last executing test programs: 32m4.471633098s ago: executing program 32 (id=33): openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$igmp6(0xa, 0x3, 0x2) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) sendfile(r3, r3, 0x0, 0x1000000201005) 31m21.992282432s ago: executing program 33 (id=79): socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x200000, &(0x7f0000000240)={[{@grpquota}, {@block_validity}, {@journal_ioprio}, {@i_version}, {@nobarrier}]}, 0x1, 0xbaf, &(0x7f0000002f00)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5mm6cwcE38/eHPe97wn8zxPTmfOe2BOA/jHms5+pBGHIuJsEjFZ359GxFC1NxKxWTvu/t3L81lLolJ5+7ckkoi4d/fyfOO1kvp2vD4YiYibryXx749a466ubyzPlcullfr46Nr5S0dX1zdeWTo/d650rnThxOyrJ2ZPzs52sdbbl9774pkf3nj+6vWPZ978/MB3SZyOifpccx3dMh3TW3+TZoWImOt2sJwM1OtprjMp5JgQAAAdpU1ruP/GZAzEw8XbZHz7Y67JAQAAAF1RGYioAAAAAPtc4v4fAAAA9rnG9wDu3b0832j5fiOhv+6ciYipWv2N55trM4XYrG5HYjAixn5Povmx1qT2a09tOov09felrEWPnkPuZPNKRPx/u/OfVOufqj7F3Vp/GhEzXYg//ch4L9V/ugvxn6z+4S5EBICIG2dqF7LW61+6tf6Jba5/hW2uXbuR9/W/sf6737L+e1j/QJv131s7jHH4wUs32801r//e/eTnhSx+tn2qop7AnSsRhwvb1Z9s1Z+0qf/sDmOMz9++1m4uqz+rt9H6XX/lesSR6mqutf6GpNP/T3R0calcmqn93Ob11092jt98/rOWxW/cC/RDdv7HYnfn/9IOY0z979dD7eYeX3/6y1DyTrU3VN/z4dza2sqxiKHk9db9xzvn0jim8RpZ/S8+1/n9v1392WfCZv3vkP3ruVLfZuOrj8QcP3L8q93X31tZ/Qu7PP+f7jDGl99ce7/dXN71AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALA3pBExEUla3OqnabEYMR4R/4mxtHxxde3lxYsfXFjI5iKmYjBdXCqXZiJisjZOsvGxav/h+Pgj49mIOBgRn02OVsfF+YvlhbyLBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYMt4RExEkhYjIo2IPybTtFjMOysAAACg66byTgAAAADoOff/AAAAsP+13P8X/jIa6WcuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7EsHn71xK4mIzVOj1ZYZqs8N5poZ0Gvpzg4b63UeQP8N5J0AkJtCU79SqVRyTAXoM/f4QPKY+ZG2M8NdzwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAv68XDt24lUTE5qnRassM1ecGc80M6LU07wSA3Ax0mkweuwPYwwp5JwDkxj0+UFvZP6jUtM6PtP3N4aeOCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDeMVFtSVqMiLTaT9NiMeJfETEVg8niUrk0ExEHIuKnycHhbHws76QBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoutX1jeW5crm0oqOj08XOaPQt1mj9zdzmmOH2Ux06OX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQi9X1jeW5crm0spp3JgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDeVtc3lufK5dJKDzt51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DAAA///6CAm5") r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) unshare(0x64000600) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000000)={0x4, 0x75, 0x3, 0x9, 0x1, "389c8cf30c3d2a39233260927ea1b1e1b1c01e"}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) mount(0x0, 0x0, &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1c5e42, 0x0) write$P9_RUNLINKAT(r1, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xb) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000500)={'syz1\x00', {0x8000, 0x3}, 0x2d, [0x9, 0x0, 0x2, 0x1, 0x0, 0x0, 0x5, 0x0, 0x1000000, 0x0, 0x0, 0xfffffffa, 0xc0, 0x0, 0x7f, 0x0, 0x1000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2000000, 0x143, 0xfefffffe, 0x0, 0x0, 0x0, 0x2e0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xd6d, 0x0, 0x1, 0x3, 0xffffffde, 0x487, 0x1000d6, 0x0, 0xfd5c, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0xfffffffa, 0x0, 0x0, 0x0, 0x9, 0xfffffffd, 0x0, 0x1, 0x1000, 0x14], [0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7, 0x20, 0xfffffffc, 0x8001, 0x6, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x3, 0x7, 0x1, 0x9, 0x400, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffff36, 0x0, 0xd58b, 0x0, 0x20008, 0x0, 0x0, 0x7, 0x0, 0x80, 0x8, 0x0, 0x10000, 0x5, 0x27, 0x0, 0x0, 0x80000000], [0x100, 0x0, 0x6, 0x0, 0x0, 0x9, 0x3, 0xffff, 0x1, 0x0, 0x0, 0x0, 0xcbcd, 0x0, 0x10000000, 0x7, 0x3a, 0x0, 0x400, 0x40, 0x1, 0x0, 0x7fff, 0x0, 0x80, 0x0, 0xe8c, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xfffffffb, 0x806, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x8, 0xff, 0x2, 0x0, 0x0, 0x28000000, 0x0, 0xfffffffe, 0x4, 0x0, 0x4d4c], [0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x7, 0x0, 0x0, 0x400, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x7, 0x0, 0x4, 0xc73, 0x9, 0x0, 0x0, 0xffffffff, 0x40, 0xe6f, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x4800, 0x0, 0x4, 0x0, 0x6, 0x4]}, 0x45c) socket$inet(0x2, 0x2, 0x1) 30m17.519166152s ago: executing program 4 (id=236): r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(r0, 0x47, &(0x7f0000000200)=0x7) 30m16.225103125s ago: executing program 4 (id=241): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r1, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef3", 0x8}], 0x1}}], 0x1, 0x2090) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) sendmmsg(r1, &(0x7f0000008d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 30m14.388995182s ago: executing program 4 (id=244): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) epoll_create1(0x0) r3 = socket(0x28, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/intl_enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='1', 0x1) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x200}, 0x8) bind(0xffffffffffffffff, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x80) connect(0xffffffffffffffff, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth1_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x15}}) 30m13.080727017s ago: executing program 4 (id=247): socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x800, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) read$hiddev(0xffffffffffffffff, &(0x7f0000000400)=""/194, 0xc2) syz_mount_image$iso9660(&(0x7f0000000140), &(0x7f0000000100)='./file0\x00', 0x2000c12, &(0x7f0000000180)={[{@check_relaxed}, {@dmode}, {@session={'session', 0x3d, 0xd}}, {@cruft}, {@map_acorn}, {@unhide}, {@overriderock}, {@showassoc}, {@map_normal}, {@nocompress}, {@nojoliet}, {@iocharset={'iocharset', 0x3d, 'cp857'}}, {@hide}, {@map_off}, {@unhide}, {@iocharset={'iocharset', 0x3d, 'koi8-ru'}}, {@map_off}, {@iocharset={'iocharset', 0x3d, 'iso8859-7'}}]}, 0x81, 0xa4f, &(0x7f0000001500)="$eJzs3U9sXVdeB/DvfbYTxzMkmU4opWqbl5RkPB3j2M40IepiSOyX1IP/INuRGrGYzDQOCjEUGpDaCCnphhUVSCAWsKtYwYJK3dAN6g52sGKBVHXFvmIVVh7dd5/jZ/s9vzh17CT9fKznd++5v3vO79537zt+f3xPeLasHtkwt7ravD3K/EdtZS1X/2kPMuYpdmnqq08+/bi8fXQ/B9KXN4t/TQaT1JP+JC8lA5NTC/OzB7ev6HZyPckXSZGkDC4eNYfrKf4q312f/yLFP5TtdnXgUWuml1W+1fb7+AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKdRMTk1NjZeHMj03NV36pWkvsXk1MJ8kdXVrUvW1ql83hz1u/i8Z7tJUd4yOLg21PdLx9YXv5ikfjKvVHOvNAckz2DufufFo299v7+2tn63bL6Rg49UbWpVbrd/vrKy/H73uNV7VdwuJvj0uNKYm16cn569eKVRn16cr184d27szNuXF+uXp2cai9cWlxqz9cmFxsWl+YX68OQP6+MXLpytN0avzV+duzI1OtNYKzz/mxNjY+fqPx393cbFhcX5uTM/HV2cfHt6ZmZ67kozplxcxpwvD8TfmV6qLzUuztbrN2+tLJ/dlFPf5p1dBo332pIyaKJHTH/GJibGxycmxj9qjZ49sVZw7s0Lb54fG+sf2yRbIp7QQcvT5VD3h3k3n77hG6lV/X/+YCbTmcvVvJN6x5/JTGUh85ntsrxlrf8/daaxbbvt/X+rl+9vW/xy+etkXmvNDrb6/19J0t7/d8ll737u5MPcze38PCtZyXLe3/eM9vbnShqZy3QWM5/pzOZis6TeKqnnQs7lXMbys7yd41lMPZcznZk0sphrWcxSGs0jajILaeRiljKfhdQznMn8MPWM50Iu5GzqaWQ01zKfq5nLlUzlYrOWm7nV3O9nt8nxYdB496Dyj7kqaGKbmjZ35uWxvrP+v/G8/iXII9v9J3F4TKut/v/ApvK+raHDk3uVFAAAALCrfv0/cvjYC//+ZVLk1eb78penZxo/2e+0AAAAgF3U/LreK+XdQDn16mDz9f/YfqcFAAAA7KKi+T92RZKhHK+m1v5dypsAAAAA8Jxofv7/Worj6wVe/wMAAMBzpvc19ntGFCNrl/+t36jub7QiqrmiyPRMY3Ryfuat8ZxuXmUgyatttc0kqTWvOVgMNP/94I2cqKJODFX3Q+s1lm0OllHjo2+N542cbG3I8Ovl3evDHSInqsgfVJE/aI/sy4bIs2UkADzvTnbqj3fY/7+RkSpi5OVml9//coc+eEzPCgBPi4dj7Px/a0izDv1/K+K1bv3/j7d5/V9GvJCbx6uvFIzm3byXldzISFrfODjeqdYDrdH1qq8hjPR4N2Co9ZWF/zpfy8iW9wMGH25re+xyJjKy/o7AL1rvVWyst1jL4Wy1tMOgCADwLDq5bT/8aP3/SI/X/0O+UggAT5U7H96tRrC/8+Hd1XutiYcl6xNDbSX3usR0m9jvbQQANtJLAwAAAAAAAAAAAAAAAAAAAAAAAAAAwO7bcLn+Q63CzRfw/8/TycrKcrKjy/5/w4nBThk+3kQte5Tzvk/0JdmdCsvdv7O1fpIdtzXY4WDbwcQ/H2qt/r/7v+f3eyK7XiEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADfAkXS16m8lhxMMpbkzN5n9eTc3+8Edkv9wGOtVjzIg3yQw7ueDwAAAAAAAAAAAAAAAAAAAAAAAAAAAADAt1zr+v+1VPffqYrSX0tOJbme5Pf2O8fd9GC/E3gyit4hf1gFrl//v5YMZLVIf/WwpxiYnFqYny2rKg6Wy7/65NOPy1vvureOqlBWULZQHlQLD7OsWmgLG9i41veaa/13a64+dal5YF5aujwzNXtl4bfXA18sPqvGrai3rb2W75+f+re/bis+UGVRfFZuaWdVu0NTy3du/+l7f1yfutxsd2pru7+2cb1iu3Yfwa2V5YmypaXGO0t/9ke3Pmhb9EJOJK8PJ8Mbt/D3y1uXlk5s3p+bsv26+IvicP4u13O4dcAUq0W5c440t//QzVsry6Pvvrdy42FO9zbkdDTHk9xIBjvk9C+dczre/dhsHnW1gbLVsWZQ+etYj23cVluN41326/eah8xQ523o0ma9x/nVY7+3MjrbMaO/+ZPv5/SOH+nTPVrsqPi6+J9i89la+zLVU32Hs7NDFc3ItiOlfdmG06tWRTa3fKJ9wc8219n1rOQJ+Mv8Ir/1cPyXWtvzf+ux2pvno7YWO58Xyc7Pi388sqVHWdfskY5tGu6o9ezTbZ1WnseqqC55/mp+VNW5g2eUH/XqsZ/Q+f/3xXD+L/eN/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADz9iqQvyerBTeW15FSSo0mOlPP1ZHXzuvcfo73aUPHYue6Gx8n52VN03dDiQR7kgxze64wAAAAAAAAAeDIuTX31yacfl7fm5/F9+Y1akh9Xn/T3Jzla/O3A5NTC/GyPigaS62sf6Q/uLIfr5a/vrs9/Uc691GOl/f36AAA8034ZAAD//+b1YfU=") mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f,,\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 30m10.578485185s ago: executing program 4 (id=250): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_icmp(0xa, 0x2, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) lseek(r3, 0x3, 0x0) 30m9.324869889s ago: executing program 4 (id=252): openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$igmp6(0xa, 0x3, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) sendfile(r2, r2, 0x0, 0x1000000201005) 29m53.829793736s ago: executing program 34 (id=252): openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$igmp6(0xa, 0x3, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) sendfile(r2, r2, 0x0, 0x1000000201005) 10m29.279746501s ago: executing program 3 (id=2399): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x920, 0x12) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(&(0x7f0000000300)={0x28000800, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x58) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r3 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_UNLOCK(r3, 0xc) r4 = socket(0x40000000015, 0x5, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 10m26.216901739s ago: executing program 3 (id=2410): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2b, 0x1804, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'pim6reg\x00', {0xff}, {}, 0x3a}, 0x5002, 0xf8, 0x140, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@state={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x1}}}, {{@ipv6={@local, @empty, [0xffffffff], [], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x24}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newsa={0x200, 0x10, 0x633, 0x70bd2a, 0x0, {{@in6=@local, @in6=@mcast1, 0x0, 0xfffd, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x4}, {@in=@multicast1, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0xfffffffffffffffd, 0x40000000000, 0x0, 0x2dcd, 0x3}, {}, {0x0, 0x4, 0x3}, 0x70bd25, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth={0xc8, 0x1, {{'md5\x00'}, 0x400, "03ff00004137b192fb8e5e7f447874748563bab2c89a19dd1016fe153742ae1eadb71f875a55462594512efa7aa6403aff00afa206c194ec05960e8c34b772a4c07334ff92c58543b783cb4b56919693a638b9f5f5f18a2a8b6a939ae273c1fdd6e1e79d7ed157870f83c5d28b8157b3d0fc069b64e462640bfa8ef34eaf73ab"}}]}, 0x200}, 0x1, 0x0, 0x0, 0x24000084}, 0x0) listen(r1, 0x5) setsockopt$inet_tcp_int(r1, 0x6, 0x3, &(0x7f0000000080)=0xa, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newnexthop={0x30, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x5}, {0x0, 0x6}]}, @NHA_FDB={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_freezer_state(r6, &(0x7f0000000140), 0x2, 0x0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r7, 0xf517, 0x0) mkdirat$cgroup(r6, &(0x7f00000000c0)='syz1\x00', 0x1ff) write$cgroup_freezer_state(r7, &(0x7f0000000040)='FROZEN\x00', 0x7) sendfile(r7, r7, 0x0, 0x9) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f0000000300)={0x3, 0x1, 0x6, 0x87f}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg(r8, &(0x7f0000001c00), 0x400000000000159, 0x40840) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'gretap0\x00', 0x0, 0x40, 0x8000, 0xffffffff, 0xc, {{0x16, 0x4, 0x0, 0x10, 0x58, 0x68, 0x0, 0xe, 0x29, 0x0, @broadcast, @rand_addr=0x64010101, {[@ssrr={0x89, 0x13, 0x3f, [@rand_addr=0x64010101, @rand_addr=0x64010101, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x37}]}, @cipso={0x86, 0x1b, 0xffffffffffffffff, [{0x1, 0xc, "df32d6a743bfaf1fb7af"}, {0x5, 0x9, "7fd356cec23675"}]}, @timestamp={0x44, 0x14, 0x9e, 0x0, 0x7, [0x1, 0x1, 0x3, 0x401]}]}}}}}) socket$packet(0x11, 0x3, 0x300) 10m19.480175553s ago: executing program 3 (id=2417): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x920, 0x12) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(&(0x7f0000000300)={0x28000800, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x58) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee00, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r3 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_UNLOCK(r3, 0xc) r4 = socket(0x40000000015, 0x5, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 10m14.980029494s ago: executing program 3 (id=2421): read$msr(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffc, 0x0, 0x0, 0x8, 0xfc, 0x4, 0xe9, 0x7, 0x1, 0x0, 0x0, 0x6, 0x9}, {0x0, 0x0, 0x0, 0x40, 0x10, 0x6, 0xfd, 0xfc, 0x1, 0xfd, 0x47}, {0x3, 0xa, 0x22, 0x8, 0x40, 0x0, 0x5f, 0x1, 0x2, 0x2, 0x0, 0x0, 0xfffffffffffffffd}], 0x1ffffff}) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8000000001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r1, &(0x7f0000006300), 0x2000, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r4, &(0x7f0000000040)=0x8000000001cb, 0x12) 10m11.286171635s ago: executing program 3 (id=2426): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x920, 0x12) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(&(0x7f0000000300)={0x28000800, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x58) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r3 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_UNLOCK(r3, 0xc) r4 = socket(0x40000000015, 0x5, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 10m2.712025547s ago: executing program 3 (id=2436): connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f00000000c0)={0x33}, 0x8) 9m54.886667262s ago: executing program 0 (id=2446): read$msr(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffc, 0x0, 0x0, 0x8, 0xfc, 0x4, 0xe9, 0x7, 0x1, 0x0, 0x0, 0x6, 0x9}, {0x0, 0x0, 0x0, 0x40, 0x10, 0x6, 0xfd, 0xfc, 0x1, 0xfd, 0x47}, {0x3, 0xa, 0x22, 0x8, 0x40, 0x0, 0x5f, 0x1, 0x2, 0x2, 0x0, 0x0, 0xfffffffffffffffd}], 0x1ffffff}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8000000001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r3, &(0x7f0000006300), 0x2000, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r4) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r5, &(0x7f0000000040)=0x8000000001cb, 0x12) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 9m52.937672444s ago: executing program 0 (id=2449): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) epoll_create1(0x0) keyctl$invalidate(0x15, 0x0) r3 = socket(0x28, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/intl_enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='1', 0x1) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt$inet_sctp_SCTP_MAXSEG(r5, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x200}, 0x8) bind(r5, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x80) connect(r5, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10) sendto(r5, &(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth1_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x15}}) 9m50.062744932s ago: executing program 0 (id=2456): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = fsopen(&(0x7f0000000040)='configfs\x00', 0x1) fsmount(r4, 0x0, 0x1) 9m47.193857448s ago: executing program 35 (id=2436): connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f00000000c0)={0x33}, 0x8) 9m45.566749362s ago: executing program 0 (id=2460): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000080)={[{@grpid}, {@jqfmt_vfsv0}]}, 0x4, 0x4eb, &(0x7f0000000540)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet(0x2, 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) shutdown(r3, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000080)={@local, @dev={0xac, 0x14, 0x14, 0x11}}, 0xc) add_key(0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) 9m35.550532679s ago: executing program 0 (id=2472): read$msr(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffc, 0x0, 0x0, 0x8, 0xfc, 0x4, 0xe9, 0x7, 0x1, 0x0, 0x0, 0x6, 0x9}, {0x0, 0x0, 0x0, 0x40, 0x10, 0x6, 0xfd, 0xfc, 0x1, 0xfd, 0x47}, {0x3, 0xa, 0x22, 0x8, 0x40, 0x0, 0x5f, 0x1, 0x2, 0x2, 0x0, 0x0, 0xfffffffffffffffd}], 0x1ffffff}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8000000001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r3, &(0x7f0000006300), 0x2000, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r6, &(0x7f0000000040)=0x8000000001cb, 0x12) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 9m27.471684067s ago: executing program 0 (id=2484): socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x800, 0x2) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) read$hiddev(0xffffffffffffffff, &(0x7f0000000400)=""/194, 0xc2) syz_mount_image$iso9660(&(0x7f0000000140), &(0x7f0000000100)='./file0\x00', 0x2000c12, &(0x7f0000000180)={[{@check_relaxed}, {@dmode}, {@session={'session', 0x3d, 0xd}}, {@cruft}, {@map_acorn}, {@unhide}, {@overriderock}, {@showassoc}, {@map_normal}, {@nocompress}, {@nojoliet}, {@iocharset={'iocharset', 0x3d, 'cp857'}}, {@hide}, {@map_off}, {@unhide}, {@iocharset={'iocharset', 0x3d, 'koi8-ru'}}, {@map_off}, {@iocharset={'iocharset', 0x3d, 'iso8859-7'}}]}, 0x81, 0xa4f, &(0x7f0000001500)="$eJzs3U9sXVdeB/DvfbYTxzMkmU4opWqbl5RkPB3j2M40IepiSOyX1IP/INuRGrGYzDQOCjEUGpDaCCnphhUVSCAWsKtYwYJK3dAN6g52sGKBVHXFvmIVVh7dd5/jZ/s9vzh17CT9fKznd++5v3vO79537zt+f3xPeLasHtkwt7ravD3K/EdtZS1X/2kPMuYpdmnqq08+/bi8fXQ/B9KXN4t/TQaT1JP+JC8lA5NTC/OzB7ev6HZyPckXSZGkDC4eNYfrKf4q312f/yLFP5TtdnXgUWuml1W+1fb7+AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKdRMTk1NjZeHMj03NV36pWkvsXk1MJ8kdXVrUvW1ql83hz1u/i8Z7tJUd4yOLg21PdLx9YXv5ikfjKvVHOvNAckz2DufufFo299v7+2tn63bL6Rg49UbWpVbrd/vrKy/H73uNV7VdwuJvj0uNKYm16cn569eKVRn16cr184d27szNuXF+uXp2cai9cWlxqz9cmFxsWl+YX68OQP6+MXLpytN0avzV+duzI1OtNYKzz/mxNjY+fqPx393cbFhcX5uTM/HV2cfHt6ZmZ67kozplxcxpwvD8TfmV6qLzUuztbrN2+tLJ/dlFPf5p1dBo332pIyaKJHTH/GJibGxycmxj9qjZ49sVZw7s0Lb54fG+sf2yRbIp7QQcvT5VD3h3k3n77hG6lV/X/+YCbTmcvVvJN6x5/JTGUh85ntsrxlrf8/daaxbbvt/X+rl+9vW/xy+etkXmvNDrb6/19J0t7/d8ll737u5MPcze38PCtZyXLe3/eM9vbnShqZy3QWM5/pzOZis6TeKqnnQs7lXMbys7yd41lMPZcznZk0sphrWcxSGs0jajILaeRiljKfhdQznMn8MPWM50Iu5GzqaWQ01zKfq5nLlUzlYrOWm7nV3O9nt8nxYdB496Dyj7kqaGKbmjZ35uWxvrP+v/G8/iXII9v9J3F4TKut/v/ApvK+raHDk3uVFAAAALCrfv0/cvjYC//+ZVLk1eb78penZxo/2e+0AAAAgF3U/LreK+XdQDn16mDz9f/YfqcFAAAA7KKi+T92RZKhHK+m1v5dypsAAAAA8Jxofv7/Worj6wVe/wMAAMBzpvc19ntGFCNrl/+t36jub7QiqrmiyPRMY3Ryfuat8ZxuXmUgyatttc0kqTWvOVgMNP/94I2cqKJODFX3Q+s1lm0OllHjo2+N542cbG3I8Ovl3evDHSInqsgfVJE/aI/sy4bIs2UkADzvTnbqj3fY/7+RkSpi5OVml9//coc+eEzPCgBPi4dj7Px/a0izDv1/K+K1bv3/j7d5/V9GvJCbx6uvFIzm3byXldzISFrfODjeqdYDrdH1qq8hjPR4N2Co9ZWF/zpfy8iW9wMGH25re+xyJjKy/o7AL1rvVWyst1jL4Wy1tMOgCADwLDq5bT/8aP3/SI/X/0O+UggAT5U7H96tRrC/8+Hd1XutiYcl6xNDbSX3usR0m9jvbQQANtJLAwAAAAAAAAAAAAAAAAAAAAAAAAAAwO7bcLn+Q63CzRfw/8/TycrKcrKjy/5/w4nBThk+3kQte5Tzvk/0JdmdCsvdv7O1fpIdtzXY4WDbwcQ/H2qt/r/7v+f3eyK7XiEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADfAkXS16m8lhxMMpbkzN5n9eTc3+8Edkv9wGOtVjzIg3yQw7ueDwAAAAAAAAAAAAAAAAAAAAAAAAAAAADAt1zr+v+1VPffqYrSX0tOJbme5Pf2O8fd9GC/E3gyit4hf1gFrl//v5YMZLVIf/WwpxiYnFqYny2rKg6Wy7/65NOPy1vvureOqlBWULZQHlQLD7OsWmgLG9i41veaa/13a64+dal5YF5aujwzNXtl4bfXA18sPqvGrai3rb2W75+f+re/bis+UGVRfFZuaWdVu0NTy3du/+l7f1yfutxsd2pru7+2cb1iu3Yfwa2V5YmypaXGO0t/9ke3Pmhb9EJOJK8PJ8Mbt/D3y1uXlk5s3p+bsv26+IvicP4u13O4dcAUq0W5c440t//QzVsry6Pvvrdy42FO9zbkdDTHk9xIBjvk9C+dczre/dhsHnW1gbLVsWZQ+etYj23cVluN41326/eah8xQ523o0ma9x/nVY7+3MjrbMaO/+ZPv5/SOH+nTPVrsqPi6+J9i89la+zLVU32Hs7NDFc3ItiOlfdmG06tWRTa3fKJ9wc8219n1rOQJ+Mv8Ir/1cPyXWtvzf+ux2pvno7YWO58Xyc7Pi388sqVHWdfskY5tGu6o9ezTbZ1WnseqqC55/mp+VNW5g2eUH/XqsZ/Q+f/3xXD+L/eN/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADz9iqQvyerBTeW15FSSo0mOlPP1ZHXzuvcfo73aUPHYue6Gx8n52VN03dDiQR7kgxze64wAAAAAAAAAeDIuTX31yacfl7fm5/F9+Y1akh9Xn/T3Jzla/O3A5NTC/GyPigaS62sf6Q/uLIfr5a/vrs9/Uc691GOl/f36AAA8034ZAAD//+b1YfU=") mount(0x0, 0x0, &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f,,\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 9m11.730318165s ago: executing program 36 (id=2484): socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x800, 0x2) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) read$hiddev(0xffffffffffffffff, &(0x7f0000000400)=""/194, 0xc2) syz_mount_image$iso9660(&(0x7f0000000140), &(0x7f0000000100)='./file0\x00', 0x2000c12, &(0x7f0000000180)={[{@check_relaxed}, {@dmode}, {@session={'session', 0x3d, 0xd}}, {@cruft}, {@map_acorn}, {@unhide}, {@overriderock}, {@showassoc}, {@map_normal}, {@nocompress}, {@nojoliet}, {@iocharset={'iocharset', 0x3d, 'cp857'}}, {@hide}, {@map_off}, {@unhide}, {@iocharset={'iocharset', 0x3d, 'koi8-ru'}}, {@map_off}, {@iocharset={'iocharset', 0x3d, 'iso8859-7'}}]}, 0x81, 0xa4f, &(0x7f0000001500)="$eJzs3U9sXVdeB/DvfbYTxzMkmU4opWqbl5RkPB3j2M40IepiSOyX1IP/INuRGrGYzDQOCjEUGpDaCCnphhUVSCAWsKtYwYJK3dAN6g52sGKBVHXFvmIVVh7dd5/jZ/s9vzh17CT9fKznd++5v3vO79537zt+f3xPeLasHtkwt7ravD3K/EdtZS1X/2kPMuYpdmnqq08+/bi8fXQ/B9KXN4t/TQaT1JP+JC8lA5NTC/OzB7ev6HZyPckXSZGkDC4eNYfrKf4q312f/yLFP5TtdnXgUWuml1W+1fb7+AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKdRMTk1NjZeHMj03NV36pWkvsXk1MJ8kdXVrUvW1ql83hz1u/i8Z7tJUd4yOLg21PdLx9YXv5ikfjKvVHOvNAckz2DufufFo299v7+2tn63bL6Rg49UbWpVbrd/vrKy/H73uNV7VdwuJvj0uNKYm16cn569eKVRn16cr184d27szNuXF+uXp2cai9cWlxqz9cmFxsWl+YX68OQP6+MXLpytN0avzV+duzI1OtNYKzz/mxNjY+fqPx393cbFhcX5uTM/HV2cfHt6ZmZ67kozplxcxpwvD8TfmV6qLzUuztbrN2+tLJ/dlFPf5p1dBo332pIyaKJHTH/GJibGxycmxj9qjZ49sVZw7s0Lb54fG+sf2yRbIp7QQcvT5VD3h3k3n77hG6lV/X/+YCbTmcvVvJN6x5/JTGUh85ntsrxlrf8/daaxbbvt/X+rl+9vW/xy+etkXmvNDrb6/19J0t7/d8ll737u5MPcze38PCtZyXLe3/eM9vbnShqZy3QWM5/pzOZis6TeKqnnQs7lXMbys7yd41lMPZcznZk0sphrWcxSGs0jajILaeRiljKfhdQznMn8MPWM50Iu5GzqaWQ01zKfq5nLlUzlYrOWm7nV3O9nt8nxYdB496Dyj7kqaGKbmjZ35uWxvrP+v/G8/iXII9v9J3F4TKut/v/ApvK+raHDk3uVFAAAALCrfv0/cvjYC//+ZVLk1eb78penZxo/2e+0AAAAgF3U/LreK+XdQDn16mDz9f/YfqcFAAAA7KKi+T92RZKhHK+m1v5dypsAAAAA8Jxofv7/Worj6wVe/wMAAMBzpvc19ntGFCNrl/+t36jub7QiqrmiyPRMY3Ryfuat8ZxuXmUgyatttc0kqTWvOVgMNP/94I2cqKJODFX3Q+s1lm0OllHjo2+N542cbG3I8Ovl3evDHSInqsgfVJE/aI/sy4bIs2UkADzvTnbqj3fY/7+RkSpi5OVml9//coc+eEzPCgBPi4dj7Px/a0izDv1/K+K1bv3/j7d5/V9GvJCbx6uvFIzm3byXldzISFrfODjeqdYDrdH1qq8hjPR4N2Co9ZWF/zpfy8iW9wMGH25re+xyJjKy/o7AL1rvVWyst1jL4Wy1tMOgCADwLDq5bT/8aP3/SI/X/0O+UggAT5U7H96tRrC/8+Hd1XutiYcl6xNDbSX3usR0m9jvbQQANtJLAwAAAAAAAAAAAAAAAAAAAAAAAAAAwO7bcLn+Q63CzRfw/8/TycrKcrKjy/5/w4nBThk+3kQte5Tzvk/0JdmdCsvdv7O1fpIdtzXY4WDbwcQ/H2qt/r/7v+f3eyK7XiEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADfAkXS16m8lhxMMpbkzN5n9eTc3+8Edkv9wGOtVjzIg3yQw7ueDwAAAAAAAAAAAAAAAAAAAAAAAAAAAADAt1zr+v+1VPffqYrSX0tOJbme5Pf2O8fd9GC/E3gyit4hf1gFrl//v5YMZLVIf/WwpxiYnFqYny2rKg6Wy7/65NOPy1vvureOqlBWULZQHlQLD7OsWmgLG9i41veaa/13a64+dal5YF5aujwzNXtl4bfXA18sPqvGrai3rb2W75+f+re/bis+UGVRfFZuaWdVu0NTy3du/+l7f1yfutxsd2pru7+2cb1iu3Yfwa2V5YmypaXGO0t/9ke3Pmhb9EJOJK8PJ8Mbt/D3y1uXlk5s3p+bsv26+IvicP4u13O4dcAUq0W5c440t//QzVsry6Pvvrdy42FO9zbkdDTHk9xIBjvk9C+dczre/dhsHnW1gbLVsWZQ+etYj23cVluN41326/eah8xQ523o0ma9x/nVY7+3MjrbMaO/+ZPv5/SOH+nTPVrsqPi6+J9i89la+zLVU32Hs7NDFc3ItiOlfdmG06tWRTa3fKJ9wc8219n1rOQJ+Mv8Ir/1cPyXWtvzf+ux2pvno7YWO58Xyc7Pi388sqVHWdfskY5tGu6o9ezTbZ1WnseqqC55/mp+VNW5g2eUH/XqsZ/Q+f/3xXD+L/eN/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADz9iqQvyerBTeW15FSSo0mOlPP1ZHXzuvcfo73aUPHYue6Gx8n52VN03dDiQR7kgxze64wAAAAAAAAAeDIuTX31yacfl7fm5/F9+Y1akh9Xn/T3Jzla/O3A5NTC/GyPigaS62sf6Q/uLIfr5a/vrs9/Uc691GOl/f36AAA8034ZAAD//+b1YfU=") mount(0x0, 0x0, &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f,,\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 6m6.254474574s ago: executing program 9 (id=2780): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@block_validity}, {@errors_remount}, {@nombcache}]}, 0x1, 0x44f, &(0x7f0000000640)="$eJzs28tvG8UfAPDvrpP219cvoSqPPoBAQVQ8kiYtpQcuIJA4gIQEh3IMSVqVug1qgkSrCAJC5YgqcUcckfgLOMEFASckrnBHlSoUIbVwMlp7N7Ed23nUiaH+fKRtZ3bXnfl6drwzO90A+tZI9kcSsTcifo2IoVq28YSR2l+3lxam/lpamEqiUnnjj6R63q2lhani1OJze4rMQET6SRKHW5Q7d+XqhclyeeZynh+bv/ju2NyVq8+cvzh5bubczKWJ06dPnhh/7tTEs12JM4vr1qEPZo8cfOWt669Nnbn+9o9fJ0X8TXF0yUing49XKl0urrf21aWTgR5WhA0p1bppDFb7/1CUYqXxhuLlj3taOWBLVSqVyn3tDy9WgLtYEr2uAdAbxY0+m//mW3Hr34bRR+/dfKE2Acpiv51vtSMDkebnDDbNb7tpJCLOLP79RbbFRp9DpFtUKQDgrvZtNv55umH8l48/0qh/LvT/fA1lOCLuiYj9EXEqIg5ExL0R1XPvj4gHWhWStC+/eZFk9fgnvbHp4NYhG/89n69tNY7/lgdXw6U8t68a/2By9nx55nj+nRyLwZ1ZfrxDGd+99Mtn7Y7Vj/+yLSu/GAvm9bgxsLPxM9OT85N3EnO9mx9FHBpoFX+yvBKQNd/BiDi0yTLOP/nVkSJ9uNR4bO34O+jCOlPly4gnau2/GE3xF5LO65Nj/4vyzPGx4qpY7aefr73ervw7ir8Lsvbf3fL6X45/OKlfr53beBnXfvu07Zxms9f/juTNhn3vT87PXx6P2JG8Wqt0/f6JpvMmVs7P4j92tHX/3x8r38Th7PpPIx6MiIci4uG87o9ExKMRcbRD/D+8+Ng7HeP/s138Ozv8q92RxT/d0P7FD1+79l9J7IjmPa0TpQvff9NQ6HBT/Gu2/8lq6li+Zz2/f+up1+auZgAAAPjvySb7eyNJR5fTaTo6Wvs//Adid1qenZt/6uzse5ema+8IDMdgWjzpGqp7HjqeT+uL/ERT/kT+3Pjz0q5qfnRqtjzd6+Chz+1p0/8zv5d6XTtgy3lfC/qX/g99q/49AKDPuP9D/2rR/3f1oh7A9mt1//+wB/UAtl9T/7fsB33E/B/6l/4P/Uv/h740tyvWfkleQmJVItJ/RTUktijR618mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA7vgnAAD//wW66qg=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[], 0x10) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb4}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) 6m5.162999485s ago: executing program 9 (id=2782): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x920, 0x12) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(&(0x7f0000000300)={0x28000800, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x58) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r3 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_UNLOCK(r3, 0xc) r4 = socket(0x40000000015, 0x5, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 6m3.032472016s ago: executing program 9 (id=2785): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000901, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) shutdown(r3, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, 0x0, 0x0) 5m53.674530533s ago: executing program 9 (id=2795): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) r4 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x200000001000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000000)={0xffff7fff, 0x2, 0x1, 0x0, 0x5}) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000000840)={0x1, 0x0, [{0x30000, 0x0, 0x0}]}) getpgid(r1) sendmmsg$inet(r0, &(0x7f0000003240), 0x0, 0x4000800) syz_ublk_setup_io_uring(0xfbb, &(0x7f0000000280)={0x0, 0x9012, 0x8, 0x3, 0x2b9}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) syz_ublk_setup_io_uring(0x3bf1, &(0x7f00000004c0)={0x0, 0x4e2f, 0x2, 0x0, 0x3}, 0x0, &(0x7f0000000580), &(0x7f00000005c0)) 5m52.364610161s ago: executing program 9 (id=2797): getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0xc4c03d12, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x2, 0x0, 0x0, 0x400000) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 5m52.346215765s ago: executing program 7 (id=2798): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000080)={[{@grpid}, {@jqfmt_vfsv0}]}, 0x4, 0x4eb, &(0x7f0000000540)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) shutdown(r2, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000080)={@local, @dev={0xac, 0x14, 0x14, 0x11}}, 0xc) add_key(0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) 5m50.884366073s ago: executing program 9 (id=2800): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000140)=':', 0x1}], 0x1}, 0x40095) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setpriority(0x2, 0x0, 0x2) fcntl$dupfd(r0, 0x0, r0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f00000006c0)=0x1, 0x3a) 5m47.690559029s ago: executing program 7 (id=2805): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000901, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) shutdown(r3, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, 0x0, 0x0) 5m44.897905749s ago: executing program 7 (id=2807): read$msr(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffc, 0x0, 0x0, 0x8, 0xfc, 0x4, 0xe9, 0x7, 0x1, 0x0, 0x0, 0x6, 0x9}, {0x0, 0x0, 0x0, 0x40, 0x10, 0x6, 0xfd, 0xfc, 0x1, 0xfd, 0x47}, {0x3, 0xa, 0x22, 0x8, 0x40, 0x0, 0x5f, 0x1, 0x2, 0x2, 0x0, 0x0, 0xfffffffffffffffd}], 0x1ffffff}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8000000001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r6, &(0x7f0000000040)=0x8000000001cb, 0x12) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 5m40.603085017s ago: executing program 7 (id=2813): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) epoll_create1(0x0) keyctl$invalidate(0x15, 0x0) r3 = socket(0x28, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/intl_enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='1', 0x1) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt$inet_sctp_SCTP_MAXSEG(r5, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x200}, 0x8) bind(r5, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x80) connect(r5, 0x0, 0x0) sendto(r5, &(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth1_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x15}}) 5m36.982422072s ago: executing program 7 (id=2818): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@block_validity}, {@errors_remount}, {@nombcache}]}, 0x1, 0x44f, &(0x7f0000000640)="$eJzs28tvG8UfAPDvrpP219cvoSqPPoBAQVQ8kiYtpQcuIJA4gIQEh3IMSVqVug1qgkSrCAJC5YgqcUcckfgLOMEFASckrnBHlSoUIbVwMlp7N7Ed23nUiaH+fKRtZ3bXnfl6drwzO90A+tZI9kcSsTcifo2IoVq28YSR2l+3lxam/lpamEqiUnnjj6R63q2lhani1OJze4rMQET6SRKHW5Q7d+XqhclyeeZynh+bv/ju2NyVq8+cvzh5bubczKWJ06dPnhh/7tTEs12JM4vr1qEPZo8cfOWt669Nnbn+9o9fJ0X8TXF0yUing49XKl0urrf21aWTgR5WhA0p1bppDFb7/1CUYqXxhuLlj3taOWBLVSqVyn3tDy9WgLtYEr2uAdAbxY0+m//mW3Hr34bRR+/dfKE2Acpiv51vtSMDkebnDDbNb7tpJCLOLP79RbbFRp9DpFtUKQDgrvZtNv55umH8l48/0qh/LvT/fA1lOCLuiYj9EXEqIg5ExL0R1XPvj4gHWhWStC+/eZFk9fgnvbHp4NYhG/89n69tNY7/lgdXw6U8t68a/2By9nx55nj+nRyLwZ1ZfrxDGd+99Mtn7Y7Vj/+yLSu/GAvm9bgxsLPxM9OT85N3EnO9mx9FHBpoFX+yvBKQNd/BiDi0yTLOP/nVkSJ9uNR4bO34O+jCOlPly4gnau2/GE3xF5LO65Nj/4vyzPGx4qpY7aefr73ervw7ir8Lsvbf3fL6X45/OKlfr53beBnXfvu07Zxms9f/juTNhn3vT87PXx6P2JG8Wqt0/f6JpvMmVs7P4j92tHX/3x8r38Th7PpPIx6MiIci4uG87o9ExKMRcbRD/D+8+Ng7HeP/s138Ozv8q92RxT/d0P7FD1+79l9J7IjmPa0TpQvff9NQ6HBT/Gu2/8lq6li+Zz2/f+up1+auZgAAAPjvySb7eyNJR5fTaTo6Wvs//Adid1qenZt/6uzse5ema+8IDMdgWjzpGqp7HjqeT+uL/ERT/kT+3Pjz0q5qfnRqtjzd6+Chz+1p0/8zv5d6XTtgy3lfC/qX/g99q/49AKDPuP9D/2rR/3f1oh7A9mt1//+wB/UAtl9T/7fsB33E/B/6l/4P/Uv/h740tyvWfkleQmJVItJ/RTUktijR618mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA7vgnAAD//wW66qg=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[], 0x10) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb4}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) 5m35.589133597s ago: executing program 37 (id=2800): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000140)=':', 0x1}], 0x1}, 0x40095) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setpriority(0x2, 0x0, 0x2) fcntl$dupfd(r0, 0x0, r0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f00000006c0)=0x1, 0x3a) 5m35.577867279s ago: executing program 7 (id=2821): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000080)={@local, @dev={0xac, 0x14, 0x14, 0x11}}, 0xc) 5m20.150706051s ago: executing program 38 (id=2821): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000080)={@local, @dev={0xac, 0x14, 0x14, 0x11}}, 0xc) 10.050191806s ago: executing program 6 (id=3908): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e07ff051440"], 0xa) 8.733184064s ago: executing program 2 (id=3909): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1234\x00', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x5678\x00', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/f1\x00') vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=@newlink={0x48, 0x10, 0x401, 0xfffffffe, 0x200, {0x0, 0x0, 0x0, 0x0, 0x10227}, [@IFLA_MASTER={0x8, 0xa, r4}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r5}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x840) write(r2, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f00000003c0)={0x0, 0x5f5e100}, 0x0) write(r2, &(0x7f0000000400)='\n\x00', 0x1) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0105865, &(0x7f00000007c0)={&(0x7f0000000440)=0x7fffffffffffffff, 0x6, &(0x7f0000000480)=[{}, {}, {}, {}], &(0x7f0000000780)}) 8.722457606s ago: executing program 6 (id=3912): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x1, 0x9}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) setrlimit(0x9, &(0x7f0000000080)={0x8606, 0xffff}) io_setup(0xffff, &(0x7f0000000000)) 7.195050019s ago: executing program 2 (id=3915): r0 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000004c0)='j\x95\'\x8aC\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000240)={0x4, 0x3, 0x2004, 0x8, 0xd, "03f37fe99f4da288"}) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='\x00\xe5\xff\xff\xff\xff\xff\xff\xff2', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='\x00', &(0x7f0000000400)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000002c0)='\xe6\xdf\xf4\x89\b,\xcd\x9dP\x9e\xd7\xe3/\xd2=#\xc8\xb7\x98\f\x87\xcf\x00\x00\x00\x00\x00\x00\x00\x9a\x8e\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000200)="82", 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b80)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-+a\x13qQ\xd5f39hSr\xafbB\xe2\xe8\xcd\x1bf\x18\x7f\xf27E#\"\xab\x99\xec\x88\x8d\xd8C\x0f\x95\xff\xfeG\xf9t\xb1 \xcc\xc5\xbb\x88\xb6\xd2\xf2Jwq\xf8oG\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x0) copy_file_range(r1, 0x0, r1, &(0x7f00000003c0)=0xffffffffffff8000, 0x0, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)="653aa3c2184ee1c5b6170607265d8155c6ae", 0x12) unlinkat(r4, &(0x7f0000004800)='./file0\x00', 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) accept4(r2, 0x0, 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r5 = syz_ublk_setup_io_uring(0x41eb, &(0x7f0000000000)={0x0, 0x25dc, 0x1, 0x1, 0x3a9}, &(0x7f00000000c0), 0x0, &(0x7f0000000180)) syz_ublk_setup_io_uring(0x10b5, &(0x7f0000000240)={0x0, 0x140a, 0x20000, 0x1, 0x25, 0x0, r5}, 0x0, 0x0, &(0x7f00000047c0)) sendmmsg(r2, &(0x7f0000004700), 0x0, 0x4000000) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/pids.max\x00', 0xc8442, 0x11) write$cgroup_int(r6, &(0x7f0000007880)=0x7fffffff, 0x12) socket$packet(0x11, 0x3, 0x300) 6.816253069s ago: executing program 5 (id=3920): r0 = fsopen(&(0x7f0000000040)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt(r5, 0x6b, 0xffff, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) write$sysctl(0xffffffffffffffff, &(0x7f00000000c0)='2\x00', 0x2) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) 6.815048239s ago: executing program 2 (id=3921): r0 = fsopen(&(0x7f0000000040)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt(r5, 0x6b, 0xffff, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) write$sysctl(0xffffffffffffffff, &(0x7f00000000c0)='2\x00', 0x2) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) 5.654693145s ago: executing program 1 (id=3922): 5.638247198s ago: executing program 1 (id=3923): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, 0x0) read$FUSE(r0, &(0x7f0000008340)={0x2020, 0x0, 0x0}, 0x206f) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34814c40, 0x0, 0xfffd, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1000003}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) read$FUSE(r2, 0x0, 0x500) 5.579574831s ago: executing program 6 (id=3925): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1234\x00', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x5678\x00', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/f1\x00') vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=@newlink={0x48, 0x10, 0x401, 0xfffffffe, 0x200, {0x0, 0x0, 0x0, 0x0, 0x10227}, [@IFLA_MASTER={0x8, 0xa, r4}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r5}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x840) write(r2, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f00000003c0)={0x0, 0x5f5e100}, 0x0) write(r2, &(0x7f0000000400)='\n\x00', 0x1) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0105865, &(0x7f00000007c0)={&(0x7f0000000440)=0x7fffffffffffffff, 0x6, &(0x7f0000000480)=[{}, {}, {}, {}], &(0x7f0000000780)}) 3.410231409s ago: executing program 8 (id=3926): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/os_desc/b_vendor_code\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 3.409916859s ago: executing program 5 (id=3927): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r0, 0x8000000000000003, {}, 0xfd}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@deltclass={0x24, 0x29, 0x8, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffff}, {0x1, 0x8}, {0x6, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0xfd27c4eff795f0e1}, 0x480c5) close(0xffffffffffffffff) 3.40908451s ago: executing program 2 (id=3928): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e"], 0x88) 3.342642053s ago: executing program 8 (id=3929): mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 3.294308054s ago: executing program 5 (id=3930): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000380)='scalable', 0x8) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3.209713881s ago: executing program 1 (id=3931): r0 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000004c0)='j\x95\'\x8aC\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000240)={0x4, 0x3, 0x2004, 0x8, 0xd, "03f37fe99f4da288"}) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='\x00\xe5\xff\xff\xff\xff\xff\xff\xff2', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='\x00', &(0x7f0000000400)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000002c0)='\xe6\xdf\xf4\x89\b,\xcd\x9dP\x9e\xd7\xe3/\xd2=#\xc8\xb7\x98\f\x87\xcf\x00\x00\x00\x00\x00\x00\x00\x9a\x8e\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000200)="82", 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b80)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-+a\x13qQ\xd5f39hSr\xafbB\xe2\xe8\xcd\x1bf\x18\x7f\xf27E#\"\xab\x99\xec\x88\x8d\xd8C\x0f\x95\xff\xfeG\xf9t\xb1 \xcc\xc5\xbb\x88\xb6\xd2\xf2Jwq\xf8oG0x0}, &(0x7f00000000c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', r4, 0x3c, 0x5, 0x6, 0x1, 0x8, @mcast1, @private1, 0x8, 0x20, 0xffff, 0x400}}) 3.054625515s ago: executing program 2 (id=3933): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) socket$kcm(0x2, 0xa, 0x2) io_submit(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e20, @empty}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x20008001, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) accept4(r0, 0x0, 0x0, 0x0) 3.054309915s ago: executing program 5 (id=3934): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r2, @ANYBLOB="38002d80"], 0x54}}, 0x0) 2.987875089s ago: executing program 1 (id=3935): ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x83, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x5, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder1\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x28, 0x1056}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/submit_queues\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='2', 0x1) 2.97822759s ago: executing program 8 (id=3936): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) r2 = openat$cgroup_pressure(r0, &(0x7f0000000140)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) close(r2) 2.630185594s ago: executing program 5 (id=3937): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x1) socket$netlink(0x10, 0x3, 0x0) ioctl$UI_DEV_CREATE(r3, 0x5501) write$input_event(r3, &(0x7f0000000300)={{0x77359400}, 0x1, 0x1, 0x1}, 0x10) write$input_event(r3, &(0x7f00000003c0), 0x18) ioctl$HCIINQUIRY(r0, 0x800448d4, &(0x7f0000000000)={0x0, 0x1, "020240", 0x4e, 0xfe}) 2.249564994s ago: executing program 6 (id=3938): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[], 0x0, 0x1a, 0x0, 0x0, 0x0, 0x9520388457b6d5a6}, 0x28) open(&(0x7f00000000c0)='./bus\x00', 0x18d03e, 0x0) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="01032abd7000fddbdf2505040000"], 0x14}, 0x1, 0x0, 0x0, 0x40014}, 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x41102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$packet(0x11, 0x3, 0x300) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r3, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r3, 0x1) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) syz_80211_inject_frame(&(0x7f0000000040), &(0x7f0000001080)=ANY=[@ANYBLOB="98ae0100ffffffffffff080211000001505050505050ef1ac5fd29dee111f301ac69bd768ed976159782ebc54ecd2990e862ebf78d545fe080848371e6a8832733177fafeb300033061501ca11ee15281abd1bd342e57667d62f6fcdea1693d547f49ad2c8bf49d0501552fdad6fc11fadfa69e5e6d700acee4f1bcbf9052b9a09d4946d76fa09fbb45a1709113d498e4c66662a7f66e0ca84fda2d52284ccf67425c505c8f5fb983ec99210b2348787017a4d7349bb6ce191b561b94280f4d4922fb34a8f39ebbe83c1bffcafbbcd4bc97cc9d7da5bab9d9a8428fbff9be540dd059e4732a99e88ab06c1a8243f445a9ca6f4a58301cdd39daeffa29949a81beced55796c22ce87e425114d5806abb847d75736dd8645db641b54de364af130cf155deac36c29cf1afb5a0000457e3be65a8002c986eba01d6ea4b5bb63fefcc54cf27b614e1c5a91ace48a63bf3966814c47a60bc57fe517a1ae6fa7b3d1f0119f479dd2e11fbfd9b5ea1b00fa50c1023513a17e8f89a8fe4491a9dd521edc6847249311817cc6cf4d2afbc99d0758c47af5eb4bb7f435a20cf061b7f219a85eba937e68c31145212c3fc53a3dca889ddb1231eea5a6f661b5a97d74ea1d4ef68345b47664e5bcba8d8f0b0364bf32faf4fa8cc28bd1c20eb23ce87d2ae229b8df0f8e46aa259f54a810539ee9c5a67657781e4bc382c2a13ad04f3705748ab625e346c877d2f302f695d80b3680f96bb041423addd0b9a420ab4fd04028fa5a80bc449b87806fa0b8c00ba49bc2435634712aaae529127d59150494d5ab6594ad562878e57edaf49a6f57ec8fe95d27b96534f15d013c505aba183575a1aca10d0fdf63427345fce5bd0294cc2cf4fbfc2bbfaba17af5a5202be90ae07706e2073f533eb1e87062fc4b53bf10a34dc43a7f4429e11b4beafa4aa3d7024fcc1b3365798ed663de2ae87490fa29dbce13110500addbf03876f70bb4b356ed3509ca495f682c8c7710d40bd65988112ffec8078f617087cb86861d26bb4d26c6b92e8f1e098ef42675a99df77d33d76be039cb3b5d4114465cc18c334a8283bf8d760404982c02345863a963b0d758000b13281efad17b259b547b641c5a0a9d8cf277245897a046251af4c8b4bfa6877f846c6ec6d24cbdb3445dc172c8da079df2db66d02ee7f7e61a0814a62d1e5481809baba2e5084c61d9bf80a5449694156f2d44daace44718b4750ef66cbf92dd71226dc927ae9d151683d2287f11ab2fe257abc174286696c28fcf9ec5447502090031cfa00004cbf3a92fde22cfddb34686b6eb34a69a31029cf9127eb521bd2dd2ad1761b7839e039d5fabfb232c9015478fd92c6a79e0743c9c5d90a80c1272116df37aad083de02135d122261887c342fc7aad287c0029920e8772403f6f17e9239c7252066c96d6dcbdb870a2f37d15dd6d4ce6ba3cbd7735b1bf6da10d83fa4ab80e90e7f113f1386eb43c1733050723abbc5d4ce8aa06b74d9a85ecc644d186b29e41c5e57ac2051b52a96b2df5dbe58d1195cf80547e2e11aace4f915417beac98a5b9eae8119decb2639f4ded05ddeedcc2d80606f96acf7685be8f70efea89753464b7b86d361a99ab65f9adf0c210e85248f415e0276debc367dfa10d0291eb87a5bfabc723a5492bd82259d1cc174d7af59f3a4b96bfc780f797197a7814ec71f6f5ec1bd26eb42b562ecc0c36ef8ba6b3685c06312bd8f01f29bbd4f2315422109a0b5d467dd4968b1351c6501fdbeb0f048834e0457570ea52f6076cdd95f813774bcd6910d63f5c73d59077f9ff517defe026d105998684b46fb4c2b95d845cb248712a8b9ef4774856e262764485a1bbfce94ac180e33ae03a9469933387e3d306d0c10573613f1a5662da15a7c5b66f83714038f3be89a5f9313826a158f1900c88c9b094695bc59658b0eaaecdfe1c934bc17545b36eb3750c2aae69025e2c826b16c5da1311b00694478129bc597eab8121f6c0202be9661cb6945ca5058d52d753ef48f2605abb07dd3078e26dc0c8c06e50c39eac58be0573b11f9adcce5ebbf1da555c9567c55d5425f83489ab6bfa113f2e4708c7503ad55d9e28bbcaeb2e2eb13c831f018067966759bab8d229dbfc0cc14a9933678295f11fdfb603aeb7130315532430d9adf2a084302a161444e0e8c5f8fd894582a8d9b083ef818d3fd2cc29c51699fbff8def23d764d1efe4cfbb33ab06e97dc3d5dd244dc281dd32bb6de7986bfd23360f16bcaf880d6514583445b3d0560379ff4c68ad314c455f2ff9a996b106bad79e840d5c94af08413a891e3577dfbfe111bf7b96be120eccba75b15de674ba98b7e70cb6eb083339b8b14bc6da56828d46e6c3efa2d341b09d749f2c4e21c54ba9c72a2b255a0c80e8fdbe9784b57279b476d632cd56d165ad20b363eb9a899bf35074f8a0e2c8c98a676014eb0656afe6ca5a5ceb4118a115abea9340b6b8134abeb0e61dd1aa139b1a74a463c10e83f881eeff7a649a4c804638996cf2043399e36c147ff04e4476da830cea3daa52c1df117a251631e7b394131c26ca957c71337f64eb4c87bf6aabbc48eed26eed30e11133716f2e3662a351bfbe58afcee2b1c834524bb6be7831ddd1eb61058fd6cc167da7d36ea7a76414a50fd027d4dbcf242f74a226a5e77b73ff9de59d11731765c8802d4a21bb7d90fc086a0fdc2032ccd97d95a1cec2225856451c52bbfc588d3b58ec3d2009242ceb6ff089f1d9f53f2c128be130b95ca2eeab795e254582e99032bf4224089d44e4e5f22bf778e5b97d48e2ddac401fcc371973af9aff78b9139a2691114326e1db1ce477046b00"/2047], 0x7c9) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x16) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="270e28bd70000000000004"], 0x14}, 0x1, 0x40030000000000}, 0x4000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000100)=r5) 1.406620603s ago: executing program 8 (id=3939): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/os_desc/b_vendor_code\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 1.397670284s ago: executing program 2 (id=3940): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r0, 0x8000000000000003, {}, 0xfd}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@deltclass={0x24, 0x29, 0x8, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffff}, {0x1, 0x8}, {0x6, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0xfd27c4eff795f0e1}, 0x480c5) close(0xffffffffffffffff) 1.368008691s ago: executing program 1 (id=3941): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, 0x0) read$FUSE(r0, &(0x7f0000008340)={0x2020, 0x0, 0x0}, 0x206f) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34814c40, 0x0, 0xfffd, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1000003}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) read$FUSE(r2, 0x0, 0x500) 178.359293ms ago: executing program 8 (id=3942): r0 = fsopen(&(0x7f0000000040)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt(r5, 0x6b, 0xffff, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) write$sysctl(0xffffffffffffffff, &(0x7f00000000c0)='2\x00', 0x2) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) 2.8972ms ago: executing program 6 (id=3943): r0 = fsopen(&(0x7f0000000040)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt(r5, 0x6b, 0xffff, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) write$sysctl(0xffffffffffffffff, &(0x7f00000000c0)='2\x00', 0x2) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) 0s ago: executing program 5 (id=3944): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600004e20590000a2bc5603ca00000f7f89000000200000000101", 0x32}], 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008894) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e"], 0x88) kernel console output (not intermixed with test programs): 89189][T19117] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1821.630493][T19117] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1821.656455][ C0] vkms_vblank_simulate: vblank timer overrun [ 1821.708847][T19117] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1821.810715][T12547] as10x_usb: error during firmware upload part1 [ 1821.852524][T12547] Registered device nBox DVB-T Dongle [ 1821.880114][T12547] usb 7-1: USB disconnect, device number 2 [ 1821.935045][T19188] syz.8.3002: attempt to access beyond end of device [ 1821.935045][T19188] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1821.982613][T19117] device hsr_slave_0 entered promiscuous mode [ 1822.012295][T12547] Unregistered device nBox DVB-T Dongle [ 1822.020603][T19117] device hsr_slave_1 entered promiscuous mode [ 1822.025125][T12547] as10x_usb: device has been disconnected [ 1822.109930][T19191] tmpfs: Unknown parameter 'quota' [ 1822.551807][T16264] Bluetooth: hci4: command 0x041b tx timeout [ 1823.647674][T19117] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1823.680236][T19117] Cannot create hsr debugfs directory [ 1823.919337][T19207] IPv6: NLM_F_CREATE should be specified when creating new route [ 1823.928479][T19207] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1823.936218][T19207] IPv6: NLM_F_CREATE should be set when creating new route [ 1823.943632][T19207] IPv6: NLM_F_CREATE should be set when creating new route [ 1823.950868][T19207] IPv6: NLM_F_CREATE should be set when creating new route [ 1823.961668][T19208] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.3006'. [ 1824.374073][T19224] syz.6.3012: attempt to access beyond end of device [ 1824.374073][T19224] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1824.428083][T19038] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1824.504828][T19227] tmpfs: Unknown parameter 'quota' [ 1824.631799][T16264] Bluetooth: hci4: command 0x040f tx timeout [ 1825.198362][T19038] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1825.468331][T19233] device-mapper: ioctl: device has been removed from the dev hash table. [ 1825.479085][T19038] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1825.513883][T19038] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1825.605814][T16075] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1825.847887][T16075] usb 7-1: config index 0 descriptor too short (expected 50, got 32) [ 1825.871407][T16075] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1825.892022][T16075] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1825.922024][T16075] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1825.973551][T16075] usb 7-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1826.005101][T16075] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1826.025374][T16075] usb 7-1: Product: syz [ 1826.029603][T16075] usb 7-1: Manufacturer: syz [ 1826.034690][T16075] usb 7-1: SerialNumber: syz [ 1826.097048][T19232] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1826.142224][T16075] usb_debug 7-1:1.0: debug converter detected [ 1826.215663][T16075] usb 7-1: debug converter now attached to ttyUSB0 [ 1826.251949][ T76] device hsr_slave_0 left promiscuous mode [ 1826.269370][ T76] device hsr_slave_1 left promiscuous mode [ 1826.317108][ T76] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1826.332706][ T76] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1826.336721][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1826.351757][ T76] device bridge_slave_1 left promiscuous mode [ 1826.358043][ T76] bridge0: port 2(bridge_slave_1) entered disabled state [ 1826.379578][T16191] usb 7-1: USB disconnect, device number 3 [ 1826.403083][ T76] device bridge_slave_0 left promiscuous mode [ 1826.410281][T16191] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1826.420293][ T76] bridge0: port 1(bridge_slave_0) entered disabled state [ 1826.429135][T16191] usb_debug 7-1:1.0: device disconnected [ 1826.460400][ T76] device hsr_slave_0 left promiscuous mode [ 1826.477105][ T76] device hsr_slave_1 left promiscuous mode [ 1826.497943][ T76] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1826.519587][ T76] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1826.534668][ T76] device bridge_slave_1 left promiscuous mode [ 1826.541034][ T76] bridge0: port 2(bridge_slave_1) entered disabled state [ 1826.557392][ T76] device bridge_slave_0 left promiscuous mode [ 1826.566916][ T76] bridge0: port 1(bridge_slave_0) entered disabled state [ 1826.611251][ T76] device veth1_vlan left promiscuous mode [ 1826.617509][ T76] device veth0_vlan left promiscuous mode [ 1826.711967][T16264] Bluetooth: hci4: command 0x0419 tx timeout [ 1827.450013][ T76] team0 (unregistering): Port device team_slave_1 removed [ 1827.498758][ T76] team0 (unregistering): Port device team_slave_0 removed [ 1827.540844][ T76] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1827.583722][ T76] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1827.842592][ T76] bond0 (unregistering): Released all slaves [ 1828.073809][ T76] team0 (unregistering): Port device team_slave_1 removed [ 1828.114791][ T76] team0 (unregistering): Port device team_slave_0 removed [ 1828.155636][ T76] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1828.198938][ T76] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1828.435835][ T76] bond0 (unregistering): Released all slaves [ 1828.567006][T19038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1828.580298][T19117] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1828.605200][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1828.614892][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1828.641795][T19038] 8021q: adding VLAN 0 to HW filter on device team0 [ 1828.656559][T19117] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1828.718622][T19117] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1828.759066][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1828.777220][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1828.786301][T19276] 9pnet_virtio: no channels available for device syz [ 1828.794724][ T26] audit: type=1326 audit(1790279790.536:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1828.822479][ T4417] bridge0: port 1(bridge_slave_0) entered blocking state [ 1828.829684][ T4417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1828.897084][ T26] audit: type=1326 audit(1790279790.586:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1828.921460][ C0] vkms_vblank_simulate: vblank timer overrun [ 1828.953302][T19117] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1829.029107][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1829.117112][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1829.288244][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1829.444700][ T4417] bridge0: port 2(bridge_slave_1) entered blocking state [ 1829.451888][ T4417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1829.467427][ T26] audit: type=1326 audit(1790279790.586:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1829.759657][ T26] audit: type=1326 audit(1790279790.586:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1829.791842][ T26] audit: type=1326 audit(1790279790.586:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1829.825616][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1829.859746][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1829.875133][ T26] audit: type=1326 audit(1790279790.586:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1829.906120][ T26] audit: type=1326 audit(1790279790.586:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1829.945998][T19291] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 1829.978307][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1830.014550][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1830.034122][ T26] audit: type=1326 audit(1790279790.586:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1830.053139][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1830.090011][ T26] audit: type=1326 audit(1790279790.586:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1830.115121][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1830.132858][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1830.140373][ T26] audit: type=1326 audit(1790279790.586:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19274 comm="syz.6.3021" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1830.160290][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1830.212447][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1830.226678][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1830.236693][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1830.264884][T19038] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1830.353847][T16191] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 1830.464945][T19117] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1830.508973][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1830.523962][T19305] jffs2: notice: (19305) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1830.539240][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1830.544546][T16191] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 1830.564971][T16191] usb 9-1: config 0 has no interface number 0 [ 1830.575044][T19117] 8021q: adding VLAN 0 to HW filter on device team0 [ 1830.586222][T16191] usb 9-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1830.608186][T13329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1830.627002][T16191] usb 9-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid maxpacket 255, setting to 64 [ 1830.653231][T13329] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1830.664557][T16191] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice= 0.03 [ 1830.683126][T13329] bridge0: port 1(bridge_slave_0) entered blocking state [ 1830.687233][T16191] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1830.690275][T13329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1830.723074][T16191] usb 9-1: Product: syz [ 1830.727292][T16191] usb 9-1: Manufacturer: syz [ 1830.735818][T16191] usb 9-1: SerialNumber: syz [ 1830.736618][T13329] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1830.774834][T16191] usb 9-1: config 0 descriptor?? [ 1830.781838][T19295] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1830.814013][T13329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1830.840123][T16191] yurex 9-1:0.50: USB YUREX device now attached to Yurex #0 [ 1830.846914][T13329] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1830.876996][T13329] bridge0: port 2(bridge_slave_1) entered blocking state [ 1830.884225][T13329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1831.001223][T19315] FAULT_INJECTION: forcing a failure. [ 1831.001223][T19315] name failslab, interval 1, probability 0, space 0, times 1 [ 1831.053273][T19315] CPU: 0 PID: 19315 Comm: syz.6.3030 Not tainted syzkaller #0 [ 1831.060806][T19315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1831.070892][T19315] Call Trace: [ 1831.074197][T19315] [ 1831.077149][T19315] dump_stack_lvl+0x188/0x24e [ 1831.081869][T19315] ? show_regs_print_info+0x12/0x12 [ 1831.087103][T19315] ? load_image+0x410/0x410 [ 1831.091652][T19315] ? __might_sleep+0xd0/0xd0 [ 1831.096349][T19315] ? __lock_acquire+0x7c40/0x7c40 [ 1831.101417][T19315] should_fail_ex+0x390/0x4c0 [ 1831.106249][T19315] should_failslab+0x5/0x20 [ 1831.110784][T19315] slab_pre_alloc_hook+0x59/0x300 [ 1831.115963][T19315] ? kobject_get_path+0xac/0x220 [ 1831.120940][T19315] __kmem_cache_alloc_node+0x4f/0x270 [ 1831.126353][T19315] ? kobject_get_path+0xac/0x220 [ 1831.131325][T19315] __kmalloc+0xa3/0x240 [ 1831.135519][T19315] kobject_get_path+0xac/0x220 [ 1831.140317][T19315] kobject_uevent_env+0x28d/0x890 [ 1831.145390][T19315] device_del+0x8dd/0xa80 [ 1831.149871][T19315] ? kill_device+0x160/0x160 [ 1831.154507][T19315] ? pm_runtime_set_memalloc_noio+0x1e3/0x250 [ 1831.160712][T19315] ? netdev_unregister_kobject+0x164/0x250 [ 1831.166629][T19315] unregister_netdevice_many_notify+0x14b6/0x1990 [ 1831.173125][T19315] ? unregister_netdevice_many+0x20/0x20 [ 1831.178756][T19315] ? mif6_add+0xcf0/0xcf0 [ 1831.183242][T19315] ? do_raw_spin_unlock+0x11d/0x230 [ 1831.188442][T19315] mroute_clean_tables+0x381/0xaf0 [ 1831.193553][T19315] ? __mutex_lock+0x3ba/0xae0 [ 1831.198233][T19315] ? ip6_mroute_setsockopt+0x9b3/0xf00 [ 1831.203693][T19315] ? ip6mr_sk_done+0x340/0x340 [ 1831.208458][T19315] ? __might_fault+0xa6/0x120 [ 1831.213138][T19315] ip6_mroute_setsockopt+0x9c4/0xf00 [ 1831.218428][T19315] ? ip6mr_fib_lookup+0x1e0/0x1e0 [ 1831.223467][T19315] ? save_fpregs_to_fpstate+0x9a/0x1f0 [ 1831.228960][T19315] ? __might_fault+0xa6/0x120 [ 1831.233633][T19315] ? __might_fault+0xc2/0x120 [ 1831.238302][T19315] ? __might_fault+0xa6/0x120 [ 1831.242976][T19315] do_ipv6_setsockopt+0x3ad/0x3c30 [ 1831.248172][T19315] ? sk_dst_reset+0xa0/0xa0 [ 1831.252677][T19315] ? finish_task_switch+0x262/0x8e0 [ 1831.257956][T19315] ? lockdep_hardirqs_on+0x94/0x140 [ 1831.263157][T19315] ? finish_task_switch+0x262/0x8e0 [ 1831.268356][T19315] ? __schedule+0x1087/0x4030 [ 1831.273041][T19315] ? mark_lock+0x94/0x320 [ 1831.277376][T19315] ? __lock_acquire+0x138a/0x7c40 [ 1831.282405][T19315] ? schedule+0xd0/0x180 [ 1831.286644][T19315] ? futex_wait_queue+0x134/0x1b0 [ 1831.291747][T19315] ? aa_label_sk_perm+0x501/0x6b0 [ 1831.296816][T19315] ? verify_lock_unused+0x140/0x140 [ 1831.302018][T19315] ? aa_sk_perm+0x950/0x950 [ 1831.306540][T19315] ? __might_sleep+0xd0/0xd0 [ 1831.311129][T19315] ? __fget_files+0x28/0x460 [ 1831.315746][T19315] ? aa_sk_perm+0x81f/0x950 [ 1831.320246][T19315] ipv6_setsockopt+0x55/0x190 [ 1831.324930][T19315] rawv6_setsockopt+0x29e/0x660 [ 1831.329771][T19315] ? __fget_files+0x3fc/0x460 [ 1831.334449][T19315] ? raw6_destroy+0x30/0x30 [ 1831.338946][T19315] ? aa_sock_opt_perm+0x74/0x100 [ 1831.343949][T19315] ? sock_common_setsockopt+0x32/0xb0 [ 1831.349360][T19315] ? sock_common_recvmsg+0x190/0x190 [ 1831.354704][T19315] __sys_setsockopt+0x2bf/0x3d0 [ 1831.359553][T19315] __x64_sys_setsockopt+0xb1/0xc0 [ 1831.364575][T19315] do_syscall_64+0x4c/0xa0 [ 1831.368983][T19315] ? clear_bhb_loop+0x60/0xb0 [ 1831.373655][T19315] ? clear_bhb_loop+0x60/0xb0 [ 1831.378328][T19315] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1831.384221][T19315] RIP: 0033:0x7fe06ab9e159 [ 1831.388633][T19315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1831.408241][T19315] RSP: 002b:00007fe06bb13028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1831.416648][T19315] RAX: ffffffffffffffda RBX: 00007fe06ae25fa0 RCX: 00007fe06ab9e159 [ 1831.424613][T19315] RDX: 00000000000000d4 RSI: 0000000000000029 RDI: 0000000000000003 [ 1831.432574][T19315] RBP: 00007fe06ac3506b R08: 0000000000000004 R09: 0000000000000000 [ 1831.440537][T19315] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 1831.448500][T19315] R13: 00007fe06ae26038 R14: 00007fe06ae25fa0 R15: 00007ffccc245a58 [ 1831.456477][T19315] [ 1831.474806][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1831.486308][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1831.509476][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1831.539824][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1831.558234][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1831.581000][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1831.608849][T19117] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1831.629274][T19117] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1831.653583][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1831.669156][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1831.678869][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1831.694702][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1831.704399][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1831.716985][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1831.762568][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1831.779135][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1831.804609][T19038] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1831.870778][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1831.890237][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1831.955597][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1831.984978][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1832.024111][T19038] device veth0_vlan entered promiscuous mode [ 1832.032873][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1832.054625][ T4531] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1832.099230][T19038] device veth1_vlan entered promiscuous mode [ 1832.176001][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1832.192597][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1832.224945][T19038] device veth0_macvtap entered promiscuous mode [ 1832.238943][T19038] device veth1_macvtap entered promiscuous mode [ 1832.329632][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1832.358623][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.384680][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1832.405536][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.424919][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1832.447018][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.463300][T19038] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1832.480601][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1832.490325][T19357] FAULT_INJECTION: forcing a failure. [ 1832.490325][T19357] name failslab, interval 1, probability 0, space 0, times 0 [ 1832.496204][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1832.510486][T19357] CPU: 1 PID: 19357 Comm: syz.5.3037 Not tainted syzkaller #0 [ 1832.517977][T19357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1832.528057][T19357] Call Trace: [ 1832.531353][T19357] [ 1832.532527][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1832.534284][T19357] dump_stack_lvl+0x188/0x24e [ 1832.546991][T19357] ? show_regs_print_info+0x12/0x12 [ 1832.552218][T19357] ? load_image+0x410/0x410 [ 1832.552587][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1832.556729][T19357] ? __lock_acquire+0x7c40/0x7c40 [ 1832.569861][T19357] should_fail_ex+0x390/0x4c0 [ 1832.574577][T19357] should_failslab+0x5/0x20 [ 1832.579108][T19357] slab_pre_alloc_hook+0x59/0x300 [ 1832.584165][T19357] ? ceph_alloc_options+0x4a/0x1c0 [ 1832.589447][T19357] __kmem_cache_alloc_node+0x4f/0x270 [ 1832.594854][T19357] ? ceph_alloc_options+0x4a/0x1c0 [ 1832.599998][T19357] kmalloc_trace+0x26/0xe0 [ 1832.604441][T19357] ceph_alloc_options+0x4a/0x1c0 [ 1832.609420][T19357] ceph_init_fs_context+0x64/0x4a0 [ 1832.614640][T19357] ? destroy_caches+0x80/0x80 [ 1832.619346][T19357] alloc_fs_context+0x628/0x7d0 [ 1832.620255][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1832.624286][T19357] __se_sys_fsopen+0xa0/0x2c0 [ 1832.624316][T19357] do_syscall_64+0x4c/0xa0 [ 1832.624334][T19357] ? clear_bhb_loop+0x60/0xb0 [ 1832.645738][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.648477][T19357] ? clear_bhb_loop+0x60/0xb0 [ 1832.662975][T19357] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1832.668894][T19357] RIP: 0033:0x7f0666b9e159 [ 1832.673330][T19357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1832.678660][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1832.692933][T19357] RSP: 002b:00007f0667a47028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1832.692960][T19357] RAX: ffffffffffffffda RBX: 00007f0666e25fa0 RCX: 00007f0666b9e159 [ 1832.692972][T19357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 1832.692983][T19357] RBP: 00007f0666c3506b R08: 0000000000000000 R09: 0000000000000000 [ 1832.692993][T19357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1832.720937][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.727743][T19357] R13: 00007f0666e26038 R14: 00007f0666e25fa0 R15: 00007ffdeeff6138 [ 1832.727771][T19357] [ 1832.727840][ C1] vkms_vblank_simulate: vblank timer overrun [ 1832.781411][T19038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1832.797450][T19038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1832.808919][T19038] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1832.846661][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1832.867910][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1832.896342][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1832.915311][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1832.933733][T19038] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1832.948456][T19038] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1832.980019][T19038] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1832.980706][T19364] 9pnet_virtio: no channels available for device syz [ 1833.001215][T19038] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1833.045044][T19117] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1833.115687][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1833.132875][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1833.166555][T16075] usb 9-1: USB disconnect, device number 2 [ 1833.291311][T16075] yurex 9-1:0.50: USB YUREX #0 now disconnected [ 1833.302706][T19368] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3039'. [ 1833.378966][T19375] syz.8.3041: attempt to access beyond end of device [ 1833.378966][T19375] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1833.440063][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1833.460267][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1833.510483][T19376] tmpfs: Unknown parameter 'quota' [ 1834.412119][T19117] device veth0_vlan entered promiscuous mode [ 1834.431314][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1834.458588][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1834.510957][T19117] device veth1_vlan entered promiscuous mode [ 1834.755133][ T4531] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1834.834392][ T4531] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1835.061802][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1835.085090][T19117] device veth0_macvtap entered promiscuous mode [ 1835.818031][ T4417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1835.835559][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1835.851803][ T4417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1835.860977][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1835.886202][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1835.902940][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1835.926792][T19117] device veth1_macvtap entered promiscuous mode [ 1836.067838][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1836.116561][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.145768][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1836.167897][T19398] syz.2.2820: attempt to access beyond end of device [ 1836.167897][T19398] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1836.177791][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.211234][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1836.242013][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.278453][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1836.295727][T19398] tmpfs: Unknown parameter 'quota' [ 1836.307730][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.377471][T19117] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1836.405491][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1836.458633][T11976] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1836.505769][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1836.556081][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.573303][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1836.584412][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.597844][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1836.614704][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.630225][T19117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1836.641568][T19117] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1836.660239][T19117] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1836.687929][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1836.688074][T19418] jffs2: notice: (19418) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1836.697684][ T4417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1836.731238][T19117] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1836.747038][T19117] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1836.759394][T19117] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1836.769013][T19117] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1836.999200][T19418] tipc: Can't bind to reserved service type 2 [ 1837.537114][T19421] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3052'. [ 1837.711263][T11976] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1837.741598][T11976] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1837.769332][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 1837.769347][ T26] audit: type=1326 audit(1790279799.506:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1837.791046][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1837.799571][ C1] vkms_vblank_simulate: vblank timer overrun [ 1837.842870][ T4417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1837.851048][ T4417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1837.915467][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1837.922954][ T26] audit: type=1326 audit(1790279799.506:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1837.946921][ C1] vkms_vblank_simulate: vblank timer overrun [ 1837.998512][ T26] audit: type=1326 audit(1790279799.506:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1838.051881][ T26] audit: type=1326 audit(1790279799.546:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=148 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1838.120803][ T26] audit: type=1326 audit(1790279799.546:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1838.144878][ C1] vkms_vblank_simulate: vblank timer overrun [ 1838.216650][ T26] audit: type=1326 audit(1790279799.546:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1839.364980][ T26] audit: type=1326 audit(1790279799.556:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1839.448332][ T26] audit: type=1326 audit(1790279799.556:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1839.702478][ T26] audit: type=1326 audit(1790279799.556:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.5.3054" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f0666b9e159 code=0x7ffc0000 [ 1839.789040][T19438] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 1840.197710][ T4280] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1840.208664][ T4280] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1840.217731][ T4280] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1840.227419][ T4280] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1840.236415][ T4280] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1840.243928][ T4280] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1840.910782][T19467] chnl_net:caif_netlink_parms(): no params data found [ 1841.267113][T19467] bridge0: port 1(bridge_slave_0) entered blocking state [ 1841.291500][T19467] bridge0: port 1(bridge_slave_0) entered disabled state [ 1841.317168][T19467] device bridge_slave_0 entered promiscuous mode [ 1841.345665][T19467] bridge0: port 2(bridge_slave_1) entered blocking state [ 1841.361799][T19467] bridge0: port 2(bridge_slave_1) entered disabled state [ 1841.400550][T19467] device bridge_slave_1 entered promiscuous mode [ 1841.450186][ T26] audit: type=1800 audit(1790279803.186:37): pid=19500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3070" name="zone_nr_conv" dev="configfs" ino=82326 res=0 errno=0 [ 1841.484285][T19498] bridge0: port 3(netdevsim0) entered blocking state [ 1841.497782][T19498] bridge0: port 3(netdevsim0) entered disabled state [ 1841.598746][T19498] device netdevsim0 entered promiscuous mode [ 1841.792542][T19498] bridge0: port 3(netdevsim0) entered blocking state [ 1841.799690][T19498] bridge0: port 3(netdevsim0) entered forwarding state [ 1841.910558][T19502] netlink: 'syz.1.3069': attribute type 10 has an invalid length. [ 1841.983243][T19502] bridge0: port 3(netdevsim0) entered disabled state [ 1841.990520][T19502] bridge0: port 2(bridge_slave_1) entered disabled state [ 1842.000059][T19502] bridge0: port 1(bridge_slave_0) entered disabled state [ 1842.260965][T19502] bridge0: port 3(netdevsim0) entered blocking state [ 1842.267816][T19502] bridge0: port 3(netdevsim0) entered forwarding state [ 1842.276301][T19502] bridge0: port 2(bridge_slave_1) entered blocking state [ 1842.283577][T19502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1842.290957][T19502] bridge0: port 1(bridge_slave_0) entered blocking state [ 1842.298121][T19502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1842.307652][T19502] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1842.316755][T16264] Bluetooth: hci0: command 0x0409 tx timeout [ 1842.339113][T19467] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1842.404814][T19511] comedi comedi3: rti802: I/O port conflict (0x21,4) [ 1842.415279][T19467] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1842.469760][T19467] team0: Port device team_slave_0 added [ 1842.592188][T19467] team0: Port device team_slave_1 added [ 1842.674280][T19467] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1842.681278][T19467] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1842.786345][T19467] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1842.817683][T19467] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1842.835046][T19467] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1842.885687][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 1842.885700][ T26] audit: type=1800 audit(1790279804.626:40): pid=19530 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3076" name="UDC" dev="configfs" ino=83525 res=0 errno=0 [ 1842.931809][T19467] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1842.976587][T19532] Need at least one configuration in g1. [ 1843.005680][T19530] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1843.024705][T19532] udc dummy_udc.0: failed to start g1: -22 [ 1843.041223][T19532] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1843.071403][T19530] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1843.098150][ T4315] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1843.151269][T19532] UDC core: g1: couldn't find an available UDC or it's busy [ 1843.183956][T19530] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1843.254978][T16639] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.301923][ T4315] usb 2-1: Using ep0 maxpacket: 16 [ 1843.310118][ T4315] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1843.352978][ T4315] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1843.382676][ T4315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1843.394552][T19467] device hsr_slave_0 entered promiscuous mode [ 1843.396304][ T4315] usb 2-1: Product: syz [ 1843.405342][ T4315] usb 2-1: Manufacturer: syz [ 1843.413755][T19467] device hsr_slave_1 entered promiscuous mode [ 1843.415132][ T4315] usb 2-1: SerialNumber: syz [ 1843.447998][T16191] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1843.452324][ T4315] usb 2-1: config 0 descriptor?? [ 1843.462699][T19467] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1843.478545][T19467] Cannot create hsr debugfs directory [ 1843.644309][T16191] usb 9-1: config index 0 descriptor too short (expected 50, got 32) [ 1843.685837][T16191] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1843.802317][T16191] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1843.903127][T16191] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1844.050455][T16191] usb 9-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1844.148375][T16191] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.230213][T16191] usb 9-1: Product: syz [ 1844.273927][T16191] usb 9-1: Manufacturer: syz [ 1844.318718][T16191] usb 9-1: SerialNumber: syz [ 1844.392075][T16264] Bluetooth: hci0: command 0x041b tx timeout [ 1844.405599][T16639] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1844.424456][ T4315] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1844.433840][ T4315] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 1844.445507][T19536] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1844.482200][T16191] usb_debug 9-1:1.0: debug converter detected [ 1844.512543][ T4315] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1844.570706][T16191] usb 9-1: debug converter now attached to ttyUSB0 [ 1844.811407][T16639] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1844.920388][T12547] usb 9-1: USB disconnect, device number 3 [ 1845.220316][T19551] null_blk: disk nullb1 created [ 1845.574999][T12547] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1845.582967][ T4315] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1845.601922][ T4315] em28xx 2-1:0.0: board has no eeprom [ 1845.629871][T12547] usb_debug 9-1:1.0: device disconnected [ 1845.721891][ T4315] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1845.740319][ T4315] em28xx 2-1:0.0: dvb set to bulk mode. [ 1845.762041][ T6458] em28xx 2-1:0.0: Binding DVB extension [ 1845.790850][T16639] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1845.795493][ T4315] usb 2-1: USB disconnect, device number 2 [ 1845.852434][ T4315] em28xx 2-1:0.0: Disconnecting em28xx [ 1846.022010][ T129] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1846.081221][ T6458] em28xx 2-1:0.0: Registering input extension [ 1846.109738][ T4315] em28xx 2-1:0.0: Closing input extension [ 1846.241874][ T129] usb 7-1: Using ep0 maxpacket: 8 [ 1846.253507][ T129] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1846.284416][T19575] syz.8.3088: attempt to access beyond end of device [ 1846.284416][T19575] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1846.299546][ T4315] em28xx 2-1:0.0: Freeing device [ 1846.310602][ T129] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1846.344844][ T129] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1846.357215][ T129] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 1846.368417][ T129] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1846.379569][ T129] usb 7-1: config 0 descriptor?? [ 1846.454405][T19578] tmpfs: Unknown parameter 'quota' [ 1846.517660][ T4280] Bluetooth: hci0: command 0x040f tx timeout [ 1847.421276][ T129] usbhid 7-1:0.0: can't add hid device: -71 [ 1847.429874][ T129] usbhid: probe of 7-1:0.0 failed with error -71 [ 1847.459508][ T129] usb 7-1: USB disconnect, device number 4 [ 1847.771837][T16075] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1847.966096][T16075] usb 3-1: config index 0 descriptor too short (expected 50, got 32) [ 1847.991381][T16075] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1848.037949][T16075] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1848.070511][T16075] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1848.126391][T16075] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1848.162431][T16075] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1848.178281][T16075] usb 3-1: Product: syz [ 1848.203804][T16075] usb 3-1: Manufacturer: syz [ 1848.216713][T16075] usb 3-1: SerialNumber: syz [ 1848.246997][T19595] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1848.261530][T16075] usb_debug 3-1:1.0: debug converter detected [ 1848.294705][T16075] usb 3-1: debug converter now attached to ttyUSB0 [ 1848.479874][ T129] usb 3-1: USB disconnect, device number 2 [ 1848.507800][ T129] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1848.536146][ T129] usb_debug 3-1:1.0: device disconnected [ 1848.552028][ T4280] Bluetooth: hci0: command 0x0419 tx timeout [ 1848.668646][T19623] FAULT_INJECTION: forcing a failure. [ 1848.668646][T19623] name failslab, interval 1, probability 0, space 0, times 0 [ 1848.698423][T19623] CPU: 1 PID: 19623 Comm: syz.6.3100 Not tainted syzkaller #0 [ 1848.705955][T19623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1848.716035][T19623] Call Trace: [ 1848.719334][T19623] [ 1848.722288][T19623] dump_stack_lvl+0x188/0x24e [ 1848.726994][T19623] ? __alloc_skb+0xf9/0x7d0 [ 1848.731523][T19623] ? show_regs_print_info+0x12/0x12 [ 1848.736758][T19623] ? load_image+0x410/0x410 [ 1848.741297][T19623] ? __kasan_kmalloc+0x8e/0xa0 [ 1848.746089][T19623] ? verify_lock_unused+0x140/0x140 [ 1848.751326][T19623] should_fail_ex+0x390/0x4c0 [ 1848.756044][T19623] should_failslab+0x5/0x20 [ 1848.760572][T19623] slab_pre_alloc_hook+0x59/0x300 [ 1848.765632][T19623] kmem_cache_alloc+0x56/0x2f0 [ 1848.770419][T19623] ? skb_clone+0x1e7/0x370 [ 1848.774865][T19623] skb_clone+0x1e7/0x370 [ 1848.779137][T19623] __netlink_deliver_tap+0x3e4/0x7e0 [ 1848.784524][T19623] ? netlink_deliver_tap+0x2e/0x1b0 [ 1848.789752][T19623] netlink_deliver_tap+0x19c/0x1b0 [ 1848.794897][T19623] netlink_sendskb+0x64/0x130 [ 1848.799600][T19623] netlink_ack+0xcd1/0x1160 [ 1848.804140][T19623] ? netlink_dump+0xcd0/0xcd0 [ 1848.808854][T19623] netlink_rcv_skb+0x26d/0x440 [ 1848.813634][T19623] ? genl_bind+0x360/0x360 [ 1848.818074][T19623] ? netlink_ack+0x1160/0x1160 [ 1848.822867][T19623] ? down_read+0x1a8/0x2d0 [ 1848.827309][T19623] genl_rcv+0x24/0x40 [ 1848.831310][T19623] netlink_unicast+0x7ad/0x920 [ 1848.836106][T19623] netlink_sendmsg+0x8ad/0xbd0 [ 1848.840904][T19623] ? netlink_getsockopt+0x550/0x550 [ 1848.846123][T19623] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1848.851694][T19623] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1848.857075][T19623] ? security_socket_sendmsg+0x7c/0xa0 [ 1848.862626][T19623] ? netlink_getsockopt+0x550/0x550 [ 1848.867860][T19623] ____sys_sendmsg+0x5ed/0x9a0 [ 1848.872660][T19623] ? __sys_sendmsg_sock+0x30/0x30 [ 1848.877710][T19623] ? __import_iovec+0x306/0x510 [ 1848.882605][T19623] ? import_iovec+0x6f/0xa0 [ 1848.887148][T19623] ___sys_sendmsg+0x2a2/0x360 [ 1848.891861][T19623] ? __sys_sendmsg+0x2a0/0x2a0 [ 1848.896696][T19623] __se_sys_sendmsg+0x1c3/0x2b0 [ 1848.901571][T19623] ? __x64_sys_sendmsg+0x80/0x80 [ 1848.906548][T19623] ? lockdep_hardirqs_on+0x94/0x140 [ 1848.911781][T19623] do_syscall_64+0x4c/0xa0 [ 1848.916260][T19623] ? clear_bhb_loop+0x60/0xb0 [ 1848.920962][T19623] ? clear_bhb_loop+0x60/0xb0 [ 1848.925659][T19623] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1848.931582][T19623] RIP: 0033:0x7fe06ab9e159 [ 1848.936021][T19623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1848.955651][T19623] RSP: 002b:00007fe06bb13028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1848.964092][T19623] RAX: ffffffffffffffda RBX: 00007fe06ae25fa0 RCX: 00007fe06ab9e159 [ 1848.972087][T19623] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 1848.980090][T19623] RBP: 00007fe06ac3506b R08: 0000000000000000 R09: 0000000000000000 [ 1848.988089][T19623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1848.996085][T19623] R13: 00007fe06ae26038 R14: 00007fe06ae25fa0 R15: 00007ffccc245a58 [ 1849.004102][T19623] [ 1849.007227][ C1] vkms_vblank_simulate: vblank timer overrun [ 1849.197729][T16639] device hsr_slave_0 left promiscuous mode [ 1849.231931][T16639] device hsr_slave_1 left promiscuous mode [ 1849.241039][T16639] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1849.258816][T16639] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1849.298155][T16639] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1849.311358][T16639] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1849.333894][T16639] device bridge_slave_1 left promiscuous mode [ 1849.350255][T16639] bridge0: port 2(bridge_slave_1) entered disabled state [ 1849.381798][T16639] device bridge_slave_0 left promiscuous mode [ 1849.390778][T16639] bridge0: port 1(bridge_slave_0) entered disabled state [ 1849.477207][T16639] device veth1_macvtap left promiscuous mode [ 1849.493551][T16639] device veth0_macvtap left promiscuous mode [ 1849.507339][T16639] device veth1_vlan left promiscuous mode [ 1849.527072][T19649] syz.2.3108: attempt to access beyond end of device [ 1849.527072][T19649] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1849.546632][T16639] device veth0_vlan left promiscuous mode [ 1849.643738][T19655] tmpfs: Unknown parameter 'quota' [ 1851.607291][T16075] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1851.724582][T16639] team0 (unregistering): Port device team_slave_1 removed [ 1851.773032][T16639] team0 (unregistering): Port device team_slave_0 removed [ 1851.794956][T16075] usb 9-1: config index 0 descriptor too short (expected 50, got 32) [ 1851.803440][T16075] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1851.814276][T16075] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1851.824070][T16075] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1851.839035][T16639] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1851.840686][T16075] usb 9-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1851.857134][T16075] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1851.865339][T16075] usb 9-1: Product: syz [ 1851.869535][T16075] usb 9-1: Manufacturer: syz [ 1851.874262][T16075] usb 9-1: SerialNumber: syz [ 1851.889956][T19677] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1851.911170][T16075] usb_debug 9-1:1.0: debug converter detected [ 1851.930589][T16075] usb 9-1: debug converter now attached to ttyUSB0 [ 1851.938618][T16639] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1852.128858][ T7] usb 9-1: USB disconnect, device number 4 [ 1852.161364][ T7] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1852.172725][ T7] usb_debug 9-1:1.0: device disconnected [ 1852.301056][T16639] bond0 (unregistering): Released all slaves [ 1852.667020][T19690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1852.712587][T19467] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1852.927733][T19467] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1853.046143][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.052786][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.121368][T19467] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1853.347793][T19467] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1854.633112][ T4280] Bluetooth: hci0: command 0x0405 tx timeout [ 1855.318305][T19467] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1855.766438][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1855.824423][ T5162] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1855.969370][T19467] 8021q: adding VLAN 0 to HW filter on device team0 [ 1856.045404][T19715] Bluetooth: MGMT ver 1.22 [ 1856.058068][T19715] FAULT_INJECTION: forcing a failure. [ 1856.058068][T19715] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1856.072757][T19715] CPU: 0 PID: 19715 Comm: syz.6.3121 Not tainted syzkaller #0 [ 1856.078533][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1856.080242][T19715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1856.098399][T19715] Call Trace: [ 1856.101682][T19715] [ 1856.102510][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1856.104607][T19715] dump_stack_lvl+0x188/0x24e [ 1856.117295][T19715] ? show_regs_print_info+0x12/0x12 [ 1856.122514][T19715] ? load_image+0x410/0x410 [ 1856.127021][T19715] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1856.133008][T19715] ? preempt_schedule_common+0xa5/0xd0 [ 1856.138468][T19715] should_fail_ex+0x390/0x4c0 [ 1856.143148][T19715] get_futex_key+0x1b1/0x1000 [ 1856.147821][T19715] ? preempt_schedule_thunk+0x16/0x18 [ 1856.153283][T19715] ? try_to_wake_up+0x6c1/0x10b0 [ 1856.158218][T19715] ? futex_setup_timer+0xc0/0xc0 [ 1856.163155][T19715] futex_wake+0x123/0x4f0 [ 1856.167489][T19715] ? __fget_files+0x28/0x460 [ 1856.172167][T19715] ? futex_wake_mark+0x150/0x150 [ 1856.177198][T19715] ? __fget_files+0x28/0x460 [ 1856.181794][T19715] ? __fget_files+0x28/0x460 [ 1856.186386][T19715] do_futex+0x2e2/0x320 [ 1856.190540][T19715] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1856.196429][T19715] ? __fdget+0x18e/0x200 [ 1856.200673][T19715] __se_sys_futex+0x381/0x410 [ 1856.205349][T19715] ? __x64_sys_futex+0xf0/0xf0 [ 1856.210110][T19715] ? __x64_sys_futex+0x1d/0xf0 [ 1856.214900][T19715] do_syscall_64+0x4c/0xa0 [ 1856.219317][T19715] ? clear_bhb_loop+0x60/0xb0 [ 1856.223985][T19715] ? clear_bhb_loop+0x60/0xb0 [ 1856.228653][T19715] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1856.234548][T19715] RIP: 0033:0x7fe06ab9e159 [ 1856.238958][T19715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1856.258569][T19715] RSP: 002b:00007fe06bb130e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1856.266982][T19715] RAX: ffffffffffffffda RBX: 00007fe06ae25fa8 RCX: 00007fe06ab9e159 [ 1856.274948][T19715] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe06ae25fac [ 1856.282912][T19715] RBP: 00007fe06ae25fa0 R08: 0000b1c3f4200dfc R09: 0000000000000000 [ 1856.290881][T19715] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 1856.298844][T19715] R13: 00007fe06ae26038 R14: 00007ffccc245970 R15: 00007ffccc245a58 [ 1856.306818][T19715] [ 1856.323782][T19715] mmap: syz.6.3121 (19715): VmData 37523456 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 1856.342541][ T4701] bridge0: port 1(bridge_slave_0) entered blocking state [ 1856.349729][ T4701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1856.385966][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1856.407111][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1856.443362][ T4701] bridge0: port 2(bridge_slave_1) entered blocking state [ 1856.450533][ T4701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1856.482077][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1856.509306][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1856.543614][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1856.576315][ T4594] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1856.594090][ T4594] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1856.634742][ T4594] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1856.650216][ T4594] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1856.674664][ T4594] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1856.801315][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1856.857485][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1857.068059][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1857.145779][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1857.313192][T19467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1858.927402][ T26] audit: type=1326 audit(1790279820.666:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1859.191554][ T26] audit: type=1326 audit(1790279820.666:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1859.215705][ C1] vkms_vblank_simulate: vblank timer overrun [ 1859.222506][ T26] audit: type=1326 audit(1790279820.666:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1859.989016][T19754] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3129'. [ 1860.181767][ T26] audit: type=1326 audit(1790279820.666:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1860.413990][T19775] futex_wake_op: syz.1.3129 tries to shift op by -1; fix this program [ 1861.254014][ T26] audit: type=1326 audit(1790279820.666:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.254056][ T26] audit: type=1326 audit(1790279820.696:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.254079][ T26] audit: type=1326 audit(1790279820.696:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.254096][ T26] audit: type=1326 audit(1790279820.696:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.254112][ T26] audit: type=1326 audit(1790279820.696:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.254129][ T26] audit: type=1326 audit(1790279820.716:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19772 comm="syz.6.3137" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe06ab9e159 code=0x7ffc0000 [ 1861.937434][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1861.937620][ T4701] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1861.979153][T19467] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1864.410005][T19898] syz.8.3152: attempt to access beyond end of device [ 1864.410005][T19898] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1864.545562][T19901] tmpfs: Unknown parameter 'quota' [ 1865.393265][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1865.422384][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1865.499760][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1865.522714][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1867.224979][T19467] device veth0_vlan entered promiscuous mode [ 1867.242278][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1867.250516][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1867.321592][T19467] device veth1_vlan entered promiscuous mode [ 1867.437536][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1867.458706][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1867.482026][T19467] device veth0_macvtap entered promiscuous mode [ 1867.500954][T19467] device veth1_macvtap entered promiscuous mode [ 1867.530142][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1867.545909][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1867.557633][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1867.573511][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1867.692011][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1867.721837][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1867.742464][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1867.780663][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1867.837902][T19467] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1867.860743][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1867.887492][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1867.949127][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1867.959975][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1867.976593][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1868.005936][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1868.040474][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1868.064881][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1868.096628][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1868.116226][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1868.137730][T19467] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1868.161328][T19467] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1868.215970][T19467] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1868.257806][T19825] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1868.275559][T19825] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1868.303026][T19944] bridge0: port 3(netdevsim0) entered disabled state [ 1868.309972][T19944] bridge0: port 2(bridge_slave_1) entered disabled state [ 1868.317266][T19944] bridge0: port 1(bridge_slave_0) entered disabled state [ 1868.346801][T19467] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1868.360027][T19467] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1868.380841][T19467] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1868.390184][T19467] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1868.558862][T19834] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1868.573818][T19834] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1868.616833][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1868.695579][T19832] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1868.733956][T19832] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1868.767806][T19825] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1869.023920][T19968] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.3170'. [ 1869.148632][T19972] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 1869.321369][T19977] syz.8.3173: attempt to access beyond end of device [ 1869.321369][T19977] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1869.524165][T19978] tmpfs: Unknown parameter 'quota' [ 1870.729990][T16264] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1870.740713][T16264] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1870.750597][ T4278] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1870.763082][T16264] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1870.772129][T16264] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1870.796398][T16264] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1871.073975][T20010] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3182'. [ 1871.261944][T20019] comedi comedi3: c6xdigio: I/O port conflict (0x40006484,3) [ 1871.574132][T19997] chnl_net:caif_netlink_parms(): no params data found [ 1871.816403][T19997] bridge0: port 1(bridge_slave_0) entered blocking state [ 1871.901079][T19997] bridge0: port 1(bridge_slave_0) entered disabled state [ 1871.948455][T19997] device bridge_slave_0 entered promiscuous mode [ 1871.986287][T19997] bridge0: port 2(bridge_slave_1) entered blocking state [ 1872.013211][T19997] bridge0: port 2(bridge_slave_1) entered disabled state [ 1872.039880][T19997] device bridge_slave_1 entered promiscuous mode [ 1872.074622][T20052] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3194'. [ 1872.143747][T19997] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1872.170817][T20054] tipc: Started in network mode [ 1872.181981][T20054] tipc: Node identity 0010000000000000002, cluster identity 1 [ 1872.248921][T19997] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1872.845735][T19997] team0: Port device team_slave_0 added [ 1872.872287][T16264] Bluetooth: hci1: command 0x0409 tx timeout [ 1872.900267][T19997] team0: Port device team_slave_1 added [ 1873.018333][T19997] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1873.042795][T19997] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1873.112125][T19997] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1873.154101][T19997] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1873.170366][T19997] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1873.215468][T19997] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1873.337788][T19997] device hsr_slave_0 entered promiscuous mode [ 1873.360355][T19997] device hsr_slave_1 entered promiscuous mode [ 1873.375715][T19997] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1873.393248][T19997] Cannot create hsr debugfs directory [ 1873.399958][T20095] IPv6: NLM_F_CREATE should be specified when creating new route [ 1873.439360][T20095] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1873.446696][T20095] IPv6: NLM_F_CREATE should be set when creating new route [ 1873.454003][T20095] IPv6: NLM_F_CREATE should be set when creating new route [ 1873.461244][T20095] IPv6: NLM_F_CREATE should be set when creating new route [ 1874.739044][T19997] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1874.883653][T20127] syz.8.3216: attempt to access beyond end of device [ 1874.883653][T20127] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1874.942382][T19997] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1874.955452][T16264] Bluetooth: hci1: command 0x041b tx timeout [ 1875.032158][T20131] tmpfs: Unknown parameter 'quota' [ 1875.845846][T19997] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1875.963081][T19997] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1876.245432][T20149] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1876.264837][T19997] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1876.287896][T19997] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1876.324183][T19997] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1876.640542][T19997] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1877.031947][T16264] Bluetooth: hci1: command 0x040f tx timeout [ 1877.310966][T19997] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1877.311053][T20157] syz.5.3223: attempt to access beyond end of device [ 1877.311053][T20157] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1877.329480][T19997] 8021q: adding VLAN 0 to HW filter on device team0 [ 1877.339763][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1877.392154][T19832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1877.461570][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1877.497093][T20162] tmpfs: Unknown parameter 'quota' [ 1877.566155][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1877.669560][T19834] bridge0: port 1(bridge_slave_0) entered blocking state [ 1877.676756][T19834] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1878.242514][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1878.252211][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1878.261015][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1878.275029][T19834] bridge0: port 2(bridge_slave_1) entered blocking state [ 1878.282238][T19834] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1878.291005][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1878.303182][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1878.343528][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1878.412101][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1878.458759][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1878.501025][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1878.530222][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1878.554924][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1878.588625][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1878.621556][T19997] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1878.652930][T19997] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1878.695924][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1878.720619][T19834] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1878.751199][T20183] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1878.788596][T20187] syz.1.3233: attempt to access beyond end of device [ 1878.788596][T20187] md32: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1878.905457][T20191] tmpfs: Unknown parameter 'quota' [ 1879.111997][T16264] Bluetooth: hci1: command 0x0419 tx timeout [ 1882.138831][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1882.166213][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1882.264844][T19997] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1882.641966][ T129] usb 9-1: new full-speed USB device number 5 using dummy_hcd [ 1882.828013][T20248] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3241'. [ 1882.843530][ T129] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1882.867537][ T129] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1882.933723][T20248] bond1 (unregistering): Released all slaves [ 1882.940455][ T129] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1882.996775][ T129] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1883.219063][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1883.240634][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1883.259365][ T129] usb 9-1: usb_control_msg returned -32 [ 1883.273068][ T129] usbtmc 9-1:16.0: can't read capabilities [ 1883.301184][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1883.321051][ T129] usb 9-1: USB disconnect, device number 5 [ 1883.361074][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1883.416552][T19997] device veth0_vlan entered promiscuous mode [ 1883.425640][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1883.447026][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1883.481075][T19997] device veth1_vlan entered promiscuous mode [ 1883.536785][T20263] netlink: 'syz.5.3250': attribute type 1 has an invalid length. [ 1883.565663][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1883.591224][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1883.628622][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1883.674497][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1883.723267][T19997] device veth0_macvtap entered promiscuous mode [ 1883.760463][T19997] device veth1_macvtap entered promiscuous mode [ 1883.847600][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1883.898652][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1883.931823][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1883.966447][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.009246][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1884.057731][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.085539][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1884.120453][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.163654][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1884.200338][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.241063][T19997] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1884.269241][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1884.287898][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1884.307044][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1884.335960][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1884.363206][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1884.385298][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.421748][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1884.579695][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1884.908058][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1885.093911][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1885.176461][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1885.188839][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1885.199273][T19997] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1885.210025][T19997] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1885.221438][T19997] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1885.264215][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1885.273290][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1885.284698][T19997] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1885.295843][T19997] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1885.305299][T19997] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1885.314094][T19997] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1885.529393][T19835] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1885.546028][T19835] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1885.581059][T19835] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1885.661800][T19832] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1885.669682][T19832] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1885.718499][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1886.001366][ T126] libceph: connect (1)[c::]:6789 error -101 [ 1886.025486][ T126] libceph: mon0 (1)[c::]:6789 connect error [ 1886.146274][T20325] ceph: No mds server is up or the cluster is laggy [ 1886.427017][ T4389] libceph: connect (1)[c::]:6789 error -101 [ 1886.458837][ T4389] libceph: mon0 (1)[c::]:6789 connect error [ 1887.484338][T20360] ima: rule for LSM 'u' is undefined [ 1887.513811][ T26] kauditd_printk_skb: 109 callbacks suppressed [ 1887.513828][ T26] audit: type=1807 audit(1790279848.226:160): action=measure func=FILE_CHECK obj_type=u res=0 [ 1887.577454][ T26] audit: type=1802 audit(1790279848.286:161): pid=20360 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.2.3278" res=0 errno=0 [ 1887.831993][ T126] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1888.031781][ T126] usb 3-1: Using ep0 maxpacket: 8 [ 1888.039760][ T126] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 1888.075406][ T126] usb 3-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1888.125470][ T126] usb 3-1: config 179 has no interface number 0 [ 1888.158171][ T126] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1888.182812][ T126] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1888.230523][ T126] usb 3-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 1888.299458][ T126] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1888.327686][ T129] libceph: connect (1)[c::]:6789 error -101 [ 1888.334126][ T126] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1888.368808][T20360] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1888.393645][ T129] libceph: mon0 (1)[c::]:6789 connect error [ 1888.504122][T20385] ceph: No mds server is up or the cluster is laggy [ 1888.656073][T20401] IPv6: NLM_F_CREATE should be specified when creating new route [ 1888.697882][T20401] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1888.705218][T20401] IPv6: NLM_F_CREATE should be set when creating new route [ 1888.712560][T20401] IPv6: NLM_F_CREATE should be set when creating new route [ 1888.719809][T20401] IPv6: NLM_F_CREATE should be set when creating new route [ 1888.824066][T20404] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3287'. [ 1888.884003][T20359] ima: policy update failed [ 1888.890673][ T6458] usb 3-1: USB disconnect, device number 3 [ 1888.897107][ T26] audit: type=1802 audit(1790279849.636:162): pid=20359 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.3278" res=0 errno=0 [ 1889.764526][T20434] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3296'. [ 1892.136295][T20487] IPv6: NLM_F_CREATE should be specified when creating new route [ 1892.150501][T20487] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1892.157822][T20487] IPv6: NLM_F_CREATE should be set when creating new route [ 1892.165165][T20487] IPv6: NLM_F_CREATE should be set when creating new route [ 1892.172439][T20487] IPv6: NLM_F_CREATE should be set when creating new route [ 1892.199318][T20494] netlink: 16186 bytes leftover after parsing attributes in process `syz.6.3313'. [ 1892.422123][T20503] process 'syz.5.3315' launched './file0' with NULL argv: empty string added [ 1892.638873][T20514] FAULT_INJECTION: forcing a failure. [ 1892.638873][T20514] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1892.697496][T20514] CPU: 1 PID: 20514 Comm: syz.8.3323 Not tainted syzkaller #0 [ 1892.705027][T20514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1892.715151][T20514] Call Trace: [ 1892.718428][T20514] [ 1892.721351][T20514] dump_stack_lvl+0x188/0x24e [ 1892.726055][T20514] ? show_regs_print_info+0x12/0x12 [ 1892.731245][T20514] ? load_image+0x410/0x410 [ 1892.735745][T20514] ? __local_bh_enable_ip+0x136/0x1c0 [ 1892.741105][T20514] ? _local_bh_enable+0xa0/0xa0 [ 1892.745948][T20514] should_fail_ex+0x390/0x4c0 [ 1892.750617][T20514] get_futex_key+0x1b1/0x1000 [ 1892.755288][T20514] ? futex_setup_timer+0xc0/0xc0 [ 1892.760220][T20514] futex_wake+0x123/0x4f0 [ 1892.764548][T20514] ? _local_bh_enable+0xa0/0xa0 [ 1892.769392][T20514] ? futex_wake_mark+0x150/0x150 [ 1892.774321][T20514] ? arch_do_signal_or_restart+0xf39/0x1310 [ 1892.780204][T20514] do_futex+0x2e2/0x320 [ 1892.784369][T20514] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1892.790252][T20514] __se_sys_futex+0x381/0x410 [ 1892.794920][T20514] ? __x64_sys_futex+0xf0/0xf0 [ 1892.799692][T20514] ? __x64_sys_futex+0x1d/0xf0 [ 1892.804447][T20514] do_syscall_64+0x4c/0xa0 [ 1892.808852][T20514] ? clear_bhb_loop+0x60/0xb0 [ 1892.813515][T20514] ? clear_bhb_loop+0x60/0xb0 [ 1892.818176][T20514] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1892.824073][T20514] RIP: 0033:0x7f784659e159 [ 1892.828483][T20514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1892.848085][T20514] RSP: 002b:00007f78474370e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1892.856498][T20514] RAX: ffffffffffffffda RBX: 00007f7846825fa8 RCX: 00007f784659e159 [ 1892.864465][T20514] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7846825fac [ 1892.872429][T20514] RBP: 00007f7846825fa0 R08: 00234cc5e0262344 R09: 0000000000000000 [ 1892.880389][T20514] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 1892.888352][T20514] R13: 00007f7846826038 R14: 00007ffea55881f0 R15: 00007ffea55882d8 [ 1892.896323][T20514] [ 1893.393177][T20531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1893.400509][T20531] IPv6: NLM_F_CREATE should be set when creating new route [ 1893.407865][T20531] IPv6: NLM_F_CREATE should be set when creating new route [ 1893.415176][T20531] IPv6: NLM_F_CREATE should be set when creating new route [ 1893.447267][T20533] jffs2: notice: (20533) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1893.469175][T20534] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.3328'. [ 1893.870882][T20552] netlink: 1204 bytes leftover after parsing attributes in process `syz.2.3334'. [ 1894.367203][T20565] netlink: 'syz.8.3338': attribute type 1 has an invalid length. [ 1894.497709][T20571] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1894.529194][T20571] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.3341'. [ 1894.573924][T20577] jffs2: notice: (20577) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1894.633025][ T4280] Bluetooth: hci1: command 0x0401 tx timeout [ 1894.743138][T20586] tipc: Started in network mode [ 1894.748168][T20586] tipc: Node identity 0010000000000000002, cluster identity 1 [ 1895.288916][T20615] jffs2: notice: (20615) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1895.582530][ T126] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1895.797243][ T126] usb 7-1: config index 0 descriptor too short (expected 50, got 32) [ 1895.841319][ T126] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1895.996501][ T126] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1896.121926][ T126] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1896.294667][ T126] usb 7-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1896.415841][ T126] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1896.512229][ T126] usb 7-1: Product: syz [ 1896.516459][ T126] usb 7-1: Manufacturer: syz [ 1896.553216][ T126] usb 7-1: SerialNumber: syz [ 1896.573399][T20620] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1896.628985][ T126] usb_debug 7-1:1.0: debug converter detected [ 1896.678416][ T126] usb 7-1: debug converter now attached to ttyUSB0 [ 1896.840764][ T4389] usb 7-1: USB disconnect, device number 5 [ 1896.859877][ T4389] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1896.899241][ T4389] usb_debug 7-1:1.0: device disconnected [ 1897.500190][T20694] zero sized request [ 1897.663312][T20701] FAULT_INJECTION: forcing a failure. [ 1897.663312][T20701] name failslab, interval 1, probability 0, space 0, times 0 [ 1897.708755][T20701] CPU: 0 PID: 20701 Comm: syz.1.3385 Not tainted syzkaller #0 [ 1897.716289][T20701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1897.726374][T20701] Call Trace: [ 1897.729671][T20701] [ 1897.732633][T20701] dump_stack_lvl+0x188/0x24e [ 1897.737341][T20701] ? show_regs_print_info+0x12/0x12 [ 1897.742573][T20701] ? load_image+0x410/0x410 [ 1897.747120][T20701] ? __lock_acquire+0x7c40/0x7c40 [ 1897.752200][T20701] should_fail_ex+0x390/0x4c0 [ 1897.756919][T20701] should_failslab+0x5/0x20 [ 1897.761444][T20701] slab_pre_alloc_hook+0x59/0x300 [ 1897.766498][T20701] ? alloc_pipe_info+0xe4/0x4a0 [ 1897.771473][T20701] __kmem_cache_alloc_node+0x4f/0x270 [ 1897.776878][T20701] ? alloc_pipe_info+0xe4/0x4a0 [ 1897.781762][T20701] kmalloc_trace+0x26/0xe0 [ 1897.786214][T20701] alloc_pipe_info+0xe4/0x4a0 [ 1897.790933][T20701] splice_direct_to_actor+0x95d/0xbd0 [ 1897.796430][T20701] ? aa_path_link+0x8a0/0x8a0 [ 1897.801145][T20701] ? aa_file_perm+0x3ea/0xf00 [ 1897.805851][T20701] ? direct_file_splice_eof+0xa0/0xa0 [ 1897.811251][T20701] ? pipe_to_sendpage+0x320/0x320 [ 1897.816307][T20701] ? common_file_perm+0x171/0x1c0 [ 1897.821365][T20701] ? fsnotify_perm+0x5a/0x550 [ 1897.826065][T20701] ? security_file_permission+0x75/0xa0 [ 1897.831643][T20701] do_splice_direct+0x1ce/0x2f0 [ 1897.836530][T20701] ? splice_direct_to_actor+0xbd0/0xbd0 [ 1897.842108][T20701] ? rcu_read_lock_any_held+0xb0/0x130 [ 1897.847607][T20701] ? do_splice_direct+0x2f0/0x2f0 [ 1897.852666][T20701] ? common_file_perm+0x171/0x1c0 [ 1897.857730][T20701] do_sendfile+0x51b/0xe20 [ 1897.862187][T20701] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1897.868106][T20701] ? do_pwritev+0x3a0/0x3a0 [ 1897.872640][T20701] __se_sys_sendfile64+0x141/0x1a0 [ 1897.877771][T20701] ? lock_chain_count+0x20/0x20 [ 1897.882658][T20701] ? __x64_sys_sendfile64+0xa0/0xa0 [ 1897.887891][T20701] ? lockdep_hardirqs_on+0x94/0x140 [ 1897.893129][T20701] do_syscall_64+0x4c/0xa0 [ 1897.897571][T20701] ? clear_bhb_loop+0x60/0xb0 [ 1897.902269][T20701] ? clear_bhb_loop+0x60/0xb0 [ 1897.906968][T20701] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1897.912898][T20701] RIP: 0033:0x7fd2f099e159 [ 1897.917331][T20701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1897.936965][T20701] RSP: 002b:00007fd2f17c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1897.945412][T20701] RAX: ffffffffffffffda RBX: 00007fd2f0c25fa0 RCX: 00007fd2f099e159 [ 1897.953410][T20701] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 1897.961406][T20701] RBP: 00007fd2f0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1897.969404][T20701] R10: 0000000000008112 R11: 0000000000000246 R12: 0000000000000000 [ 1897.977402][T20701] R13: 00007fd2f0c26038 R14: 00007fd2f0c25fa0 R15: 00007ffff1a8ec68 [ 1897.985419][T20701] [ 1897.988590][ C0] vkms_vblank_simulate: vblank timer overrun [ 1898.167050][T20719] base or size exceeds the MTRR width [ 1898.443054][ T4389] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1898.644239][ T4389] usb 3-1: config index 0 descriptor too short (expected 50, got 32) [ 1898.661620][ T4389] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1898.699813][ T4389] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1898.742713][ T4389] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1898.771528][ T4389] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1898.801850][ T4389] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1898.809916][ T4389] usb 3-1: Product: syz [ 1898.831703][ T4389] usb 3-1: Manufacturer: syz [ 1898.836538][ T4389] usb 3-1: SerialNumber: syz [ 1898.882809][T20721] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1898.898770][ T4389] usb_debug 3-1:1.0: debug converter detected [ 1898.923339][ T4389] usb 3-1: debug converter now attached to ttyUSB0 [ 1899.107050][ T6458] usb 3-1: USB disconnect, device number 4 [ 1899.132378][ T6458] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1899.143943][ T6458] usb_debug 3-1:1.0: device disconnected [ 1899.524313][T20789] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3415'. [ 1900.318867][ T26] audit: type=1326 audit(1790279861.056:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.361801][ T26] audit: type=1326 audit(1790279861.086:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.437381][ T26] audit: type=1326 audit(1790279861.096:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.511966][ T4389] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1900.536701][ T26] audit: type=1326 audit(1790279861.096:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.599998][ T26] audit: type=1326 audit(1790279861.096:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.694400][ T26] audit: type=1326 audit(1790279861.096:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.753667][ T4389] usb 2-1: config index 0 descriptor too short (expected 50, got 32) [ 1900.771077][ T4389] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1900.812001][ T4389] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1900.823587][ T4389] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1900.849550][ T26] audit: type=1326 audit(1790279861.096:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.874519][ T4389] usb 2-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1900.915717][ T4389] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1900.939578][ T4389] usb 2-1: Product: syz [ 1900.944677][ T4389] usb 2-1: Manufacturer: syz [ 1900.949677][ T26] audit: type=1326 audit(1790279861.096:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1900.977662][ T4389] usb 2-1: SerialNumber: syz [ 1900.986309][T20824] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1900.999273][ T4389] usb_debug 2-1:1.0: debug converter detected [ 1901.009222][ T26] audit: type=1326 audit(1790279861.096:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7f5a3c19e159 code=0x7ffc0000 [ 1901.044450][ T4389] usb 2-1: debug converter now attached to ttyUSB0 [ 1901.111236][ T26] audit: type=1326 audit(1790279861.096:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20828 comm="syz.6.3430" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5a3c197ed7 code=0x7ffc0000 [ 1901.204553][ T4389] usb 2-1: USB disconnect, device number 3 [ 1901.240450][ T4389] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1901.274520][ T4389] usb_debug 2-1:1.0: device disconnected [ 1902.072404][T20904] jffs2: notice: (20904) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1902.841912][ T6458] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1903.053707][ T6458] usb 2-1: config index 0 descriptor too short (expected 50, got 32) [ 1903.073553][ T6458] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1903.119712][ T6458] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1903.148973][ T6458] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1903.197648][ T6458] usb 2-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1903.222446][ T6458] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1903.254240][ T6458] usb 2-1: Product: syz [ 1903.271418][ T6458] usb 2-1: Manufacturer: syz [ 1903.295779][ T6458] usb 2-1: SerialNumber: syz [ 1903.333079][T20928] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1903.345145][ T6458] usb_debug 2-1:1.0: debug converter detected [ 1903.374758][ T6458] usb 2-1: debug converter now attached to ttyUSB0 [ 1903.549252][ T4389] usb 2-1: USB disconnect, device number 4 [ 1903.565980][ T4389] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1903.583032][ T4389] usb_debug 2-1:1.0: device disconnected [ 1904.267401][T20989] blktrace: Concurrent blktraces are not allowed on sg0 [ 1905.377366][ T4389] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1905.541896][T21043] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1905.549184][T21043] IPv6: NLM_F_CREATE should be set when creating new route [ 1905.556515][T21043] IPv6: NLM_F_CREATE should be set when creating new route [ 1905.563790][T21043] IPv6: NLM_F_CREATE should be set when creating new route [ 1905.581439][ T4389] usb 3-1: config index 0 descriptor too short (expected 50, got 32) [ 1905.591382][T21043] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3494'. [ 1905.607744][ T4389] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.619102][ T4389] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1905.639522][ T4389] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1905.670649][ T4389] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1905.691516][ T4389] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1905.709184][ T4389] usb 3-1: Product: syz [ 1905.719229][ T4389] usb 3-1: Manufacturer: syz [ 1905.729812][ T4389] usb 3-1: SerialNumber: syz [ 1905.743316][T21019] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1905.773916][ T4389] usb_debug 3-1:1.0: debug converter detected [ 1905.808115][ T4389] usb 3-1: debug converter now attached to ttyUSB0 [ 1905.945491][T21054] netlink: 'syz.5.3497': attribute type 1 has an invalid length. [ 1905.986507][ T126] usb 3-1: USB disconnect, device number 5 [ 1906.016601][ T126] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1906.055243][ T126] usb_debug 3-1:1.0: device disconnected [ 1906.179263][T21063] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3501'. [ 1906.475052][T21079] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1906.482388][T21079] IPv6: NLM_F_CREATE should be set when creating new route [ 1906.489697][T21079] IPv6: NLM_F_CREATE should be set when creating new route [ 1906.497015][T21079] IPv6: NLM_F_CREATE should be set when creating new route [ 1906.621244][T21079] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.3506'. [ 1906.817386][T21095] netlink: 'syz.6.3511': attribute type 1 has an invalid length. [ 1907.050108][T21111] tipc: Started in network mode [ 1907.065730][T21111] tipc: Node identity 0010000000000000002, cluster identity 1 [ 1907.224252][T21120] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1907.231579][T21120] IPv6: NLM_F_CREATE should be set when creating new route [ 1907.238905][T21120] IPv6: NLM_F_CREATE should be set when creating new route [ 1907.246172][T21120] IPv6: NLM_F_CREATE should be set when creating new route [ 1907.265799][T21120] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.3522'. [ 1907.481759][ T129] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1907.725330][ T129] usb 6-1: config index 0 descriptor too short (expected 50, got 32) [ 1907.799829][ T129] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1907.969121][ T129] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 1908.130724][ T129] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1908.345699][ T129] usb 6-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1908.385151][ T129] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1908.409752][ T129] usb 6-1: Product: syz [ 1908.429947][ T129] usb 6-1: Manufacturer: syz [ 1908.450359][ T129] usb 6-1: SerialNumber: syz [ 1908.477416][T21121] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1908.495093][ T129] usb_debug 6-1:1.0: debug converter detected [ 1908.518581][ T129] usb 6-1: debug converter now attached to ttyUSB0 [ 1908.707072][ T129] usb 6-1: USB disconnect, device number 2 [ 1908.758215][ T129] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1908.780391][ T129] usb_debug 6-1:1.0: device disconnected [ 1908.849669][T21154] netlink: 'syz.2.3530': attribute type 1 has an invalid length. [ 1909.646104][T21169] FAULT_INJECTION: forcing a failure. [ 1909.646104][T21169] name failslab, interval 1, probability 0, space 0, times 0 [ 1909.901898][T21169] CPU: 1 PID: 21169 Comm: syz.8.3534 Not tainted syzkaller #0 [ 1909.909435][T21169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1909.919518][T21169] Call Trace: [ 1909.922809][T21169] [ 1909.925750][T21169] dump_stack_lvl+0x188/0x24e [ 1909.930452][T21169] ? show_regs_print_info+0x12/0x12 [ 1909.935664][T21169] ? load_image+0x410/0x410 [ 1909.940186][T21169] ? __lock_acquire+0x7c40/0x7c40 [ 1909.945239][T21169] should_fail_ex+0x390/0x4c0 [ 1909.949942][T21169] should_failslab+0x5/0x20 [ 1909.954462][T21169] slab_pre_alloc_hook+0x59/0x300 [ 1909.959502][T21169] ? ceph_alloc_options+0x4a/0x1c0 [ 1909.964633][T21169] __kmem_cache_alloc_node+0x4f/0x270 [ 1909.970023][T21169] ? ceph_alloc_options+0x4a/0x1c0 [ 1909.975154][T21169] kmalloc_trace+0x26/0xe0 [ 1909.979582][T21169] ceph_alloc_options+0x4a/0x1c0 [ 1909.984537][T21169] ceph_init_fs_context+0x64/0x4a0 [ 1909.989662][T21169] ? destroy_caches+0x80/0x80 [ 1909.994358][T21169] alloc_fs_context+0x628/0x7d0 [ 1909.999235][T21169] __se_sys_fsopen+0xa0/0x2c0 [ 1910.003939][T21169] do_syscall_64+0x4c/0xa0 [ 1910.008380][T21169] ? clear_bhb_loop+0x60/0xb0 [ 1910.013075][T21169] ? clear_bhb_loop+0x60/0xb0 [ 1910.017773][T21169] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1910.023697][T21169] RIP: 0033:0x7f784659e159 [ 1910.028127][T21169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1910.047763][T21169] RSP: 002b:00007f7847437028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1910.056207][T21169] RAX: ffffffffffffffda RBX: 00007f7846825fa0 RCX: 00007f784659e159 [ 1910.064195][T21169] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 1910.072181][T21169] RBP: 00007f784663506b R08: 0000000000000000 R09: 0000000000000000 [ 1910.080175][T21169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1910.088167][T21169] R13: 00007f7846826038 R14: 00007f7846825fa0 R15: 00007ffea55882d8 [ 1910.096167][T21169] [ 1910.475759][ T26] kauditd_printk_skb: 60 callbacks suppressed [ 1910.475775][ T26] audit: type=1800 audit(1790279871.216:233): pid=21176 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3535" name="zone_nr_conv" dev="configfs" ino=88867 res=0 errno=0 [ 1913.493023][T21198] netlink: 'syz.5.3541': attribute type 1 has an invalid length. [ 1914.473846][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.480202][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1916.297806][T16264] Bluetooth: hci1: link tx timeout [ 1916.304142][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.316377][T16264] Bluetooth: hci1: link tx timeout [ 1916.322141][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.332816][T16264] Bluetooth: hci1: link tx timeout [ 1916.338223][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.346599][T16264] Bluetooth: hci1: link tx timeout [ 1916.352166][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.360166][T16264] Bluetooth: hci1: link tx timeout [ 1916.365512][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.374066][T16264] Bluetooth: hci1: link tx timeout [ 1916.379471][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.387467][T16264] Bluetooth: hci1: link tx timeout [ 1916.394526][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.402589][T16264] Bluetooth: hci1: link tx timeout [ 1916.407946][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.416393][T16264] Bluetooth: hci1: link tx timeout [ 1916.421777][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.431144][T16264] Bluetooth: hci1: link tx timeout [ 1916.437116][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.445185][T16264] Bluetooth: hci1: link tx timeout [ 1916.450602][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.459237][T16264] Bluetooth: hci1: link tx timeout [ 1916.464667][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.474481][T16264] Bluetooth: hci1: link tx timeout [ 1916.479719][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.487447][T16264] Bluetooth: hci1: link tx timeout [ 1916.492862][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.501411][T16264] Bluetooth: hci1: link tx timeout [ 1916.507500][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.515574][T16264] Bluetooth: hci1: link tx timeout [ 1916.520949][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.529373][T16264] Bluetooth: hci1: link tx timeout [ 1916.534896][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.542862][T16264] Bluetooth: hci1: link tx timeout [ 1916.548596][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.557389][T16264] Bluetooth: hci1: link tx timeout [ 1916.563230][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.571159][T16264] Bluetooth: hci1: link tx timeout [ 1916.576939][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.585404][T16264] Bluetooth: hci1: link tx timeout [ 1916.590762][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.599786][T16264] Bluetooth: hci1: link tx timeout [ 1916.605168][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.614060][T16264] Bluetooth: hci1: link tx timeout [ 1916.619445][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.627408][T16264] Bluetooth: hci1: link tx timeout [ 1916.633511][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.641513][T16264] Bluetooth: hci1: link tx timeout [ 1916.646755][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.671289][T16264] Bluetooth: hci1: link tx timeout [ 1916.683346][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.691121][T16264] Bluetooth: hci1: link tx timeout [ 1916.696454][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.708408][T16264] Bluetooth: hci1: link tx timeout [ 1916.714588][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.722991][T16264] Bluetooth: hci1: link tx timeout [ 1916.728694][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.736821][T16264] Bluetooth: hci1: link tx timeout [ 1916.742209][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.750661][T16264] Bluetooth: hci1: link tx timeout [ 1916.756257][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.765295][T16264] Bluetooth: hci1: link tx timeout [ 1916.771045][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1916.786357][T16264] Bluetooth: hci1: link tx timeout [ 1916.791914][T16264] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1916.799850][T16264] Bluetooth: hci1: link tx timeout [ 1916.810739][T16264] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1917.401552][ T26] audit: type=1800 audit(1790279878.136:234): pid=21283 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3564" name="idVendor" dev="configfs" ino=89026 res=0 errno=0 [ 1918.391880][T16264] Bluetooth: hci1: command 0x0406 tx timeout [ 1920.062001][T21380] tipc: Started in network mode [ 1920.066937][T21380] tipc: Node identity 0010000000000000002, cluster identity 1 [ 1920.472057][T16264] Bluetooth: hci1: command 0x0406 tx timeout [ 1922.008090][ T26] audit: type=1800 audit(1790279882.746:235): pid=21453 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3619" name="idVendor" dev="configfs" ino=91198 res=0 errno=0 [ 1922.071063][ T26] audit: type=1800 audit(1790279882.786:236): pid=21453 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3619" name="idProduct" dev="configfs" ino=91199 res=0 errno=0 [ 1922.150336][ T26] audit: type=1800 audit(1790279882.856:237): pid=21458 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3619" name="UDC" dev="configfs" ino=90316 res=0 errno=0 [ 1922.150348][T21458] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1922.150361][T21458] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1922.213676][T21461] Config c/1 of g1 needs at least one function. [ 1922.220084][T21461] udc dummy_udc.0: failed to start g1: -22 [ 1922.335187][T21461] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1922.368267][T21461] UDC core: g1: couldn't find an available UDC or it's busy [ 1922.451474][T21458] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1922.723668][T21477] netlink: 'syz.1.3626': attribute type 1 has an invalid length. [ 1923.873122][ T26] audit: type=1800 audit(1790279884.606:238): pid=21516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3638" name="idVendor" dev="configfs" ino=90395 res=0 errno=0 [ 1924.240838][ T26] audit: type=1800 audit(1790279884.616:239): pid=21516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3638" name="idProduct" dev="configfs" ino=90397 res=0 errno=0 [ 1924.278268][ T26] audit: type=1800 audit(1790279885.016:240): pid=21519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3638" name="UDC" dev="configfs" ino=91287 res=0 errno=0 [ 1924.299961][T21519] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1924.307615][T21519] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1924.336982][T21521] Config c/1 of g1 needs at least one function. [ 1924.344811][T21519] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1924.351941][T21521] udc dummy_udc.0: failed to start g1: -22 [ 1924.409553][T21521] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1924.548690][T21521] UDC core: g1: couldn't find an available UDC or it's busy [ 1926.894065][ T26] audit: type=1800 audit(1790279887.636:241): pid=21561 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3656" name="idVendor" dev="configfs" ino=91375 res=0 errno=0 [ 1926.943227][ T26] audit: type=1800 audit(1790279887.666:242): pid=21561 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3656" name="idProduct" dev="configfs" ino=91376 res=0 errno=0 [ 1926.982831][T21565] Config c/1 of g1 needs at least one function. [ 1927.040351][T21565] udc dummy_udc.0: failed to start g1: -22 [ 1927.083976][T21565] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1927.091600][ T26] audit: type=1800 audit(1790279887.716:243): pid=21565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3656" name="UDC" dev="configfs" ino=91379 res=0 errno=0 [ 1927.143733][T21565] UDC core: g1: couldn't find an available UDC or it's busy [ 1927.668090][T21591] FAULT_INJECTION: forcing a failure. [ 1927.668090][T21591] name failslab, interval 1, probability 0, space 0, times 0 [ 1927.702209][T21593] fuse: Bad value for 'fd' [ 1927.739106][T21591] CPU: 1 PID: 21591 Comm: syz.1.3665 Not tainted syzkaller #0 [ 1927.746633][T21591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1927.756710][T21591] Call Trace: [ 1927.760008][T21591] [ 1927.762954][T21591] dump_stack_lvl+0x188/0x24e [ 1927.767659][T21591] ? show_regs_print_info+0x12/0x12 [ 1927.772857][T21591] ? load_image+0x410/0x410 [ 1927.777356][T21591] ? __might_sleep+0xd0/0xd0 [ 1927.781950][T21591] ? __lock_acquire+0x7c40/0x7c40 [ 1927.786974][T21591] should_fail_ex+0x390/0x4c0 [ 1927.791653][T21591] should_failslab+0x5/0x20 [ 1927.796156][T21591] slab_pre_alloc_hook+0x59/0x300 [ 1927.801181][T21591] kmem_cache_alloc_lru+0x49/0x2e0 [ 1927.806283][T21591] ? __d_alloc+0x2e/0x6e0 [ 1927.810624][T21591] __d_alloc+0x2e/0x6e0 [ 1927.814770][T21591] ? d_alloc_pseudo+0xe/0x70 [ 1927.819352][T21591] d_alloc_pseudo+0x19/0x70 [ 1927.823863][T21591] alloc_file_pseudo+0xe0/0x200 [ 1927.828727][T21591] ? alloc_empty_file_noaccount+0x80/0x80 [ 1927.834454][T21591] ? alloc_fd+0x590/0x640 [ 1927.838806][T21591] anon_inode_getfd+0xc6/0x1b0 [ 1927.843646][T21591] btf_new_fd+0x5d3/0x760 [ 1927.848066][T21591] __sys_bpf+0x612/0x780 [ 1927.852357][T21591] ? bpf_link_show_fdinfo+0x380/0x380 [ 1927.857733][T21591] ? lock_chain_count+0x20/0x20 [ 1927.862600][T21591] __x64_sys_bpf+0x78/0x90 [ 1927.867028][T21591] do_syscall_64+0x4c/0xa0 [ 1927.871437][T21591] ? clear_bhb_loop+0x60/0xb0 [ 1927.876108][T21591] ? clear_bhb_loop+0x60/0xb0 [ 1927.880788][T21591] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1927.886693][T21591] RIP: 0033:0x7fd2f099e159 [ 1927.891138][T21591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1927.910746][T21591] RSP: 002b:00007fd2f17c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1927.919164][T21591] RAX: ffffffffffffffda RBX: 00007fd2f0c25fa0 RCX: 00007fd2f099e159 [ 1927.927133][T21591] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 1927.935105][T21591] RBP: 00007fd2f0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1927.943073][T21591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1927.951044][T21591] R13: 00007fd2f0c26038 R14: 00007fd2f0c25fa0 R15: 00007ffff1a8ec68 [ 1927.959018][T21591] [ 1929.139126][ T26] audit: type=1800 audit(1790279889.876:244): pid=21605 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3672" name="idVendor" dev="configfs" ino=90498 res=0 errno=0 [ 1929.159588][ C0] vkms_vblank_simulate: vblank timer overrun [ 1929.200060][ T26] audit: type=1800 audit(1790279889.916:245): pid=21605 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3672" name="idProduct" dev="configfs" ino=90501 res=0 errno=0 [ 1929.233185][T21615] Config c/1 of g1 needs at least one function. [ 1929.247249][T21615] udc dummy_udc.0: failed to start g1: -22 [ 1929.262874][T21615] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1929.297843][ T26] audit: type=1800 audit(1790279889.966:246): pid=21615 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3672" name="UDC" dev="configfs" ino=90503 res=0 errno=0 [ 1929.375976][T21615] UDC core: g1: couldn't find an available UDC or it's busy [ 1930.983150][T21653] fuse: Bad value for 'fd' [ 1931.912225][ T4280] Bluetooth: hci2: command 0x0406 tx timeout [ 1934.100159][ T26] audit: type=1800 audit(1790279894.836:247): pid=21724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3689" name="idVendor" dev="configfs" ino=90582 res=0 errno=0 [ 1934.159307][T21727] Config c/1 of g1 needs at least one function. [ 1934.184539][ T26] audit: type=1800 audit(1790279894.836:248): pid=21724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3689" name="idProduct" dev="configfs" ino=90583 res=0 errno=0 [ 1934.198177][T21727] udc dummy_udc.0: failed to start g1: -22 [ 1934.291849][ T26] audit: type=1800 audit(1790279894.896:249): pid=21727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3689" name="UDC" dev="configfs" ino=90584 res=0 errno=0 [ 1934.316486][T21727] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1934.342405][T21727] UDC core: g1: couldn't find an available UDC or it's busy [ 1937.910489][T21785] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1937.956828][T21785] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1938.053269][T21785] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1938.063043][T21793] jffs2: notice: (21793) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1941.251451][T21831] netlink: 'syz.1.3720': attribute type 1 has an invalid length. [ 1943.221075][T21851] jffs2: notice: (21851) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1943.438720][ T26] audit: type=1800 audit(1790279904.176:250): pid=21858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3726" name="idVendor" dev="configfs" ino=91712 res=0 errno=0 [ 1943.520226][T21862] Config c/1 of g1 needs at least one function. [ 1943.531900][ T26] audit: type=1800 audit(1790279904.206:251): pid=21858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3726" name="idProduct" dev="configfs" ino=90820 res=0 errno=0 [ 1943.542156][T21862] udc dummy_udc.0: failed to start g1: -22 [ 1943.583129][T21862] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1943.631267][ T26] audit: type=1800 audit(1790279904.256:252): pid=21862 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3726" name="UDC" dev="configfs" ino=90825 res=0 errno=0 [ 1943.691289][T21862] UDC core: g1: couldn't find an available UDC or it's busy [ 1944.842704][T21883] netlink: 'syz.2.3734': attribute type 1 has an invalid length. [ 1945.854540][T21903] jffs2: notice: (21903) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1946.504456][T13490] libceph: connect (1)[c::]:6789 error -101 [ 1946.511374][T13490] libceph: mon0 (1)[c::]:6789 connect error [ 1947.436727][T13490] libceph: connect (1)[c::]:6789 error -101 [ 1947.436788][T16264] Bluetooth: hci4: command 0x0406 tx timeout [ 1947.465435][T21925] ceph: No mds server is up or the cluster is laggy [ 1947.472877][T13490] libceph: mon0 (1)[c::]:6789 connect error [ 1947.762182][T16264] Bluetooth: hci1: command 0x0405 tx timeout [ 1949.366455][T21946] netlink: 'syz.1.3750': attribute type 1 has an invalid length. [ 1954.387017][T22003] netlink: 'syz.2.3765': attribute type 1 has an invalid length. [ 1954.619713][T22024] jffs2: notice: (22024) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1957.434949][T22036] blktrace: Concurrent blktraces are not allowed on sg0 [ 1958.167405][T22075] jffs2: notice: (22075) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1959.046215][T22081] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1961.285654][T22101] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input7 [ 1961.287566][T22120] jffs2: notice: (22120) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1962.813700][T22135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1964.218275][ T26] audit: type=1800 audit(1790279924.956:253): pid=22137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3806" name="idVendor" dev="configfs" ino=92107 res=0 errno=0 [ 1964.243031][ T26] audit: type=1800 audit(1790279924.976:254): pid=22137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3806" name="idProduct" dev="configfs" ino=92108 res=0 errno=0 [ 1964.316507][ T26] audit: type=1800 audit(1790279925.056:255): pid=22140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3806" name="UDC" dev="configfs" ino=92314 res=0 errno=0 [ 1964.347198][T22140] Config c/1 of g1 needs at least one function. [ 1964.421862][T22140] udc dummy_udc.0: failed to start g1: -22 [ 1964.427748][T22140] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1964.479856][T22149] fuse: Bad value for 'fd' [ 1964.492027][T22140] UDC core: g1: couldn't find an available UDC or it's busy [ 1966.504706][T22170] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1967.794381][T22166] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input8 [ 1968.753057][T22180] jffs2: notice: (22180) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1969.798899][T22189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3820'. [ 1969.860604][T22193] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1971.250300][T22205] fuse: Bad value for 'fd' [ 1971.356278][T22211] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1974.085024][T22219] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input9 [ 1975.918622][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1975.930222][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1976.142188][T22241] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3835'. [ 1976.223166][T22241] bridge0: port 2(bridge_slave_1) entered disabled state [ 1976.230456][T22241] bridge0: port 1(bridge_slave_0) entered disabled state [ 1976.326316][T22247] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1977.852024][T22262] fuse: Bad value for 'fd' [ 1979.129129][T22278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1981.160391][T22275] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input10 [ 1981.924926][T22301] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1983.998622][T22311] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3855'. [ 1984.965083][ T26] audit: type=1800 audit(1790279945.706:256): pid=22320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3859" name="idVendor" dev="configfs" ino=92735 res=0 errno=0 [ 1984.990488][ T26] audit: type=1800 audit(1790279945.736:257): pid=22320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3859" name="idProduct" dev="configfs" ino=92736 res=0 errno=0 [ 1985.264200][ T26] audit: type=1800 audit(1790279946.006:258): pid=22321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3859" name="UDC" dev="configfs" ino=92743 res=0 errno=0 [ 1985.308194][T22321] Config c/1 of g1 needs at least one function. [ 1985.360246][T22321] udc dummy_udc.0: failed to start g1: -22 [ 1985.366373][T22321] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1985.382559][T22321] UDC core: g1: couldn't find an available UDC or it's busy [ 1985.550669][T22336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1985.708012][T22330] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input11 [ 1988.282959][T22356] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3869'. [ 1992.617850][T22382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1993.361835][T16264] Bluetooth: hci0: command 0x0406 tx timeout [ 1994.113991][ T26] audit: type=1800 audit(1790279954.856:259): pid=22378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3874" name="idVendor" dev="configfs" ino=92911 res=0 errno=0 [ 1994.182111][ T26] audit: type=1800 audit(1790279954.926:260): pid=22378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3874" name="idProduct" dev="configfs" ino=92912 res=0 errno=0 [ 1995.795974][T22378] Config c/1 of g1 needs at least one function. [ 1995.805361][ T26] audit: type=1800 audit(1790279956.536:261): pid=22383 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3874" name="UDC" dev="configfs" ino=92924 res=0 errno=0 [ 1995.846451][T22378] udc dummy_udc.0: failed to start g1: -22 [ 1995.876138][T22378] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 1995.902194][T22378] UDC core: g1: couldn't find an available UDC or it's busy [ 1998.072466][ T4280] Bluetooth: hci0: command 0x0c13 tx timeout [ 1998.078733][T16264] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 1999.056921][T22475] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2001.821175][ T26] audit: type=1800 audit(1790279962.556:262): pid=22489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3892" name="idVendor" dev="configfs" ino=93028 res=0 errno=0 [ 2001.894427][ T26] audit: type=1800 audit(1790279962.596:263): pid=22489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3892" name="idProduct" dev="configfs" ino=93029 res=0 errno=0 [ 2001.956770][ T26] audit: type=1800 audit(1790279962.666:264): pid=22493 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3892" name="UDC" dev="configfs" ino=93035 res=0 errno=0 [ 2002.077872][T22493] Config c/1 of g1 needs at least one function. [ 2002.407671][T22493] udc dummy_udc.0: failed to start g1: -22 [ 2002.413673][T22493] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 2002.426650][T22493] UDC core: g1: couldn't find an available UDC or it's busy [ 2004.775757][T22524] FAULT_INJECTION: forcing a failure. [ 2004.775757][T22524] name failslab, interval 1, probability 0, space 0, times 0 [ 2005.021905][T22524] CPU: 1 PID: 22524 Comm: syz.8.3901 Not tainted syzkaller #0 [ 2005.029438][T22524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2005.039534][T22524] Call Trace: [ 2005.042837][T22524] [ 2005.045785][T22524] dump_stack_lvl+0x188/0x24e [ 2005.050504][T22524] ? show_regs_print_info+0x12/0x12 [ 2005.055720][T22524] ? load_image+0x410/0x410 [ 2005.060247][T22524] ? __might_sleep+0xd0/0xd0 [ 2005.064860][T22524] ? __lock_acquire+0x7c40/0x7c40 [ 2005.069921][T22524] should_fail_ex+0x390/0x4c0 [ 2005.074634][T22524] should_failslab+0x5/0x20 [ 2005.079152][T22524] slab_pre_alloc_hook+0x59/0x300 [ 2005.084202][T22524] ? __rwlock_init+0x140/0x140 [ 2005.088981][T22524] kmem_cache_alloc+0x56/0x2f0 [ 2005.093765][T22524] ? key_alloc+0x302/0x1030 [ 2005.098421][T22524] key_alloc+0x302/0x1030 [ 2005.102798][T22524] keyring_alloc+0x41/0xa0 [ 2005.107250][T22524] lookup_user_key+0x4da/0x1110 [ 2005.112135][T22524] ? lookup_user_key_possessed+0x40/0x40 [ 2005.117796][T22524] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 2005.123805][T22524] ? __might_fault+0xc2/0x120 [ 2005.128509][T22524] ? __might_fault+0xa6/0x120 [ 2005.133216][T22524] __se_sys_add_key+0x311/0x410 [ 2005.138092][T22524] ? __x64_sys_add_key+0xc0/0xc0 [ 2005.143083][T22524] ? lockdep_hardirqs_on+0x94/0x140 [ 2005.148303][T22524] ? __x64_sys_add_key+0x1c/0xc0 [ 2005.153265][T22524] do_syscall_64+0x4c/0xa0 [ 2005.157699][T22524] ? clear_bhb_loop+0x60/0xb0 [ 2005.162401][T22524] ? clear_bhb_loop+0x60/0xb0 [ 2005.167099][T22524] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2005.173026][T22524] RIP: 0033:0x7f784659e159 [ 2005.177462][T22524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2005.197119][T22524] RSP: 002b:00007f7847437028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 2005.205554][T22524] RAX: ffffffffffffffda RBX: 00007f7846825fa0 RCX: 00007f784659e159 [ 2005.213556][T22524] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 2005.221544][T22524] RBP: 00007f784663506b R08: fffffffffffffffe R09: 0000000000000000 [ 2005.229531][T22524] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 2005.237516][T22524] R13: 00007f7846826038 R14: 00007f7846825fa0 R15: 00007ffea55882d8 [ 2005.245518][T22524] [ 2005.299534][T22533] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2006.271832][T22533] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 2006.360754][T22541] 9pnet_virtio: no channels available for device syz [ 2006.371416][T22533] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2006.389866][T22533] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2006.409447][T22533] device bridge_slave_0 left promiscuous mode [ 2006.415949][T22533] bridge0: port 1(bridge_slave_0) entered disabled state [ 2006.429713][T22533] device bridge_slave_1 left promiscuous mode [ 2006.437249][T22533] bridge0: port 2(bridge_slave_1) entered disabled state [ 2006.454502][T22533] bond0: (slave bond_slave_0): Releasing backup interface [ 2006.470696][T22533] bond0: (slave bond_slave_1): Releasing backup interface [ 2006.534491][T22533] team0: Port device team_slave_0 removed [ 2006.556975][T16264] Bluetooth: hci1: unexpected event for opcode 0x1405 [ 2006.575108][T22533] team0: Port device team_slave_1 removed [ 2006.584029][T22533] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2006.592067][T22533] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2006.608032][T22533] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2006.636130][T22533] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2006.888218][T22533] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 2006.924849][T22533] batman_adv: batadv0: Removing interface: ip6gretap1 [ 2007.682564][T22535] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3901'. [ 2007.777634][ T26] audit: type=1800 audit(1790279968.516:265): pid=22554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3909" name="idVendor" dev="configfs" ino=93111 res=0 errno=0 [ 2007.871734][ T26] audit: type=1800 audit(1790279968.516:266): pid=22554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3909" name="idProduct" dev="configfs" ino=93112 res=0 errno=0 [ 2007.896359][T22559] Config c/1 of g1 needs at least one function. [ 2007.914876][T22559] udc dummy_udc.0: failed to start g1: -22 [ 2007.937356][T22559] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 2007.951234][ T26] audit: type=1800 audit(1790279968.576:267): pid=22556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3909" name="UDC" dev="configfs" ino=93117 res=0 errno=0 [ 2007.976870][T22559] UDC core: g1: couldn't find an available UDC or it's busy [ 2008.058439][T22565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2009.428363][ T26] audit: type=1326 audit(1790279970.166:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f099e159 code=0x7ffc0000 [ 2009.541258][ T26] audit: type=1326 audit(1790279970.196:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f099e159 code=0x7ffc0000 [ 2009.626623][ T26] audit: type=1326 audit(1790279970.196:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fd2f099e159 code=0x7ffc0000 [ 2009.688122][ T26] audit: type=1326 audit(1790279970.196:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f099e159 code=0x7ffc0000 [ 2010.499338][ T26] audit: type=1326 audit(1790279970.196:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f099e159 code=0x7ffc0000 [ 2010.524740][ T26] audit: type=1326 audit(1790279970.196:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd2f095e98e code=0x7ffc0000 [ 2010.549687][ T26] audit: type=1326 audit(1790279970.196:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22573 comm="syz.1.3914" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd2f095e98e code=0x7ffc0000 [ 2012.069442][T22606] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2013.182579][ T26] kauditd_printk_skb: 15 callbacks suppressed [ 2013.182594][ T26] audit: type=1800 audit(1790279973.926:290): pid=22614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3925" name="idVendor" dev="configfs" ino=94116 res=0 errno=0 [ 2013.281681][ T26] audit: type=1800 audit(1790279973.976:291): pid=22614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3925" name="idProduct" dev="configfs" ino=94283 res=0 errno=0 [ 2013.303663][T22622] Config c/1 of g1 needs at least one function. [ 2013.310464][T22622] udc dummy_udc.0: failed to start g1: -22 [ 2013.340560][T22622] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 2013.377080][T22622] UDC core: g1: couldn't find an available UDC or it's busy [ 2013.381022][ T26] audit: type=1800 audit(1790279974.026:292): pid=22622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3925" name="UDC" dev="configfs" ino=94119 res=0 errno=0 [ 2015.293085][T22656] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2037.353817][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 2037.360167][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 2098.794756][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 2098.801115][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 2160.233681][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 2160.240015][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 2221.673655][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.680004][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 2243.431908][T12547] kworker/dying (12547) used greatest stack depth: 15904 bytes left [ 2283.113639][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 2283.119951][ T1280] ieee802154 phy1 wpan1: encryption failed: -22