241.835316][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 241.854845][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 242.186321][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 242.209719][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 242.223277][ T2289] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 242.292650][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 242.310962][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 242.354082][ T5303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 245.011740][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 245.019217][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 245.056762][ T5303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 245.210307][ T4234] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 245.284608][ T5479] usb usb8: usbfs: process 5479 (syz.4.356) did not claim interface 0 before use [ 245.480312][ T4234] usb 2-1: Using ep0 maxpacket: 16 [ 245.656163][ T4234] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 245.685922][ T4234] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 245.717223][ T4234] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 245.779371][ T4234] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 1, skipping [ 245.850090][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 245.870861][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 245.906432][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 245.923762][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 245.962310][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 245.975286][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 245.987036][ T5303] device veth0_vlan entered promiscuous mode [ 246.007928][ T5303] device veth1_vlan entered promiscuous mode [ 246.014617][ T4234] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 246.030643][ T4234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.038682][ T4234] usb 2-1: Product: syz [ 246.047403][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 246.074679][ T4234] usb 2-1: Manufacturer: syz [ 246.091017][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 246.099039][ T4234] usb 2-1: SerialNumber: syz [ 246.113074][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 246.143408][ T5303] device veth0_macvtap entered promiscuous mode [ 246.166161][ T5303] device veth1_macvtap entered promiscuous mode [ 247.114294][ T4369] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 247.151089][ T4369] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 247.160638][ T4234] usb 2-1: 0:2 : does not exist [ 247.211334][ T4234] usb 2-1: USB disconnect, device number 6 [ 247.220838][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 248.640190][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.717743][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 248.738834][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.780189][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 248.818034][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.837851][ T4353] udevd[4353]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 248.849183][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 248.883411][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 249.076971][ T5303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 250.079381][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.157225][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.228257][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.238803][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.248697][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.265783][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.320233][ T5303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.347909][ T5303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.394891][ T5303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 250.444113][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 250.471273][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 250.532125][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 250.571891][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 250.619887][ T5303] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.642542][ T5303] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.693902][ T5303] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.734783][ T5303] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.020943][ T5524] smpboot: CPU 1 is now offline [ 251.075677][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.100484][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.108095][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 251.418797][ T5207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.490060][ T5207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.554407][ T5207] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 251.631852][ T5538] using random self ethernet address [ 251.637355][ T5538] using random host ethernet address [ 256.008841][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.015620][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.460756][ T5598] netlink: 'syz.1.373': attribute type 5 has an invalid length. [ 259.468457][ T5598] netlink: 'syz.1.373': attribute type 1 has an invalid length. [ 259.580478][ T5598] netlink: 'syz.1.373': attribute type 2 has an invalid length. [ 262.795759][ T5634] loop3: detected capacity change from 0 to 8 [ 263.481443][ T5650] x86: Booting SMP configuration: [ 263.486684][ T5650] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 263.564373][ T0] kvm-clock: cpu 1, msr f103041, secondary cpu clock [ 263.575853][ T18] kvm-guest: stealtime: cpu 1, msr b9127440 [ 263.652569][ T5654] loop1: detected capacity change from 0 to 512 [ 264.662786][ T5654] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpjquota=,errors=continue,noblock_validity,,errors=continue. Quota mode: none. [ 265.100246][ T4234] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 267.320429][ T4234] usb 4-1: unable to get BOS descriptor or descriptor too short [ 267.360484][ T4234] usb 4-1: not running at top speed; connect to a high speed hub [ 267.440558][ T4234] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 267.641011][ T4234] usb 4-1: New USB device found, idVendor=17cc, idProduct=1020, bcdDevice= 0.40 [ 267.680213][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.708579][ T4234] usb 4-1: Product: syz [ 267.738894][ T4234] usb 4-1: Manufacturer: syz [ 267.759109][ T4234] usb 4-1: SerialNumber: syz [ 267.810390][ T4234] usb 4-1: can't set config #1, error -71 [ 267.860649][ T4234] usb 4-1: USB disconnect, device number 3 [ 269.690758][ T1108] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 270.866516][ T1108] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 270.896938][ T1108] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.011472][ T1108] usb 4-1: config 0 descriptor?? [ 271.051495][ T1108] cp210x 4-1:0.0: cp210x converter detected [ 271.480289][ T1108] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 271.502281][ T26] kauditd_printk_skb: 49 callbacks suppressed [ 271.502296][ T26] audit: type=1400 audit(1786292767.002:105): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=5757 comm="syz.2.416" [ 271.540401][ T1108] cp210x 4-1:0.0: GPIO initialisation failed: -524 [ 271.547034][ T4229] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 271.571186][ T1108] usb 4-1: cp210x converter now attached to ttyUSB0 [ 271.735591][ T5761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.409'. [ 271.761354][ T1108] usb 4-1: USB disconnect, device number 4 [ 272.642725][ T1108] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 272.690661][ T1108] cp210x 4-1:0.0: device disconnected [ 272.720658][ T4229] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.748987][ T4229] usb 5-1: New USB device found, idVendor=a8d2, idProduct=6007, bcdDevice= 0.00 [ 273.640288][ T4229] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.711116][ T4229] usb 5-1: config 0 descriptor?? [ 275.090388][ T4229] usbhid 5-1:0.0: can't add hid device: -71 [ 275.096629][ T4229] usbhid: probe of 5-1:0.0 failed with error -71 [ 275.137179][ T4229] usb 5-1: USB disconnect, device number 4 [ 276.299359][ T4237] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 276.660392][ T4237] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 276.700272][ T4237] usb 6-1: New USB device found, idVendor=045e, idProduct=00f9, bcdDevice= 0.00 [ 276.750221][ T4237] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.790183][ T4237] usb 6-1: config 0 descriptor?? [ 276.810504][ T5796] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 277.290576][ T4229] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 278.460316][ T4237] usbhid 6-1:0.0: can't add hid device: -71 [ 278.466642][ T4237] usbhid: probe of 6-1:0.0 failed with error -71 [ 278.490501][ T4229] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 278.523541][ T4229] usb 2-1: config 0 has no interface number 0 [ 278.532011][ T4237] usb 6-1: USB disconnect, device number 2 [ 278.710477][ T4229] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 278.741118][ T4229] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.749212][ T4229] usb 2-1: Product: syz [ 278.787719][ T4229] usb 2-1: Manufacturer: syz [ 278.820221][ T4229] usb 2-1: SerialNumber: syz [ 278.841204][ T4229] usb 2-1: config 0 descriptor?? [ 280.156654][ T5853] smpboot: CPU 1 is now offline [ 280.380337][ T4229] asix 2-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 280.437543][ T4229] asix: probe of 2-1:0.251 failed with error -524 [ 280.541620][ T5856] x86: Booting SMP configuration: [ 280.582199][ T1108] usb 2-1: USB disconnect, device number 7 [ 280.687249][ T5856] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 281.639040][ T0] kvm-clock: cpu 1, msr f103041, secondary cpu clock [ 281.715612][ T18] kvm-guest: stealtime: cpu 1, msr b9127440 [ 284.706808][ T5942] device syzkaller0 entered promiscuous mode [ 284.870232][ T4237] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 286.882446][ T4237] usb 6-1: unable to get BOS descriptor or descriptor too short [ 286.911283][ T1108] kernel write not supported for file /cpu/0/msr (pid: 1108 comm: kworker/0:2) [ 286.950432][ T4237] usb 6-1: not running at top speed; connect to a high speed hub [ 287.060490][ T4237] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 208, changing to 4 [ 288.111672][ T4237] usb 6-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice= 0.40 [ 288.198540][ T4237] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.249166][ T4237] usb 6-1: Product: syz [ 288.259265][ T4237] usb 6-1: Manufacturer: syz [ 288.289601][ T4237] usb 6-1: SerialNumber: syz [ 288.298533][ T5962] loop5: detected capacity change from 0 to 512 [ 288.330462][ T4237] usb 6-1: can't set config #1, error -71 [ 288.360921][ T4237] usb 6-1: USB disconnect, device number 3 [ 288.470195][ T4228] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 288.487477][ T5962] EXT4-fs (loop5): inline encryption not supported [ 288.500242][ T5962] EXT4-fs (loop5): mounting ext3 file system using the ext4 subsystem [ 288.579622][ T5962] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.448: corrupted in-inode xattr [ 288.630373][ T5962] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.448: couldn't read orphan inode 15 (err -117) [ 288.681120][ T5962] EXT4-fs (loop5): mounted filesystem without journal. Opts: min_batch_time=0x00000000000000ff,jqfmt=vfsv0,min_batch_time=0x00000000000003ff,noload,norecovery,noblock_validity,resgid=0x0000000000000000,inlinecrypt,errors=continue,,errors=continue. Quota mode: none. [ 288.843243][ T5962] EXT4-fs error (device loop5): ext4_map_blocks:631: inode #2: block 13: comm syz.5.448: lblock 0 mapped to illegal pblock 13 (length 1) [ 288.858498][ T4228] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 288.899888][ T4228] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 288.940458][ T4228] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 288.962994][ T5962] EXT4-fs error (device loop5): ext4_map_blocks:631: inode #2: block 13: comm syz.5.448: lblock 0 mapped to illegal pblock 13 (length 1) [ 289.008861][ T4228] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 289.051190][ T4228] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.059420][ T5962] EXT4-fs warning (device loop5): ext4_empty_dir:3139: inode #2: lblock 0: comm syz.5.448: error -117 reading directory block [ 289.097350][ T4228] usb 5-1: config 0 descriptor?? [ 290.356310][ T4228] plantronics 0003:047F:FFFF.0001: item fetching failed at offset 14/15 [ 290.431524][ T4228] plantronics 0003:047F:FFFF.0001: parse failed [ 290.470266][ T4228] plantronics: probe of 0003:047F:FFFF.0001 failed with error -22 [ 290.515530][ T4228] usb 5-1: USB disconnect, device number 5 [ 295.770869][ T6005] process 'syz.4.461' launched './file0' with NULL argv: empty string added [ 296.311819][ T6019] loop4: detected capacity change from 0 to 1024 [ 296.399433][ T6020] loop5: detected capacity change from 0 to 4096 [ 296.522685][ T6020] EXT4-fs (loop5): Test dummy encryption mode enabled [ 296.529561][ T6020] EXT4-fs (loop5): Ignoring removed orlov option [ 296.622701][ T6020] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,test_dummy_encryption,lazytime,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 296.736767][ T2289] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.849901][ T2289] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.078325][ T2289] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.117310][ T6028] netlink: 12 bytes leftover after parsing attributes in process `syz.4.471'. [ 297.127586][ T6028] netlink: 36 bytes leftover after parsing attributes in process `syz.4.471'. [ 297.145225][ T6028] netlink: 12 bytes leftover after parsing attributes in process `syz.4.471'. [ 297.154220][ T6028] netlink: 36 bytes leftover after parsing attributes in process `syz.4.471'. [ 297.210767][ T2289] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.799775][ T6029] chnl_net:caif_netlink_parms(): no params data found [ 297.823059][ T6025] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 298.980293][ T4232] Bluetooth: hci1: command 0x0405 tx timeout [ 299.870554][ T4232] Bluetooth: hci2: command 0x0409 tx timeout [ 299.969188][ T6029] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.986962][ T6029] bridge0: port 1(bridge_slave_0) entered disabled state [ 300.020264][ T6029] device bridge_slave_0 entered promiscuous mode [ 300.031060][ T6029] bridge0: port 2(bridge_slave_1) entered blocking state [ 300.050338][ T6029] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.069747][ T6029] device bridge_slave_1 entered promiscuous mode [ 300.148520][ T6029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 300.229738][ T6029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 300.349135][ T6029] team0: Port device team_slave_0 added [ 300.473503][ T6029] team0: Port device team_slave_1 added [ 300.519715][ T6029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 300.549109][ T6029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 300.607907][ T6029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 300.664581][ T6029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 300.678722][ T6029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 300.756913][ T6029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 300.918830][ T6029] device hsr_slave_0 entered promiscuous mode [ 300.938872][ T6029] device hsr_slave_1 entered promiscuous mode [ 300.966007][ T6029] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 300.997128][ T6029] Cannot create hsr debugfs directory [ 301.307543][ T2289] device hsr_slave_0 left promiscuous mode [ 301.321953][ T2289] device hsr_slave_1 left promiscuous mode [ 301.339470][ T2289] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 301.358813][ T2289] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 301.369840][ T6093] loop5: detected capacity change from 0 to 512 [ 301.377750][ T2289] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 301.392796][ T2289] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 301.404678][ T2289] device bridge_slave_1 left promiscuous mode [ 301.414503][ T2289] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.428321][ T2289] device bridge_slave_0 left promiscuous mode [ 301.439986][ T2289] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.474085][ T2289] device veth1_macvtap left promiscuous mode [ 301.487229][ T2289] device veth0_macvtap left promiscuous mode [ 301.493730][ T2289] device veth1_vlan left promiscuous mode [ 301.499541][ T2289] device veth0_vlan left promiscuous mode [ 302.434222][ T4232] Bluetooth: hci2: command 0x041b tx timeout [ 302.956825][ T2289] team0 (unregistering): Port device team_slave_1 removed [ 302.987295][ T2289] team0 (unregistering): Port device team_slave_0 removed [ 303.005406][ T2289] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 303.028826][ T2289] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 303.133271][ T2289] bond0 (unregistering): Released all slaves [ 303.234922][ T6110] netlink: 104 bytes leftover after parsing attributes in process `syz.2.484'. [ 303.453764][ T6029] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 303.577064][ T6029] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 303.606821][ T6029] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 303.666611][ T6029] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 303.937667][ T6029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 304.046572][ T6029] 8021q: adding VLAN 0 to HW filter on device team0 [ 304.965274][ T4194] Bluetooth: hci2: command 0x040f tx timeout [ 304.991738][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 304.999596][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 305.109835][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 305.137833][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 305.177838][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.184987][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 305.238951][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 305.286657][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 305.320907][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.328031][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 305.410567][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 305.474621][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 305.520722][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 306.408606][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 306.468867][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 306.477999][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 306.511105][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 306.556547][ T6029] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 306.600161][ T6029] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 306.643876][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 306.658671][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 306.676755][ T6159] loop3: detected capacity change from 0 to 1024 [ 306.685631][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 306.708453][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 306.728140][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 306.768556][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 306.825303][ T6159] EXT4-fs (loop3): Ignoring removed bh option [ 307.044955][ T6159] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,sysvgroups,stripe=0x0000000000000010,bh,init_itable,,errors=continue. Quota mode: none. [ 307.070328][ T4175] Bluetooth: hci2: command 0x0419 tx timeout [ 307.244774][ T4248] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 307.270723][ T4248] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 308.254490][ T6029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 308.278774][ T6180] loop3: detected capacity change from 0 to 1024 [ 308.608444][ T6188] loop5: detected capacity change from 0 to 1024 [ 308.657509][ T6188] EXT4-fs (loop5): INFO: recovery required on readonly filesystem [ 308.665604][ T6188] EXT4-fs (loop5): write access will be enabled during recovery [ 308.673611][ T6188] EXT4-fs (loop5): barriers disabled [ 308.687410][ T6188] JBD2: no valid journal superblock found [ 308.694594][ T6188] EXT4-fs (loop5): error loading journal [ 308.949204][ T6196] loop3: detected capacity change from 0 to 2048 [ 309.024978][ T6196] loop3: p1 < > p4 [ 309.063041][ T6196] loop3: p4 size 722688 extends beyond EOD, truncated [ 310.100285][ T1108] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 310.113701][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 310.132270][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 311.121505][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 311.160777][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 311.202913][ T6029] device veth0_vlan entered promiscuous mode [ 311.218155][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 311.249095][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 311.289492][ T4352] udevd[4352]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 311.311657][ T6029] device veth1_vlan entered promiscuous mode [ 311.320541][ T1108] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 311.335611][ T4353] udevd[4353]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 311.355559][ T1108] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 311.417402][ T1108] usb 6-1: config 0 interface 0 has no altsetting 0 [ 311.440713][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 311.471160][ T4353] udevd[4353]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 311.471516][ T4352] udevd[4352]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 311.490868][ T1108] usb 6-1: New USB device found, idVendor=054c, idProduct=0374, bcdDevice= 0.00 [ 311.499949][ T1108] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.502223][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 311.568140][ T1108] usb 6-1: config 0 descriptor?? [ 311.595997][ T6029] device veth0_macvtap entered promiscuous mode [ 311.610512][ T6202] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 311.639373][ T6029] device veth1_macvtap entered promiscuous mode [ 311.712544][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.763693][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.805083][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.839326][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.880204][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.908945][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.935953][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.970025][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 312.001494][ T6029] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 312.040310][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 312.073585][ T1108] sony 0003:054C:0374.0002: item fetching failed at offset 5/7 [ 312.080352][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 312.096454][ T1108] sony 0003:054C:0374.0002: parse failed [ 312.122562][ T1108] sony: probe of 0003:054C:0374.0002 failed with error -22 [ 312.142618][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 312.213918][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 312.259485][ T6229] loop4: detected capacity change from 0 to 2048 [ 312.260248][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 312.280199][ T13] usb 6-1: USB disconnect, device number 4 [ 312.305713][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 312.356377][ T6029] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 312.410701][ T6029] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 312.419824][ T6229] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 312.461521][ T6029] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 312.468947][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 312.487633][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 312.521207][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 312.540932][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 312.549854][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 312.585516][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 312.609979][ T6029] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.636492][ T6029] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.666334][ T6029] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.675374][ T6029] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.197525][ T309] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 313.227897][ T309] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 313.269036][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 313.341069][ T4248] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 313.351584][ T4248] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 313.396560][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 313.440950][ T6247] loop3: detected capacity change from 0 to 4096 [ 313.626484][ T6247] EXT4-fs (loop3): Test dummy encryption mode enabled [ 313.640955][ T6247] EXT4-fs (loop3): Ignoring removed orlov option [ 313.721453][ T6247] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,test_dummy_encryption,lazytime,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 314.243937][ T4195] Bluetooth: Unknown LE signaling command 0x96 [ 314.252985][ T4195] Bluetooth: Wrong link type (-22) [ 315.329151][ T6292] loop6: detected capacity change from 0 to 8 [ 315.362239][ T6296] loop4: detected capacity change from 0 to 128 [ 315.463483][ T6296] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 315.522265][ T6296] ext4 filesystem being mounted at /93/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 316.890147][ C0] sched: RT throttling activated [ 317.226854][ T6296] syz.4.526 (pid 6296) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 317.240415][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.246754][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.284039][ T6296] fscrypt (loop4, inode 12): Missing crypto API support for Adiantum (API name: "adiantum(xchacha12,aes)") [ 318.297611][ T6296] fscrypt (loop4, inode 12): Missing crypto API support for Adiantum (API name: "adiantum(xchacha12,aes)") [ 321.180199][ T6354] loop9: detected capacity change from 0 to 7 [ 321.197685][ C1] print_req_error: 2 callbacks suppressed [ 321.197703][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.214639][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.261815][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.272765][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.337998][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.348955][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.357446][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.368375][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.534491][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.545457][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.553589][ C0] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.564561][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.650852][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.661835][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.669751][ T6354] ldm_validate_partition_table(): Disk read failed. [ 321.725914][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.736979][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.779334][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.790288][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.816085][ C1] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 321.827111][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 321.863342][ T6354] Dev loop9: unable to read RDB block 0 [ 321.875791][ T6354] loop9: unable to read partition table [ 321.881628][ T6354] loop9: partition table beyond EOD, truncated [ 321.887855][ T6354] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 323.960849][ T6393] loop5: detected capacity change from 0 to 128 [ 324.116333][ T6398] loop6: detected capacity change from 0 to 16 [ 324.269034][ T6398] erofs: (device loop6): erofs_load_compr_cfgs: try to load compressed fs with unsupported algorithms 2 [ 324.316677][ T6393] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 324.340355][ T6393] ext4 filesystem being mounted at /47/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 324.722106][ T6413] input: syz0 as /devices/virtual/input/input5 [ 331.054776][ T6490] loop6: detected capacity change from 0 to 2048 [ 331.126698][ T6490] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 334.890090][ T6537] usb usb8: usbfs: process 6537 (syz.6.582) did not claim interface 0 before use [ 337.464295][ T6565] usb usb8: usbfs: process 6565 (syz.5.588) did not claim interface 0 before use [ 342.066985][ T6625] loop5: detected capacity change from 0 to 128 [ 342.256814][ T6625] EXT4-fs (loop5): mounted filesystem without journal. Opts: data_err=ignore,,errors=continue. Quota mode: none. [ 342.358146][ T6625] ext4 filesystem being mounted at /60/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 342.493544][ T6625] EXT4-fs warning (device loop5): verify_group_input:147: Cannot add at group 524405 (only 1 groups) [ 344.685136][ T6676] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[6677] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6676] [ 345.899760][ T6693] loop4: detected capacity change from 0 to 256 [ 345.951405][ T6695] loop3: detected capacity change from 0 to 256 [ 346.025027][ T6695] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 346.936820][ T6721] loop4: detected capacity change from 0 to 128 [ 347.063831][ T6721] EXT4-fs (loop4): mounted filesystem without journal. Opts: data_err=ignore,,errors=continue. Quota mode: none. [ 347.132698][ T6721] ext4 filesystem being mounted at /105/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 347.246248][ T6721] EXT4-fs warning (device loop4): verify_group_input:147: Cannot add at group 524405 (only 1 groups) [ 350.510484][ T4347] Bluetooth: hci1: command 0x0406 tx timeout [ 350.726136][ T6749] loop5: detected capacity change from 0 to 2048 [ 350.795909][ T6749] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 351.526161][ T6763] loop5: detected capacity change from 0 to 128 [ 351.998008][ T6773] netlink: 4 bytes leftover after parsing attributes in process `syz.5.627'. [ 353.366633][ T6780] usb usb8: usbfs: process 6780 (syz.4.614) did not claim interface 0 before use [ 359.710287][ T4229] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 360.090374][ T4229] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 360.115608][ T4229] usb 5-1: config 0 has no interface number 0 [ 360.129022][ T4229] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 360.152166][ T4229] usb 5-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 361.210442][ T4229] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 361.229778][ T4229] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.260254][ T4229] usb 5-1: Product: syz [ 361.264471][ T4229] usb 5-1: Manufacturer: syz [ 361.269093][ T4229] usb 5-1: SerialNumber: syz [ 361.285945][ T4229] usb 5-1: config 0 descriptor?? [ 361.320531][ T6843] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 361.328347][ T6843] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 361.369629][ T6884] loop3: detected capacity change from 0 to 2048 [ 361.381356][ T4229] smsc95xx v2.0.0 [ 361.458742][ T6884] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 361.479892][ T6884] UDF-fs: Scanning with blocksize 512 failed [ 361.517005][ T6884] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 361.587499][ T6843] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 361.609817][ T6843] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 362.649302][ T26] audit: type=1326 audit(1786292857.292:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6888 comm="syz.6.672" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7fc00000 [ 362.679341][ T4194] Bluetooth: hci2: command 0x0405 tx timeout [ 362.751623][ T4229] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 362.761658][ T26] audit: type=1326 audit(1786292857.912:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6888 comm="syz.6.672" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fcfb7078459 code=0x7fc00000 [ 362.761711][ T26] audit: type=1326 audit(1786292857.912:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6888 comm="syz.6.672" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7fcfb707851d code=0x7fc00000 [ 362.761748][ T26] audit: type=1326 audit(1786292857.912:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6888 comm="syz.6.672" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fcfb70d70d9 code=0x7fc00000 [ 362.862797][ T6894] fuse: Bad value for 'fd' [ 362.916119][ T6897] loop4: detected capacity change from 0 to 512 [ 363.020706][ T4229] smsc95xx: probe of 5-1:0.67 failed with error -71 [ 363.048938][ T6897] EXT4-fs error (device loop4): ext4_ext_check_inode:501: inode #3: comm syz.4.675: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 3, max 4(4), depth 0(0) [ 363.110692][ T4229] usb 5-1: USB disconnect, device number 6 [ 363.151598][ T6897] EXT4-fs error (device loop4): ext4_quota_enable:6447: comm syz.4.675: Bad quota inode: 3, type: 0 [ 363.243594][ T6897] EXT4-fs warning (device loop4): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 363.322807][ T6897] EXT4-fs (loop4): mount failed [ 370.613094][ T6986] fuse: Bad value for 'fd' [ 375.375011][ T7035] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7034] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7035] [ 379.155984][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.162695][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.230262][ T13] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 379.353765][ T7063] netlink: 16 bytes leftover after parsing attributes in process `syz.2.734'. [ 379.470306][ T13] usb 5-1: Using ep0 maxpacket: 16 [ 379.630237][ T13] usb 5-1: unable to get BOS descriptor or descriptor too short [ 379.720305][ T13] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 228, changing to 7 [ 380.020271][ T13] usb 5-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 380.730188][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.837978][ T13] usb 5-1: Product: syz [ 380.850293][ T13] usb 5-1: Manufacturer: syz [ 380.854938][ T13] usb 5-1: SerialNumber: syz [ 383.065767][ T13] usb 5-1: MIDIStreaming interface descriptor not found [ 383.580608][ T13] usb 5-1: USB disconnect, device number 7 [ 384.136873][ T7094] udevd[7094]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 384.567478][ T7107] netlink: 16 bytes leftover after parsing attributes in process `syz.6.760'. [ 389.423947][ T7136] loop3: detected capacity change from 0 to 1024 [ 389.545303][ T7136] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 389.610319][ T7136] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 389.645421][ T7136] EXT4-fs (loop3): invalid journal inode [ 389.684054][ T7136] EXT4-fs (loop3): can't get journal size [ 390.540325][ T7136] EXT4-fs (loop3): corrupt root inode, run e2fsck [ 390.546945][ T7136] EXT4-fs (loop3): mount failed [ 392.942627][ T7163] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 395.845274][ T7181] netlink: 16 bytes leftover after parsing attributes in process `syz.5.764'. [ 397.100241][ T4228] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 397.350241][ T4228] usb 6-1: Using ep0 maxpacket: 32 [ 397.470313][ T4228] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 397.497585][ T4228] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 397.581461][ T4228] usb 6-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 397.668526][ T4228] usb 6-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 398.640144][ T4228] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 398.696917][ T4228] usb 6-1: config 1 interface 1 has no altsetting 0 [ 400.640241][ T4228] usb 6-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 400.662503][ T4228] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.720263][ T4228] usb 6-1: Product: syz [ 400.724492][ T4228] usb 6-1: Manufacturer: syz [ 400.790352][ T4228] usb 6-1: can't set config #1, error -71 [ 401.013119][ T4228] usb 6-1: USB disconnect, device number 5 [ 402.265323][ T7228] netlink: 16 bytes leftover after parsing attributes in process `syz.3.788'. [ 409.056850][ T7260] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7262] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7260] [ 410.954691][ T13] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 411.170464][ T1108] hid-generic 0000:0000:0000.0003: item fetching failed at offset 0/2 [ 411.183774][ T7270] capability: warning: `syz.4.796' uses deprecated v2 capabilities in a way that may be insecure [ 411.212297][ T1108] hid-generic: probe of 0000:0000:0000.0003 failed with error -22 [ 411.381838][ T7273] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4198] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7273] [ 411.399087][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.440213][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.490237][ T13] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 412.304196][ T7277] netlink: 8 bytes leftover after parsing attributes in process `syz.6.802'. [ 412.380204][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.515666][ T13] usb 4-1: config 0 descriptor?? [ 414.864642][ T13] hid-led: probe of 0003:27B8:01ED.0004 failed with error -71 [ 414.903361][ T13] usb 4-1: USB disconnect, device number 5 [ 416.638116][ T13] hid-generic 0000:0000:0000.0005: item fetching failed at offset 0/2 [ 416.662818][ T13] hid-generic: probe of 0000:0000:0000.0005 failed with error -22 [ 419.885498][ T26] audit: type=1326 audit(1786294196.541:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7347 comm="syz.6.826" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x0 [ 419.929800][ T4195] Bluetooth: Unexpected continuation frame (len 16) [ 422.210248][ T4231] Bluetooth: hci2: command 0x0406 tx timeout [ 423.855665][ T7376] loop4: detected capacity change from 0 to 1024 [ 424.092920][ T4195] Bluetooth: Unexpected continuation frame (len 16) [ 424.130008][ T7376] hfsplus: unknown catalog record type 0 [ 424.324590][ T2289] hfsplus: b-tree write err: -5, ino 25 [ 424.350643][ T2289] hfsplus: b-tree write err: -5, ino 4 [ 424.356461][ T2289] hfsplus: b-tree write err: -5, ino 2 [ 426.213110][ T7400] loop4: detected capacity change from 0 to 1024 [ 427.471905][ T7409] loop5: detected capacity change from 0 to 16 [ 427.558137][ T7409] erofs: (device loop5): mounted with root inode @ nid 36. [ 429.125805][ T1108] hid-generic 0000:0000:0000.0006: item fetching failed at offset 0/2 [ 429.150619][ T1108] hid-generic: probe of 0000:0000:0000.0006 failed with error -22 [ 429.288761][ T7421] netlink: 'syz.6.855': attribute type 49 has an invalid length. [ 429.714183][ T7427] netlink: 176 bytes leftover after parsing attributes in process `syz.6.857'. [ 433.246040][ T7475] loop4: detected capacity change from 0 to 512 [ 433.350198][ T13] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 433.477367][ T7475] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 433.536915][ T7475] ext4 filesystem being mounted at /145/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 434.618441][ T7475] Quota error (device loop4): do_check_range: Getting dqdh_next_free 4294967294 out of range 0-8 [ 434.660330][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 434.701651][ T7475] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 434.711982][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 434.770375][ T7475] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.874: Failed to acquire dquot type 0 [ 434.790219][ T13] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 434.880284][ T13] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 434.930161][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.966566][ T13] usb 4-1: config 0 descriptor?? [ 435.167694][ T7499] loop4: detected capacity change from 0 to 1024 [ 435.401005][ T7499] hfsplus: cannot replace xattr [ 435.522862][ T13] plantronics 0003:047F:FFFF.0007: item 0 0 0 8 parsing failed [ 435.547564][ T13] plantronics 0003:047F:FFFF.0007: parse failed [ 435.600190][ T13] plantronics: probe of 0003:047F:FFFF.0007 failed with error -22 [ 436.563569][ T4228] usb 4-1: USB disconnect, device number 6 [ 439.137865][ T7529] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7531] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7529] [ 439.934154][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.940529][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.902628][ T4231] Bluetooth: hci2: command 0x0405 tx timeout [ 442.076198][ T7538] loop3: detected capacity change from 0 to 1024 [ 442.264116][ T7538] EXT4-fs (loop3): warning: mounting unchecked fs, running e2fsck is recommended [ 442.573659][ T7562] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7563] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7562] [ 443.242685][ T7538] EXT4-fs (loop3): Errors on filesystem, clearing orphan list. [ 443.332731][ T7538] EXT4-fs (loop3): mounted filesystem without journal. Opts: norecovery,quota,,errors=continue. Quota mode: writeback. [ 444.332551][ T7581] loop5: detected capacity change from 0 to 128 [ 444.519854][ T7581] FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 445.569329][ T5303] FAT-fs (loop5): error, fat_free_clusters: deleting FAT entry beyond EOF [ 445.733932][ T5303] FAT-fs (loop5): Filesystem has been set read-only [ 446.626593][ T5303] FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 447.889125][ T7635] device syzkaller0 entered promiscuous mode [ 448.928060][ T7660] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7661] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7660] [ 450.203768][ T7677] loop3: detected capacity change from 0 to 2048 [ 450.537089][ T7677] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 450.577512][ T7677] ext4 filesystem being mounted at /168/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 451.595251][ T7677] fs-verity: sha512 using implementation "sha512-avx2" [ 451.816487][ T7694] Invalid ELF header len 56 [ 452.827235][ T7677] syz.3.948 (7677) used greatest stack depth: 21120 bytes left [ 455.091143][ T7729] netlink: 56 bytes leftover after parsing attributes in process `syz.4.964'. [ 456.199035][ T7729] netlink: 'syz.4.964': attribute type 3 has an invalid length. [ 456.379078][ T1108] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 456.521470][ T7733] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7735] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7733] [ 457.489582][ T1108] usb 4-1: Invalid ep0 maxpacket: 64 [ 457.639534][ T1108] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 457.879698][ T1108] usb 4-1: Invalid ep0 maxpacket: 64 [ 457.885233][ T1108] usb usb4-port1: attempt power cycle [ 462.134269][ T7791] loop4: detected capacity change from 0 to 512 [ 462.271793][ T1108] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 462.342247][ T7791] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 462.375118][ T7791] ext4 filesystem being mounted at /161/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 462.642088][ T1108] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 462.791991][ T1108] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 464.103019][ T1108] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 464.156559][ T1108] usb 6-1: config 0 interface 0 has no altsetting 0 [ 464.206329][ T1108] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 464.243622][ T1108] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.274812][ T1108] usb 6-1: config 0 descriptor?? [ 464.293186][ T7784] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 464.492601][ T7808] loop4: detected capacity change from 0 to 512 [ 464.613076][ T1108] usbhid 6-1:0.0: can't add hid device: -71 [ 464.619236][ T1108] usbhid: probe of 6-1:0.0 failed with error -71 [ 464.658984][ T7808] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 464.713141][ T1108] usb 6-1: USB disconnect, device number 6 [ 464.723284][ T7808] ext4 filesystem being mounted at /162/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 465.049473][ T7815] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7817] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7815] [ 466.030918][ T7822] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 466.282626][ T7832] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 466.556167][ T7834] loop4: detected capacity change from 0 to 512 [ 466.661432][ T7834] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 466.859992][ T7834] device lo entered promiscuous mode [ 466.865812][ T7834] device tunl0 entered promiscuous mode [ 466.871750][ T7834] device gre0 entered promiscuous mode [ 466.877721][ T7834] device gretap0 entered promiscuous mode [ 466.884325][ T7834] device erspan0 entered promiscuous mode [ 466.890503][ T7834] device ip_vti0 entered promiscuous mode [ 466.896675][ T7834] device ip6_vti0 entered promiscuous mode [ 466.902889][ T7834] device sit0 entered promiscuous mode [ 466.908785][ T7834] device ip6tnl0 entered promiscuous mode [ 466.915474][ T7834] device ip6gre0 entered promiscuous mode [ 466.921524][ T7834] device syz_tun entered promiscuous mode [ 466.927763][ T7834] device ip6gretap0 entered promiscuous mode [ 466.934306][ T7834] device bridge0 entered promiscuous mode [ 466.940451][ T7834] device vcan0 entered promiscuous mode [ 466.946125][ T7834] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 466.953460][ T7834] device bond0 entered promiscuous mode [ 466.959081][ T7834] device bond_slave_0 entered promiscuous mode [ 466.965383][ T7834] device bond_slave_1 entered promiscuous mode [ 466.972428][ T7834] device team0 entered promiscuous mode [ 466.978062][ T7834] device team_slave_0 entered promiscuous mode [ 466.984460][ T7834] device team_slave_1 entered promiscuous mode [ 466.991459][ T7834] device dummy0 entered promiscuous mode [ 466.997477][ T7834] device nlmon0 entered promiscuous mode [ 467.155130][ T7834] device caif0 entered promiscuous mode [ 467.160910][ T7834] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 467.720937][ T7852] xt_hashlimit: size too large, truncated to 1048576 [ 470.068902][ T7868] loop4: detected capacity change from 0 to 256 [ 470.186270][ T7868] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 470.257048][ T26] audit: type=1326 audit(1786295015.957:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 470.367553][ T26] audit: type=1326 audit(1786295015.997:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 470.452515][ T26] audit: type=1326 audit(1786295015.997:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 470.485243][ T7876] bridge0: port 3(syz_tun) entered blocking state [ 470.550374][ T7876] bridge0: port 3(syz_tun) entered disabled state [ 470.596120][ T7876] device syz_tun entered promiscuous mode [ 470.611557][ T26] audit: type=1326 audit(1786295015.997:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 470.648440][ T7876] bridge0: port 3(syz_tun) entered blocking state [ 470.655587][ T7876] bridge0: port 3(syz_tun) entered forwarding state [ 470.854517][ T26] audit: type=1326 audit(1786295015.997:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=282 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 471.050773][ T26] audit: type=1326 audit(1786295015.997:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 471.242083][ T26] audit: type=1326 audit(1786295015.997:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 471.359262][ T26] audit: type=1326 audit(1786295015.997:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7869 comm="syz.6.1006" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fcfb70d70d9 code=0x7ffc0000 [ 477.499446][ T7965] x_tables: unsorted entry at hook 2 [ 478.820167][ T7979] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7982] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7979] [ 482.877473][ T8013] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[8015] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[8013] [ 484.042050][ T8004] netlink: 'syz.4.1057': attribute type 72 has an invalid length. [ 484.050020][ T8004] netlink: 'syz.4.1057': attribute type 5 has an invalid length. [ 484.873644][ T8022] chnl_net:caif_netlink_parms(): no params data found [ 484.987442][ T8022] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.998693][ T8022] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.009340][ T8022] device bridge_slave_0 entered promiscuous mode [ 485.024146][ T8022] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.031461][ T8022] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.048797][ T8022] device bridge_slave_1 entered promiscuous mode [ 485.076402][ T8022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 485.089204][ T8022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 485.124423][ T8022] team0: Port device team_slave_0 added [ 485.132379][ T8022] team0: Port device team_slave_1 added [ 485.156290][ T8022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 485.163493][ T8022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 485.187556][ T8035] loop4: detected capacity change from 0 to 2048 [ 485.194106][ T8022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 485.208939][ T8022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 485.216238][ T8022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 485.242679][ T8022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 485.342637][ T8035] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 485.385402][ T8022] device hsr_slave_0 entered promiscuous mode [ 485.449506][ T8035] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 485.498390][ T8022] device hsr_slave_1 entered promiscuous mode [ 485.579331][ T8022] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 485.602822][ T8022] Cannot create hsr debugfs directory [ 487.465695][ T4231] Bluetooth: hci5: command 0x0409 tx timeout [ 487.954171][ T8022] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 487.979476][ T8022] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 488.012740][ T8022] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 488.092424][ T8022] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 488.232931][ T2289] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.329511][ T2289] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.421916][ T2289] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.509181][ T2289] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.570464][ T8022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 488.660462][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 488.680340][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 488.706393][ T8022] 8021q: adding VLAN 0 to HW filter on device team0 [ 488.762427][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 488.786062][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 488.810993][ T4343] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.818179][ T4343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 488.886974][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 488.919826][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 488.939472][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 488.959409][ T4343] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.966613][ T4343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.023485][ T4343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 489.164335][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 489.787274][ T4230] Bluetooth: hci5: command 0x041b tx timeout [ 489.813334][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 489.874923][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 489.907007][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 489.937772][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 489.960278][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 490.002842][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 490.038809][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 490.091832][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 490.125545][ T8022] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 490.173301][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 491.605869][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 491.613403][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 491.663427][ T8022] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 491.795686][ T4194] Bluetooth: hci5: command 0x040f tx timeout [ 491.988988][ T8071] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[8099] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[8071] [ 492.437522][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 492.491508][ T4803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 492.571589][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 492.591327][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 492.663200][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 492.677135][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 492.716679][ T8022] device veth0_vlan entered promiscuous mode [ 492.761543][ T8022] device veth1_vlan entered promiscuous mode [ 492.897495][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 492.914737][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 492.959965][ T8022] device veth0_macvtap entered promiscuous mode [ 493.037291][ T8022] device veth1_macvtap entered promiscuous mode [ 493.052488][ T26] audit: type=1326 audit(1786295038.736:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 493.891347][ T4230] Bluetooth: hci5: command 0x0419 tx timeout [ 493.932077][ T2289] device hsr_slave_0 left promiscuous mode [ 493.943012][ T2289] device hsr_slave_1 left promiscuous mode [ 493.963469][ T2289] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 493.994522][ T26] audit: type=1326 audit(1786295038.736:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 493.995816][ T2289] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 494.033269][ T26] audit: type=1326 audit(1786295038.736:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 494.095802][ T26] audit: type=1326 audit(1786295038.736:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 494.126729][ T26] audit: type=1326 audit(1786295038.736:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 494.158436][ T2289] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.183065][ T2289] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 494.196847][ T26] audit: type=1326 audit(1786295038.736:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 494.231504][ T26] audit: type=1326 audit(1786295038.736:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 494.257426][ T2289] device bridge_slave_1 left promiscuous mode [ 494.288931][ T2289] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.304738][ T2289] device bridge_slave_0 left promiscuous mode [ 494.321197][ T2289] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.341042][ T26] audit: type=1326 audit(1786295038.736:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 495.279667][ T2289] device veth1_macvtap left promiscuous mode [ 495.285750][ T2289] device veth0_macvtap left promiscuous mode [ 495.307400][ T26] audit: type=1326 audit(1786295038.736:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 495.347347][ T2289] device veth1_vlan left promiscuous mode [ 495.356665][ T26] audit: type=1326 audit(1786295038.736:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.2.1093" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=203 compat=0 ip=0x7f44a8fde0d9 code=0x7ffc0000 [ 495.394757][ T2289] device veth0_vlan left promiscuous mode [ 496.102111][ T2289] team0 (unregistering): Port device team_slave_1 removed [ 496.155323][ T2289] team0 (unregistering): Port device team_slave_0 removed [ 496.211219][ T2289] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.265189][ T2289] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.525368][ T2289] bond0 (unregistering): Released all slaves [ 496.665755][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 496.688721][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 496.785825][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 496.824821][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 496.835904][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 496.874548][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 496.884846][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 496.909074][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 496.931584][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 496.983864][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 497.024035][ T8022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.109217][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 497.128760][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 497.175744][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 497.220774][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 497.237347][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 497.271091][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 497.293335][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 497.348210][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 497.402745][ T8022] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 497.414526][ T8022] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 497.462969][ T8022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 497.718865][ T8160] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[8161] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[8160] [ 498.306458][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 499.124389][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 499.173834][ T8022] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.199695][ T8022] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.208428][ T8022] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.226034][ T8022] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.121487][ T4242] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.147957][ T4242] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.190491][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 500.313372][ T4242] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.332527][ T4242] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.367193][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 500.430813][ T8184] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 500.438619][ T8184] IPv6: NLM_F_CREATE should be set when creating new route [ 501.526157][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.532568][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.924073][ T4195] ================================================================== [ 501.932714][ T4195] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12cf/0x3ca0 [ 501.940565][ T4195] Read of size 1 at addr ffff888077b82c0a by task kworker/u5:3/4195 [ 501.948536][ T4195] [ 501.950858][ T4195] CPU: 1 PID: 4195 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 501.958432][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.968482][ T4195] Workqueue: hci0 hci_rx_work [ 501.973183][ T4195] Call Trace: [ 501.976460][ T4195] [ 501.979399][ T4195] dump_stack_lvl+0x188/0x250 [ 501.984105][ T4195] ? show_regs_print_info+0x20/0x20 [ 501.989309][ T4195] ? load_image+0x410/0x410 [ 501.993823][ T4195] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 501.999300][ T4195] print_address_description+0x60/0x2d0 [ 502.004846][ T4195] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 502.009953][ T4195] kasan_report+0xdf/0x130 [ 502.014370][ T4195] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 502.019479][ T4195] hci_le_meta_evt+0x12cf/0x3ca0 [ 502.024414][ T4195] ? hci_event_packet+0x363/0x1310 [ 502.029521][ T4195] ? __lock_acquire+0x7b50/0x7b50 [ 502.034563][ T4195] ? hci_remote_host_features_evt+0x240/0x240 [ 502.040652][ T4195] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 502.046285][ T4195] ? mark_lock+0x94/0x320 [ 502.050606][ T4195] ? mutex_unlock+0x10/0x10 [ 502.055109][ T4195] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 502.061110][ T4195] ? lock_chain_count+0x20/0x20 [ 502.065986][ T4195] ? __rwlock_init+0x140/0x140 [ 502.070756][ T4195] hci_event_packet+0xe0b/0x1310 [ 502.075698][ T4195] ? _raw_spin_unlock+0x40/0x40 [ 502.080581][ T4195] ? rcu_lock_release+0x20/0x20 [ 502.085477][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 502.090681][ T4195] hci_rx_work+0x255/0xa10 [ 502.095117][ T4195] process_one_work+0x867/0xff0 [ 502.099980][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 502.105611][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 502.110899][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 502.115924][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 502.121468][ T4195] ? wq_worker_running+0x97/0x170 [ 502.126494][ T4195] worker_thread+0xad7/0x12a0 [ 502.131199][ T4195] kthread+0x42e/0x520 [ 502.135292][ T4195] ? rcu_lock_release+0x20/0x20 [ 502.140142][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 502.144732][ T4195] ret_from_fork+0x1f/0x30 [ 502.149158][ T4195] [ 502.152175][ T4195] [ 502.154497][ T4195] Allocated by task 8204: [ 502.158834][ T4195] __kasan_kmalloc+0xaf/0xe0 [ 502.163423][ T4195] __alloc_skb+0x22c/0x750 [ 502.167834][ T4195] vhci_write+0xbd/0x440 [ 502.172072][ T4195] vfs_write+0x748/0xd70 [ 502.176310][ T4195] ksys_write+0x153/0x260 [ 502.180634][ T4195] do_syscall_64+0x4c/0xa0 [ 502.185056][ T4195] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 502.190941][ T4195] [ 502.193260][ T4195] The buggy address belongs to the object at ffff888077b82800 [ 502.193260][ T4195] which belongs to the cache kmalloc-1k of size 1024 [ 502.207306][ T4195] The buggy address is located 10 bytes to the right of [ 502.207306][ T4195] 1024-byte region [ffff888077b82800, ffff888077b82c00) [ 502.221095][ T4195] The buggy address belongs to the page: [ 502.226726][ T4195] page:ffffea0001dee000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77b80 [ 502.236876][ T4195] head:ffffea0001dee000 order:3 compound_mapcount:0 compound_pincount:0 [ 502.245195][ T4195] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 502.253202][ T4195] raw: 00fff00000010200 ffffea0001837e00 0000000300000003 ffff888016c41dc0 [ 502.261787][ T4195] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 502.270366][ T4195] page dumped because: kasan: bad access detected [ 502.276805][ T4195] page_owner tracks the page as allocated [ 502.282510][ T4195] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3946, ts 43856584141, free_ts 43810665991 [ 502.301606][ T4195] get_page_from_freelist+0x24f6/0x2670 [ 502.307158][ T4195] __alloc_pages+0x1ee/0x480 [ 502.311786][ T4195] new_slab+0xc0/0x4b0 [ 502.315864][ T4195] ___slab_alloc+0x807/0xdd0 [ 502.320452][ T4195] __kmalloc+0x11d/0x340 [ 502.324688][ T4195] load_elf_binary+0x2b9/0x2910 [ 502.329537][ T4195] bprm_execve+0xa8d/0x1740 [ 502.334033][ T4195] do_execveat_common+0x504/0x6b0 [ 502.339068][ T4195] __x64_sys_execve+0x8e/0xa0 [ 502.343741][ T4195] do_syscall_64+0x4c/0xa0 [ 502.348178][ T4195] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 502.354073][ T4195] page last free stack trace: [ 502.358737][ T4195] free_unref_page_prepare+0x637/0x6c0 [ 502.364192][ T4195] free_unref_page+0x8f/0x2a0 [ 502.368899][ T4195] __unfreeze_partials+0x188/0x1e0 [ 502.374018][ T4195] put_cpu_partial+0x12d/0x190 [ 502.378792][ T4195] qlist_free_all+0x35/0x90 [ 502.383295][ T4195] kasan_quarantine_reduce+0x150/0x160 [ 502.388743][ T4195] __kasan_slab_alloc+0x2f/0xc0 [ 502.393589][ T4195] slab_post_alloc_hook+0x4c/0x380 [ 502.398695][ T4195] __kmalloc+0x189/0x340 [ 502.402934][ T4195] tomoyo_supervisor+0xc5f/0x1190 [ 502.407967][ T4195] tomoyo_path_permission+0x262/0x3a0 [ 502.413352][ T4195] tomoyo_path_perm+0x423/0x5d0 [ 502.418209][ T4195] security_inode_getattr+0xcf/0x120 [ 502.423505][ T4195] vfs_getattr+0x26/0x3a0 [ 502.427854][ T4195] __x64_sys_newfstat+0x137/0x210 [ 502.432895][ T4195] do_syscall_64+0x4c/0xa0 [ 502.437311][ T4195] [ 502.439635][ T4195] Memory state around the buggy address: [ 502.445264][ T4195] ffff888077b82b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 502.453336][ T4195] ffff888077b82b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 502.461391][ T4195] >ffff888077b82c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 502.469449][ T4195] ^ SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 502.473776][ T4195] ffff888077b82c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 502.481838][ T4195] ffff888077b82d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 502.489910][ T4195] ================================================================== [ 502.497962][ T4195] Disabling lock debugging due to kernel taint [ 502.540578][ T4195] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 502.547837][ T4195] CPU: 1 PID: 4195 Comm: kworker/u5:3 Tainted: G B syzkaller #0 [ 502.556804][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 502.566907][ T4195] Workqueue: hci0 hci_rx_work [ 502.571630][ T4195] Call Trace: [ 502.574949][ T4195] [ 502.577907][ T4195] dump_stack_lvl+0x188/0x250 [ 502.582610][ T4195] ? show_regs_print_info+0x20/0x20 [ 502.587815][ T4195] ? load_image+0x410/0x410 [ 502.592323][ T4195] panic+0x2f8/0x850 [ 502.596227][ T4195] ? bpf_jit_dump+0xd0/0xd0 [ 502.600736][ T4195] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 502.606737][ T4195] ? _raw_spin_unlock+0x40/0x40 [ 502.611739][ T4195] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 502.616877][ T4195] check_panic_on_warn+0x80/0xa0 [ 502.622039][ T4195] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 502.627159][ T4195] end_report+0x6d/0xf0 [ 502.631331][ T4195] kasan_report+0x102/0x130 [ 502.635841][ T4195] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 502.641089][ T4195] hci_le_meta_evt+0x12cf/0x3ca0 [ 502.646034][ T4195] ? hci_event_packet+0x363/0x1310 [ 502.651152][ T4195] ? __lock_acquire+0x7b50/0x7b50 [ 502.656205][ T4195] ? hci_remote_host_features_evt+0x240/0x240 [ 502.662272][ T4195] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 502.667932][ T4195] ? mark_lock+0x94/0x320 [ 502.672279][ T4195] ? mutex_unlock+0x10/0x10 [ 502.676789][ T4195] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 502.682778][ T4195] ? lock_chain_count+0x20/0x20 [ 502.687641][ T4195] ? __rwlock_init+0x140/0x140 [ 502.692410][ T4195] hci_event_packet+0xe0b/0x1310 [ 502.697353][ T4195] ? _raw_spin_unlock+0x40/0x40 [ 502.702201][ T4195] ? rcu_lock_release+0x20/0x20 [ 502.707071][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 502.712269][ T4195] hci_rx_work+0x255/0xa10 [ 502.716709][ T4195] process_one_work+0x867/0xff0 [ 502.721570][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 502.727202][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 502.732506][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 502.737531][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 502.743097][ T4195] ? wq_worker_running+0x97/0x170 [ 502.748296][ T4195] worker_thread+0xad7/0x12a0 [ 502.752996][ T4195] kthread+0x42e/0x520 [ 502.757081][ T4195] ? rcu_lock_release+0x20/0x20 [ 502.761937][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 502.766549][ T4195] ret_from_fork+0x1f/0x30 [ 502.770983][ T4195] [ 502.774140][ T4195] Kernel Offset: disabled [ 502.778549][ T4195] Rebooting in 86400 seconds..