last executing test programs: 33.638992482s ago: executing program 4 (id=46): socket$kcm(0x11, 0x200000000000002, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000040)={0x18, 0x0, {0x1, @multicast, 'ip6gre0\x00'}}, 0x1e) sendmmsg(r4, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 32.102828725s ago: executing program 4 (id=50): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/225, 0xe1}, {&(0x7f0000001240)=""/106, 0x6a}, {&(0x7f0000000000)=""/149, 0x95}, {&(0x7f00000000c0)=""/60, 0x3c}], 0x4, 0x7, 0x20000000) 32.070594921s ago: executing program 4 (id=51): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() setresuid(0xee01, 0x0, 0x0) setfsuid(0x0) landlock_create_ruleset(0x0, 0x0, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@dev, @empty, @val, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast2, @local}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8906}}}}}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32=r3, @ANYBLOB="200001"], 0x38}}, 0x0) dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)={0x54, r2, 0x113, 0x70bd2c, 0x25dfdbfc, {0x41}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x87}, {0xc, 0x8f, 0xffffffffffffffff}, {0xc}}]}, 0x54}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='net_prio.prioidx\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000001000000000000000000000071180b"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) quotactl_fd$Q_SETQUOTA(r6, 0xffffffff80000800, 0x0, &(0x7f0000000180)={0x8, 0x0, 0x4, 0x0, 0x4, 0x6, 0xa, 0x3, 0xa42c}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000200)={0x200002, 0x202003, 0x7fe, 0x6, 0x7, 0x5}) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) 30.017250972s ago: executing program 4 (id=58): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'bond0\x00', 0x84aebfbd6349b7f2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r5) socketpair(0x1f, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './sys_sec\x00'}, 0x6e) setrlimit(0x0, &(0x7f00000001c0)={0xfffffffffffffffd, 0x5}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000240)='./sys_sec\x00', 0x200000, &(0x7f0000000480)={[{@nombcache}, {@resuid}, {@journal_dev={'journal_dev', 0x3d, 0x4}}, {@user_xattr}]}, 0x3, 0x480, &(0x7f0000000a40)="$eJzs3M9vFFUcAPDvTLsFBGxF/MEPtYrGBrWlgMrBgxpNPGBiogeMp6YtBCnU0JoIIQrG4MkYE+/Go/+CJ70YoxcTr3o3JMT0AnhxzezOtLtld8u2225lP59k4L2dmX3f78683TfzdhtAzxrO/kkidkTEHxExWK3WbzBc/e/mwqXJWwuXJpMol9/+O6lsd2Ph0mSxabHf9rwykkaknyWxr0G7cxcunpmYmZk+n9fH5s9+MDZ34eJzp89OnJo+NX3u8LFjR4+Mv/jC4ecbBz7QXp5ZTDf2fjy7f88b73715vEv6vJflkeHDLda+VS53OHmumtnTTnp72IgtKUvIrLDVar0/8Hoi6WDNxivf9rV4IB1VS6Xy9ubr75cBu5iSdTXdXnoFcUHfXb9WyzLBwEvr9/wo+uuv1K9AMryvpkv1TX9kebblJZd33bScEScuPzPN9kSbd+HaPMmCABARPyQjX+ebTT+S+PBmu3uzeeGhiLivojYFRH3R8TuiHggorLtQxHxcGXPWBw7rWT5JMnt45/02poSXEE2/nspn9uqH/8tZjDUl9d2VvIvJSdPz0wfyl+TkShtyerjLdr48bXfv2y2rnb8ly1Z+8VYMI/jWv+W+n2mJuYn1pJzretXIvb2F7nW5p8szgQkEbEnIvauso3TB7/b32zdyvm30IF5pvK3EU9Xj//lWKjPv5C0np8c2xoz04fGirPidr/8dvWtJs1XXvgTB1eZfwdkx/+ehuf/Yv5DSe187Vz7bVz98/Om1zSrPf8Hkncq5eIK6KOJ+fnz4xEDyfFq0LWPH17at6gX22f5jxxo3P93xdIrsS8ispP4kYh4NCIey2N/PCKeiIgDLfL/+dUn32+4Il3j+d8BWf5TbR3/pcJALH+kcaHvzE/f1zU6tFTM87/V+vgfrZRG8kfu5P3vTuJa3dkMAAAA/z9pROyIJB1dLKfp6Gj1+/K7I9KZ2bn5Z07OfnhuqvobgaEopcWdrsGa+6Hj+WV9tX4lIqpfLSjWH8nvG3/dt61SH52cnZnqdvLQ47Y36f+Zv/q6HR2w7vxeC3qX/g+9q1H/39qFOICN5/MfeleD/r+tG3EAG6/R5/8nrXf5d71iATbWsv5v2g96SPvX/7++ty6BABuuaf+/m//yD1Dh/j/0pLltsfKP5FsWimda5e6bpZBEREefMEqbIq+1F8pJw4MbaVYobYYIFdah0N33JQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgE75LwAA//8YzNth") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r7, &(0x7f0000000100)='select \n', 0xfffffd5b) 26.17549561s ago: executing program 4 (id=86): setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f00000003c0)=[@in6={0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00', 0x7}], 0x1c) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000140)={0x1d}) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b"], 0x88) 25.921152391s ago: executing program 4 (id=92): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = epoll_create1(0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) epoll_ctl$EPOLL_CTL_MOD(r2, 0xfe, r1, &(0x7f0000000080)={0x10000013}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x17, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa1}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_idx={0x18, 0x8, 0x5, 0x0, 0x4}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffe}, @map_val={0x18, 0x5, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x9, 0x56, &(0x7f00000001c0)=""/86, 0x41100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0x3, 0xff, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000002c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff], &(0x7f0000000340)=[{0x4, 0x4, 0xe, 0x8}], 0x10, 0xf}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x4, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x38}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0xb4) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000d00)=r4, 0x4) socket$kcm(0x10, 0x2, 0x0) pipe2$9p(&(0x7f0000000040), 0x80000) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) 25.258392984s ago: executing program 32 (id=92): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = epoll_create1(0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) epoll_ctl$EPOLL_CTL_MOD(r2, 0xfe, r1, &(0x7f0000000080)={0x10000013}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x17, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa1}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_idx={0x18, 0x8, 0x5, 0x0, 0x4}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffe}, @map_val={0x18, 0x5, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x9, 0x56, &(0x7f00000001c0)=""/86, 0x41100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0x3, 0xff, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000002c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff], &(0x7f0000000340)=[{0x4, 0x4, 0xe, 0x8}], 0x10, 0xf}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x4, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x38}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0xb4) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000d00)=r4, 0x4) socket$kcm(0x10, 0x2, 0x0) pipe2$9p(&(0x7f0000000040), 0x80000) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) 2.884000037s ago: executing program 3 (id=300): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x40800) 2.873563925s ago: executing program 5 (id=301): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x2a, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") r0 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000d40)=ANY=[@ANYBLOB="e06c0295dde1d457877dd29b941e237f6fe35c4ae3a2739f051073b9b7127744f969a5fb331384878406e7be238ca9c6a62d6c900d7dc0c2be86c59866b195dec0f60d1eb69cf72ddafdda0baa558cf5db8c6d601f9916f7979ddd08e1cc9572e1cacbf8b017d5ef995c2ec2141c84daf87591e6863716a780c862101d60b7716d5fa2ce7e6d901628123c53c629418b9fb227bb783160fdff3c13da0828248290eb423f06415a961c0e58a3f259f85748150ba4374c94ef8969f8d2b677cdefee17692622ee1a6ad821a9", @ANYRES16, @ANYBLOB="1100000000070000000000000000080001000100000008000300", @ANYRES32=r1], 0x72}}, 0x4000014) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000f00)=ANY=[@ANYRESHEX=r1, @ANYRES16=0x0, @ANYBLOB="020026bd7000fddb04b194ea7eccf9000800", @ANYRES8, @ANYBLOB="050018013a00000008002600501400000800a100070000000800a000460b000005001901070000000400870004006c000800cd00d6000700050019010d00000008009f000500000008002201390000000800a1004802000008009f0002000000080022018b000000080027000100000004006c0004008e0004006c0008009f00000000000800a00003000000"], 0xa8}, 0x1, 0x0, 0x0, 0x8814}, 0xc0d1) socket$igmp(0x2, 0x3, 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x242040, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x2, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffec, 0x4}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x3}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x8}]}}]}, 0x44}}, 0x6000894) r5 = dup(r2) ioctl$BLKRRPART(r5, 0x125f, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x28011, r6, 0x7808b000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$BLKFLSBUF(r5, 0x1261, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) truncate(&(0x7f0000000040)='./file0\x00', 0x40200) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r8, 0x3b88, &(0x7f0000000280)={0xc}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x48032, 0xffffffffffffffff, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$FS_IOC_ENABLE_VERITY(r7, 0x40806685, &(0x7f0000000a80)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.805356425s ago: executing program 3 (id=302): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x21, 0x10, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='syzkaller\x00', 0x8}, 0x94) 2.805016308s ago: executing program 3 (id=303): bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x0, 0x0}, 0x8) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000580)=r0, 0x4) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000780)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x7, [@typedef={0x8, 0x0, 0x0, 0x8, 0x5}, @enum={0x2, 0x5, 0x0, 0x6, 0x4, [{0x0, 0x9}, {0x9, 0x2}, {0xd, 0xffffffff}, {0xb, 0x5}, {0x5, 0x2}]}]}, {0x0, [0x0, 0x0, 0x30, 0x0, 0x2e]}}, &(0x7f0000000700)=""/81, 0x5f, 0x51, 0x0, 0x1}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@bloom_filter={0x1e, 0x6, 0x0, 0x9, 0x200, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x2, 0x3, 0x3, 0x4}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=@base={0x9, 0xafa, 0x40, 0x31, 0x21106, 0xffffffffffffffff, 0x6, '\x00', 0x0, r1, 0x2, 0x0, 0x5}, 0x50) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r6, 0x5760, 0x1) close_range(r5, r6, 0x0) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000d00)='.log\x00', 0x200002, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x4, &(0x7f00000001c0)=@raw=[@cb_func={0x18, 0x6, 0x4, 0x0, 0x4}, @ldst={0x0, 0x0, 0x2, 0x5, 0xb, 0x4, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x15, 0x4, 0x3, 0x0, 0xfffffffffffffffc}], &(0x7f00000009c0)='syzkaller\x00', 0x40, 0x8e, &(0x7f0000000ac0)=""/142, 0x41100, 0x2c, '\x00', 0x0, @fallback=0x34, r2, 0x8, &(0x7f0000000b80)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000bc0)={0x4, 0xb, 0x8, 0x1}, 0x10, r0, 0xffffffffffffffff, 0x0, &(0x7f0000000d40)=[r3, r4, r6, r7], 0x0, 0x10, 0x5}, 0x94) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000900)=@bpf_tracing={0x1a, 0xd, &(0x7f00000007c0)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}], &(0x7f0000000840)='GPL\x00', 0x3ff, 0x7b, &(0x7f0000000880)=""/123, 0x40f00, 0x12, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1bb5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x774}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000014c0)={0x12, 0xc, &(0x7f00000003c0)=ANY=[], &(0x7f0000000a80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3c, '\x00', 0x0, @fallback=0x31, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, r8, 0xa, 0x0, 0x0, 0x0}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000000980)=[{0x0}, {&(0x7f00000006c0)=""/227, 0xe3}], 0x2}, 0x2a45}], 0x1, 0x40000041, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r9, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r9, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x256, 0x10022, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x2a0471a, &(0x7f0000000000), 0x82, 0x4a0, &(0x7f0000000240)="$eJzs3M9rHFUcAPDvTH609mfUqm0tGi1i8EfSpFV78CIoeKgo6KHqKSZpKU0baSKYUtooUi+CFPSsHgX/Am9eBD0Jgie9eZBC0V5axcPK7M60u5tMs4nJbtr9fGC77+2b2XnfffN23r7XSQBdazD7J4nYFhG/RsTOWrZxg8Ha0/Wr5yb+vnpuIolK5fU/k+p2166emyg2LfbbmmeG0oj0oyQ/SKPZ+bMnx6enp87k+ZG5U++OzM6fffrEqfHjU8enTo8dPnzo4Ohzz449syZxZnFd23t+Zt+el9+89MrE0Uvv/PBNVt9teXl9HKvSv/ilwSzwvypVzWWPxV3/63Abzfa6dNLbwYqwIj0RkTVXX9b/K5XKhbqynfHSh3myr2T3rW2oIrBOsmvTprp8cRnLr4sLlVLJLUuB20ESna4B0BnFdT/7/Vs82jwE6agrL9R+AGVxX88ftZLeSPNt+pp+366lwYg4uvDPF9kj1mIeAgBgGZ9MfH4knlpq/JfG/XXb7cjXUAYi4u6IuCci7o2IXRFxX0R12wciYncrB61bIGheGlo8/kkvrz665WXjv+fzta3G8V8x+ouBnjy3vRp/X3LsxPTUgfwzGYq+TVl+9BbH+O7Fnz8tK6sf/2WP7PjFWDCvx+XeTY37TI7PjZfOyK/QlQ8i9vbGv5VKpSn+JIpWSiJiT0TsXdlb76guLkTEiSe+3le20fLx33y7RdZgnanyVcTjtfZfiKb4C8ni9cn+7TfXJ0c2x/TUgZHirFjsx58uvlZ2/NbjXx9Z+29pPP/zki/n88TA2/XrtbNRsnK5rfQYF3/7OPtMNy9Vttrzvz95o/p9VMxXvz8+N3dmNKI/OVLNN7w+dnPfIl9sn8U/tD8rKeIv9kyr33GRt/+DEbEvXy97KCIezuv+SEQ8GhH7S6OP+P0WZRuh/Sfr2j+J5vN/9/nac9H+8ytO9Jz8/tuy45fEX3eKZe1/qJoayl+pfv8to9UKrv6TAwAAgNtHWp25SdLhG+k0HR6u/cfeXbElnZ6ZnXvy2Mx7pydrMzwD0ZcWM1076+ZDR5OF/B1r+bF8rrgoP5jPG3/WE9X88MTM9GSHY4dut7Wk/2f+6Ol07YB1t9Q62tgSN7QBd57m/p82Zi+82s7KAG3lfm3oXsv0/7Rd9QDaz/UfutdS/f9CU95aANyZXP+he+n/0L30f+hetf5/4/7snvilk7UB2mQVt/NLSMzOn410Q1SjpUTrfw9ivRNvbYxqtJDo9DcTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA2vgvAAD//wgr640=") ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x22042, 0x20) ioctl$EXT4_IOC_MOVE_EXT(r10, 0x40305829, &(0x7f0000000080)={0x17c04, 0xffffffffffffffff, 0x9e, 0xfe5f, 0x486, 0xfff}) setsockopt$XDP_TX_RING(r10, 0x11b, 0x3, &(0x7f0000000040)=0x1a0850, 0x4) 2.700475713s ago: executing program 5 (id=304): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x14, r3, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r6, &(0x7f0000000340), &(0x7f00000005c0)=""/140}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000002c0)=r7, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.690208414s ago: executing program 1 (id=305): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0xcc, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x80, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @empty}}}]}]}, @CTA_EXPECT_NAT={0x38, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x36}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}}}}]}, @CTA_EXPECT_NAT_TUPLE={0x4}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 2.627299439s ago: executing program 1 (id=307): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) syz_io_uring_setup(0x131, &(0x7f0000000600)={0x0, 0x800006}, &(0x7f0000ffe000), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r1 = getpid() sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x3000)=nil, 0x1000}) 1.865193711s ago: executing program 3 (id=309): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000480)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x100, 0x2}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r4 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r4, 0x8000012a, 0x3c66, 0x1f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x2, 0x4c, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x15}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1.761650187s ago: executing program 3 (id=311): bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) read$FUSE(r2, &(0x7f00000004c0)={0x2020}, 0x2020) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000080)="c3"}, 0x20) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000040)=@in={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4040054}, 0x24000001) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x420, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r4, 0x4000) 1.713121701s ago: executing program 5 (id=312): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='3', 0x1) 1.621338873s ago: executing program 2 (id=313): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = syz_io_uring_setup(0x787c, &(0x7f0000000240)={0x0, 0x3b82, 0x40, 0x1, 0x222}, &(0x7f00000002c0), &(0x7f00000003c0), &(0x7f0000000400)) syz_io_uring_setup(0x56f5, &(0x7f0000000440)={0x0, 0x817, 0x2, 0x1, 0x2a2, 0x0, r2}, &(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0x1) close_range(r0, r1, 0x0) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r3, &(0x7f0000000000)='3', 0x1) r4 = add_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="90ea4fb2c4ec530a05a513f5d67ea2baf75a063a283e129a28a2b92776248ab60d7adab80cd10a7216f6fc3fe8f1de6b4f70d4b9247788cf4bb62612dd39573bee81b360e44c6f50b15a346893b5b62104457711a5600416667de2b140d913bc5bd54e885aff7a36225a9dcb6bed90c69b9a4b6404ee6cb591d49d26702a40532a0040099c0660c6f4c0523d0634ced95fd446f93a78a9433b69fd0f396b6fe1dff3bd8f39e4166b6c711403139e2d685a99e7b0127a76d5f67fb26077316f200012fc5504", 0xc5, 0xfffffffffffffff9) keyctl$revoke(0x3, r4) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r0, 0x92) 1.619895756s ago: executing program 1 (id=314): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x2a, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") r0 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000d40)=ANY=[@ANYBLOB="e06c0295dde1d457877dd29b941e237f6fe35c4ae3a2739f051073b9b7127744f969a5fb331384878406e7be238ca9c6a62d6c900d7dc0c2be86c59866b195dec0f60d1eb69cf72ddafdda0baa558cf5db8c6d601f9916f7979ddd08e1cc9572e1cacbf8b017d5ef995c2ec2141c84daf87591e6863716a780c862101d60b7716d5fa2ce7e6d901628123c53c629418b9fb227bb783160fdff3c13da0828248290eb423f06415a961c0e58a3f259f85748150ba4374c94ef8969f8d2b677cdefee17692622ee1a6ad821a9", @ANYRES16, @ANYBLOB="1100000000070000000000000000080001000100000008000300", @ANYRES32=r1], 0x72}}, 0x4000014) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000f00)=ANY=[@ANYRESHEX=r1, @ANYRES16=0x0, @ANYBLOB="020026bd7000fddb04b194ea7eccf9000800", @ANYRES8, @ANYBLOB="050018013a00000008002600501400000800a100070000000800a000460b000005001901070000000400870004006c000800cd00d6000700050019010d00000008009f000500000008002201390000000800a1004802000008009f0002000000080022018b000000080027000100000004006c0004008e0004006c0008009f00000000000800a00003000000"], 0xa8}, 0x1, 0x0, 0x0, 0x8814}, 0xc0d1) socket$igmp(0x2, 0x3, 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x242040, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x2, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffec, 0x4}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x3}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x8}]}}]}, 0x44}}, 0x6000894) r5 = dup(r2) ioctl$BLKRRPART(r5, 0x125f, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x28011, r6, 0x7808b000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$BLKFLSBUF(r5, 0x1261, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) truncate(&(0x7f0000000040)='./file0\x00', 0x40200) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r8, 0x3b88, &(0x7f0000000280)={0xc}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x48032, 0xffffffffffffffff, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$FS_IOC_ENABLE_VERITY(r7, 0x40806685, &(0x7f0000000a80)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.516014078s ago: executing program 5 (id=315): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x14, r3, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r6, &(0x7f0000000340), &(0x7f00000005c0)=""/140}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000002c0)=r7, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.438942605s ago: executing program 2 (id=316): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0xff7, &(0x7f0000001e00)=""/4087}, 0x94) (fail_nth: 8) 1.423845795s ago: executing program 1 (id=317): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000080)={r1, 0x1, 0x6, @multicast}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r3) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000005c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYRESOCT], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015000100fdffffff00d6000002080300", @ANYRES32=r1, @ANYBLOB="140003007665746830000000000000000000000008000100"], 0x34}}, 0x0) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0\x00'}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000080)={r1, 0x1, 0x6, @multicast}, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r3) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000005c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYRESOCT], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) (async) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015000100fdffffff00d6000002080300", @ANYRES32=r1, @ANYBLOB="140003007665746830000000000000000000000008000100"], 0x34}}, 0x0) (async) 1.422421262s ago: executing program 0 (id=318): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./mnt\x00', &(0x7f0000001080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./mnt/events/cdns3/cdns3_ep0_queue/format\x00', 0x0, 0x0) read(r3, &(0x7f0000001100)=""/4096, 0x1000) close(r3) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000740)=ANY=[@ANYBLOB="d8010000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="bc01330080000000ffffffffffff080211000000f7ab87594b3f00000000000801000100dd7118aae49bd5937bad5fda023b2a5a78c05782f92fe27196352514ed223d61c8fc17d2692f2a2eecd8d55db037f220440957ec558232ad7346e19d0ffba41dae1bdf25fc38ceb7a7a77ac466c2bb6feb8de070b227826541a0d118d508fc18f3cc6f5f98db435cd2d27a5c0ce49292e72bb2dd32681a1a58e3ff43cdadc26f69deb1ef3ede9aec85a6554b2c7cd5af891f933549794b8d0f911ffdaed3ba6833441f94f5721cddaf7e6127b1f68192b4d5902dd5c215d8df43165c4061282fcbe5430fdf2448206d0e1561b338289d64b802476bd7d66916ec22a9ba727a7235efa7d79790006ecf9f6cf9dcdddfd6fc6d331c49964061c06dde5fba9c6d0c3e70ab41f94363dfcae6a3094be521aaeb94d767d83c334beb6c7fb826e4445bc76956fa8925f927e16204df31acbbd681b6d593a68b3b3756ff8a78ffb7134aff566b"], 0x1d8}, 0x1, 0x0, 0x0, 0x805}, 0x0) 1.325086592s ago: executing program 2 (id=319): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="36a4d19750a6d4f0b9958455df1d6d9d6a4e4f2d4ec6d116f65d7e13b90c4bda32d512ce3bffa21ccacc8ca0562b7237ca0ba740ea2fe0af8b031efe8d07ba0e46e575e5f6029edb779bcc02186ceb3771bd6d6af96d5dd9ab934241ee38917a47c271e92d385f45", @ANYRESHEX, @ANYRES16], 0x128}, 0x4000000) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0x0}}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r3], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0x8, r5}, 0x38) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000100)={0x1f, 0x1}, 0x6) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000d00000000000000010000001833000005008e184bafdfae4ff75f8862b16ccd5dff0050c9d432fe97c8609400000000000000000095000000000000009d0a9f3c88b73c545d10eaae21239187db63b6b9d9ee3c9877a53c2a84b0e83f0be0"], &(0x7f0000000000)='GPL\x00', 0x5, 0x1005, &(0x7f0000001500)=""/4101, 0x40f00, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x2, 0xdab, 0x0, 0x0, 0x1000, 0x80, r2, 0x0, 0x65}}}, &(0x7f0000000300)) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r11) 1.322778328s ago: executing program 0 (id=320): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x14, 0x0, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x1, @multicast, 'ip6gre0\x00'}}, 0x1e) sendmmsg(r3, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 966.94485ms ago: executing program 1 (id=321): set_mempolicy(0x2, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) (fail_nth: 1) 707.321818ms ago: executing program 3 (id=322): bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f00000004c0), 0x48, 0x820b, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x1b, 0x5, 0x490, 0xf0, 0x0, 0xffffffff, 0xf0, 0xf0, 0x3e8, 0x3e8, 0xffffffff, 0x3e8, 0x3e8, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x1d, @ipv6=@loopback, @ipv6=@remote, @gre_key=0x4, @icmp_id=0x67}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x5, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @port=0x4e20, @port=0x4e21}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv6=@private2, @ipv6=@ipv4={'\x00', '\xff\xff', @loopback}, @port=0x4e22, @icmp_id=0x66}}}, {{@ipv6={@loopback, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xff000000, 0x0, 0xff], [0xff, 0xff], 'bond_slave_0\x00', 'ip6_vti0\x00', {}, {}, 0x3b, 0xff, 0x6, 0x2c}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0xc, @ipv6=@dev={0xfe, 0x80, '\x00', 0x15}, @ipv6=@mcast2, @icmp_id=0x64, @gre_key=0xfbff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x15, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x240008c0}, 0x800) sendto$inet6(r0, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = socket(0x40000000015, 0x5, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="e64f2be8d3e7a2aa", 0x8) sendmsg$nl_route(r1, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c0000002200000128bd7000fddbdf25028014108100020418000000"], 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x81) r6 = accept4$alg(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f000001a540)=[{&(0x7f0000000100)="67108e1744", 0x5}, {&(0x7f000001a240)="00689775", 0xfeb7}], 0x2, 0x0, 0x0, 0x1}], 0x1, 0x24044080) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e23, @loopback}, 0x10) 593.154879ms ago: executing program 1 (id=323): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x12, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) socket$inet6(0xa, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001800)=ANY=[@ANYBLOB="bc0000001500010027bd7000fedbdf25fc010000000000000000000000000001200100000000000000000000000000004e2300064e2300050200002023000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="b96b6e000100000008001f00010000000a0010000000000000f8ffff4f001100fc0100000000000000000000000000007f000001000000000000000000000000fc0100000000000000000000000000010a0101010000000000000000000000006c0000000135000002000a00080016000900000023802928af2c896aa788700c77ca1d2ff8408a0dd2a98943ce980b40ea9d9c70dcad437160cfd5b128b77294831253587d930a695370cbb672ca25b52b0e51aed9"], 0xbc}, 0x1, 0x0, 0x0, 0x8881}, 0x4000) sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f0000003d00)=[{{&(0x7f0000000300)=@l2, 0x80, &(0x7f0000001480)=[{&(0x7f0000000380)=""/21, 0x15}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/187, 0xbb}], 0x3, &(0x7f00000014c0)=""/95, 0x5f}, 0x5}, {{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000017c0)=""/28, 0x1c}, {&(0x7f0000001540)=""/201, 0xc9}, {&(0x7f0000001640)=""/72, 0xb}, {&(0x7f00000016c0)=""/188, 0xbc}], 0x4, &(0x7f0000003940)=""/133, 0x85}, 0x2}, {{&(0x7f0000003a00)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x80, &(0x7f0000003c00)=[{&(0x7f0000003a80)=""/18, 0x12}, {&(0x7f0000003dc0)=""/168, 0xa8}, {&(0x7f0000003b80)=""/77, 0x4d}], 0x3, &(0x7f0000003c40)=""/153, 0x99}, 0x6}], 0x3, 0x12101, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_ethernet(0x7e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd60fb6809001b2f00fc020000000000000000000000000000ff020000000000000000000000000001242088a88dff00000006000000000800000086dd88a888"], 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000240), 0x35c, 0x0) unshare(0x64000600) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) recvmmsg(r0, &(0x7f00000063c0)=[{{0x0, 0x0, 0x0}, 0x10}, {{0x0, 0x0, 0x0}, 0x22}], 0x2, 0x120, 0x0) shutdown(r0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) 325.312245ms ago: executing program 2 (id=324): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r1 = getpid() sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x3000)=nil, 0x1000}) 322.89624ms ago: executing program 5 (id=325): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x802, 0x0) mmap$fb(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3, 0x11, r0, 0x4e000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xd40c, 0x1000, 0x40002, 0xee}, &(0x7f0000000480), &(0x7f0000000040), &(0x7f00000001c0)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x80000, 0x2, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7396, 0x4, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x727b, 0x80, 0xffffffff, 0x24f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x200, 0x6, 0xffffffff}}], 0x1, 0x0, 0x0) 192.478313ms ago: executing program 5 (id=326): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') setns(r1, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0x4) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8b04, &(0x7f0000000040)={'virt_wifi0\x00', @link_local}) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0)="3066f9238255f82748367dc1d36b666707310000000000000000000000007a7ce0c3d4648f31276ce525e0522ba98aae0bd4e69a79f08fed0a60c6740e4d09d9fa3db1a5d66e0bf9c5a61454054f7828b963aad2694e77c765d0a808835ebc64de5272c2a4dd5f1f489b6f24ea3a16a742d88089e995eea07898de5d0d912795462a447d4c23a9727640334970693f9d8ce9becb6c88adb21c7c0133d5ccd858980228cfe88ec3d80c001ae9c4fa6561ca9f79b88b115f80ec8760b4da1efc9d960fddcbcc8adfcec454370263d23fb53994ea5444f626", 0xd7) socket(0x10, 0x803, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xb}, {}, {0xfff2, 0xf}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@gettfilter={0x2c, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}, {0xc}}, [{0x8, 0xb, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 192.005975ms ago: executing program 0 (id=327): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e1f1b"], 0x22) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000180)={[{@nodiscard}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000ffff00d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_setup(0x34b9, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) r3 = syz_io_uring_setup(0x6e68, &(0x7f0000000400)={0x0, 0xf604, 0x10000, 0x0, 0x128}, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x20, r2, 0x0, &(0x7f0000000d40)={0x0, 0x0, 0x0}, 0x2, 0x48000, 0x1, {0x2}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @adiantum, 0x0, '\x00', @a}) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084000000060005"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 191.266603ms ago: executing program 2 (id=328): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x2a, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") r0 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000d40)=ANY=[@ANYBLOB="e06c0295dde1d457877dd29b941e237f6fe35c4ae3a2739f051073b9b7127744f969a5fb331384878406e7be238ca9c6a62d6c900d7dc0c2be86c59866b195dec0f60d1eb69cf72ddafdda0baa558cf5db8c6d601f9916f7979ddd08e1cc9572e1cacbf8b017d5ef995c2ec2141c84daf87591e6863716a780c862101d60b7716d5fa2ce7e6d901628123c53c629418b9fb227bb783160fdff3c13da0828248290eb423f06415a961c0e58a3f259f85748150ba4374c94ef8969f8d2b677cdefee17692622ee1a6ad821a9", @ANYRES16, @ANYBLOB="1100000000070000000000000000080001000100000008000300", @ANYRES32=r1], 0x72}}, 0x4000014) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000f00)=ANY=[@ANYRESHEX=r1, @ANYRES16=0x0, @ANYBLOB="020026bd7000fddb04b194ea7eccf9000800", @ANYRES8, @ANYBLOB="050018013a00000008002600501400000800a100070000000800a000460b000005001901070000000400870004006c000800cd00d6000700050019010d00000008009f000500000008002201390000000800a1004802000008009f0002000000080022018b000000080027000100000004006c0004008e0004006c0008009f00000000000800a00003000000"], 0xa8}, 0x1, 0x0, 0x0, 0x8814}, 0xc0d1) socket$igmp(0x2, 0x3, 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x242040, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x2, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffec, 0x4}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x3}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x8}]}}]}, 0x44}}, 0x6000894) r5 = dup(r2) ioctl$BLKRRPART(r5, 0x125f, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x28011, r6, 0x7808b000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$BLKFLSBUF(r5, 0x1261, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) truncate(&(0x7f0000000040)='./file0\x00', 0x40200) ioctl$IOMMU_GET_HW_INFO(r7, 0x3b8a, &(0x7f0000000b40)={0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000280)={0xc}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x48032, 0xffffffffffffffff, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$FS_IOC_ENABLE_VERITY(r7, 0x40806685, &(0x7f0000000a80)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) 120.632582ms ago: executing program 0 (id=329): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @multicast2}, 0x10) listen(r0, 0x6) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x4000, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x33, 0x1, 0x2, 0x25dfdbfd, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x40) (async) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x0, 0x4b1}, 0x8) (async) ioctl$BTRFS_IOC_INO_LOOKUP(r2, 0xd0009412, &(0x7f0000000740)) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) (async) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000400)={@remote, @multicast2, 0x0}, &(0x7f0000000440)=0xc) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r5, 0x80000800, 0x0, &(0x7f0000000100)={0x1000, 0x1000, 0x1000, 0x1000, 0x1000, 0x1000, 0x1000, 0x1000, 0x3f}) quotactl_fd$Q_SYNC(r5, 0x80000100, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={0x1, 0xffffffffffffffff}, 0x4) (async) r7 = syz_open_dev$vcsu(&(0x7f0000000500), 0x4, 0x200001) (async) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000540), 0x1530c0, 0x0) (async) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x17, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x4}, [@exit, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x1}]}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r4, 0x0, r5, 0x8, &(0x7f0000000480)={0x6, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[r6, r7, r8, r9], 0x0, 0x10, 0x7}, 0x94) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x2, 0x9}, 0x8) 51.116262ms ago: executing program 0 (id=330): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c00078008000640"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="74000000090601020000000000000008030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 50.588635ms ago: executing program 2 (id=331): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000000)={0x0, 0x0}, 0x10) getsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000001f4c000000060a0b160000000000d7fac1be88a8031b0044801c000180090001006d617371000000000c00028008000240000000000900010073797a30e0411090000000000900020073797a32000000000011000100"/116], 0x74}, 0x1, 0x0, 0x0, 0x850}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x3, 0x0, 0x9}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/net/ipv6/conf/all/keep_addr_on_down\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)='1\n\x00', 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_newaddr={0x34, 0x14, 0x401, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x34}}, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r7, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0) r8 = socket(0x15, 0x5, 0x0) getsockopt(r8, 0x200000000114, 0x2711, 0x0, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000200)={'lo\x00'}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) mount(0x0, &(0x7f0000000100)='./sys_dbg\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys_dbg/bus/usb/devices/usb5/authorized_default\x00', 0x1, 0x0) 0s ago: executing program 0 (id=332): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)="31e4", 0x2) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_pts(r1, 0x101001) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000280)={0x401, 0x3}) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000340)={0x0, 0x1, 0x8, 0x11, 0x200, &(0x7f0000000d80)="1ae19327aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a730900000000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c536689a4a62f872f9ca3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d228186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f91ffffffffd51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6ece06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a2a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0600000000000000a1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe021c773a6664b66ae04aa62c564d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000004000000000f800"}) r3 = syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x1000, &(0x7f0000000080)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x75f}}, {@max_read={'max_read', 0x3d, 0x4}}, {@default_permissions}, {@default_permissions}, {@allow_other}], [{@fowner_lt}, {@smackfsdef={'smackfsdef', 0x3d, '{+@&-@/):.@}(\"\xa4@!-'}}, {@dont_appraise}]}}, 0x0, 0x0, &(0x7f00000001c0)="1a8085f485cdaffefd473446c75e816d272f3c56978f07d801d8a9784111a3815ecd7a0a1ed8af488c0d7c67d9361d48d6ed7c398ba849175fb9c795176be918c32d830c1a9f9ef1f6351c068e6ff31718987082a2c547d6741a93") mkdirat(r3, &(0x7f0000000240)='./file0\x00', 0x14f) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. [ 28.664406][ T4703] cgroup: Unknown subsys name 'net' [ 28.814464][ T4703] cgroup: Unknown subsys name 'cpuset' [ 28.816539][ T4703] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.974681][ T4703] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.743481][ T4722] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.745407][ T4725] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.746534][ T4726] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.747048][ T4726] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.747256][ T4726] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.747473][ T4726] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.747812][ T4726] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.748033][ T4726] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.748765][ T4726] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.749870][ T4726] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.755093][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.755597][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.755766][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.756090][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.756297][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.756724][ T4726] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.766641][ T4725] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.768349][ T4725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.770522][ T4716] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.772155][ T4716] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.780695][ T4716] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.782395][ T4716] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.787507][ T4717] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.796503][ T4716] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.798266][ T4716] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.094525][ T4727] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.094740][ T4727] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.094805][ T4727] bridge_slave_0: entered allmulticast mode [ 30.095599][ T4727] bridge_slave_0: entered promiscuous mode [ 30.096858][ T4727] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.096909][ T4727] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.096998][ T4727] bridge_slave_1: entered allmulticast mode [ 30.097401][ T4727] bridge_slave_1: entered promiscuous mode [ 30.104724][ T4727] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.106019][ T4727] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.125606][ T4727] team0: Port device team_slave_0 added [ 30.126435][ T4727] team0: Port device team_slave_1 added [ 30.158112][ T4727] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.158138][ T4727] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.158165][ T4727] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.159319][ T4727] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.159328][ T4727] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.159340][ T4727] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.214860][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.216487][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.217208][ T4714] bridge_slave_0: entered allmulticast mode [ 30.217643][ T4714] bridge_slave_0: entered promiscuous mode [ 30.228466][ T4727] hsr_slave_0: entered promiscuous mode [ 30.228833][ T4727] hsr_slave_1: entered promiscuous mode [ 30.229224][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.229483][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.229535][ T4714] bridge_slave_1: entered allmulticast mode [ 30.230012][ T4714] bridge_slave_1: entered promiscuous mode [ 30.244449][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.244520][ T4721] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.244571][ T4721] bridge_slave_0: entered allmulticast mode [ 30.244985][ T4721] bridge_slave_0: entered promiscuous mode [ 30.246052][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.246074][ T4721] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.246119][ T4721] bridge_slave_1: entered allmulticast mode [ 30.246557][ T4721] bridge_slave_1: entered promiscuous mode [ 30.253851][ T4721] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.254700][ T4721] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.263751][ T4721] team0: Port device team_slave_0 added [ 30.269946][ T4715] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.269994][ T4715] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.270054][ T4715] bridge_slave_0: entered allmulticast mode [ 30.270870][ T4715] bridge_slave_0: entered promiscuous mode [ 30.271994][ T4715] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.272046][ T4715] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.272135][ T4715] bridge_slave_1: entered allmulticast mode [ 30.272542][ T4715] bridge_slave_1: entered promiscuous mode [ 30.279614][ T4715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.282435][ T4714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.283637][ T4721] team0: Port device team_slave_1 added [ 30.284495][ T4714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.288013][ T4715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.288473][ T4724] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.288973][ T4724] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.289064][ T4724] bridge_slave_0: entered allmulticast mode [ 30.289472][ T4724] bridge_slave_0: entered promiscuous mode [ 30.290680][ T4724] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.290699][ T4724] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.290787][ T4724] bridge_slave_1: entered allmulticast mode [ 30.291184][ T4724] bridge_slave_1: entered promiscuous mode [ 30.317357][ T4714] team0: Port device team_slave_0 added [ 30.322006][ T4714] team0: Port device team_slave_1 added [ 30.323958][ T4715] team0: Port device team_slave_0 added [ 30.324743][ T4715] team0: Port device team_slave_1 added [ 30.327712][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.328992][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.333040][ T4721] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.333615][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.333623][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.333635][ T4721] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.346337][ T4724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.351597][ T4724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.366229][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.367639][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.367677][ T4714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.368289][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.368299][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.368309][ T4715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.368884][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.368891][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.368900][ T4715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.370636][ T4721] hsr_slave_0: entered promiscuous mode [ 30.370953][ T4721] hsr_slave_1: entered promiscuous mode [ 30.371158][ T4721] debugfs: 'hsr0' already exists in 'hsr' [ 30.371192][ T4721] Cannot create hsr debugfs directory [ 30.380090][ T4724] team0: Port device team_slave_0 added [ 30.380344][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.380350][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.380363][ T4714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.387167][ T4724] team0: Port device team_slave_1 added [ 30.418832][ T4724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.418864][ T4724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.418877][ T4724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.419474][ T4724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.419481][ T4724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.419493][ T4724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.429943][ T4714] hsr_slave_0: entered promiscuous mode [ 30.430259][ T4714] hsr_slave_1: entered promiscuous mode [ 30.430579][ T4714] debugfs: 'hsr0' already exists in 'hsr' [ 30.430591][ T4714] Cannot create hsr debugfs directory [ 30.435703][ T4715] hsr_slave_0: entered promiscuous mode [ 30.436003][ T4715] hsr_slave_1: entered promiscuous mode [ 30.436227][ T4715] debugfs: 'hsr0' already exists in 'hsr' [ 30.436236][ T4715] Cannot create hsr debugfs directory [ 30.447679][ T4724] hsr_slave_0: entered promiscuous mode [ 30.448026][ T4724] hsr_slave_1: entered promiscuous mode [ 30.448223][ T4724] debugfs: 'hsr0' already exists in 'hsr' [ 30.448232][ T4724] Cannot create hsr debugfs directory [ 30.545569][ T4727] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.548426][ T4727] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.549537][ T4727] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.551461][ T4727] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.560750][ T4727] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.563677][ T4727] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.571510][ T4727] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.574423][ T4727] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.592408][ T4721] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.595775][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.597469][ T4721] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.599688][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.602060][ T4721] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.604740][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.606695][ T4721] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.608936][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.615511][ T4727] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.615568][ T4727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.615729][ T4727] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.615768][ T4727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.630951][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.630997][ T4721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.631063][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.631091][ T4721] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.649839][ T4715] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.652097][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.653376][ T4715] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.654438][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.658396][ T4715] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.660595][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.672714][ T4714] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.676473][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.678583][ T4714] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.680965][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.682627][ T4715] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.685083][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.688280][ T4721] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.690484][ T4714] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.692802][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.693786][ T4714] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.695054][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.701308][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.703616][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.708543][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.710107][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.729936][ T4727] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.738688][ T4721] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.748732][ T4724] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.751110][ T4724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.751415][ T4724] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.753527][ T4724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.756000][ T1957] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.756052][ T1957] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.757664][ T4727] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.763720][ T4724] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.765984][ T4724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.767795][ T4724] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.770330][ T4724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.772890][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.772928][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.773530][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.773556][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.773905][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.773926][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.798257][ T4721] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.798284][ T4721] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.812382][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.825771][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.828523][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.828567][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.848333][ T1172] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.848379][ T1172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.879594][ T4715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.883584][ T4724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.907847][ T4724] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.924408][ T4715] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.930264][ T1923] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.930310][ T1923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.940348][ T1923] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.940394][ T1923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.940761][ T1923] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.940779][ T1923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.955290][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.955337][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.962419][ T4715] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.962799][ T4715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.971728][ T4724] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.979223][ T4724] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.008046][ T4721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.036870][ T4721] veth0_vlan: entered promiscuous mode [ 31.040082][ T4721] veth1_vlan: entered promiscuous mode [ 31.060031][ T4721] veth0_macvtap: entered promiscuous mode [ 31.065634][ T4721] veth1_macvtap: entered promiscuous mode [ 31.076229][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.081889][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.117177][ T4727] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.155079][ T1906] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.155242][ T1906] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.155250][ T1906] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.156045][ T1172] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.156777][ T1172] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.156872][ T1172] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.186407][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.186442][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.214288][ T4715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.221533][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.232119][ T4721] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.263795][ T4715] veth0_vlan: entered promiscuous mode [ 31.268859][ T4893] loop0: detected capacity change from 0 to 512 [ 31.286339][ T4893] EXT4-fs (loop0): couldn't mount as ext3 due to feature incompatibilities [ 31.288359][ T4715] veth1_vlan: entered promiscuous mode [ 31.290788][ T4727] veth0_vlan: entered promiscuous mode [ 31.292212][ T4714] veth0_vlan: entered promiscuous mode [ 31.295972][ T4714] veth1_vlan: entered promiscuous mode [ 31.299575][ T4727] veth1_vlan: entered promiscuous mode [ 31.308062][ T4727] veth0_macvtap: entered promiscuous mode [ 31.310396][ T4727] veth1_macvtap: entered promiscuous mode [ 31.316819][ T4727] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.340049][ T4724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.344757][ T4727] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.359920][ T4715] veth0_macvtap: entered promiscuous mode [ 31.378696][ T4714] veth0_macvtap: entered promiscuous mode [ 31.380093][ T4715] veth1_macvtap: entered promiscuous mode [ 31.384376][ T1906] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.385030][ T1906] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.388287][ T4714] veth1_macvtap: entered promiscuous mode [ 31.392213][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.393607][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.406766][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.417280][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.420337][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.420383][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.420404][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.420904][ T4724] veth0_vlan: entered promiscuous mode [ 31.422216][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.439927][ T4724] veth1_vlan: entered promiscuous mode [ 31.836885][ T4898] overlayfs: missing 'lowerdir' [ 31.837718][ T4716] Bluetooth: hci4: command tx timeout [ 31.859758][ T4719] Bluetooth: hci2: command tx timeout [ 31.860005][ T4719] Bluetooth: hci1: command tx timeout [ 31.860212][ T4719] Bluetooth: hci0: command tx timeout [ 31.861172][ T4716] Bluetooth: hci3: command tx timeout [ 32.376959][ T1172] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.382376][ T40] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.416278][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.416315][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.446822][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.446867][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.463534][ T1906] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.463582][ T1906] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.463613][ T1906] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.463634][ T1906] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.490052][ T4724] veth0_macvtap: entered promiscuous mode [ 32.490644][ T1906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.490653][ T1906] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.507717][ T4724] veth1_macvtap: entered promiscuous mode [ 32.539026][ T4724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.540101][ T4724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.547753][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.547777][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.548336][ T4902] capability: warning: `syz.0.6' uses deprecated v2 capabilities in a way that may be insecure [ 32.554552][ T1957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.554579][ T1957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.610573][ T1957] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.610607][ T1957] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.619685][ T4902] loop0: detected capacity change from 0 to 512 [ 32.624262][ T4902] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 32.627210][ T4902] EXT4-fs (loop0): group descriptors corrupted! [ 32.686051][ T4906] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5'. [ 32.693032][ T1957] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.695431][ T1172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.695463][ T1172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.695569][ T1172] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.700780][ T1957] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.702251][ T1957] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.704315][ T1957] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.707975][ T1957] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.710576][ T4906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.710801][ T4906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.724411][ T4906] warning: `syz.4.5' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 32.979721][ T4911] loop1: detected capacity change from 0 to 2048 [ 33.018294][ T4911] loop1: p1 < > p4 [ 33.018294][ T4911] p4: [ 33.023712][ T4911] loop1: p4 size 722688 extends beyond EOD, truncated [ 33.071101][ T4920] netlink: 'syz.1.8': attribute type 1 has an invalid length. [ 33.161799][ T4707] udevd[4707]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 33.189006][ T4708] udevd[4708]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 33.547844][ T4918] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7'. [ 33.550576][ T4928] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10'. [ 33.707261][ T4934] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11'. [ 33.853127][ T4717] Bluetooth: hci4: command tx timeout [ 33.925021][ T4938] loop0: detected capacity change from 0 to 1024 [ 33.927346][ T4938] ======================================================= [ 33.927346][ T4938] WARNING: The mand mount option has been deprecated and [ 33.927346][ T4938] and is ignored by this kernel. Remove the mand [ 33.927346][ T4938] option from the mount to silence this warning. [ 33.927346][ T4938] ======================================================= [ 33.934721][ T4716] Bluetooth: hci0: command tx timeout [ 33.934746][ T4716] Bluetooth: hci1: command tx timeout [ 33.934761][ T4716] Bluetooth: hci2: command tx timeout [ 33.934841][ T4717] Bluetooth: hci3: command tx timeout [ 33.940540][ T4938] EXT4-fs (loop0): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 33.957703][ T4938] EXT4-fs error (device loop0): ext4_map_blocks:791: inode #3: block 2: comm syz.0.13: lblock 2 mapped to illegal pblock 2 (length 1) [ 33.960241][ T4938] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 33.961700][ T4938] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 33.961810][ T4938] EXT4-fs error (device loop0): ext4_map_blocks:791: inode #3: block 48: comm syz.0.13: lblock 0 mapped to illegal pblock 48 (length 1) [ 33.961831][ T4938] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 33.968028][ T4938] Quota error (device loop0): v2_write_file_info: Can't write info structure [ 33.968042][ T4938] EXT4-fs error (device loop0): ext4_acquire_dquot:7041: comm syz.0.13: Failed to acquire dquot type 0 [ 33.968141][ T4938] loop0: lost filesystem error report for type 5 error -117 [ 33.972986][ C0] EXT4-fs (loop0): error count since last fsck: 3 [ 33.973005][ C0] EXT4-fs (loop0): initial error at time 33: ext4_map_blocks:791: inode 3: block 2 [ 33.973024][ C0] EXT4-fs (loop0): last error at time 33: ext4_acquire_dquot:7041 [ 33.981638][ T4938] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 33.981659][ T4938] loop0: lost filesystem error report for type 5 error -117 [ 33.990925][ T4938] EXT4-fs error (device loop0): ext4_evict_inode:267: inode #11: comm syz.0.13: mark_inode_dirty error [ 33.997018][ T4938] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 34.000142][ T4938] EXT4-fs warning (device loop0): ext4_evict_inode:270: couldn't mark inode dirty (err -117) [ 34.000264][ T4938] EXT4-fs (loop0): 1 orphan inode deleted [ 34.000765][ T4938] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.007186][ T4945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15'. [ 34.076314][ T4949] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 34.110298][ T1923] EXT4-fs error (device loop0): ext4_map_blocks:791: inode #3: block 1: comm kworker/u8:7: lblock 1 mapped to illegal pblock 1 (length 1) [ 34.112390][ T1923] Quota error (device loop0): remove_tree: Can't read quota data block 1 [ 34.112412][ T1923] EXT4-fs error (device loop0): ext4_release_dquot:7077: comm kworker/u8:7: Failed to release dquot type 0 [ 34.117812][ T4938] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.120021][ T4815] wiimote 0005:057E:0306.0001: hidraw0: BLUETOOTH HID v0.03 Gamepad [sy®>d÷}ç³N] on syz0 [ 34.122108][ T4815] wiimote 0005:057E:0306.0001: New device registered [ 34.127737][ T4938] EXT4-fs error (device loop0): __ext4_get_inode_loc:4886: comm syz.0.13: Invalid inode table block 1 in block_group 0 [ 34.127772][ T4938] loop0: lost filesystem error report for type 5 error -117 [ 34.130612][ T4938] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 34.130648][ T4938] loop0: lost filesystem error report for type 5 error -117 [ 34.130925][ T4938] EXT4-fs error (device loop0): ext4_quota_off:7325: inode #3: comm syz.0.13: mark_inode_dirty error [ 34.130957][ T4938] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 34.961605][ T4946] wiimote 0005:057E:0306.0001: Device removed [ 35.137122][ T4815] wiimote 0005:057E:0306.0001: detected device: Nintendo Wii Remote (Gen 1) [ 35.440611][ T4952] fido_id[4952]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 35.571735][ T4815] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input4 [ 35.605384][ T4815] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input5 [ 35.611695][ T4815] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input3 [ 35.933589][ T4717] Bluetooth: hci4: command tx timeout [ 36.014433][ T4719] Bluetooth: hci2: command tx timeout [ 36.014472][ T4719] Bluetooth: hci1: command tx timeout [ 36.014500][ T4719] Bluetooth: hci0: command tx timeout [ 36.017630][ T4717] Bluetooth: hci3: command tx timeout [ 36.028912][ T4971] netlink: 28 bytes leftover after parsing attributes in process `syz.1.23'. [ 36.041026][ T4971] netlink: 'syz.1.23': attribute type 2 has an invalid length. [ 36.041063][ T4971] netlink: 4 bytes leftover after parsing attributes in process `syz.1.23'. [ 36.048453][ T4981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.24'. [ 36.076862][ T4969] binder: 4968:4969 got transaction to invalid handle, 3 [ 36.076904][ T4969] binder: 4968:4969 cannot find target node [ 36.076933][ T4969] binder: 4968:4969 transaction call to 0:0 failed 2/29201/-22, code 0 size 0-0 line 3252 [ 36.093456][ T4900] binder: undelivered TRANSACTION_ERROR: 29201 [ 36.328725][ T4996] netlink: 28 bytes leftover after parsing attributes in process `syz.4.28'. [ 36.328761][ T4996] netlink: 28 bytes leftover after parsing attributes in process `syz.4.28'. [ 36.518990][ T5003] loop0: detected capacity change from 0 to 8 [ 36.879405][ T4981] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 36.879532][ T4981] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 36.888700][ T4981] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 36.892129][ T4981] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 36.892781][ T4981] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 36.897644][ T4981] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 36.899835][ T4981] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 36.899921][ T4981] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 36.904703][ T4981] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 36.908441][ T4981] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 36.910268][ T4981] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 36.912054][ T5007] FAULT_INJECTION: forcing a failure. [ 36.912054][ T5007] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 36.912504][ T5007] CPU: 1 UID: 0 PID: 5007 Comm: syz.1.33 Not tainted syzkaller #0 PREEMPT [ 36.912521][ T5007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 36.912527][ T5007] Call trace: [ 36.912530][ T5007] show_stack+0x2c/0x3c (C) [ 36.912550][ T5007] __dump_stack+0x30/0x40 [ 36.912562][ T5007] dump_stack_lvl+0xd8/0x12c [ 36.912573][ T5007] dump_stack+0x1c/0x28 [ 36.912582][ T5007] should_fail_ex+0x41c/0x590 [ 36.912590][ T5007] should_fail+0x14/0x24 [ 36.912597][ T5007] should_fail_usercopy+0x20/0x30 [ 36.912604][ T5007] _inline_copy_from_user+0x3c/0x174 [ 36.912612][ T5007] kstrtouint_from_user+0xcc/0x174 [ 36.912620][ T5007] proc_fail_nth_write+0x9c/0x234 [ 36.912629][ T5007] vfs_write+0x2a4/0xa0c [ 36.912636][ T5007] ksys_write+0x12c/0x228 [ 36.912643][ T5007] __arm64_sys_write+0x84/0x98 [ 36.912650][ T5007] invoke_syscall+0x98/0x244 [ 36.912660][ T5007] el0_svc_common+0xec/0x23c [ 36.912669][ T5007] do_el0_svc+0x4c/0x5c [ 36.912679][ T5007] el0_svc+0x64/0x260 [ 36.912688][ T5007] el0t_64_sync_handler+0x44/0x104 [ 36.912696][ T5007] el0t_64_sync+0x198/0x19c [ 36.925641][ T4981] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 36.939014][ T4981] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 36.940671][ T4981] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 36.945807][ T4981] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 36.947443][ T5009] loop1: detected capacity change from 0 to 512 [ 36.949436][ T5009] EXT4-fs: Ignoring removed nomblk_io_submit option [ 36.952132][ T5009] EXT4-fs: Ignoring removed nomblk_io_submit option [ 36.953969][ T5009] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 36.962297][ T5009] EXT4-fs (loop1): 1 truncate cleaned up [ 36.973856][ T5009] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.001872][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.075394][ T5018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.077163][ T5018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.172234][ T5016] loop1: detected capacity change from 0 to 1024 [ 37.189503][ T5016] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 37.203488][ T5016] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #3: block 2: comm syz.1.36: lblock 2 mapped to illegal pblock 2 (length 1) [ 37.203532][ T5016] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 37.206562][ T5016] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 37.206596][ T5016] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #3: block 48: comm syz.1.36: lblock 0 mapped to illegal pblock 48 (length 1) [ 37.206624][ T5016] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 37.213093][ C0] EXT4-fs (loop1): error count since last fsck: 2 [ 37.213108][ C0] EXT4-fs (loop1): initial error at time 37: ext4_map_blocks:791: inode 3: block 2 [ 37.213128][ C0] EXT4-fs (loop1): last error at time 37: ext4_map_blocks:791: inode 3: block 48 [ 37.218398][ T5016] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 37.218416][ T5016] EXT4-fs error (device loop1): ext4_acquire_dquot:7041: comm syz.1.36: Failed to acquire dquot type 0 [ 37.218431][ T5016] loop1: lost filesystem error report for type 5 error -117 [ 37.226686][ T5016] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 37.230287][ T5016] loop1: lost filesystem error report for type 5 error -117 [ 37.230482][ T5016] EXT4-fs error (device loop1): ext4_evict_inode:267: inode #11: comm syz.1.36: mark_inode_dirty error [ 37.234790][ T5016] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 37.235107][ T5016] EXT4-fs warning (device loop1): ext4_evict_inode:270: couldn't mark inode dirty (err -117) [ 37.238933][ T5016] EXT4-fs (loop1): 1 orphan inode deleted [ 37.239411][ T5016] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.243730][ T13] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 37.243758][ T13] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 37.246997][ T13] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 37.247027][ T13] EXT4-fs error (device loop1): ext4_release_dquot:7077: comm kworker/u8:1: Failed to release dquot type 0 [ 37.247052][ T13] loop1: lost filesystem error report for type 5 error -117 [ 37.260717][ T5016] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.265540][ T5016] EXT4-fs error (device loop1): __ext4_get_inode_loc:4886: comm syz.1.36: Invalid inode table block 1 in block_group 0 [ 37.265640][ T5016] loop1: lost filesystem error report for type 5 error -117 [ 37.268532][ T5016] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 37.272780][ T5016] loop1: lost filesystem error report for type 5 error -117 [ 37.274838][ T5016] EXT4-fs error (device loop1): ext4_quota_off:7325: inode #3: comm syz.1.36: mark_inode_dirty error [ 37.278918][ T5016] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 37.856702][ T5030] loop1: detected capacity change from 0 to 2048 [ 37.866233][ T5032] loop2: detected capacity change from 0 to 1024 [ 37.868428][ T5032] EXT4-fs: Ignoring removed bh option [ 37.868476][ T5032] EXT4-fs: Ignoring removed nomblk_io_submit option [ 37.871068][ T5032] EXT4-fs: test_dummy_encryption requires encrypt feature [ 37.875699][ T5030] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.907736][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.176210][ T4717] Bluetooth: hci0: command 0x0c1a tx timeout [ 38.903649][ T4717] Bluetooth: hci1: command 0x0c1a tx timeout [ 38.948618][ T4900] wiimote 0005:057E:0306.0002: hidraw1: BLUETOOTH HID v0.03 Gamepad [sy®>d÷}ç³N] on syz0 [ 38.948731][ T4900] wiimote 0005:057E:0306.0002: New device registered [ 38.974371][ T4716] Bluetooth: hci3: command 0x0c1a tx timeout [ 38.974420][ T4716] Bluetooth: hci2: command 0x0c1a tx timeout [ 38.977081][ T4717] Bluetooth: hci4: command 0x0c1a tx timeout [ 40.023047][ T4900] wiimote 0005:057E:0306.0002: detected device: Nintendo Wii Remote (Gen 1) [ 40.025641][ T4900] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 40.027356][ T4900] CPU: 1 UID: 0 PID: 4900 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT [ 40.027378][ T4900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 40.027384][ T4900] Workqueue: events wiimote_init_worker [ 40.027408][ T4900] Call trace: [ 40.027412][ T4900] show_stack+0x2c/0x3c (C) [ 40.027430][ T4900] __dump_stack+0x30/0x40 [ 40.027443][ T4900] dump_stack_lvl+0xd8/0x12c [ 40.027453][ T4900] dump_stack+0x1c/0x28 [ 40.027463][ T4900] sysfs_warn_dup+0x9c/0xb8 [ 40.027475][ T4900] sysfs_do_create_link_sd+0xc8/0x120 [ 40.027484][ T4900] sysfs_create_link+0x74/0x94 [ 40.027493][ T4900] device_add_class_symlinks+0x1e0/0x254 [ 40.027503][ T4900] device_add+0x3fc/0x9e0 [ 40.027509][ T4900] __power_supply_register+0x8f0/0xc2c [ 40.027521][ T4900] power_supply_register+0x34/0x48 [ 40.027530][ T4900] wiimod_battery_probe+0x1b4/0x304 [ 40.027539][ T4900] wiimote_init_worker+0x13f8/0x1d6c [ 40.027548][ T4900] process_scheduled_works+0x788/0x10b8 [ 40.027559][ T4900] worker_thread+0x798/0xbd0 [ 40.027568][ T4900] kthread+0x304/0x3d4 [ 40.027576][ T4900] ret_from_fork+0x10/0x20 [ 40.047049][ T4900] wiimote 0005:057E:0306.0002: cannot register battery device [ 40.308206][ T5066] loop2: detected capacity change from 0 to 128 [ 40.315242][ T5066] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 40.418257][ T5059] wiimote 0005:057E:0306.0002: Device removed [ 40.423250][ T4717] Bluetooth: hci0: command 0x0c1a tx timeout [ 40.533025][ T5066] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 40.973160][ T4717] Bluetooth: hci1: command 0x0c1a tx timeout [ 41.053086][ T4717] Bluetooth: hci4: command 0x0c1a tx timeout [ 41.053115][ T4719] Bluetooth: hci2: command 0x0c1a tx timeout [ 41.053138][ T4719] Bluetooth: hci3: command 0x0c1a tx timeout [ 41.070155][ T13] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.077242][ T4724] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.099182][ T5076] loop0: detected capacity change from 0 to 8192 [ 41.119622][ T5080] __nla_validate_parse: 1 callbacks suppressed [ 41.120849][ T5080] netlink: 8 bytes leftover after parsing attributes in process `syz.2.55'. [ 41.124776][ T5080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.126560][ T5080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.135444][ T5076] loop0: p1[EZD] p3 p4 [ 41.135473][ T5076] loop0: partition table partially beyond EOD, truncated [ 41.136797][ T5076] loop0: p3 start 150994944 is beyond EOD, truncated [ 41.358851][ T30] audit: type=1326 audit(41.290:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm="syz.0.53" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.364983][ T30] audit: type=1326 audit(41.300:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm="syz.0.53" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=167 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.373468][ T30] audit: type=1326 audit(41.300:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.379618][ T30] audit: type=1326 audit(41.300:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=29 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.379692][ T30] audit: type=1326 audit(41.300:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.379751][ T30] audit: type=1326 audit(41.300:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=29 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.379822][ T30] audit: type=1326 audit(41.310:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.379897][ T30] audit: type=1326 audit(41.310:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.385071][ T30] audit: type=1326 audit(41.310:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 41.385146][ T30] audit: type=1326 audit(41.320:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5075 comm=FF exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2379228 code=0x7ffc0000 [ 42.516362][ T4717] Bluetooth: hci0: command 0x0c1a tx timeout [ 42.543424][ T5106] loop4: detected capacity change from 0 to 512 [ 42.550062][ T5106] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 42.554093][ T5106] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 42.562706][ T5106] EXT4-fs error (device loop4): __ext4_iget:5533: inode #11: block 2: comm syz.4.58: invalid block [ 42.562737][ T5106] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 42.567156][ T5106] EXT4-fs error (device loop4): ext4_orphan_get:1404: comm syz.4.58: couldn't read orphan inode 11 (err -117) [ 42.572544][ T5106] loop4: lost filesystem error report for type 5 error -117 [ 42.572960][ C1] EXT4-fs (loop4): error count since last fsck: 2 [ 42.572977][ C1] EXT4-fs (loop4): initial error at time 42: __ext4_iget:5533: inode 11: block 2 [ 42.573019][ C1] EXT4-fs (loop4): last error at time 42: ext4_orphan_get:1404 [ 42.581505][ T5106] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.615212][ T5110] binder: BINDER_SET_CONTEXT_MGR already set [ 42.615237][ T5110] binder: 5109:5110 ioctl 4018620d 20000480 returned -16 [ 42.699110][ T5110] binder: 5109:5110 got transaction to invalid handle, 3 [ 42.699148][ T5110] binder: 5109:5110 cannot find target node [ 42.699180][ T5110] binder: 5109:5110 transaction call to 0:0 failed 4/29201/-22, code 0 size 0-0 line 3252 [ 42.703759][ T866] binder: undelivered TRANSACTION_ERROR: 29201 [ 42.781800][ T5112] loop3: detected capacity change from 0 to 8192 [ 42.788260][ T5112] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 42.808610][ T5112] overlay: ./file0 is not a directory [ 43.053145][ T4717] Bluetooth: hci1: command 0x0c1a tx timeout [ 43.061551][ T5118] FAULT_INJECTION: forcing a failure. [ 43.061551][ T5118] name failslab, interval 1, probability 0, space 0, times 0 [ 43.065006][ T5118] CPU: 1 UID: 0 PID: 5118 Comm: syz.0.64 Not tainted syzkaller #0 PREEMPT [ 43.065020][ T5118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 43.065025][ T5118] Call trace: [ 43.065028][ T5118] show_stack+0x2c/0x3c (C) [ 43.065049][ T5118] __dump_stack+0x30/0x40 [ 43.065060][ T5118] dump_stack_lvl+0xd8/0x12c [ 43.065070][ T5118] dump_stack+0x1c/0x28 [ 43.065079][ T5118] should_fail_ex+0x41c/0x590 [ 43.065087][ T5118] should_failslab+0xc4/0x120 [ 43.065095][ T5118] __kmalloc_noprof+0x108/0x6b8 [ 43.065104][ T5118] tomoyo_realpath_from_path+0xbc/0x4dc [ 43.065113][ T5118] tomoyo_path_number_perm+0x1f0/0x500 [ 43.065121][ T5118] tomoyo_file_ioctl+0x2c/0x3c [ 43.065129][ T5118] security_file_ioctl+0xdc/0x2b0 [ 43.065138][ T5118] __arm64_sys_ioctl+0xb0/0x1cc [ 43.065149][ T5118] invoke_syscall+0x98/0x244 [ 43.065159][ T5118] el0_svc_common+0xec/0x23c [ 43.065168][ T5118] do_el0_svc+0x4c/0x5c [ 43.065177][ T5118] el0_svc+0x64/0x260 [ 43.065187][ T5118] el0t_64_sync_handler+0x44/0x104 [ 43.065195][ T5118] el0t_64_sync+0x198/0x19c [ 43.083000][ T5118] ERROR: Out of memory at tomoyo_realpath_from_path. [ 43.133152][ T4717] Bluetooth: hci4: command 0x0c1a tx timeout [ 43.143053][ T4716] Bluetooth: hci2: command 0x0c1a tx timeout [ 43.143097][ T4717] Bluetooth: hci3: command 0x0c1a tx timeout [ 43.822314][ T5123] capability: warning: `syz.3.66' uses 32-bit capabilities (legacy support in use) [ 43.978165][ T5132] Zero length message leads to an empty skb [ 44.256767][ T5145] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 44.256799][ T5145] IPv6: NLM_F_CREATE should be set when creating new route [ 44.284783][ T5147] netlink: 'syz.1.71': attribute type 1 has an invalid length. [ 44.294659][ T5145] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.294985][ T5145] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.404106][ T5145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.416008][ T5145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.712999][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.714997][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.716822][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.719282][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.792171][ T5155] loop0: detected capacity change from 0 to 1024 [ 44.807021][ T5155] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.894563][ T5163] FAULT_INJECTION: forcing a failure. [ 44.894563][ T5163] name failslab, interval 1, probability 0, space 0, times 0 [ 44.894599][ T5163] CPU: 0 UID: 0 PID: 5163 Comm: syz.2.76 Not tainted syzkaller #0 PREEMPT [ 44.894612][ T5163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 44.894619][ T5163] Call trace: [ 44.894622][ T5163] show_stack+0x2c/0x3c (C) [ 44.894640][ T5163] __dump_stack+0x30/0x40 [ 44.894651][ T5163] dump_stack_lvl+0xd8/0x12c [ 44.894660][ T5163] dump_stack+0x1c/0x28 [ 44.894670][ T5163] should_fail_ex+0x41c/0x590 [ 44.894678][ T5163] should_failslab+0xc4/0x120 [ 44.894686][ T5163] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 44.894695][ T5163] __alloc_skb+0x1f0/0x610 [ 44.894705][ T5163] inet6_rt_notify+0x178/0x488 [ 44.894715][ T5163] fib6_del+0xd98/0x1260 [ 44.894722][ T5163] __ip6_del_rt+0x9c/0x1a4 [ 44.894730][ T5163] ip6_del_rt+0xb4/0x10c [ 44.894737][ T5163] cleanup_prefix_route+0x114/0x4b8 [ 44.894747][ T5163] inet6_addr_modify+0x1fc/0xce4 [ 44.894755][ T5163] inet6_rtm_newaddr+0x6f4/0xa40 [ 44.894762][ T5163] rtnetlink_rcv_msg+0x66c/0x9bc [ 44.894770][ T5163] netlink_rcv_skb+0x238/0x414 [ 44.894779][ T5163] rtnetlink_rcv+0x28/0x38 [ 44.894787][ T5163] netlink_unicast+0x600/0x7f8 [ 44.894795][ T5163] netlink_sendmsg+0x648/0x948 [ 44.894804][ T5163] __sock_sendmsg+0xc8/0x17c [ 44.894812][ T5163] ____sys_sendmsg+0x3d0/0x6c8 [ 44.894821][ T5163] ___sys_sendmsg+0x198/0x224 [ 44.894830][ T5163] __sys_sendmsg+0x158/0x204 [ 44.894846][ T5163] __arm64_sys_sendmsg+0x88/0x9c [ 44.894856][ T5163] invoke_syscall+0x98/0x244 [ 44.894869][ T5163] el0_svc_common+0xec/0x23c [ 44.894879][ T5163] do_el0_svc+0x4c/0x5c [ 44.894889][ T5163] el0_svc+0x64/0x260 [ 44.894899][ T5163] el0t_64_sync_handler+0x44/0x104 [ 44.894907][ T5163] el0t_64_sync+0x198/0x19c [ 44.936735][ T4717] Bluetooth: hci3: unexpected event for opcode 0x2042 [ 45.226028][ T5174] netlink: 24 bytes leftover after parsing attributes in process `syz.2.78'. [ 45.240269][ T5173] loop1: detected capacity change from 0 to 4096 [ 45.241306][ T5173] EXT4-fs: inline encryption not supported [ 45.248927][ T5173] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 45.248970][ T5173] EXT4-fs (loop1): Test dummy encryption mode enabled [ 45.249920][ T5173] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 45.249958][ T5173] System zones: 0-5 [ 45.251333][ T5173] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.322872][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.570502][ T5184] binder: BINDER_SET_CONTEXT_MGR already set [ 45.570768][ T5184] binder: 5179:5184 ioctl 4018620d 20004a80 returned -16 [ 45.572198][ T5184] binder: 5179:5184 got transaction to invalid handle, 1 [ 45.572227][ T5184] binder: 5179:5184 cannot find target node [ 45.572408][ T5184] binder: 5179:5184 transaction call to 0:0 failed 7/29201/-22, code 0 size 72-24 line 3252 [ 45.573101][ T5184] binder: 5179:5184 ioctl c0306201 200006c0 returned -14 [ 45.582610][ T5184] loop1: detected capacity change from 0 to 128 [ 45.734719][ T5184] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 45.742245][ T5183] loop2: detected capacity change from 0 to 8192 [ 45.791378][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.818048][ T5183] syz.2.82 uses obsolete (PF_INET,SOCK_PACKET) [ 45.835085][ T5183] IPVS: set_ctl: invalid protocol: 60 224.0.0.1:20001 [ 45.837250][ T5183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.82'. [ 45.839033][ T5183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.82'. [ 45.846683][ T5187] loop3: detected capacity change from 0 to 4096 [ 45.848473][ T5187] EXT4-fs: inline encryption not supported [ 45.851951][ T5189] FAULT_INJECTION: forcing a failure. [ 45.851951][ T5189] name failslab, interval 1, probability 0, space 0, times 0 [ 45.851987][ T5189] CPU: 0 UID: 0 PID: 5189 Comm: syz.0.84 Not tainted syzkaller #0 PREEMPT [ 45.851998][ T5189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 45.852003][ T5189] Call trace: [ 45.852006][ T5189] show_stack+0x2c/0x3c (C) [ 45.852026][ T5189] __dump_stack+0x30/0x40 [ 45.852037][ T5189] dump_stack_lvl+0xd8/0x12c [ 45.852047][ T5189] dump_stack+0x1c/0x28 [ 45.852057][ T5189] should_fail_ex+0x41c/0x590 [ 45.852065][ T5189] should_failslab+0xc4/0x120 [ 45.852073][ T5189] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 45.852082][ T5189] __alloc_skb+0x1f0/0x610 [ 45.852092][ T5189] netlink_ack+0x11c/0x890 [ 45.852102][ T5189] netlink_rcv_skb+0x21c/0x414 [ 45.852110][ T5189] nfnetlink_rcv+0x218/0x16ec [ 45.852118][ T5189] netlink_unicast+0x600/0x7f8 [ 45.852126][ T5189] netlink_sendmsg+0x648/0x948 [ 45.852135][ T5189] __sock_sendmsg+0xc8/0x17c [ 45.852143][ T5189] ____sys_sendmsg+0x3d0/0x6c8 [ 45.852152][ T5189] ___sys_sendmsg+0x198/0x224 [ 45.852161][ T5189] __sys_sendmsg+0x158/0x204 [ 45.852170][ T5189] __arm64_sys_sendmsg+0x88/0x9c [ 45.852179][ T5189] invoke_syscall+0x98/0x244 [ 45.852189][ T5189] el0_svc_common+0xec/0x23c [ 45.852199][ T5189] do_el0_svc+0x4c/0x5c [ 45.852208][ T5189] el0_svc+0x64/0x260 [ 45.852217][ T5189] el0t_64_sync_handler+0x44/0x104 [ 45.852226][ T5189] el0t_64_sync+0x198/0x19c [ 45.882392][ T5187] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 45.882430][ T5187] EXT4-fs (loop3): Test dummy encryption mode enabled [ 45.889519][ T5187] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 45.889586][ T5187] System zones: 0-5 [ 45.905670][ T5192] FAULT_INJECTION: forcing a failure. [ 45.905670][ T5192] name failslab, interval 1, probability 0, space 0, times 0 [ 45.909045][ T5192] CPU: 0 UID: 0 PID: 5192 Comm: syz.0.85 Not tainted syzkaller #0 PREEMPT [ 45.909071][ T5192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 45.909077][ T5192] Call trace: [ 45.909081][ T5192] show_stack+0x2c/0x3c (C) [ 45.909102][ T5192] __dump_stack+0x30/0x40 [ 45.909113][ T5192] dump_stack_lvl+0xd8/0x12c [ 45.909124][ T5192] dump_stack+0x1c/0x28 [ 45.909134][ T5192] should_fail_ex+0x41c/0x590 [ 45.909141][ T5192] should_failslab+0xc4/0x120 [ 45.909150][ T5192] __kmalloc_noprof+0x108/0x6b8 [ 45.909159][ T5192] genl_family_rcv_msg_attrs_parse+0xcc/0x27c [ 45.909170][ T5192] genl_family_rcv_msg_doit+0xd8/0x2d4 [ 45.909180][ T5192] genl_rcv_msg+0x43c/0x620 [ 45.909189][ T5192] netlink_rcv_skb+0x238/0x414 [ 45.909198][ T5192] genl_rcv+0x38/0x50 [ 45.909207][ T5192] netlink_unicast+0x600/0x7f8 [ 45.909216][ T5192] netlink_sendmsg+0x648/0x948 [ 45.909224][ T5192] __sock_sendmsg+0xc8/0x17c [ 45.909233][ T5192] ____sys_sendmsg+0x3d0/0x6c8 [ 45.909242][ T5192] ___sys_sendmsg+0x198/0x224 [ 45.909252][ T5192] __sys_sendmsg+0x158/0x204 [ 45.909261][ T5192] __arm64_sys_sendmsg+0x88/0x9c [ 45.909270][ T5192] invoke_syscall+0x98/0x244 [ 45.909280][ T5192] el0_svc_common+0xec/0x23c [ 45.909289][ T5192] do_el0_svc+0x4c/0x5c [ 45.909299][ T5192] el0_svc+0x64/0x260 [ 45.909307][ T5192] el0t_64_sync_handler+0x44/0x104 [ 45.909316][ T5192] el0t_64_sync+0x198/0x19c [ 45.931965][ T5187] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.982714][ T4714] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.036522][ T5197] loop3: detected capacity change from 0 to 256 [ 46.042149][ T5199] loop2: detected capacity change from 0 to 1024 [ 46.043563][ T5199] EXT4-fs: Ignoring removed nomblk_io_submit option [ 46.048693][ T5199] EXT4-fs warning (device loop2): ext4_multi_mount_protect:287: Invalid MMP block in superblock [ 46.139540][ T4727] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.211980][ T1923] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.574543][ T4715] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 46.820668][ T1923] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.077606][ T5218] netlink: 40 bytes leftover after parsing attributes in process `syz.1.95'. [ 47.092181][ T5217] loop0: detected capacity change from 0 to 2048 [ 47.095746][ T5219] FAULT_INJECTION: forcing a failure. [ 47.095746][ T5219] name failslab, interval 1, probability 0, space 0, times 0 [ 47.095775][ T5219] CPU: 1 UID: 0 PID: 5219 Comm: syz.3.96 Not tainted syzkaller #0 PREEMPT [ 47.095789][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 47.095795][ T5219] Call trace: [ 47.095798][ T5219] show_stack+0x2c/0x3c (C) [ 47.095817][ T5219] __dump_stack+0x30/0x40 [ 47.095828][ T5219] dump_stack_lvl+0xd8/0x12c [ 47.095838][ T5219] dump_stack+0x1c/0x28 [ 47.095848][ T5219] should_fail_ex+0x41c/0x590 [ 47.095861][ T5219] should_failslab+0xc4/0x120 [ 47.095870][ T5219] __kmalloc_cache_noprof+0x94/0x5ec [ 47.095879][ T5219] tcf_proto_create+0x78/0x2e8 [ 47.095889][ T5219] tc_new_tfilter+0xc74/0x132c [ 47.095898][ T5219] rtnetlink_rcv_msg+0x66c/0x9bc [ 47.095907][ T5219] netlink_rcv_skb+0x238/0x414 [ 47.095917][ T5219] rtnetlink_rcv+0x28/0x38 [ 47.095924][ T5219] netlink_unicast+0x600/0x7f8 [ 47.095933][ T5219] netlink_sendmsg+0x648/0x948 [ 47.095941][ T5219] __sock_sendmsg+0xc8/0x17c [ 47.095950][ T5219] ____sys_sendmsg+0x3d0/0x6c8 [ 47.095959][ T5219] ___sys_sendmsg+0x198/0x224 [ 47.095968][ T5219] __sys_sendmsg+0x158/0x204 [ 47.095977][ T5219] __arm64_sys_sendmsg+0x88/0x9c [ 47.095986][ T5219] invoke_syscall+0x98/0x244 [ 47.095997][ T5219] el0_svc_common+0xec/0x23c [ 47.096006][ T5219] do_el0_svc+0x4c/0x5c [ 47.096015][ T5219] el0_svc+0x64/0x260 [ 47.096025][ T5219] el0t_64_sync_handler+0x44/0x104 [ 47.096033][ T5219] el0t_64_sync+0x198/0x19c [ 47.107108][ T5217] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.112249][ T5217] FAULT_INJECTION: forcing a failure. [ 47.112249][ T5217] name failslab, interval 1, probability 0, space 0, times 0 [ 47.112283][ T5217] CPU: 1 UID: 0 PID: 5217 Comm: syz.0.94 Not tainted syzkaller #0 PREEMPT [ 47.112295][ T5217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 47.112300][ T5217] Call trace: [ 47.112303][ T5217] show_stack+0x2c/0x3c (C) [ 47.112319][ T5217] __dump_stack+0x30/0x40 [ 47.112329][ T5217] dump_stack_lvl+0xd8/0x12c [ 47.112339][ T5217] dump_stack+0x1c/0x28 [ 47.112348][ T5217] should_fail_ex+0x41c/0x590 [ 47.112356][ T5217] should_failslab+0xc4/0x120 [ 47.112363][ T5217] kmem_cache_alloc_lru_noprof+0x98/0x5dc [ 47.112372][ T5217] __d_alloc+0x50/0x690 [ 47.112380][ T5217] d_alloc_parallel+0xc4/0xf28 [ 47.112387][ T5217] __lookup_slow+0x90/0x2b4 [ 47.112396][ T5217] lookup_slow+0x60/0x84 [ 47.112403][ T5217] path_lookupat+0x358/0x798 [ 47.112411][ T5217] filename_lookup+0x1d0/0x3c8 [ 47.112418][ T5217] user_path_at+0x54/0x78 [ 47.112426][ T5217] do_mount+0xb0/0x148 [ 47.112435][ T5217] __arm64_sys_mount+0x33c/0x388 [ 47.112444][ T5217] invoke_syscall+0x98/0x244 [ 47.112454][ T5217] el0_svc_common+0xec/0x23c [ 47.112463][ T5217] do_el0_svc+0x4c/0x5c [ 47.112472][ T5217] el0_svc+0x64/0x260 [ 47.112481][ T5217] el0t_64_sync_handler+0x44/0x104 [ 47.112489][ T5217] el0t_64_sync+0x198/0x19c [ 47.162508][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.177561][ T4716] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 47.178872][ T4716] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 47.180032][ T4716] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 47.183916][ T4716] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 47.185191][ T4716] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 47.190381][ T1923] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.339910][ T1923] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.358531][ T5237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.360415][ T5237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.459026][ T5244] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.481427][ T1923] bridge_slave_1: left allmulticast mode [ 47.481466][ T1923] bridge_slave_1: left promiscuous mode [ 47.481956][ T1923] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.488392][ T1923] bridge_slave_0: left allmulticast mode [ 47.489574][ T1923] bridge_slave_0: left promiscuous mode [ 47.490619][ T1923] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.615310][ T5257] FAULT_INJECTION: forcing a failure. [ 47.615310][ T5257] name failslab, interval 1, probability 0, space 0, times 0 [ 47.615344][ T5257] CPU: 0 UID: 0 PID: 5257 Comm: syz.0.107 Not tainted syzkaller #0 PREEMPT [ 47.615359][ T5257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 47.615367][ T5257] Call trace: [ 47.615371][ T5257] show_stack+0x2c/0x3c (C) [ 47.615392][ T5257] __dump_stack+0x30/0x40 [ 47.615404][ T5257] dump_stack_lvl+0xd8/0x12c [ 47.615414][ T5257] dump_stack+0x1c/0x28 [ 47.615423][ T5257] should_fail_ex+0x41c/0x590 [ 47.615431][ T5257] should_failslab+0xc4/0x120 [ 47.615440][ T5257] __kmalloc_cache_noprof+0x94/0x5ec [ 47.615449][ T5257] rtnl_newlink+0x110/0x1144 [ 47.615458][ T5257] rtnetlink_rcv_msg+0x66c/0x9bc [ 47.615466][ T5257] netlink_rcv_skb+0x238/0x414 [ 47.615476][ T5257] rtnetlink_rcv+0x28/0x38 [ 47.615484][ T5257] netlink_unicast+0x600/0x7f8 [ 47.615492][ T5257] netlink_sendmsg+0x648/0x948 [ 47.615501][ T5257] __sock_sendmsg+0xc8/0x17c [ 47.615510][ T5257] ____sys_sendmsg+0x3d0/0x6c8 [ 47.615519][ T5257] ___sys_sendmsg+0x198/0x224 [ 47.615528][ T5257] __sys_sendmsg+0x158/0x204 [ 47.615537][ T5257] __arm64_sys_sendmsg+0x88/0x9c [ 47.615546][ T5257] invoke_syscall+0x98/0x244 [ 47.615556][ T5257] el0_svc_common+0xec/0x23c [ 47.615565][ T5257] do_el0_svc+0x4c/0x5c [ 47.615575][ T5257] el0_svc+0x64/0x260 [ 47.615584][ T5257] el0t_64_sync_handler+0x44/0x104 [ 47.615592][ T5257] el0t_64_sync+0x198/0x19c [ 47.710664][ T1923] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 47.744666][ T1923] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 47.785311][ T1923] bond0 (unregistering): Released all slaves [ 47.798639][ T5259] batman_adv: batadv0: Adding interface: macvtap1 [ 47.803024][ T5259] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.808461][ T5259] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 47.926058][ T5273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.926413][ T5273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.927675][ T5273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.927828][ T5273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.089457][ T5222] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.089544][ T5222] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.089652][ T5222] bridge_slave_0: entered allmulticast mode [ 48.090097][ T5222] bridge_slave_0: entered promiscuous mode [ 48.090954][ T5222] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.090976][ T5222] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.091035][ T5222] bridge_slave_1: entered allmulticast mode [ 48.091809][ T5222] bridge_slave_1: entered promiscuous mode [ 48.092670][ T4405] 8021q: adding VLAN 0 to HW filter on device eth0 [ 48.114917][ T5222] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.115865][ T5222] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.128964][ T5222] team0: Port device team_slave_0 added [ 48.131813][ T5222] team0: Port device team_slave_1 added [ 48.176153][ T5222] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.176180][ T5222] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.176205][ T5222] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.176769][ T5222] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.176775][ T5222] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.176788][ T5222] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.187989][ T5295] netlink: 40 bytes leftover after parsing attributes in process `syz.0.113'. [ 48.203420][ T1923] hsr_slave_0: left promiscuous mode [ 48.204621][ T1923] hsr_slave_1: left promiscuous mode [ 48.205876][ T1923] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 48.206119][ T1923] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 48.210149][ T1923] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 48.210180][ T1923] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 48.216264][ T5297] set_capacity_and_notify: 1 callbacks suppressed [ 48.216516][ T5297] loop0: detected capacity change from 0 to 256 [ 48.218819][ T1923] veth1_macvtap: left promiscuous mode [ 48.218873][ T1923] veth0_macvtap: left promiscuous mode [ 48.218944][ T1923] veth1_vlan: left promiscuous mode [ 48.219021][ T1923] veth0_vlan: left promiscuous mode [ 48.220817][ T5297] FAULT_INJECTION: forcing a failure. [ 48.220817][ T5297] name failslab, interval 1, probability 0, space 0, times 0 [ 48.220833][ T5297] CPU: 0 UID: 0 PID: 5297 Comm: syz.0.114 Not tainted syzkaller #0 PREEMPT [ 48.220851][ T5297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.220857][ T5297] Call trace: [ 48.220861][ T5297] show_stack+0x2c/0x3c (C) [ 48.220880][ T5297] __dump_stack+0x30/0x40 [ 48.220892][ T5297] dump_stack_lvl+0xd8/0x12c [ 48.220902][ T5297] dump_stack+0x1c/0x28 [ 48.220912][ T5297] should_fail_ex+0x41c/0x590 [ 48.220920][ T5297] should_failslab+0xc4/0x120 [ 48.220928][ T5297] kmem_cache_alloc_lru_noprof+0x98/0x5dc [ 48.220937][ T5297] __d_alloc+0x50/0x690 [ 48.220945][ T5297] d_alloc_parallel+0xc4/0xf28 [ 48.220953][ T5297] path_openat+0x924/0x2a60 [ 48.220962][ T5297] do_file_open+0x1c8/0x2e8 [ 48.220970][ T5297] do_sys_openat2+0x114/0x1e8 [ 48.220980][ T5297] do_sys_open+0xb0/0xe0 [ 48.220989][ T5297] __arm64_sys_openat+0xa8/0xc4 [ 48.220999][ T5297] invoke_syscall+0x98/0x244 [ 48.221008][ T5297] el0_svc_common+0xec/0x23c [ 48.221018][ T5297] do_el0_svc+0x4c/0x5c [ 48.221027][ T5297] el0_svc+0x64/0x260 [ 48.221036][ T5297] el0t_64_sync_handler+0x44/0x104 [ 48.221045][ T5297] el0t_64_sync+0x198/0x19c [ 48.260635][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.426022][ T1923] team0 (unregistering): Port device team_slave_1 removed [ 48.431648][ T1923] team0 (unregistering): Port device team_slave_0 removed [ 48.517571][ T5222] hsr_slave_0: entered promiscuous mode [ 48.518036][ T5222] hsr_slave_1: entered promiscuous mode [ 48.585604][ T5313] loop2: detected capacity change from 0 to 2048 [ 48.643625][ T4405] 8021q: adding VLAN 0 to HW filter on device eth1 [ 48.677687][ T5313] loop2: p1 < > p4 [ 48.677687][ T5313] p4: [ 48.680658][ T5313] loop2: p4 size 722688 extends beyond EOD, truncated [ 48.945997][ T5222] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 48.947582][ T4973] udevd[4973]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 48.950447][ T5222] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.950987][ T5329] binder: BINDER_SET_CONTEXT_MGR already set [ 48.950995][ T5329] binder: 5328:5329 ioctl 4018620d 20000480 returned -16 [ 48.952112][ T5222] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 48.954943][ T5222] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.955276][ T5222] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 48.960332][ T4974] udevd[4974]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 48.960685][ T5222] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.962823][ T5222] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 48.975061][ T5222] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.007995][ T5222] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.008043][ T5222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.008114][ T5222] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.008142][ T5222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.031635][ T5342] binder: 5328:5342 got transaction to invalid handle, 3 [ 49.031670][ T5342] binder: 5328:5342 cannot find target node [ 49.031685][ T5342] binder: 5328:5342 transaction call to 0:0 failed 10/29201/-22, code 0 size 0-0 line 3252 [ 49.059316][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.061243][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.069214][ T866] binder: undelivered TRANSACTION_ERROR: 29201 [ 49.104995][ T5222] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.120693][ T4405] 8021q: adding VLAN 0 to HW filter on device eth2 [ 49.127064][ T5222] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.166722][ T1923] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.166773][ T1923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.169352][ T5351] loop2: detected capacity change from 0 to 512 [ 49.206645][ T1923] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.206689][ T1923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.245677][ T5359] FAULT_INJECTION: forcing a failure. [ 49.245677][ T5359] name failslab, interval 1, probability 0, space 0, times 0 [ 49.245715][ T5359] CPU: 1 UID: 0 PID: 5359 Comm: syz.0.122 Not tainted syzkaller #0 PREEMPT [ 49.245730][ T5359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 49.245737][ T5359] Call trace: [ 49.245741][ T5359] show_stack+0x2c/0x3c (C) [ 49.245761][ T5359] __dump_stack+0x30/0x40 [ 49.245772][ T5359] dump_stack_lvl+0xd8/0x12c [ 49.245782][ T5359] dump_stack+0x1c/0x28 [ 49.245792][ T5359] should_fail_ex+0x41c/0x590 [ 49.245800][ T5359] should_failslab+0xc4/0x120 [ 49.245808][ T5359] kmem_cache_alloc_node_noprof+0x98/0x5f8 [ 49.245817][ T5359] __alloc_skb+0x1f0/0x610 [ 49.245827][ T5359] netlink_ack+0x11c/0x890 [ 49.245837][ T5359] netlink_rcv_skb+0x21c/0x414 [ 49.245845][ T5359] rtnetlink_rcv+0x28/0x38 [ 49.245861][ T5359] netlink_unicast+0x600/0x7f8 [ 49.245870][ T5359] netlink_sendmsg+0x648/0x948 [ 49.245879][ T5359] __sock_sendmsg+0xc8/0x17c [ 49.245888][ T5359] ____sys_sendmsg+0x3d0/0x6c8 [ 49.245898][ T5359] ___sys_sendmsg+0x198/0x224 [ 49.245907][ T5359] __sys_sendmsg+0x158/0x204 [ 49.245916][ T5359] __arm64_sys_sendmsg+0x88/0x9c [ 49.245925][ T5359] invoke_syscall+0x98/0x244 [ 49.245935][ T5359] el0_svc_common+0xec/0x23c [ 49.245945][ T5359] do_el0_svc+0x4c/0x5c [ 49.245954][ T5359] el0_svc+0x64/0x260 [ 49.245963][ T5359] el0t_64_sync_handler+0x44/0x104 [ 49.245972][ T5359] el0t_64_sync+0x198/0x19c [ 49.259578][ T5351] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.293164][ T4716] Bluetooth: hci4: command tx timeout [ 49.327023][ T4724] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.354207][ T5371] netlink: 24 bytes leftover after parsing attributes in process `syz.1.126'. [ 49.361863][ T5374] loop2: detected capacity change from 0 to 256 [ 49.535994][ T5222] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.604604][ T4405] 8021q: adding VLAN 0 to HW filter on device eth3 [ 49.886600][ T5418] netlink: 16 bytes leftover after parsing attributes in process `syz.1.131'. [ 49.924959][ T5222] veth0_vlan: entered promiscuous mode [ 49.932409][ T5222] veth1_vlan: entered promiscuous mode [ 49.949561][ T5222] veth0_macvtap: entered promiscuous mode [ 49.954551][ T5222] veth1_macvtap: entered promiscuous mode [ 49.962157][ T5222] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.965402][ T5222] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.014324][ T1906] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.028914][ T1906] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.028940][ T1906] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.051488][ T1906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.053360][ T1957] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.053387][ T1957] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.053402][ T1957] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.055188][ T1906] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.105286][ T5426] zram0: detected capacity change from 0 to 8 [ 50.201079][ T5439] netlink: 56 bytes leftover after parsing attributes in process `syz.0.139'. [ 50.217247][ T5441] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 50.217274][ T5441] overlayfs: failed to set xattr on upper [ 50.217292][ T5441] overlayfs: ...falling back to redirect_dir=nofollow. [ 50.217302][ T5441] overlayfs: ...falling back to uuid=null. [ 50.217314][ T5441] overlayfs: maximum fs stacking depth exceeded [ 50.638684][ T5457] loop2: detected capacity change from 0 to 256 [ 50.728668][ T5465] loop2: detected capacity change from 0 to 512 [ 50.739952][ T5465] journal_path: Non-blockdev passed as './file0' [ 50.739988][ T5465] EXT4-fs: error: could not find journal device path [ 50.923695][ T5469] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(4) [ 51.136516][ T30] audit: type=1326 audit(51.110:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5472 comm="syz.5.147" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff99b79228 code=0x0 [ 51.176140][ T5478] netlink: 32 bytes leftover after parsing attributes in process `syz.3.148'. [ 51.176184][ T5478] netlink: 32 bytes leftover after parsing attributes in process `syz.3.148'. [ 51.176198][ T5478] netlink: 24 bytes leftover after parsing attributes in process `syz.3.148'. [ 51.267668][ T5482] FAULT_INJECTION: forcing a failure. [ 51.267668][ T5482] name failslab, interval 1, probability 0, space 0, times 0 [ 51.270332][ T5482] CPU: 0 UID: 0 PID: 5482 Comm: syz.0.151 Not tainted syzkaller #0 PREEMPT [ 51.270351][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 51.270357][ T5482] Call trace: [ 51.270360][ T5482] show_stack+0x2c/0x3c (C) [ 51.270386][ T5482] __dump_stack+0x30/0x40 [ 51.270398][ T5482] dump_stack_lvl+0xd8/0x12c [ 51.270408][ T5482] dump_stack+0x1c/0x28 [ 51.270418][ T5482] should_fail_ex+0x41c/0x590 [ 51.270427][ T5482] should_failslab+0xc4/0x120 [ 51.270435][ T5482] kmem_cache_alloc_lru_noprof+0x98/0x5dc [ 51.270444][ T5482] __d_alloc+0x50/0x690 [ 51.270453][ T5482] d_alloc_parallel+0xc4/0xf28 [ 51.270461][ T5482] __lookup_slow+0x90/0x2b4 [ 51.270469][ T5482] lookup_slow+0x60/0x84 [ 51.270477][ T5482] lookup_one_unlocked+0x88/0xa4 [ 51.270485][ T5482] ovl_lookup_single+0x25c/0xb74 [ 51.270493][ T5482] ovl_lookup_layer+0x2e8/0x3ac [ 51.270500][ T5482] ovl_lookup+0x474/0x162c [ 51.270507][ T5482] __lookup_slow+0x1e4/0x2b4 [ 51.270515][ T5482] lookup_slow+0x60/0x84 [ 51.270523][ T5482] path_lookupat+0x358/0x798 [ 51.270530][ T5482] filename_lookup+0x1d0/0x3c8 [ 51.270538][ T5482] filename_linkat+0xfc/0x4ac [ 51.270547][ T5482] __arm64_sys_linkat+0xf8/0x128 [ 51.270555][ T5482] invoke_syscall+0x98/0x244 [ 51.270565][ T5482] el0_svc_common+0xec/0x23c [ 51.270575][ T5482] do_el0_svc+0x4c/0x5c [ 51.270584][ T5482] el0_svc+0x64/0x260 [ 51.270593][ T5482] el0t_64_sync_handler+0x44/0x104 [ 51.270602][ T5482] el0t_64_sync+0x198/0x19c [ 52.010271][ T5491] loop5: detected capacity change from 0 to 8192 [ 52.079253][ T5495] loop5: detected capacity change from 0 to 256 [ 52.080865][ T5495] vfat: Unknown parameter 'sh¿fðο¡®P9²ortname' [ 52.108302][ T5497] Bluetooth: MGMT ver 1.23 [ 52.110259][ T5497] FAULT_INJECTION: forcing a failure. [ 52.110259][ T5497] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.114008][ T5497] CPU: 0 UID: 0 PID: 5497 Comm: syz.1.157 Not tainted syzkaller #0 PREEMPT [ 52.114036][ T5497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 52.114041][ T5497] Call trace: [ 52.114045][ T5497] show_stack+0x2c/0x3c (C) [ 52.114068][ T5497] __dump_stack+0x30/0x40 [ 52.114079][ T5497] dump_stack_lvl+0xd8/0x12c [ 52.114089][ T5497] dump_stack+0x1c/0x28 [ 52.114099][ T5497] should_fail_ex+0x41c/0x590 [ 52.114107][ T5497] should_fail+0x14/0x24 [ 52.114114][ T5497] should_fail_usercopy+0x20/0x30 [ 52.114121][ T5497] simple_read_from_buffer+0xc4/0x238 [ 52.114131][ T5497] proc_fail_nth_read+0x1a8/0x248 [ 52.114140][ T5497] vfs_read+0x230/0x8c8 [ 52.114147][ T5497] ksys_read+0x12c/0x228 [ 52.114153][ T5497] __arm64_sys_read+0x84/0x98 [ 52.114160][ T5497] invoke_syscall+0x98/0x244 [ 52.114170][ T5497] el0_svc_common+0xec/0x23c [ 52.114179][ T5497] do_el0_svc+0x4c/0x5c [ 52.114189][ T5497] el0_svc+0x64/0x260 [ 52.114198][ T5497] el0t_64_sync_handler+0x44/0x104 [ 52.114206][ T5497] el0t_64_sync+0x198/0x19c [ 52.139531][ T5499] mmap: syz.5.158 (5499) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 52.192361][ T5504] FAULT_INJECTION: forcing a failure. [ 52.192361][ T5504] name failslab, interval 1, probability 0, space 0, times 0 [ 52.195206][ T5504] CPU: 0 UID: 0 PID: 5504 Comm: syz.1.161 Not tainted syzkaller #0 PREEMPT [ 52.195227][ T5504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 52.195233][ T5504] Call trace: [ 52.195237][ T5504] show_stack+0x2c/0x3c (C) [ 52.195261][ T5504] __dump_stack+0x30/0x40 [ 52.195272][ T5504] dump_stack_lvl+0xd8/0x12c [ 52.195283][ T5504] dump_stack+0x1c/0x28 [ 52.195292][ T5504] should_fail_ex+0x41c/0x590 [ 52.195300][ T5504] should_failslab+0xc4/0x120 [ 52.195309][ T5504] kmem_cache_alloc_noprof+0x94/0x5d8 [ 52.195317][ T5504] skb_clone+0x1ac/0x320 [ 52.195328][ T5504] __netlink_deliver_tap+0x364/0x6f4 [ 52.195338][ T5504] netlink_deliver_tap+0x1d8/0x1dc [ 52.195347][ T5504] netlink_unicast+0x5dc/0x7f8 [ 52.195355][ T5504] netlink_sendmsg+0x648/0x948 [ 52.195364][ T5504] __sock_sendmsg+0xc8/0x17c [ 52.195372][ T5504] ____sys_sendmsg+0x3d0/0x6c8 [ 52.195382][ T5504] ___sys_sendmsg+0x198/0x224 [ 52.195391][ T5504] __sys_sendmsg+0x158/0x204 [ 52.195400][ T5504] __arm64_sys_sendmsg+0x88/0x9c [ 52.195409][ T5504] invoke_syscall+0x98/0x244 [ 52.195419][ T5504] el0_svc_common+0xec/0x23c [ 52.195428][ T5504] do_el0_svc+0x4c/0x5c [ 52.195438][ T5504] el0_svc+0x64/0x260 [ 52.195447][ T5504] el0t_64_sync_handler+0x44/0x104 [ 52.195455][ T5504] el0t_64_sync+0x198/0x19c [ 52.241575][ T5508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.163'. [ 52.297167][ T5513] loop0: detected capacity change from 0 to 2048 [ 52.354705][ T5513] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.376273][ T5517] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.059880][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.148035][ T5525] Injecting memory failure for pfn 0x1335e8 at process virtual address 0x20036000 [ 53.159237][ T5525] Memory failure: 0x1335e8: recovery action for clean LRU page: Recovered [ 53.159269][ T5525] Injecting memory failure for pfn 0x13cc8e at process virtual address 0x20037000 [ 53.159504][ T5525] Memory failure: 0x13cc8e: recovery action for clean LRU page: Recovered [ 53.159521][ T5525] Injecting memory failure for pfn 0x13cc81 at process virtual address 0x20038000 [ 53.169315][ T5525] Memory failure: 0x13cc81: recovery action for clean LRU page: Recovered [ 53.171361][ T5525] Injecting memory failure for pfn 0x13cc7f at process virtual address 0x20039000 [ 53.175444][ T5525] Memory failure: 0x13cc7f: recovery action for clean LRU page: Recovered [ 53.187605][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.274076][ T5471] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 53.303652][ T5535] tmpfs: Bad value for 'mpol' [ 53.936684][ T5543] binder: BINDER_SET_CONTEXT_MGR already set [ 53.936709][ T5543] binder: 5542:5543 ioctl 4018620d 20000480 returned -16 [ 53.963476][ T5543] binder: 5542:5543 got transaction to invalid handle, 3 [ 53.963506][ T5543] binder: 5542:5543 cannot find target node [ 53.963522][ T5543] binder: 5542:5543 transaction call to 0:0 failed 12/29201/-22, code 0 size 0-0 line 3252 [ 53.971857][ T4808] binder: undelivered TRANSACTION_ERROR: 29201 [ 54.237508][ T5567] set_capacity_and_notify: 1 callbacks suppressed [ 54.237548][ T5567] loop2: detected capacity change from 0 to 512 [ 54.238861][ T5567] journal_path: Non-blockdev passed as './file0' [ 54.238874][ T5567] EXT4-fs: error: could not find journal device path [ 54.315486][ T5572] binder: BINDER_SET_CONTEXT_MGR already set [ 54.315517][ T5572] binder: 5571:5572 ioctl 4018620d 20000480 returned -16 [ 54.340446][ T5572] binder: 5571:5572 got transaction to invalid handle, 3 [ 54.340478][ T5572] binder: 5571:5572 cannot find target node [ 54.340497][ T5572] binder: 5571:5572 transaction call to 0:0 failed 14/29201/-22, code 0 size 0-0 line 3252 [ 54.411546][ T5573] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(4) [ 54.631596][ T26] binder: undelivered TRANSACTION_ERROR: 29201 [ 54.724009][ T5578] loop1: detected capacity change from 0 to 2048 [ 54.790074][ T5578] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.796305][ T5584] loop3: detected capacity change from 0 to 512 [ 54.798890][ T5584] EXT4-fs (loop3): DAX unsupported by block device. [ 54.802909][ T5578] FAULT_INJECTION: forcing a failure. [ 54.802909][ T5578] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 54.803232][ T5578] CPU: 1 UID: 0 PID: 5578 Comm: syz.1.188 Not tainted syzkaller #0 PREEMPT [ 54.803250][ T5578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 54.803257][ T5578] Call trace: [ 54.803262][ T5578] show_stack+0x2c/0x3c (C) [ 54.803286][ T5578] __dump_stack+0x30/0x40 [ 54.803298][ T5578] dump_stack_lvl+0xd8/0x12c [ 54.803308][ T5578] dump_stack+0x1c/0x28 [ 54.803318][ T5578] should_fail_ex+0x41c/0x590 [ 54.803327][ T5578] should_fail+0x14/0x24 [ 54.803333][ T5578] should_fail_usercopy+0x20/0x30 [ 54.803340][ T5578] fsverity_ioctl_read_metadata+0x110/0x3a8 [ 54.803350][ T5578] ext4_ioctl+0x19d0/0x4430 [ 54.803359][ T5578] __arm64_sys_ioctl+0x154/0x1cc [ 54.803373][ T5578] invoke_syscall+0x98/0x244 [ 54.803383][ T5578] el0_svc_common+0xec/0x23c [ 54.803393][ T5578] do_el0_svc+0x4c/0x5c [ 54.803403][ T5578] el0_svc+0x64/0x260 [ 54.803412][ T5578] el0t_64_sync_handler+0x44/0x104 [ 54.803421][ T5578] el0t_64_sync+0x198/0x19c [ 54.829128][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.537210][ T5599] netlink: 8 bytes leftover after parsing attributes in process `syz.0.193'. [ 55.686585][ T5608] netlink: 8 bytes leftover after parsing attributes in process `syz.0.195'. [ 56.288049][ T5620] can0: slcan on ttyS3. [ 56.380929][ T5620] can0 (unregistered): slcan off ttyS3. [ 56.521977][ T5623] loop3: detected capacity change from 0 to 4096 [ 56.522444][ T5623] EXT4-fs: inline encryption not supported [ 56.523807][ T5623] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 56.523819][ T5623] EXT4-fs (loop3): Test dummy encryption mode enabled [ 56.530684][ T5623] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 56.530748][ T5623] System zones: 0-5 [ 56.536353][ T5623] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.560667][ T4714] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.613801][ T5628] loop3: detected capacity change from 0 to 256 [ 56.937581][ T5645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.206'. [ 57.144826][ T5654] netlink: 24 bytes leftover after parsing attributes in process `syz.5.208'. [ 57.268365][ T5657] netlink: 24 bytes leftover after parsing attributes in process `syz.5.209'. [ 57.422194][ T5662] loop2: detected capacity change from 0 to 4096 [ 57.424398][ T5662] EXT4-fs: inline encryption not supported [ 57.426191][ T5662] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 57.428142][ T5662] EXT4-fs (loop2): Test dummy encryption mode enabled [ 57.434012][ T5662] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 57.435849][ T5662] System zones: 0-5 [ 57.442140][ T5662] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.467910][ T4724] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.491118][ T5664] netlink: 8 bytes leftover after parsing attributes in process `syz.5.212'. [ 57.494433][ T5664] netlink: 34959 bytes leftover after parsing attributes in process `syz.5.212'. [ 57.495655][ T5673] netlink: 'syz.2.213': attribute type 12 has an invalid length. [ 57.495668][ T5673] netlink: 'syz.2.213': attribute type 29 has an invalid length. [ 57.495676][ T5673] netlink: 148 bytes leftover after parsing attributes in process `syz.2.213'. [ 57.496552][ T5673] 9p: Bad value for 'rfdno' [ 57.506380][ T5664] binder: 5663:5664 tried to acquire reference to desc 0, got 1 instead [ 57.510483][ T5664] binder: 5663:5664 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 57.513533][ T5664] binder: 5664 RLIMIT_NICE not set [ 57.513553][ T5664] binder: 5664 RLIMIT_NICE not set [ 57.516307][ T5664] binder: 5664 RLIMIT_NICE not set [ 57.516412][ T5664] binder: 5663:5664 got transaction with invalid offset (48, min 0 max 5632) or object. [ 57.516476][ T5664] binder: 5663:5664 transaction reply to 5663:5664 failed 20/29201/-22, code 0 size 5632-24 line 3524 [ 57.516499][ T5664] binder: send failed reply for transaction 19 to 5663:5664 [ 57.518478][ T5664] netlink: 8 bytes leftover after parsing attributes in process `syz.5.212'. [ 57.540820][ T26] binder: undelivered TRANSACTION_ERROR: 29190 [ 57.540907][ T26] binder: undelivered TRANSACTION_COMPLETE [ 57.540920][ T26] binder: undelivered TRANSACTION_ERROR: 29201 [ 57.554985][ T5677] loop5: detected capacity change from 0 to 256 [ 57.735056][ T5681] loop5: detected capacity change from 0 to 2048 [ 57.746431][ T5689] loop1: detected capacity change from 0 to 512 [ 57.747314][ T5689] EXT4-fs: inline encryption not supported [ 57.748844][ T5681] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.752918][ T5689] EXT4-fs: Mount option(s) incompatible with ext3 [ 57.767399][ T5689] netlink: 4 bytes leftover after parsing attributes in process `syz.1.220'. [ 57.779781][ T5689] netlink: 4 bytes leftover after parsing attributes in process `syz.1.220'. [ 57.915064][ T5699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.222'. [ 57.916875][ T5699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.917890][ T5699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.984049][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.112341][ T5705] loop5: detected capacity change from 0 to 128 [ 58.133708][ T5705] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 58.898660][ T5729] netlink: 8 bytes leftover after parsing attributes in process `syz.1.230'. [ 58.978773][ T5222] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 59.051158][ T5733] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 59.169890][ T5735] Illegal XDP return value 4294967294 on prog (id 24) dev syz_tun, expect packet loss! [ 59.693059][ T5748] geneve2: entered promiscuous mode [ 59.693094][ T5748] geneve2: entered allmulticast mode [ 59.746904][ T5755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.237'. [ 59.797868][ T5759] FAULT_INJECTION: forcing a failure. [ 59.797868][ T5759] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.797904][ T5759] CPU: 1 UID: 0 PID: 5759 Comm: syz.0.238 Not tainted syzkaller #0 PREEMPT [ 59.797916][ T5759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 59.797922][ T5759] Call trace: [ 59.797926][ T5759] show_stack+0x2c/0x3c (C) [ 59.797948][ T5759] __dump_stack+0x30/0x40 [ 59.797961][ T5759] dump_stack_lvl+0xd8/0x12c [ 59.797971][ T5759] dump_stack+0x1c/0x28 [ 59.797980][ T5759] should_fail_ex+0x41c/0x590 [ 59.797989][ T5759] should_fail+0x14/0x24 [ 59.797995][ T5759] should_fail_usercopy+0x20/0x30 [ 59.798003][ T5759] _inline_copy_from_user+0x3c/0x188 [ 59.798013][ T5759] do_sys_poll+0x1d8/0xc80 [ 59.798020][ T5759] __arm64_sys_ppoll+0x1f0/0x270 [ 59.798027][ T5759] invoke_syscall+0x98/0x244 [ 59.798037][ T5759] el0_svc_common+0xec/0x23c [ 59.798046][ T5759] do_el0_svc+0x4c/0x5c [ 59.798056][ T5759] el0_svc+0x64/0x260 [ 59.798065][ T5759] el0t_64_sync_handler+0x44/0x104 [ 59.798073][ T5759] el0t_64_sync+0x198/0x19c [ 59.979050][ T5769] binder: 5763:5769 got transaction to invalid handle, 3 [ 59.981092][ T5769] binder: 5763:5769 cannot find target node [ 59.982395][ T5769] binder: 5763:5769 transaction call to 0:0 failed 22/29201/-22, code 0 size 0-0 line 3252 [ 60.072073][ T5774] syz_tun: entered allmulticast mode [ 60.107866][ T5776] set_capacity_and_notify: 1 callbacks suppressed [ 60.111972][ T5776] loop0: detected capacity change from 0 to 512 [ 60.112353][ T5776] EXT4-fs: Ignoring removed i_version option [ 60.112378][ T5776] EXT4-fs: Ignoring removed bh option [ 60.117414][ T4808] binder: undelivered TRANSACTION_ERROR: 29201 [ 60.154966][ T5781] loop2: detected capacity change from 0 to 512 [ 60.168843][ T5776] EXT4-fs error (device loop0): ext4_orphan_get:1399: comm syz.0.241: inode #13: comm syz.0.241: iget: illegal inode # [ 60.168889][ T5776] loop0: lost filesystem error report for type 5 error -117 [ 60.173026][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 60.173051][ C1] EXT4-fs (loop0): initial error at time 60: ext4_orphan_get:1399 [ 60.173074][ C1] EXT4-fs (loop0): last error at time 60: ext4_orphan_get:1399 [ 60.179276][ T5776] EXT4-fs (loop0): Remounting filesystem read-only [ 60.186369][ T5781] EXT4-fs error (device loop2): ext4_validate_block_bitmap:432: comm syz.2.244: bg 0: block 4: invalid block bitmap [ 60.190060][ T5781] loop2: lost filesystem error report for type 5 error -117 [ 60.192972][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 60.193007][ C0] EXT4-fs (loop2): initial error at time 60: ext4_validate_block_bitmap:432 [ 60.193048][ C0] EXT4-fs (loop2): last error at time 60: ext4_validate_block_bitmap:432 [ 60.203152][ T5781] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 60.203183][ T5781] loop2: lost filesystem error report for type 5 error -117 [ 60.212654][ T5781] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.244: invalid indirect mapped block 1 (level 1) [ 60.212691][ T5781] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 60.215556][ T5781] EXT4-fs (loop2): 1 truncate cleaned up [ 60.225182][ T5781] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 60.227356][ T5776] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 60.265741][ T5776] EXT4-fs (loop0): shut down requested (2) [ 60.366756][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.384826][ T5781] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 60.433947][ T5780] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 60.803352][ T5815] loop5: detected capacity change from 0 to 2048 [ 60.835870][ T5815] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 60.924821][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.991539][ T5831] loop5: detected capacity change from 0 to 2048 [ 61.039613][ T4724] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.065145][ T5831] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.289377][ T5853] netlink: 'syz.0.259': attribute type 3 has an invalid length. [ 61.289915][ T5853] netlink: 'syz.0.259': attribute type 3 has an invalid length. [ 61.474467][ T5851] loop1: detected capacity change from 0 to 1024 [ 61.477216][ T5851] EXT4-fs: inline encryption not supported [ 61.484386][ T5851] Quota error (device loop1): do_check_range: Getting block 64 out of range 1-5 [ 61.484427][ T5851] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 61.484446][ T5851] EXT4-fs error (device loop1): ext4_acquire_dquot:7041: comm syz.1.261: Failed to acquire dquot type 0 [ 61.484464][ T5851] loop1: lost filesystem error report for type 5 error -117 [ 61.489203][ T5851] EXT4-fs error (device loop1): mb_free_blocks:2049: group 0, inode 13: block 160:freeing already freed block (bit 10); block bitmap corrupt. [ 61.492453][ T5851] EXT4-fs (loop1): 1 truncate cleaned up [ 61.493301][ T5851] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.519062][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.545115][ T5852] Quota error (device loop1): do_check_range: Getting block 64 out of range 1-5 [ 61.545171][ T5852] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 61.545182][ T5852] EXT4-fs error (device loop1): ext4_acquire_dquot:7041: comm syz.1.261: Failed to acquire dquot type 0 [ 61.753831][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.992483][ T5891] loop1: detected capacity change from 0 to 2048 [ 62.038379][ T5891] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 62.055391][ T5896] loop2: detected capacity change from 0 to 2048 [ 62.096767][ T5896] loop2: p2 < > p3 < > [ 62.162680][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.201969][ T5903] loop1: detected capacity change from 0 to 512 [ 62.935799][ T5903] EXT4-fs error (device loop1): ext4_validate_block_bitmap:432: comm syz.1.268: bg 0: block 4: invalid block bitmap [ 62.935844][ T5903] loop1: lost filesystem error report for type 5 error -117 [ 62.942968][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 62.942999][ C0] EXT4-fs (loop1): initial error at time 62: ext4_validate_block_bitmap:432 [ 62.943026][ C0] EXT4-fs (loop1): last error at time 62: ext4_validate_block_bitmap:432 [ 62.953370][ T5903] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 62.953408][ T5903] loop1: lost filesystem error report for type 5 error -117 [ 62.955320][ T5903] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.268: invalid indirect mapped block 1 (level 1) [ 62.955346][ T5903] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 62.959478][ T5903] EXT4-fs (loop1): 1 truncate cleaned up [ 62.959933][ T5903] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 63.076013][ T5902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 63.125073][ T5912] loop3: detected capacity change from 0 to 512 [ 63.125430][ T5912] journal_path: Non-blockdev passed as './file0' [ 63.125457][ T5912] EXT4-fs: error: could not find journal device path [ 63.143326][ T5910] loop0: detected capacity change from 0 to 8192 [ 63.178228][ T5910] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 63.210851][ T5910] FAT-fs (loop0): error, clusters badly computed (1 != 0) [ 63.210887][ T5910] FAT-fs (loop0): Filesystem has been set read-only [ 63.350924][ T5917] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(4) [ 63.551479][ T4816] wiimote 0005:057E:0306.0003: hidraw0: BLUETOOTH HID v0.03 Gamepad [sy®>d÷}ç³N] on syz0 [ 63.551593][ T4816] wiimote 0005:057E:0306.0003: New device registered [ 64.314148][ T5919] wiimote 0005:057E:0306.0003: Device removed [ 64.510459][ T1594] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.513791][ T1594] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.578046][ T4816] wiimote 0005:057E:0306.0003: detected device: Nintendo Wii Remote (Gen 1) [ 64.782074][ T1021] cfg80211: failed to load regulatory.db [ 64.790673][ T4816] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input8 [ 64.791727][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.797165][ T4816] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input9 [ 64.803370][ T4816] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input7 [ 64.840811][ T5931] __nla_validate_parse: 2 callbacks suppressed [ 64.840850][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.277'. [ 64.841626][ T5931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.841782][ T5931] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.875815][ T5933] netlink: 8 bytes leftover after parsing attributes in process `syz.0.276'. [ 64.877749][ T5933] netlink: 12 bytes leftover after parsing attributes in process `syz.0.276'. [ 64.881655][ T5933] netlink: 'syz.0.276': attribute type 4 has an invalid length. [ 65.006756][ T5935] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 65.754693][ T5940] set_capacity_and_notify: 1 callbacks suppressed [ 65.757171][ T5940] loop0: detected capacity change from 0 to 2048 [ 65.766536][ T5940] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 65.868714][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.883128][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.061650][ T5944] netlink: 24 bytes leftover after parsing attributes in process `syz.0.279'. [ 66.198263][ T5950] loop3: detected capacity change from 0 to 128 [ 67.165510][ T5964] loop0: detected capacity change from 0 to 128 [ 67.176640][ T5964] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 67.253297][ T4721] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 67.802196][ T5976] SET target dimension over the limit! [ 67.808458][ T5976] netlink: 'syz.0.288': attribute type 12 has an invalid length. [ 67.810076][ T5976] netlink: 'syz.0.288': attribute type 29 has an invalid length. [ 67.812141][ T5976] netlink: 148 bytes leftover after parsing attributes in process `syz.0.288'. [ 67.813306][ T5976] netlink: 59 bytes leftover after parsing attributes in process `syz.0.288'. [ 67.890850][ T5980] loop0: detected capacity change from 0 to 2048 [ 67.905451][ T5980] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.957352][ T4721] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.090935][ T5993] loop5: detected capacity change from 0 to 4096 [ 68.091261][ T5993] EXT4-fs: inline encryption not supported [ 68.092058][ T5993] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 68.092078][ T5993] EXT4-fs (loop5): Test dummy encryption mode enabled [ 68.144288][ T5993] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 68.144339][ T5993] System zones: 0-5 [ 68.147449][ T5993] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.169138][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.270381][ T6002] loop0: detected capacity change from 0 to 256 [ 68.275826][ T6002] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 68.351123][ T6008] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 68.443042][ T6008] FAT-fs (loop0): Filesystem has been set read-only [ 69.047546][ T6008] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.067516][ T6008] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.069813][ T6010] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 69.086903][ T6012] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 69.182223][ T6002] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 69.210076][ T6013] loop1: detected capacity change from 0 to 8192 [ 69.212161][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 69.217086][ T6002] FAT-fs (loop0): Filesystem has been set read-only [ 69.219027][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.223423][ T4717] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 69.223461][ T4717] Bluetooth: hci2: command 0x0c1a tx timeout [ 69.235189][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.236756][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.238500][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.240156][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.241954][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.244364][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.246865][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.248784][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.250442][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.251934][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.254248][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.255909][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.257844][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.259597][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.261386][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.263426][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.265208][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.266930][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.268727][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.270432][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.272240][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.274211][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.275886][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.277593][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.278539][ T6016] loop5: detected capacity change from 0 to 2048 [ 69.280627][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.282280][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.285467][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.287171][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.288794][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.290349][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.292168][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.293996][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.295585][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.296115][ T6013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.299'. [ 69.296128][ T6013] netlink: 12 bytes leftover after parsing attributes in process `syz.1.299'. [ 69.300654][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.302474][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.304174][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.304203][ T6002] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 69.316731][ T6016] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 69.319544][ T6022] loop3: detected capacity change from 0 to 512 [ 69.329495][ T6022] EXT4-fs error (device loop3): ext4_orphan_get:1399: inode #15: comm syz.3.303: iget: bad extended attribute block 134217728 [ 69.329533][ T6022] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 69.329681][ T6022] EXT4-fs error (device loop3): ext4_orphan_get:1404: comm syz.3.303: couldn't read orphan inode 15 (err -117) [ 69.329693][ T6022] loop3: lost filesystem error report for type 5 error -117 [ 69.341965][ T6022] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 69.404122][ T5222] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 69.404538][ T6026] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.303: bg 0: block 465: padding at end of block bitmap is not set [ 69.405812][ T6026] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 69.510019][ T6035] netlink: 8 bytes leftover after parsing attributes in process `syz.0.306'. [ 70.197038][ T4714] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.230906][ T6046] binder: BINDER_SET_CONTEXT_MGR already set [ 70.230927][ T6046] binder: 6045:6046 ioctl 4018620d 20000480 returned -16 [ 70.262259][ T6046] binder: 6045:6046 got transaction to invalid handle, 3 [ 70.262290][ T6046] binder: 6045:6046 cannot find target node [ 70.262319][ T6046] binder: 6045:6046 transaction call to 0:0 failed 24/29201/-22, code 0 size 0-0 line 3252 [ 70.333173][ T4816] binder: undelivered TRANSACTION_ERROR: 29201 [ 70.522813][ T6058] loop1: detected capacity change from 0 to 2048 [ 70.545607][ T6058] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 70.708472][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.725238][ T6071] FAULT_INJECTION: forcing a failure. [ 70.725238][ T6071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 70.725271][ T6071] CPU: 0 UID: 0 PID: 6071 Comm: syz.2.316 Not tainted syzkaller #0 PREEMPT [ 70.725283][ T6071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 70.725289][ T6071] Call trace: [ 70.725292][ T6071] show_stack+0x2c/0x3c (C) [ 70.725310][ T6071] __dump_stack+0x30/0x40 [ 70.725322][ T6071] dump_stack_lvl+0xd8/0x12c [ 70.725331][ T6071] dump_stack+0x1c/0x28 [ 70.725341][ T6071] should_fail_ex+0x41c/0x590 [ 70.725349][ T6071] should_fail+0x14/0x24 [ 70.725355][ T6071] should_fail_usercopy+0x20/0x30 [ 70.725362][ T6071] _inline_copy_from_user+0x3c/0x174 [ 70.725371][ T6071] copy_from_bpfptr+0x70/0xb0 [ 70.725378][ T6071] bpf_prog_load+0x87c/0x158c [ 70.725386][ T6071] __sys_bpf+0x7d4/0x82c [ 70.725392][ T6071] __arm64_sys_bpf+0xd0/0xec [ 70.725399][ T6071] invoke_syscall+0x98/0x244 [ 70.725409][ T6071] el0_svc_common+0xec/0x23c [ 70.725419][ T6071] do_el0_svc+0x4c/0x5c [ 70.725428][ T6071] el0_svc+0x64/0x260 [ 70.725437][ T6071] el0t_64_sync_handler+0x44/0x104 [ 70.725446][ T6071] el0t_64_sync+0x198/0x19c [ 71.071133][ T6075] netlink: 12 bytes leftover after parsing attributes in process `syz.1.317'. [ 71.388048][ T6089] FAULT_INJECTION: forcing a failure. [ 71.388048][ T6089] name failslab, interval 1, probability 0, space 0, times 0 [ 71.390938][ T6089] CPU: 1 UID: 0 PID: 6089 Comm: syz.1.321 Not tainted syzkaller #0 PREEMPT [ 71.390961][ T6089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 71.390969][ T6089] Call trace: [ 71.390973][ T6089] show_stack+0x2c/0x3c (C) [ 71.390997][ T6089] __dump_stack+0x30/0x40 [ 71.391009][ T6089] dump_stack_lvl+0xd8/0x12c [ 71.391019][ T6089] dump_stack+0x1c/0x28 [ 71.391029][ T6089] should_fail_ex+0x41c/0x590 [ 71.391037][ T6089] should_failslab+0xc4/0x120 [ 71.391046][ T6089] __kmalloc_cache_noprof+0x94/0x5ec [ 71.391055][ T6089] resv_map_alloc+0x60/0x284 [ 71.391065][ T6089] hugetlbfs_get_inode+0x70/0x834 [ 71.391076][ T6089] hugetlb_file_setup+0x20c/0x574 [ 71.391085][ T6089] ksys_mmap_pgoff+0x16c/0x5b4 [ 71.391095][ T6089] __arm64_sys_mmap+0x110/0x12c [ 71.391104][ T6089] invoke_syscall+0x98/0x244 [ 71.391114][ T6089] el0_svc_common+0xec/0x23c [ 71.391124][ T6089] do_el0_svc+0x4c/0x5c [ 71.391133][ T6089] el0_svc+0x64/0x260 [ 71.391142][ T6089] el0t_64_sync_handler+0x44/0x104 [ 71.391151][ T6089] el0t_64_sync+0x198/0x19c [ 71.814272][ T6102] binder: binder_mmap: 6099 20ffe000-21000000 bad vm_flags failed -1 [ 71.935376][ T6107] loop0: detected capacity change from 0 to 128 [ 71.945948][ T6107] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 71.950945][ T6111] loop2: detected capacity change from 0 to 2048 [ 71.967121][ T6111] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.983184][ T4721] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 72.053323][ T4724] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.075012][ T6122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 72.098686][ T6124] ================================================================== [ 72.098704][ T6124] BUG: KASAN: slab-out-of-bounds in soft_cursor+0x378/0x6bc [ 72.098724][ T6124] Read of size 24 at addr ffff0000f5ffd068 by task syz.0.332/6124 [ 72.098734][ T6124] [ 72.098739][ T6124] CPU: 1 UID: 0 PID: 6124 Comm: syz.0.332 Not tainted syzkaller #0 PREEMPT [ 72.098749][ T6124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 72.098755][ T6124] Call trace: [ 72.098758][ T6124] show_stack+0x2c/0x3c (C) [ 72.098772][ T6124] __dump_stack+0x30/0x40 [ 72.098784][ T6124] dump_stack_lvl+0xd8/0x12c [ 72.098796][ T6124] print_address_description+0xb0/0x238 [ 72.098805][ T6124] print_report+0x68/0x84 [ 72.098813][ T6124] kasan_report+0x8c/0xc4 [ 72.098825][ T6124] kasan_check_range+0x17c/0x1ac [ 72.098836][ T6124] __asan_memcpy+0x3c/0x84 [ 72.098847][ T6124] soft_cursor+0x378/0x6bc [ 72.098862][ T6124] ccw_cursor+0xb18/0x11e4 [ 72.098871][ T6124] fbcon_cursor+0x344/0x498 [ 72.098879][ T6124] hide_cursor+0xdc/0x2d0 [ 72.098889][ T6124] redraw_screen+0x200/0x51c [ 72.098898][ T6124] vc_do_resize+0x884/0xbbc [ 72.098908][ T6124] __vc_resize+0x60/0x74 [ 72.098917][ T6124] fbcon_do_set_font+0x3d8/0x734 [ 72.098926][ T6124] fbcon_set_font+0x4f0/0x6ac [ 72.098934][ T6124] con_font_op+0x98c/0xc6c [ 72.098944][ T6124] vt_ioctl+0x1664/0x1d4c [ 72.098955][ T6124] tty_ioctl+0x828/0xcb0 [ 72.098965][ T6124] __arm64_sys_ioctl+0x154/0x1cc [ 72.098978][ T6124] invoke_syscall+0x98/0x244 [ 72.098990][ T6124] el0_svc_common+0xec/0x23c [ 72.099002][ T6124] do_el0_svc+0x4c/0x5c [ 72.099013][ T6124] el0_svc+0x64/0x260 [ 72.099024][ T6124] el0t_64_sync_handler+0x44/0x104 [ 72.099034][ T6124] el0t_64_sync+0x198/0x19c [ 72.099043][ T6124] [ 72.099044][ T6124] Allocated by task 6053: [ 72.099049][ T6124] kasan_save_track+0x40/0x78 [ 72.099058][ T6124] kasan_save_alloc_info+0x40/0x50 [ 72.099067][ T6124] __kasan_kmalloc+0x9c/0xb4 [ 72.099076][ T6124] __kmalloc_noprof+0x340/0x6b8 [ 72.099084][ T6124] font_data_rotate+0x100/0x2f0 [ 72.099094][ T6124] fbcon_rotate_font+0x218/0x374 [ 72.099102][ T6124] fbcon_modechanged+0x19c/0x698 [ 72.099109][ T6124] fbcon_set_all_vcs+0x3e8/0x430 [ 72.099115][ T6124] rotate_all_store+0x33c/0x428 [ 72.099122][ T6124] dev_attr_store+0x6c/0x90 [ 72.099131][ T6124] sysfs_kf_write+0xe0/0x108 [ 72.099141][ T6124] kernfs_fop_write_iter+0x260/0x3b8 [ 72.099150][ T6124] vfs_write+0x51c/0xa0c [ 72.099156][ T6124] ksys_write+0x12c/0x228 [ 72.099161][ T6124] __arm64_sys_write+0x84/0x98 [ 72.099167][ T6124] invoke_syscall+0x98/0x244 [ 72.099177][ T6124] el0_svc_common+0xec/0x23c [ 72.099187][ T6124] do_el0_svc+0x4c/0x5c [ 72.099197][ T6124] el0_svc+0x64/0x260 [ 72.099205][ T6124] el0t_64_sync_handler+0x44/0x104 [ 72.099213][ T6124] el0t_64_sync+0x198/0x19c [ 72.099219][ T6124] [ 72.099221][ T6124] The buggy address belongs to the object at ffff0000f5ffc000 [ 72.099221][ T6124] which belongs to the cache kmalloc-4k of size 4096 [ 72.099227][ T6124] The buggy address is located 104 bytes to the right of [ 72.099227][ T6124] allocated 4096-byte region [ffff0000f5ffc000, ffff0000f5ffd000) [ 72.099235][ T6124] [ 72.099237][ T6124] The buggy address belongs to the physical page: [ 72.099241][ T6124] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x135ff8 [ 72.099248][ T6124] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.099254][ T6124] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 72.099263][ T6124] page_type: f5(slab) [ 72.099270][ T6124] raw: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 72.099277][ T6124] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 72.099284][ T6124] head: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 72.099291][ T6124] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 72.099298][ T6124] head: 05ffc00000000003 fffffdffc3d7fe01 00000000ffffffff 00000000ffffffff [ 72.099305][ T6124] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 72.099309][ T6124] page dumped because: kasan: bad access detected [ 72.099312][ T6124] [ 72.099314][ T6124] Memory state around the buggy address: [ 72.099318][ T6124] ffff0000f5ffcf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.099323][ T6124] ffff0000f5ffcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.099328][ T6124] >ffff0000f5ffd000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.099332][ T6124] ^ [ 72.099337][ T6124] ffff0000f5ffd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.099342][ T6124] ffff0000f5ffd100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.099346][ T6124] ================================================================== [ 72.100790][ T6124] Disabling lock debugging due to kernel taint [ 74.013044][ T4717] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 74.013078][ T4717] Bluetooth: hci2: command 0x0c1a tx timeout