last executing test programs: 4m45.683676506s ago: executing program 3 (id=60): socket$inet_sctp(0x2, 0x1, 0x84) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000840)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\n%?u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05\x9dR\xde\xf6\xc9!R#\xd7\xc0\xea\x9a\x04v\x85\xbcx\x9ai\xd2\r\x05ZY\x0e\"d\xc7\xd7\x02v32Z\xe0\n3\x8b\xa0\x83z\v\x90\x8ce\x12\xbcw\x1e\x7f \xdaPh: \x8e\x95\xb2\xee\xd9\xd9\xe47\x1c\xab\x97P\x86\x8c\xcb]Q\x83\xaaM\xc0\xd4\tQ\xee\x9c\x98\xe4\x18cb\xabL@bM\xe2N?6#\x87\x8c\xf9\xa3\x041U\xb9\x14\xce\x9b', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x2) close(0x3) r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x0, 0x0, 0x2000}) ioctl$DMA_BUF_SET_NAME_A(r2, 0x40046201, &(0x7f0000000140)='log\x00') r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r3, &(0x7f00000040c0)={0x2020}, 0x2020) 4m45.434571901s ago: executing program 3 (id=64): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket(0x28, 0x805, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r2, r3, 0x0, 0x0, 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r2, 0xc0107520, 0x0, 0x2000000, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0xdbf, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) accept4$unix(r1, 0x0, 0x0, 0x0) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000882}, 0x4000000) 4m45.251127486s ago: executing program 3 (id=66): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r3, 0x0, r2, 0x0, 0x6, 0x0) fcntl$setpipe(r2, 0x407, 0xb) creat(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x80, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) 4m43.653776691s ago: executing program 3 (id=76): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2a5b091, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) 4m43.3408785s ago: executing program 3 (id=78): setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x803, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) mmap(&(0x7f00000e9000/0x3000)=nil, 0x3000, 0x3000009, 0x13, r1, 0x8a740000) 4m42.787028058s ago: executing program 3 (id=82): r0 = socket$inet_smc(0x2b, 0x1, 0x0) epoll_create1(0x80000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x40, r3, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xea8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) close_range(r0, 0xffffffffffffffff, 0x0) 4m42.296550974s ago: executing program 32 (id=82): r0 = socket$inet_smc(0x2b, 0x1, 0x0) epoll_create1(0x80000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x40, r3, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xea8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) close_range(r0, 0xffffffffffffffff, 0x0) 4m10.173511622s ago: executing program 4 (id=273): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='memory.current\x00', 0x275a, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) write$binfmt_script(r2, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) 4m9.636609181s ago: executing program 4 (id=277): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) syz_usb_connect$uac3(0x2, 0x80, 0x0, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, 0x0) sendfile(r1, r0, &(0x7f00000000c0)=0x8b, 0x100000500) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r2, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x0) 4m8.654020483s ago: executing program 4 (id=282): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) syz_open_dev$vim2m(0x0, 0x7, 0x2) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 4m8.003503382s ago: executing program 4 (id=285): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x20200ccc, &(0x7f0000002c00)=ANY=[], 0xfe, 0x1528, &(0x7f0000000140)="$eJzs3AuYjtX6MPB1r7Uehia9TXIY1r3uhzcNlkmSHFLJIUmSJMkpSdIkSUJiyClpSEKOkyaHISSnxqRxPh9yTppsaZIkJKdkfdeott3X/rf3/9v7+/tfe+7fda1r1v08z1rv/cz9XO+7nue9Zr7tPqJu83q1mhKR+JfALz+ShRAxQoghQoirhBCBEKJyXOW43P0FFCT/ay/C/r0eTL/cGbDLieuft3H98zauf97G9c/buP55G9c/b+P6521cf8bysq0zi1/NLe82fv6fl/Hn/3+QnAoTv1xf4doe/40hXP+8jeuft3H985Dgj5u4/nkb1z9v4/r/57vjT/Zx/f9Dxfxzh3H9GcvL/vos+Lz3/n/B8+h/d8v/h+84fnsEfflz+9/QLvPlxxhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGMsjzjjL9FCiN/6lzsvxhhjjDHGGGOM/fv4/Jc7A8YYY4wxxhhjjP3/B0IKJbQIRD6RX8SIAqKguELEiitFIXGViIirRZy4RhQW14oioqgoJoqLeFFClBRGoLCCRChKidIiKq4TZcT1IkGUFeVEeeFEBZEobhAVxY2ikrhJVBY3iyriFlFVVBPVRQ1xq6gpbhO3iztELXGnqC3qiLqinrhL1Bd3iwbiHtFQ3CsaiftEY3G/aCIeEE3Fg6KZeEg0Fw+LFuIR0VK0Eq1FG9H2/2n8i6K3eEn0EX1Fsugn+ouXxQAxUAwSg8UQ8YoYKl4Vw8RrIkUMFyPE62KkeEOMEm+K0WKMGCveEuPEeDFBTBSTxGSRKt4WU8Q7Ik28K6aKaWK6mCHSxUwxS7wnZos5Yq54X8wTH4j5YoFYKBaJxeJDkSGWiEzxkVgqPhZZYplYLlaIlWKVWC3WiLVinVgvNoiNYpPYLLaIreITsU1sFzvETrFL7BZ7xKdir/hM7BOfi2zxxX9z/On/a3wPECBAggQNGvJBPoiBGCgIBSEWYqEQFIIIRCAO4qAwFIYiUASKQTGIh3goCSUBAYGAoBSUgihEoQyUgQRIgHJQDhw4SIREqAg3QiWoBJWhMlSBKlAVqkE1qAE1oCbUhNvhdqgFtaA21Ia6UBfugrvgbmgADaAhNIRG0AgaQ2NoAk2gKTSFZtAMmkNzaAEtoCW0hNbQGtpCW2gH7aA9tIcO0AE6QkfoBJ0gCZKgM3SGLtAFukJX6AbdoDt0hx7QE3rCi/AivAQvQV+oLftBf+gPA2AADILBMBhegaHwKrwKr0EKDIcR8Dq8Dm/AKDgFo2EMjIWxUFOOhwkwEUhOhlRIhSkwBdIgDabCNJgGMyAdZsIsmAWzYQ7MgfdhHnwAH8ACWACLYDEshgxYApmQCUvhNGTBMlgOK2AlrIKVsAbWwhpYDxtgPWyCTbAFtsAn8Alsh+2wE3bCbtgNn8Kn8Bl8BimQDdmwH/bDATgAB+Eg5EAOHIJDcBgOwxE4AkfhKByD43ACjsNJOAmn4DScgTNwDs7BeXg+/utmu8uuSxEyl5Za5pP5ZIyMkQVlQRkrY2UhWUhGZETGyThZWBaWRWQRWUwWk/EyXpaUJSVKlCRDWUqWklEZlWVkGZkgE2Q5WU466WSiTJQVZUVZSVaSleXNsoq8RVaV1eTjroasIRsHv7z/1JK1ZG1ZR9aV9WQ9WV/Wlw1kA9lQNpSNZCPZWN4vm8h+MAgelLmVaS6HQws5AlrKVrK1bCPfgEdlOzkK2svHZQf5hBwDo6GTbOeS5NOys5wAXeSzciI8J7vJydBdviB7yJ6yl3xR9pbtXR/ZV06FfrK/nAED5EA5SA6Ws6GOzK1YXfmaTJHD5Qj5ulwEb8hR8k05Wo6RY+VbcpwcLyfIiXKSnCxT5dtyinxHpsl35VQ5TU6XM2S6nClnyffkbDlHzpXvy3nyAzlfLpAL5SK5WH4oM+QSmSk/kkvlxzJLLpPL5Qq5Uq6Sq+UauVauk+vlBrlRbpKb5Ra5VX4it8ntcofcKXfJ3XKP/FTulZ/JffJzmS2/kPvlX+QB+aU8KL+SOfJreUh+Iw/Lb+UR+Z08Kr+Xx+RxeUL+IE/KH+UpeVqekWflOfmTPC9/lhekl0KBkkoprQKVT+VXMaqAKqiuULHqSlVIXaUi6moVp65RhdW1qogqqoqp4ipelVAllVGorCIVqlKqtIqq61QZdb1KUGVVOVVeOVVBJaobVEV1o6qkblKV1c2qirpFVVXVVHVVQ92qaqrb1O3qDlVL3alqqzqqrqqn7lL11d2qgbpHNVT3qkbqPtVY3a+aqAdUU/WgaqYeUs3Vw6qFekS1VK1Ua9VGtVWPqnbqMdU+92pST6iO6knVST2lktTTqrN6RnVRz6qu6jnVTT2vuqsXVA/VU/VSP6sLyqs+qq9KVv1Uf/WyGqAGqkFqsBqiXlFD1atqmHpNpajhaoR6XY1Ub6hR6k01Wo1RY9VbapwaryaoiWqSmqxS1dtqinpHpal31VQ1TU1XM1S6mqkG/TrT3H9i/Dt/Z/ywi6++RW1Vn6htarvaoXaqXWq32qP2qL1qr9qn9qlsla32q/3qgDqgDqqDKkflqEPqkDqsDqsj6og6qo6qY+q4Oqt+UCfVj+qUOq1Oq7PqnDqnzv/6OxAatNRKax3ofDq/jtEFdEF9hY7VV+pC+iod0VfrOH2NLqyv1UV0UV1MF9fxuoQuqY1GbTXpUJfSpXVUX6fL6Ot1gi6ry+ny2ukKOlHf8C+P/0f5tdVtdTvdTrfX7XUH3UF31B11J91JJ+kk3Vl31l10F91Vd9XddDfdXXfXPXQP3Uv30r11b91H99HJOln31y/rAXqgHqQH6yH6FT1UD9XD9DCdolP0CD1Cj9Qj9Sg9So/Wo/VYPVaP0+P0BD1BT9KTdKpO1VP0FJ2m0/RUPVVP19N1uk7Xs/QsPVvP1nP1XD1Pz9Pz9Xy9UC/Ui/VinaEzdKbO1Ev1Up2ll+lleoVeoVfpVXqNXqPX6XV6g96gN+lNOktv1Vv1Nr1N79A79C69S+/Re/RevVfv0/t0ts7W+/V+fUAf0Af1QZ2jc/QhfUgf1of1EX1EH9VH9TF9TJ/QJ/RJfVKf0qf0GX1Gn9Pn9Hl9Xl/QF3KXfYEMZKADHeQL8gUxQUxQMCgYxAaxQaGgUBAJIkFcEBcUDq4NigRFg2JB8SA+KBGUDEyAgQ0oCINSQekgGlwXlAmuDxKCskG5oHzgggpBYnBDUDG4MagU3BRUDm4OqgS3BFWDakH1oEZwa1AzuC24PbgjqBXcGdQO6vz2PVRwd9AguCdoGNwbNAruCxoH9wdNggeCpsGDQbPgoaB58HDQIngkaBm0CloHbYK2/+z8Qd2gXnBXUP9P5/f+VNHHXB/T1ySbfqa/edkMMAPNIDPYDDGvmKHmVTPMvGZSzHAzwrxuRpo3zCjzphltxpix5i0zzow3E8xEM8lMNqnmbTPFvGPSzLtmqplmppsZJt3MNLPMe2a2mWPmmvfNPPOBmW8WmIVmkVlsPjQZZonJNB+ZpeZjk2WWmeVmhVlpVpnVZo1Za9aZ9WaD2Wg2mc1mi9lqPjHbzHazw+w0u8xus8d8avaaz8w+87nJNl+Y/eYv5oD50hw0X5kc87U5ZL4xh8235oj5zhw135tj5rg5YX4wJ82P5pQ5bc6Ys+ac+cmcNz+bC8bnLu5zP95Ro8Z8mA9jMAYLYkGMxVgshIUwghGMwzgsjIWxCBbBYlgM4zEeS2JJzEVIWApLYRSjWAbLYAImYDkshw4dJmIiVsSKWAkrYWWsjFWwClbFqlgdq+OteCvehrfhHXgH3ol3Yh2sg/WwHtbH+tgAG2BDbIiNsBE2xsbYBJtgU2yKzbAZNsfm2AJbYEtsia2xNbbFttgO22F7bI8dsAN2xI7YCTthEiZhZ+yMXbALdsWu2A27YXfsjj2wB/bCXtgbe2Ofs30wGZOxP/bHATgAB+EgHIJDcCgOxWE4DFMwBUfgCByJI3EUjsLROAbH4ls4DsfjBJyIk3AypmIqTsEpmIZpOBWn4nScjumYjrNwFs7G2TgX5+I8nIfzcT4uxIW4GBdjBmZgJmbiUlyKWZiFy3E5rsSVuBpX41pci+txPW7EjbgZN+NW3Irb1DbcgTtwF+7CPbgH9+Je3If7MBuzcT/uxwN4AA/iQczBHDyEh/AwHsYjeASP4lE8hsfwBJ7Ak3gST+EpPINn8Bz+hOfxZ7yAHmOsFAXtFTbWXmkL2atsjC1g/zYuZovbeFvClrTGFrFFfxejtTbBlrXlbHnrbAWbaG/4Q1zVVrPVbQ17q61pb7O3/yGub++2Dew9tqG919azd/0ubmTvs43tw7aJfcQ2ta1sM9vGNrcP2xb2EdvStrKtbRvb0T5pO9mnbJJ92na2z/whzrBL7Fq7zq63G+xe+5k9Y8/aw/Zbe87+ZPvYvnaIfcUOta/aYfY1m9Jw+O9jO9yOtW/ZcXa8nWAn2kl28h/i6XaGTbcz7Sz7np1t5/whXmw/tPNspp1vF9iFdtHFODenTPuRXWo/tll2mV1uV9iVdpVdbdf8NdcVdpPdbLfYPfZTu81utzvsTrvL7r4Y557HPvu5zbZf2EP2G3vAfmkP2iM2x359Mc49vyP2O3vUfm+P2eP2hP3BnrQ/2lP29MXzzz33H+zP9oL1VhCQJEWaAspH+SmGClBBuoJi6UoqRFdRhK6mOLqGCtO1VISKUjEqTvFUgkqSISRLRCGVotIUpeuoDF1PCVSWylF5clSBEukGqkg3UiW6iSrTzVSFbqGqVI2qUw26lWrSbXS7FlSL7qTaVIfqUj26i+rT3dSA7qGGdC81ovuoMd1PTegBakoPUjN6iJrTw9SCHqGW1IpaUxtqS49SO3qM2tPj1IGeoI70JHWipyiJnqbO9Ax1oWepKz1H3eh56k4vUA/qSb3oRepNL1Ef6kvJ1I/608s0gAbSIBpMQ+gVGkqv0jB6jVJoOI2g12kkvUGj6E0aTWNoLL1F42g8TaCJNIkmUyq9TVPoHUqjd2kqTaPpNIPSaSbNovdoNs2hufQ+zaMPaD4toIW0iBbTh5RBSyiTPqKl9DFl0TJaTitoJa2i1bSG1tI6Wk8baCNtos20hbbSJ7SNttMO2km7aDftoU9pL31G++hzyqYvaD/9hQ7Ql3SQvqIc+poO0Td0mL6lI/QdHaXv6RgdpxP0A52kH+kUnaYzdJbO0U90nn6mC+RJhBDKUIU6DMJ8Yf4wJiwQFgyvCGPDK8NC4VVhJLw6jAuvCQuH14ZFwqJhsbB4GB+WCEuGJsTQhhSGYamwdBgNrwvLhNeHCWHZsFxYPnRhhTAxvCGsGN4YVgpvCiuHN4dVwlvCqmG18OF7a4S3hjXD28LbwzvCWuGdYe2wTlg3rBfeFdYP7w4bhPeEDcN7w0rhfWHj8P6wSfhA2DR8MGwWPhQ2Dx8OW4SPhC3DVmHrsE3YNnw0bBc+FrYPHw87hE+EHcMnw07hU2FS+HTYOXzmH+5PDvuF/cOXw5dD7+9RC6OLooujH0YzokuimdGPokujH0ezosuiy6Mroiujq6Kro2uia6ProuujG6Ibo5uim6Nbot7Xyy8cOOmU0y5w+Vx+F+MKuILuChfrrnSF3FUu4q52ce4aV9hd64q4oq6YK+7iXQlX0hmHzjpyoSvlSruou86Vcde7BFfWlXPlnXMVXKJr49q6tq6de8y1d4+7Du4J94R70j3pnnJPuaddZ/eM6+KedV3dc66be949715wPVxP18u96Hq7l1wf19clu2TX3/V3A9wAN8gNyvfrGswNc8NciktxI9wIN9KNdKPcKDfajXZj3Vg3zo1zE9wEN8lNcqku1U1xU1yaS3NT3VQ33U136S7dzXKz3Gw32811c928hHluvpvvFrqFbrFb7DJchst0mW6pW+qyXJZb7pa7lW6lW+1Wu7VurVvv1ruNbqPb7Da7rW6r2+a2uR1uh9vldrk9bo/b6/a6fW6fy3bZbr/b7w64A+6g+8rluK/dIfeNO+y+dUfcd+6o+94dc8fdCfeDO+l+dKfcaXfGnXXn3E/uvPvZXXDepUbejkyJvBNJi7wbmRqZFpkemRFJj8yMzIq8F5kdmROZG3k/Mi/yQWR+ZEFkYSRGCPFhJCOyJJIZ+SiyNPJxJCuyLLI8siKyMrIq4n2JbaEv5Uv7qL/Ol/HX+wRf1pfz5b3zFXyiv8FX9Df6Sv4mX9nf7Kv4W3xVX81X94/4lr6Vb+3b+Lb+Ud/OP+bb+8d9B/+E7+if9J38Uz7JP+07+2d8F/+s7+qf89388767f8H38D19L/+i7+1f8n18X5/s+/n+/mU/wA/0g/xgP8S/4of6V/0w/5pP8cP9CP+6H+nf8KP8m360H+PH+rf8OD/eT/AT/SQ/2af6t/2UAu/4NP+un+qn+el+hk/3M/0s/56f7ef4uf59P89/4Of7BX6hX+QX+w99hl/iM/1Hfqn/2Gf5ZX65X+FX+lV+tV/j1/p1fr3f4Df6TX6z3+K3+k/8Nr/d7/A7/S6/2+/xn/q9/jO/z3/us/0XHn65+pIP+q98jv/aH/Lf+MP+W3/Ef+eP+u/9MX/cn/A/+JP+R3/Kn/Zn/Fl/zv/kz/uf/QX+mzXGGGOMsX9K2sE/39/v72yTv7Zc/YUQV24vnvO3+7UQYmORX/oDZXzHiBDi6b7dH/yt1a6dnJz867FZSgSlFwghIpfGX7wN+TVeJjqIJ0WSeFxU/Lv5DZQ9z9GfzA/HvI/eLETBvxmTu47/Lb40/43/xfyPPjE2o0p4Ju7385//db2Zm390gRAJpS+NKSAuxZfmr/RfzF+03Z/ln6VEgS9ThWj/N2NixaX40vyJ4jHxjEj63ZGMMcYYY4wxxtgvBsrqXf/B/efF+/N4fTG8uDm/+Gv8D+/PGWOMMcYYY4wxdvk917PXU48mJT3elTvc4Q53/tq53O9MjDHGGGOMsX+3S4v+y50JY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDGWd/1P/Duxy32OjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2OX2fwIAAP//qCEzJQ==") creat(&(0x7f0000000580)='./bus\x00', 0x9e) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000100)='?', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) lseek(r2, 0x2, 0x4) getdents(r2, 0x0, 0x58) 4m7.329821039s ago: executing program 4 (id=290): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 4m6.601848665s ago: executing program 4 (id=296): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) fstat(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0xc0185879, 0x0) 4m5.827622408s ago: executing program 33 (id=296): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) fstat(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0xc0185879, 0x0) 2m59.130700001s ago: executing program 2 (id=712): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3}, 0x50) 2m57.941274536s ago: executing program 2 (id=714): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000200), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r0 = creat(&(0x7f0000000140)='./bus\x00', 0x182) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x2002, 0xa) creat(&(0x7f0000000040)='./file1\x00', 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x8541, 0x1a9) fallocate(r2, 0x10, 0x1, 0x8000) fallocate(r0, 0x0, 0xbf5, 0x2000402) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000001c0)={0xc, r0, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109142, 0x5) fallocate(r3, 0x20, 0x0, 0x4000) 2m57.218371138s ago: executing program 2 (id=723): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 2m56.500584284s ago: executing program 2 (id=729): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x8000, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/56, 0x328000, 0x800, 0x9, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r3, 0x0, r2}, 0x10) 2m56.123562746s ago: executing program 2 (id=732): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0xc04, &(0x7f0000000440)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x5}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@test_dummy_encryption_v1}, {@errors_remount}, {@nogrpid}]}, 0x1, 0x43f, &(0x7f0000001d80)="$eJzs281vG0UbAPBn7aR50483oSofTQsECiLiI2nSUnrgAgKJA0hIcCjHkKRVqNugJki0iiAgVI6oEnfEEYm/gBNcEHBC4gp3VKlCubRwMlp7N7Fd2zipExf8+0nbzuyOPfN4d+yZnWwAfWs8/SeJ2B8Rv0bESDVbX2C8+t+t9dW5P9dX55Iol9/4I6mUu7m+OpcXzV+3L88MRBQ+SeJIk3qXL185P1sqLVzK8lMrF96dWr585ZnFC7PnFs4tXJw5ffrkiennTs0825U407hujn2wdPTwK29de23uzLW3f/w6yeNviKNLxtsdfLxc7nJ1vXWgJp0M9LAhbEmx2k1jsNL/R6IYmydvJF7+uKeNA3ZUuVwu39f68FoZ+A9LotctAHoj/6FP57/5tktDj7vCjReqE6A07lvpNpQfGYhClhpsmN9203hEnFn764t0i525DwEAUOfbdPzzdLPxXyFq7wv9P1tDGY2IeyLiYESciohDEXFvRKXs/RHxQLNKktb1Ny6S3D7+KVzfdnAdSMd/z2drW/mW1ZsXGS1muQOV+AeTs4ulhePZZzIRg0NpfrpNHd+99MtnrY7Vjv/SLa0/Hwtm7bg+MFT/mvnZldk7ibnWjY8ixgaaxZ9srASkp+9wRIx1+qbF+uzik18dbVX0n+NvowvrTOUvI56onv+1aIg/l7Rfn5z6X5QWjk/lV8Xtfvr56uut6r+j+LsgPf97m17/G/GPJrXrtctbr+Pqb5+2nNNs9/rfk7xZt+/92ZWVS9MRe5JXq42u3T/TUG5ms3wa/8Sx5v3/YGx+EkciIr2IH4yIhyLi4aztj0TEoxFxrE38P7z42Dvbi3+ozbt2Rxr//JbO/2ZiTzTuaZ4onv/+m7pKRzuNP7Lzf7KSmsj2dPL910m7tnc1AwAAwL9PISL2R1KY3EgXCpOT1b/hPxR7C6Wl5ZWnzi69d3G++ozAaAwW8jtdIzX3Q6ezaX2en2nIn8juG39eHK7kJ+eWSvO9Dh763L4W/T/1e7HXrQN2nOe1oH/p/9C/9H/oX/o/9K8m/X+4F+0Adl+z3/8Pe9AOYPc19H/LftBHzP+hf+n/0L/0f+hLy8PR7Nn44ejw+XmJfk1E4a5ohsQOJXr9zQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAdfwcAAP//0OLkSA==") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x4008001, 0x80) lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000080)=ANY=[], 0xfe37, 0x0) 2m54.229838812s ago: executing program 2 (id=740): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) nanosleep(&(0x7f0000000240)={0x2}, 0x0) mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0) 2m39.110700298s ago: executing program 34 (id=740): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) nanosleep(&(0x7f0000000240)={0x2}, 0x0) mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0) 2m30.320763042s ago: executing program 0 (id=878): syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f000013240305000102"], 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}], 0x88}, 0xa0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000880)={0x0, 0xfffffffe, 0x400, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x2, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x1000, 0x2, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9c1e, 0x40, 0x40040001, 0x335, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd50c, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 2m29.081401948s ago: executing program 0 (id=893): sched_setattr(0x0, 0x0, 0x0) mknod(0x0, 0x4, 0x602d481) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) r1 = gettid() gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setpriority(0x0, 0xffffffffffffffff, 0x19) sched_getaffinity(r1, 0x0, 0x0) sched_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0) 2m28.813501199s ago: executing program 0 (id=896): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r0, &(0x7f0000000400)={&(0x7f0000000100), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x20, r1, 0x400, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x66}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x51) pread64(r0, &(0x7f0000000000)=""/170, 0xaa, 0x8) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1e, 0x0, 0x8, 0x4, 0x0, 0xffffffffffffffff, 0x7}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x2000002, 0xe, 0x0, &(0x7f0000000740)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000380)) syz_emit_vhci(&(0x7f0000001b00)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0xa, 0x0, 0x401}}}, 0x7) 2m28.292444938s ago: executing program 0 (id=900): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x25, 0x0, 0x3, 0x23}, {0x30, 0x0, 0x0, 0x4}, {0x28, 0x0, 0x81, 0x1}, {0xb1, 0x0, 0x28, 0x7}, {0x16, 0xfc, 0x5, 0xffffffff}]}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000000)={r3, 0x7, 0xfff, 0xa0000000000}) sendmsg$nl_route_sched(r3, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) 2m28.03433641s ago: executing program 0 (id=903): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = socket$tipc(0x1e, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000540)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x3, {{0x2, 0x4}, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4008011}, 0x40880) 2m26.88427813s ago: executing program 0 (id=908): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001100)=@mangle={'mangle\x00', 0x10, 0x6, 0x520, 0x380, 0x380, 0x290, 0x0, 0x0, 0x450, 0x450, 0x450, 0x450, 0x450, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x380}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x380}}, {{@ipv6={@local, @loopback, [0x0, 0xff, 0xff000000, 0xffffff00], [0xffffffff, 0x0, 0xffffffff, 0xff], 'ip6gre0\x00', 'syzkaller1\x00', {0xff}, {}, 0x4, 0x6, 0x0, 0x30}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x1f}, @ipv6=@empty, 0xd, 0x25, 0x162b}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xffffff00], [], 'veth1\x00', 'ip6gretap0\x00'}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@local, @ipv4=@broadcast}}}, {{@ipv6={@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'wg1\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x594) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb) 2m11.448465658s ago: executing program 35 (id=908): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001100)=@mangle={'mangle\x00', 0x10, 0x6, 0x520, 0x380, 0x380, 0x290, 0x0, 0x0, 0x450, 0x450, 0x450, 0x450, 0x450, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x380}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x380}}, {{@ipv6={@local, @loopback, [0x0, 0xff, 0xff000000, 0xffffff00], [0xffffffff, 0x0, 0xffffffff, 0xff], 'ip6gre0\x00', 'syzkaller1\x00', {0xff}, {}, 0x4, 0x6, 0x0, 0x30}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x1f}, @ipv6=@empty, 0xd, 0x25, 0x162b}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xffffff00], [], 'veth1\x00', 'ip6gretap0\x00'}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@local, @ipv4=@broadcast}}}, {{@ipv6={@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'wg1\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x594) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb) 26.124097019s ago: executing program 6 (id=1444): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f0000001980)={0xf, {"a2e3ad214fc752f91b294f0955f70e0dd038e7ff7fc6e5539b3267078b089b34083b681a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b313b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) ftruncate(0xffffffffffffffff, 0x7fffffffffffffff) r4 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x2a6) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x50, 0x0, &(0x7f0000000140)=[@free_buffer, @exit_looper, @exit_looper, @free_buffer={0x40086303, r4}, @exit_looper, @exit_looper, @acquire={0x40046305, 0x1}, @acquire_done, @dead_binder_done], 0x0, 0x0, &(0x7f00000001c0)}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000000301010400000000f1ffffff01000000240001801400018008000100e0000001660002"], 0x38}}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0x2c0, 0x60, 0xd0e0000, 0x2c0, 0x100, 0x390, 0x1d8, 0x1d8, 0x390, 0x1d8, 0x7fffffe, 0x0, {[{{@uncond, 0xee02, 0x2a0, 0x90, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x2, 0x0, [{0x3, 0x77, 0x7, 0x2}, {0x16, 0x5d, 0x8, 0xf}, {0x0, 0x7, 0x4, 0x5}, {0x200, 0x10, 0x4, 0x401}, {0x2, 0x7, 0x9, 0x7}, {0x8, 0x2, 0x40, 0x80}, {0x7, 0x10, 0x4, 0xc27e}, {0x0, 0x8, 0x1, 0x9}, {0xa66, 0xf9, 0x2, 0x40}, {0xf207, 0x18, 0x1, 0x6}, {0x2, 0x8, 0x6, 0xb6}, {0x0, 0x5, 0x5, 0x4}, {0x9, 0x7f, 0x5, 0x2}, {0x5, 0x2, 0xf, 0xc00}, {0x1, 0x9, 0x2, 0x54}, {0x3, 0x2b, 0x2, 0x3}, {0xffff, 0x5, 0x6d, 0x7}, {0x6, 0xa, 0x5, 0x51d8}, {0x8, 0xe, 0x5}, {0x0, 0x40, 0x7, 0x88}, {0x7, 0x2, 0x6, 0x3}, {0x98d, 0x2, 0xff, 0x5}, {0x81, 0x1, 0x3, 0x7f}, {0x1, 0x2, 0xc0, 0x86f}, {0x8, 0x2, 0x9, 0x6}, {0x7, 0x75, 0x7, 0xd}, {0x6, 0x6, 0x6, 0x8001}, {0x120, 0x5, 0x2, 0x3dbd}, {0x5, 0x8, 0x9, 0x1}, {0x0, 0x3, 0x9, 0xff}, {0x0, 0x4, 0x0, 0xfffffff8}, {0x7, 0x1, 0x9, 0xd}, {0xfff, 0x7, 0x0, 0xbc}, {0x0, 0x4c, 0x8, 0xff}, {0x8, 0xc0, 0x80, 0x4}, {0x1, 0x1, 0x0, 0x508d}, {0x1ff, 0x5, 0x81, 0xd}, {0x0, 0x0, 0x2, 0x5}, {0x401, 0x3, 0x80, 0x9}, {0x9, 0x2, 0x0, 0x8}, {0x0, 0x1, 0xfb, 0x7}, {0xa, 0xff, 0x1, 0x7fffffff}, {0x7, 0x4, 0x7, 0x40}, {0xa, 0xc, 0x6, 0x5}, {0x9, 0x8, 0x7, 0x10000}, {0xe9, 0x6, 0x3, 0x3}, {0xb, 0x7, 0x7, 0x200}, {0xe, 0x5, 0x6, 0x2}, {0x9, 0x5, 0x0, 0x1}, {0x9, 0x1, 0x7, 0x1}, {0x1c0, 0x5, 0x2, 0x8e1}, {0x0, 0x5, 0x0, 0x7f07}, {0x6, 0x0, 0x1, 0x1ff}, {0x2, 0x28, 0xfc, 0x8}, {0x6, 0x3, 0x7, 0x2}, {0xa, 0xc5, 0x4, 0x3}, {0x3, 0x71, 0x8, 0x7}, {0x6e, 0x2, 0x0, 0x8}, {0x0, 0x7, 0x7, 0x10000}, {0x9, 0x7, 0x5, 0x7}, {0x100, 0x8, 0x3}, {0xd34, 0x7, 0x8}, {0x9, 0x9, 0x1, 0x80000001}, {0x6, 0xfe, 0x3, 0x3}], {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@ip={@multicast2, @empty, 0xffffffff, 0xffffff00, 'veth1_virt_wifi\x00', 'xfrm0\x00', {}, {}, 0x1, 0x1, 0x6c}, 0x9400, 0x70, 0xd0, 0x94}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x0, 0x5, 0x0, 0x6, 0x4, 0x6], 0x0, 0x3}, {0x0, [0x5, 0x1, 0x6, 0x0, 0x3, 0x1]}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x488) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='ip6erspan0\x00'}) ioctl$sock_SIOCGIFBR(r1, 0x8941, &(0x7f0000000080)=@add_del={0x3, &(0x7f0000000100)='ip6erspan0\x00', 0x2a0ffffffff}) 23.979923947s ago: executing program 6 (id=1454): r0 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xe00000000, 0xfffffffffffffff9}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x8, 0x4) syz_open_procfs$namespace(0x0, &(0x7f0000001040)='ns/net\x00') ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000140)={@local}) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) 20.069292554s ago: executing program 9 (id=1468): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)={0x30, 0x30, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000009, 0x8013, r5, 0x180000000) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 13.790169537s ago: executing program 6 (id=1483): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e36, 0x5, @dev={0xfe, 0x80, '\x00', 0x21}, 0x1}], 0x1c) clock_gettime(0xa, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) socket$kcm(0x23, 0x5, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r3, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendto$phonet(r3, 0x0, 0x0, 0x80, 0x0, 0x0) 13.755607669s ago: executing program 9 (id=1484): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00000f3000/0x2000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000000000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00002b4000/0x1000)=nil, &(0x7f00008a4000/0x2000)=nil, &(0x7f0000475000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24058041) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000100)={[0x100000000]}, 0x8) 13.166514951s ago: executing program 6 (id=1488): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000002c0)='./file0\x00', 0x2048c5, &(0x7f0000000440)={[{@rodir}, {@shortname_winnt}, {@uni_xlateno}, {@utf8no}, {@uni_xlate}, {@utf8}, {@shortname_mixed}, {@utf8}, {@shortname_winnt}, {@fat=@dos1xfloppy}, {@shortname_lower}, {@shortname_win95}, {@fat=@quiet}]}, 0x0, 0x2c4, &(0x7f0000002880)="$eJzs3M9rE1sUwPHTTH+kLW2yKA/eg4cH3ehmaONfEKQFMaDURtSFMLUTDRkzYSZGImK7E3f+HcWlKwX1H+jGnXtxUwTBTRfiSJOZGNOxTat12ub7gTK3c+bM3OHeC2cKvZvXn92rlHyzZNUllVZJiazJlkh2uxUaCo+pVntUuq3Juckv7/+/euPmpXyhML+oupBfOp9T1elTrx88en76bX3y2ovpV2Oykb21+Tn3YeOfjX83vy1Fd3dFLF123bq17Ni6UvYrpuoVx7Z8W8tV3/bqaqkXxUuOW6s11aquTE3UPNv31ao2tWI3te5q3WuqdccqV9U0TZ2akEFj7DujuL64aOUPpTNIwnjcSc/LW0ZssLj+NzoFAACOlqTq/7tlX8u+Vt3t+n6X+j8l3fE96n+Rga7/D6r261BsPYnjZChavl0rOkL9DwAAAAAAAAAAAAAAAAAAAADAcbAVBJkgCDLRMfoZE5G0iES/J91PHI4+xt9g/E+urn/cS4s4TxrFRrF9bMc7m0PMjoh8bc2HULu9cLEwP6stWXnjrIb5q42iIdtzKF+Scudh2fj8uXa+duevyohMRPmO2JKTjMzE5+di8hvFUTl7JhgLn2yLKRl5d1tccWSlNa9/5D+eU71wudCTP966DgAAAACAk8DUjh3f7624qdG2IT3x9snO9/msZPb4+0DP9/Ww/Dec3HsDAAAAADBI/FGpWI5je37z4V6Np2FOXxcfwUa0me0fuaFI0q+T7vfiYREJz7xMrs/GvrNSItIbGtlxJr5h/N4ofxL5eV3MJD7cB24ERmeufrzfXgG7Ze3cJRgAAADAyRBV/0NJdwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAHW7y5i0fUH2YSs63FGMm8JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHA3fAwAA////EQlj") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, 0x0, 0x0) sendto(r1, 0x0, 0x0, 0x8800, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {0x0}, {0x0}, {0x0}], 0x5, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x40, &(0x7f0000003700)={0x77359400}) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x13481, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020}, 0x2020) io_uring_enter(r0, 0x2abd, 0xbf31, 0x35, &(0x7f0000000400)={[0x101]}, 0x8) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f0000000000)={[{@errors_continue}, {@commit={'commit', 0x3d, 0xf}}, {@lazytime}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") 12.514187744s ago: executing program 9 (id=1490): socket$nl_route(0x10, 0x3, 0x0) socket(0x1d, 0x2, 0x6) prlimit64(0x0, 0xe, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r2, 0xc0884123, &(0x7f0000000340)={0x0, "72a59baeb6c10b67b134a5f267418d0000000000000000000000820f2cf9ff6c8d2600", {0x800000000000004, 0x50000000000}}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000080)={0x0, 0x0, 0xffff5f11, 0xfffd, 0xfffffffffffffffb, 0xb, 0xfffffffffffffffa, 0x1fd, 0x4a, 0x28, 0x4, 0x2}) ioctl$SNDRV_PCM_IOCTL_STATUS32(r2, 0x806c4120, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) 12.365214634s ago: executing program 6 (id=1491): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0x2, 0x801, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e63, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r0, &(0x7f00000005c0), 0xfffffffffffffebe, 0x24008814, 0x0, 0x49) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x6a, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) epoll_create1(0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}}) 11.169333768s ago: executing program 9 (id=1500): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, 0x0, 0x0, 0x17, 0x0, 0x0) writev(r0, 0x0, 0x0) recvfrom(r0, 0x0, 0x0, 0x10000, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, 0x0, 0x0) 11.067266818s ago: executing program 8 (id=1501): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x460482, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100) syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x101000, 0x110) 10.037067762s ago: executing program 5 (id=1504): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x8040480) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0xfffffffe, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0xfffffc, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffa, 0x2, 0x20000000, 0x327, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x20, 0x1, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$dri(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x20001, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) socket$xdp(0x2c, 0x3, 0x0) 9.883082673s ago: executing program 8 (id=1506): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x3fffffff]}}], 0xffc8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x25, 0x9, 0x70bd25, 0x25dfdbfd, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4040002}, 0x4000080) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3ff, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x4}, 0x50) r2 = syz_open_procfs(0x0, &(0x7f0000001200)='attr\x00') bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xa, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="89a000fe0000000069104f000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000080), 0x0, 0xfffffffffffffffe) getdents64(r2, &(0x7f00000001c0)=""/172, 0xa4) socket$pptp(0x18, 0x1, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x20902, 0x0) write$sequencer(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="810100000000000081", @ANYRES32=r3], 0x10) 8.762369083s ago: executing program 1 (id=1509): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x400001}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents64(r3, &(0x7f0000000400)=""/101, 0x65) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) 8.761809396s ago: executing program 8 (id=1510): syz_open_dev$sg(0x0, 0x0, 0x8002) timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e20, @local}, 0x10) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000001040)={0x2, 0x4e21, @multicast2}, 0x10) timer_settime(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0xd) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mount$bpf(0x0, &(0x7f0000000100)='.\x00', &(0x7f00000006c0), 0x400008, &(0x7f00000002c0)={[], [{@seclabel}]}) 8.760292718s ago: executing program 7 (id=1511): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x28, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = open(0x0, 0x14927e, 0x102) fallocate(r1, 0x0, 0x0, 0x1000f4) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) setns(0xc9, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)={0x60, r3, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_PREV_BSSID={0xa}, @NL80211_ATTR_WIPHY_FREQ_HINT={0x8, 0xc9, @random=0x994}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_USE_RRM={0x4}]}, 0x60}, 0x1, 0x0, 0x0, 0x200048d0}, 0x40000) 8.624042672s ago: executing program 5 (id=1512): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf9477000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$unix(r2, 0x0, 0x0) socket(0x1, 0x803, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f0000000180)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xffffffff}, 0x48, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) 8.298351085s ago: executing program 7 (id=1513): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000000203010100000000000000ffffff7f000800034000000000080004400000000008000540000000000900020000000000020000000800010001"], 0x40}}, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, 0x0, 0x0) open(0x0, 0x1a3142, 0x80) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) 7.6147084s ago: executing program 5 (id=1514): openat$nullb(0xffffffffffffff9c, 0x0, 0x529c2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = fsopen(0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) syz_fuse_handle_req(r0, 0x0, 0x0, &(0x7f000000cc80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002600)={0x60, 0x0, 0x9, {{0x0, 0x7, 0xfffffffffffffff8, 0x8, 0x6, 0x2, 0x3, 0x8}}}, 0x0, &(0x7f00000026c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000000aa00)={0xa0, 0xffffffffffffffda, 0x3, {{0x1, 0x0, 0x4, 0x0, 0x40f19b1d, 0x13, {0x6, 0x8001, 0x6, 0x5, 0xc, 0x12, 0x4, 0x5, 0x6, 0xa000, 0x605, 0x0, 0x0, 0x4}}, {0x0, 0x4}}}, &(0x7f000000aac0)={0x20, 0xffffffffffffffda, 0x7, {0x80000001, 0x0, 0x8, 0x80000001}}, 0x0}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) close(0x3) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendmsg$rds(r1, &(0x7f0000000200)={&(0x7f00000002c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000084}, 0x0) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x271b, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) 7.465564149s ago: executing program 8 (id=1515): syz_usb_connect(0x0, 0x24, 0x0, 0x0) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffe11) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$inet(0x2, 0x2, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001240)=@newtfilter={0x30, 0x2c, 0x401, 0x0, 0x25dfdbed, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x0, 0xffff}, {0x300, 0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$lock(r2, 0x24, 0x0) 7.392611185s ago: executing program 1 (id=1516): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c80000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r4}, 0x38) 7.259488272s ago: executing program 7 (id=1517): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0) write(r3, &(0x7f0000000500)=' 294967 95 2\\000 0000 0\n', 0x18) 7.193359142s ago: executing program 5 (id=1518): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) listen(r0, 0xd) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r5, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r7, 0x1, 0x70bd2c, 0x25dfdbff, {0x4, 0x0, 0x2000}}, 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) 6.03860838s ago: executing program 1 (id=1519): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x8000f28, 0x5) sendmmsg$inet(r1, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000e80)="2389", 0x2}], 0x1}}], 0x1, 0x4040040) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0xee01) 4.351494148s ago: executing program 1 (id=1520): socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = socket(0x2b, 0x1, 0x1) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}}, 0x24}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x20000255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffdffe, 0x34f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x100, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x252, 0x0, r1}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) 4.325387672s ago: executing program 7 (id=1521): r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 4.271487436s ago: executing program 9 (id=1522): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)={0x2c, 0x2, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x5}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x1}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xc2c}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4002000}, 0x80) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), 0xffffffffffffffff) mmap(&(0x7f0000dde000/0x3000)=nil, 0x3000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) fallocate(r1, 0x0, 0x37e9, 0x2f92) 4.21239695s ago: executing program 8 (id=1523): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x1, 0x0, 0x25dfdbff, {0x24}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 3.925669438s ago: executing program 6 (id=1524): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000304fcff", 0x58}], 0x1) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x100000000001f, &(0x7f0000000180)=0x1, 0x4) ptrace(0x10, r1) r3 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000000)=0x20000) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c0) wait4(r1, 0x0, 0x40000000, 0x0) ptrace$setregs(0xd, r1, 0x20000000002, &(0x7f0000000040)) ptrace$cont(0x21, r1, 0x80000001, 0x4) 2.510192777s ago: executing program 36 (id=1524): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000304fcff", 0x58}], 0x1) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x100000000001f, &(0x7f0000000180)=0x1, 0x4) ptrace(0x10, r1) r3 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000000)=0x20000) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c0) wait4(r1, 0x0, 0x40000000, 0x0) ptrace$setregs(0xd, r1, 0x20000000002, &(0x7f0000000040)) ptrace$cont(0x21, r1, 0x80000001, 0x4) 2.499387913s ago: executing program 9 (id=1526): madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@bridge_newneigh={0x30, 0x1c, 0x401, 0x70bd29, 0x25dfdc02, {0x7, 0x0, 0x0, r1, 0x2, 0x0, 0x3}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x44801}, 0x840) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getpid() move_pages(0x0, 0x1, &(0x7f00000020c0)=[&(0x7f0000ffa000/0x4000)=nil], &(0x7f0000002100), &(0x7f0000002140)=[0x0, 0x0], 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b000885000000"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x18000000000002a0, 0x7, 0x0, &(0x7f0000000140)="06ff0307684426", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) pipe(0x0) 2.494784038s ago: executing program 1 (id=1527): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe51de000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000a80)={@dev={0xac, 0x14, 0x14, 0x37}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, 0x10) 2.494136622s ago: executing program 8 (id=1528): syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) socket$packet(0x11, 0x3, 0x300) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$vmci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r0, 0x7b2, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000240)=ANY=[]) chdir(&(0x7f0000000100)='./file0\x00') r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r2, &(0x7f0000000700)={0x1f, 0x0, @none, 0x1}, 0xe) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="02c820"], 0xffffffdc) syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="04080400c8"], 0x7) socket(0x10, 0x3, 0x0) 2.493372318s ago: executing program 7 (id=1529): openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0xc0185879, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0x40, 0xf, 0x3, 0xd7df, 0xbd}}}}}, 0x0) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f0000000040)=0x8, 0x4) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) 2.492737439s ago: executing program 5 (id=1530): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) semctl$IPC_INFO(0x0, 0x0, 0x3, 0xfffffffffffffffc) 1.174070845s ago: executing program 5 (id=1531): socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) syz_open_dev$I2C(0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x16f) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='usb3503 0x08\n\x00', 0xd) 3.028305ms ago: executing program 1 (id=1532): r0 = memfd_create(&(0x7f0000000cc0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x01\x83y\xf3\xb2\xe6b$\a\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\b\x00\x00\x00LR\xa1\x00\x00\x17\x1f$^\xe1\x00\x04\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\xce\xd5O\xcc\b\x9e\x19\x19#\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$h\x0ew\x00&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xda\x00\x00\x00\x00?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x01\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xff\x06\xe7j\x9fTJ;T\xf3\xfa\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x00\x00\x00\x00\x00\x00\x00\x0f\x81\xf3\x05\xa3{\x96\xf9\xba\x9em\xe9\"\x03\x933P\xbb\xd6\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%<\xd8w\x00k\x042Y\xd9\xc5\xe5\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x131\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x03\x00\x00\x00t\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x8fw\xa9A\xf7m\xeec\xb6\\\xa4T\xeej\xe2\xba\xb2V\xacc\xc6|\xae]\xdb\x10\xb3\x80z\xd5\n\xa3u\xfb\b\x03\xe5\xca;\xe5uH<\x9a\x12\x84(\x9f\xd2\xe1k\x955;J\xa4\x81Lm\x90\x1a\xfdI}\xb0\xa1\xec9\x17\xd1\xa2\xc7\xca\x98\xaeS\x92Ew`\xd2\x02\xda\xc9\xd4\xea\x02\x1d\xd3\xd5\x81\xdb\xd9~\xd6-:\xee\xe8\t\xf7\xe6\xf1\x88\x86\xb0\x04\x9ep\xb1\x93\x16\xf9\xdb\x15\x8a\xa3h<\xaf\xa0\xb5\xb0\x05ir\xff\xff\xff\xff\x00\x00\x00\x00\x83\x91\xad\x11\xf4\xbcz\x9b\x8bp]o\au\x175I\x1d\xe2\x97\xb6\x06\xdc\x14\x9b>\xd7F\xdb?\xc7%0n/\xf5S\xb5\xe8\xa5\xd1\xddN\xf9ir\xd1r\xf4L\t3\xadDz\\\xf4`\x13\xf7)\x91w\a\xcc+E\xdd\xe9\xdbb\x9c\xff\x98\x03\xb7\x0e=\xba\xa3um\xde\xff$|\xb7\x86j+\x00\x00\x00\x00\x00\x00\x00Z\xef\xd6\xf4Zs\xfc\ro\x03\xabB\x18\xdc\a\xe3\r\x00\x00\x00\x00\x00\x00I\xe1\xe2?M\x8b\x853\xce\x19\xba\fA8\x8a\xa1\x04v\xcb\xa9c\xac\xee\x8e\x8d\xfa/\x83Wm#\xe2\x8b\x01\xc2\x97\"K\x1d\xc3\tuC<}_M\x18nik9\x8a\xb1(\x04\x11\x92\x1a\xff\xbb]\x12S\xc4D\xd2h0!\x899-\xec%\xd2\xa8\x1a\xc6Fe\xff?c+\xde\xa0[\xbc\x1d\xa0\xe3\xda+\xdcK\x86\xaa\x94AD\x00[\x9c\xb1!\x01N\xd9\x96so\\\xd5\x9d$_=\x86b[\xe1\xc7\x9a\xb4}\x1erI\xe4\xb2\xb7\xe6 \x1f\a}\xb5V\x89\x9d\x9fA\xa5\xa7\xd5\x1d\x15#\x1fY&\xf2\'\xe9\xb0.\xeb\xe7\xc4\x83\xa1\xe1\t\x94^\xd4\x99\xc9\x9f\x1e\xb9\x85\x9cX\xe7\xd1l1\x1d\xc8 \xc7FB\x91\xca\x17]#c\xf5\xea\x7fL=b\xec\"\x83\xfe\x818\x14\xcdCz\x9d\x1b\xb5Q^3\xc9\\\x7fQOU\xa2~\xbe\xa8E\xe0e~sl\aJ\xec\xb2(2D\x8f\xfc\x9a\x1d7\xdc\xcfA\xc7\x9b\x93\xbc\xb2\x1d\xbe\x8eY\xce!\x04\xae\x8d\x8e%x\xa1\xe8\xca\x14W\x0f\x04b\xf29UC\\~\v\xf7\xd8\xe3\\\x8d\xdbDY\x1a\v\xa3a\xde@\xac\xca\x80\x89\xc7/\xab0\'Bk\xfc\xa0\x04\xf9:p\xd4\x1a\x84\x98\xd1\xe7a\x97\x96{\xb8g{:\xfc]', 0x4) fallocate(r0, 0x0, 0x0, 0x400001) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000280)={0x0, 0x0, 0x7fff, 0x4000006}) 0s ago: executing program 7 (id=1533): creat(0x0, 0x128) open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="3c0100"], 0x18) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010029bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="2110cc661668000008001b000000000008000400018000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_elf64(r2, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) kernel console output (not intermixed with test programs): it=40427 [ 159.473329][ T7278] CPU: 0 UID: 0 PID: 7278 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.473365][ T7278] Tainted: [L]=SOFTLOCKUP [ 159.473375][ T7278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 159.473392][ T7278] Workqueue: writeback wb_workfn (flush-7:2) [ 159.473434][ T7278] Call Trace: [ 159.473444][ T7278] [ 159.473455][ T7278] dump_stack_lvl+0xe8/0x150 [ 159.473495][ T7278] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 159.473533][ T7278] f2fs_write_end_bio+0x1211/0x16e0 [ 159.473574][ T7278] ? blkg_put+0x22/0x240 [ 159.473621][ T7278] __submit_merged_bio+0x258/0x6a0 [ 159.473651][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.473681][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.473719][ T7278] __submit_merged_write_cond+0x3c9/0x4e0 [ 159.473760][ T7278] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 159.473807][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.473847][ T7278] f2fs_write_data_pages+0x2a27/0x36f0 [ 159.473923][ T7278] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 159.473974][ T7278] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 159.474076][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474106][ T7278] ? __lock_acquire+0x6df/0x2e50 [ 159.474134][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474169][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474214][ T7278] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 159.474251][ T7278] do_writepages+0x338/0x560 [ 159.474293][ T7278] ? do_raw_spin_lock+0x12b/0x2f0 [ 159.474339][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474367][ T7278] ? reacquire_held_locks+0x117/0x1a0 [ 159.474398][ T7278] ? writeback_sb_inodes+0x450/0x1b00 [ 159.474437][ T7278] __writeback_single_inode+0x136/0x1220 [ 159.474473][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474503][ T7278] ? do_raw_spin_unlock+0xf5/0x200 [ 159.474544][ T7278] writeback_sb_inodes+0x9de/0x1b00 [ 159.474606][ T7278] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 159.474687][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474716][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.474745][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.474774][ T7278] ? queue_io+0x2d3/0x470 [ 159.474810][ T7278] wb_writeback+0x41c/0xad0 [ 159.474845][ T7278] ? queue_io+0x201/0x470 [ 159.474883][ T7278] ? __pfx_wb_writeback+0x10/0x10 [ 159.474912][ T7278] ? do_raw_spin_lock+0x12b/0x2f0 [ 159.474966][ T7278] wb_workfn+0x431/0x10f0 [ 159.474996][ T7278] ? update_se+0x90/0x1020 [ 159.475046][ T7278] ? __pfx_wb_workfn+0x10/0x10 [ 159.475079][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475108][ T7278] ? update_protect_slice+0x128/0x210 [ 159.475154][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475192][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475221][ T7278] ? lock_acquire+0x115/0x350 [ 159.475248][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475285][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.475319][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475349][ T7278] ? process_scheduled_works+0x97a/0x1630 [ 159.475384][ T7278] process_scheduled_works+0xc3d/0x1630 [ 159.475418][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475482][ T7278] ? __pfx_process_scheduled_works+0x10/0x10 [ 159.475524][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475553][ T7278] ? assign_work+0x3cf/0x5d0 [ 159.475592][ T7278] worker_thread+0xa47/0xfb0 [ 159.475660][ T7278] kthread+0x38b/0x480 [ 159.475686][ T7278] ? __pfx_worker_thread+0x10/0x10 [ 159.475719][ T7278] ? __pfx_kthread+0x10/0x10 [ 159.475747][ T7278] ret_from_fork+0x514/0xb70 [ 159.475775][ T7278] ? __pfx_ret_from_fork+0x10/0x10 [ 159.475814][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.475844][ T7278] ? __switch_to+0xc89/0x1420 [ 159.475884][ T7278] ? __pfx_kthread+0x10/0x10 [ 159.475911][ T7278] ret_from_fork_asm+0x1a/0x30 [ 159.475970][ T7278] [ 159.514354][ T7278] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 159.514462][ T7278] CPU: 0 UID: 0 PID: 7278 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.514496][ T7278] Tainted: [L]=SOFTLOCKUP [ 159.514505][ T7278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 159.514522][ T7278] Workqueue: writeback wb_workfn (flush-7:2) [ 159.514560][ T7278] Call Trace: [ 159.514569][ T7278] [ 159.514580][ T7278] dump_stack_lvl+0xe8/0x150 [ 159.514620][ T7278] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 159.514657][ T7278] f2fs_write_end_bio+0x1211/0x16e0 [ 159.514720][ T7278] __submit_merged_bio+0x258/0x6a0 [ 159.514749][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.514779][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.514816][ T7278] __submit_merged_write_cond+0x3c9/0x4e0 [ 159.514858][ T7278] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 159.514905][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.514944][ T7278] f2fs_write_data_pages+0x2a27/0x36f0 [ 159.515021][ T7278] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 159.515072][ T7278] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 159.515173][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515202][ T7278] ? __lock_acquire+0x6df/0x2e50 [ 159.515231][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515264][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515314][ T7278] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 159.515351][ T7278] do_writepages+0x338/0x560 [ 159.515392][ T7278] ? do_raw_spin_lock+0x12b/0x2f0 [ 159.515432][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515461][ T7278] ? reacquire_held_locks+0x117/0x1a0 [ 159.515491][ T7278] ? writeback_sb_inodes+0x450/0x1b00 [ 159.515531][ T7278] __writeback_single_inode+0x136/0x1220 [ 159.515568][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515597][ T7278] ? do_raw_spin_unlock+0xf5/0x200 [ 159.515637][ T7278] writeback_sb_inodes+0x9de/0x1b00 [ 159.515700][ T7278] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 159.515780][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515809][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.515839][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.515871][ T7278] ? queue_io+0x2d3/0x470 [ 159.515907][ T7278] wb_writeback+0x41c/0xad0 [ 159.515942][ T7278] ? queue_io+0x201/0x470 [ 159.515981][ T7278] ? __pfx_wb_writeback+0x10/0x10 [ 159.516011][ T7278] ? do_raw_spin_lock+0x12b/0x2f0 [ 159.516064][ T7278] wb_workfn+0x431/0x10f0 [ 159.516095][ T7278] ? update_se+0x90/0x1020 [ 159.516144][ T7278] ? __pfx_wb_workfn+0x10/0x10 [ 159.516178][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516207][ T7278] ? update_protect_slice+0x128/0x210 [ 159.516253][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516291][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516325][ T7278] ? lock_acquire+0x115/0x350 [ 159.516352][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516390][ T7278] ? rcu_is_watching+0x16/0xb0 [ 159.516419][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516450][ T7278] ? process_scheduled_works+0x97a/0x1630 [ 159.516486][ T7278] process_scheduled_works+0xc3d/0x1630 [ 159.516520][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516590][ T7278] ? __pfx_process_scheduled_works+0x10/0x10 [ 159.516632][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516661][ T7278] ? assign_work+0x3cf/0x5d0 [ 159.516700][ T7278] worker_thread+0xa47/0xfb0 [ 159.516768][ T7278] kthread+0x38b/0x480 [ 159.516794][ T7278] ? __pfx_worker_thread+0x10/0x10 [ 159.516827][ T7278] ? __pfx_kthread+0x10/0x10 [ 159.516854][ T7278] ret_from_fork+0x514/0xb70 [ 159.516882][ T7278] ? __pfx_ret_from_fork+0x10/0x10 [ 159.516922][ T7278] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.516951][ T7278] ? __switch_to+0xc89/0x1420 [ 159.516990][ T7278] ? __pfx_kthread+0x10/0x10 [ 159.517018][ T7278] ret_from_fork_asm+0x1a/0x30 [ 159.517077][ T7278] [ 159.538849][ T7278] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 160.252740][ T7385] ip_tables: iptables: counters copy to user failed while replacing table [ 160.364368][ T5764] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 160.523932][ T5764] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 160.527088][ T5764] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 160.527124][ T5764] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 160.527167][ T5764] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.570419][ T7381] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 160.615121][ T5764] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 161.121957][ T5764] usb 7-1: USB disconnect, device number 4 [ 163.562451][ T7438] loop6: detected capacity change from 0 to 512 [ 163.569357][ T7438] ext4: Bad value for 'resgid' [ 163.569405][ T7438] ext4: Bad value for 'resgid' [ 163.618359][ T7436] loop5: detected capacity change from 0 to 32768 [ 163.654916][ T7436] JBD2: Ignoring recovery information on journal [ 163.757398][ T7445] binder: 7443:7445 ioctl c0306201 200000000080 returned -14 [ 163.774802][ T7436] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 163.881989][ T7445] binder: 7443:7445 ioctl c0306201 2000000003c0 returned -14 [ 164.405516][ T31] audit: type=1804 audit(1788479341.599:45): pid=7459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.430" name="/newroot/62/file0" dev="tmpfs" ino=360 res=1 errno=0 [ 164.574586][ T5610] ocfs2: Unmounting device (7,5) on (node local) [ 165.036809][ T7470] netlink: 15143 bytes leftover after parsing attributes in process `syz.6.436'. [ 166.226248][ T7498] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 168.333507][ T7547] bridge_slave_0: left allmulticast mode [ 168.333565][ T7547] bridge_slave_0: left promiscuous mode [ 168.334218][ T7547] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.365143][ T7547] bridge_slave_1: left allmulticast mode [ 168.365194][ T7547] bridge_slave_1: left promiscuous mode [ 168.373091][ T7547] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.454902][ T7547] bond0: (slave bond_slave_0): Releasing backup interface [ 168.565883][ T7547] bond0: (slave bond_slave_1): Releasing backup interface [ 168.693393][ T7547] team0: Port device team_slave_0 removed [ 168.728460][ T7547] team0: Port device team_slave_1 removed [ 168.740294][ T7547] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.750379][ T7547] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.779083][ T7547] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 168.779135][ T7547] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 168.827366][ T7547] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 168.942697][ T7561] netlink: 'syz.6.461': attribute type 1 has an invalid length. [ 169.252654][ T7561] netlink: 28 bytes leftover after parsing attributes in process `syz.6.461'. [ 169.415905][ T7565] 8021q: adding VLAN 0 to HW filter on device bond4 [ 169.464726][ T7565] bond3: (slave bond4): making interface the new active one [ 169.480000][ T7565] bond3: (slave bond4): Enslaving as an active interface with an up link [ 169.563263][ T7567] bond3: (slave gretap2): Enslaving as a backup interface with an up link [ 169.614396][ T7561] 8021q: adding VLAN 0 to HW filter on device bond3 [ 170.709535][ T7623] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 170.752583][ T5772] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 170.937984][ T5772] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 170.939640][ T5772] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.939689][ T5772] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 170.953770][ T5772] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.953800][ T5772] usb 6-1: Product: syz [ 170.953817][ T5772] usb 6-1: Manufacturer: syz [ 170.953835][ T5772] usb 6-1: SerialNumber: syz [ 171.040089][ T5772] cdc_mbim 6-1:1.0: skipping garbage [ 171.246699][ T7617] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 171.460468][ T7617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.464294][ T7617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.617931][ T7649] fuse: fd is not a fuse device [ 171.862850][ T7658] netlink: 'syz.0.485': attribute type 1 has an invalid length. [ 172.017234][ T7658] 8021q: adding VLAN 0 to HW filter on device bond1 [ 172.122499][ T7617] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 172.132422][ T5772] cdc_mbim 6-1:1.0: dwNtbInMaxSize=4 is too small. Using 2048 [ 172.132463][ T5772] cdc_mbim 6-1:1.0: setting rx_max = 2048 [ 172.147587][ T7663] bond1: (slave dummy0): making interface the new active one [ 172.164152][ T7663] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 172.169278][ T7666] : renamed from dummy0 (while UP) [ 172.338266][ T5772] cdc_mbim 6-1:1.0: setting tx_max = 44 [ 172.399400][ T5772] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 172.573462][ T5772] wwan wwan0: port wwan0mbim0 attached [ 172.780716][ T5772] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.5-1, CDC MBIM, 1e:c4:3f:13:86:1c [ 172.837284][ T5772] usb 6-1: USB disconnect, device number 4 [ 172.850922][ T5772] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.5-1, CDC MBIM [ 173.123409][ T5793] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 173.323037][ T5793] usb 3-1: unable to get BOS descriptor or descriptor too short [ 173.323110][ T5793] usb 3-1: New USB device found, idVendor=0c45, idProduct=624f, bcdDevice=af.98 [ 173.326765][ T5793] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 173.326819][ T5793] usb 3-1: can't read configurations, error -71 [ 173.350870][ T5772] wwan wwan0: port wwan0mbim0 disconnected [ 173.849539][ T7699] tunl0: Caught tx_queue_len zero misconfig [ 173.939613][ T7701] netlink: 168 bytes leftover after parsing attributes in process `syz.5.496'. [ 174.066298][ T7707] netlink: 8 bytes leftover after parsing attributes in process `syz.0.497'. [ 174.661030][ T7718] syz_tun: entered allmulticast mode [ 174.831442][ T7728] fuse: fd is not a fuse device [ 175.554148][ T7752] tipc: Failed to remove unknown binding: 66,0,0/0:2823146101/2823146102 [ 175.571563][ T7752] tipc: Failed to remove unknown binding: 66,0,0/0:2823146101/2823146102 [ 175.989453][ T7763] jffs2: notice: (7763) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 176.849267][ T7784] loop6: detected capacity change from 0 to 4096 [ 176.966737][ T7756] loop7: detected capacity change from 0 to 40427 [ 176.980114][ T7756] F2FS-fs: heap/no_heap options were deprecated [ 176.997021][ T7756] F2FS-fs (loop7): build fault injection rate: 19 [ 176.997065][ T7756] F2FS-fs (loop7): build fault injection type: 0x3bfe8c [ 177.015337][ T7756] F2FS-fs (loop7): invalid crc value [ 177.063429][ T7756] F2FS-fs (loop7): inject page alloc in f2fs_grab_cache_folio of f2fs_build_free_nids+0xa62/0x1940 [ 177.100127][ T7787] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 177.122193][ T7784] NILFS error (device loop6): nilfs_bmap_lookup_at_level: broken bmap (inode number=6) [ 177.138079][ T7784] NILFS (loop6): mounting fs with errors [ 177.242417][ T7784] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=15) [ 177.242608][ T7784] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=15) [ 177.242726][ T7784] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=15) [ 177.243080][ T31] audit: type=1800 audit(1788479354.439:46): pid=7784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.521" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 177.543454][ T7756] F2FS-fs (loop7): inject slab alloc in f2fs_kmem_cache_alloc of read_node_folio+0x21d/0x3d0 [ 177.627924][ T7756] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 177.666024][ T7793] NILFS (loop6): DAT doesn't have a block to manage vblocknr = 159744 [ 177.666722][ T7756] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 177.690034][ T7793] NILFS error (device loop6): nilfs_bmap_truncate: broken bmap (inode number=15) [ 177.690144][ T7793] NILFS (loop6): error -5 truncating bmap (ino=15) [ 177.771617][ T7756] syz.7.515: attempt to access beyond end of device [ 177.771617][ T7756] loop7: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 177.860331][ T7756] F2FS-fs (loop7): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x3a1/0xdc0 [ 177.881880][ T7776] loop5: detected capacity change from 0 to 32768 [ 177.945648][ T7756] F2FS-fs (loop7): inject inconsistent footer in f2fs_sanity_check_node_footer of __get_node_folio+0x8bf/0xd90 [ 177.945732][ T7756] F2FS-fs (loop7): inconsistent node block, node_type:1, nid:3, node_footer[nid:3,ino:3,ofs:0,cpver:1219692001,blkaddr:4098] [ 178.006633][ T7756] F2FS-fs (loop7): inject no more block in inc_valid_node_count of f2fs_new_node_folio+0x355/0xdc0 [ 178.049608][ T7756] syz.7.515: attempt to access beyond end of device [ 178.049608][ T7756] loop7: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 178.108912][ T7756] F2FS-fs (loop7): inject dquot initialize in f2fs_dquot_initialize of f2fs_mknod+0x1d0/0x690 [ 178.307019][ C1] F2FS-fs (loop7): inject inconsistent footer in f2fs_sanity_check_node_footer of f2fs_write_end_bio+0x7ed/0x16e0 [ 178.307110][ C1] F2FS-fs (loop7): inconsistent node block, node_type:0, nid:13, node_footer[nid:13,ino:3,ofs:431431,cpver:10241045589465957861,blkaddr:4106] [ 178.442353][ T7817] netlink: 'syz.1.532': attribute type 4 has an invalid length. [ 179.364447][ T7840] loop2: detected capacity change from 0 to 1024 [ 179.581947][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.595057][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.614152][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.614202][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.641584][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.648971][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.685242][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.685287][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.710653][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.710700][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.807922][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.807987][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.857549][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.858014][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.952086][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.952140][ T7840] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.138023][ T7853] netlink: 24 bytes leftover after parsing attributes in process `syz.6.543'. [ 180.153676][ T7853] vlan0: entered promiscuous mode [ 180.374757][ T7856] Illegal XDP return value 4292343672 on prog (id 48) dev syz_tun, expect packet loss! [ 180.451263][ T5614] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 180.617620][ T5614] usb 7-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 180.628514][ T5614] usb 7-1: config 8 has an invalid interface number: 188 but max is 0 [ 180.628561][ T5614] usb 7-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 180.628607][ T5614] usb 7-1: config 8 has no interface number 0 [ 180.628661][ T5614] usb 7-1: config 8 interface 188 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 180.628702][ T5614] usb 7-1: config 8 interface 188 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 180.688392][ T5614] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.688448][ T5614] usb 7-1: Product: syz [ 180.688497][ T5614] usb 7-1: Manufacturer: syz [ 180.688522][ T5614] usb 7-1: SerialNumber: syz [ 180.965718][ T5614] vmk80xx 7-1:8.188: driver 'vmk80xx' failed to auto-configure device. [ 180.997505][ T5614] usb 7-1: USB disconnect, device number 5 [ 181.342289][ T7843] mmap: syz.5.541 (7843) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 181.471577][ T5614] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 181.631826][ T5614] usb 3-1: Using ep0 maxpacket: 8 [ 181.639016][ T5614] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 181.650471][ T5614] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 181.660529][ T5614] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 181.660589][ T5614] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 181.660627][ T5614] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 181.660663][ T5614] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 181.660717][ T5614] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.950105][ T5614] usb 3-1: GET_CAPABILITIES returned 0 [ 181.956265][ T5614] usbtmc 3-1:16.0: can't read capabilities [ 182.189634][ T7893] binder: 7889:7893 ioctl c0306201 200000000080 returned -14 [ 182.205746][ T7893] binder: 7889:7893 ioctl c0306201 2000000003c0 returned -14 [ 182.265839][ T7887] loop6: detected capacity change from 0 to 32768 [ 182.288485][ T7887] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.557 (7887) [ 182.417375][ T7887] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 182.417446][ T7887] BTRFS info (device loop6): using sha256 checksum algorithm [ 182.561716][ T5793] usb 3-1: USB disconnect, device number 11 [ 182.765143][ T7887] BTRFS info (device loop6): enabling ssd optimizations [ 182.765199][ T7887] BTRFS info (device loop6): disabling tree log [ 182.765239][ T7887] BTRFS info (device loop6): turning on async discard [ 182.765265][ T7887] BTRFS info (device loop6): enabling free space tree [ 183.355864][ T7887] BTRFS info (device loop6): balance: start -d -m [ 183.547876][ T7932] overlayfs: failed to clone upperpath [ 183.575992][ T7887] BTRFS info (device loop6): relocating block group 6881280 flags data|metadata [ 183.651585][ T5614] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 183.668204][ T7934] Set syz1 is full, maxelem 1021 reached [ 183.812194][ T5614] usb 6-1: Using ep0 maxpacket: 16 [ 183.812958][ T5614] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 183.814612][ T5614] usb 6-1: config 1 has an invalid descriptor of length 240, skipping remainder of the config [ 183.814639][ T5614] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 183.819871][ T5614] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.819898][ T5614] usb 6-1: Product: syz [ 183.819916][ T5614] usb 6-1: Manufacturer: syz [ 183.819933][ T5614] usb 6-1: SerialNumber: syz [ 183.874174][ T5614] usb 6-1: 0:2 : does not exist [ 184.078793][ T7929] nvme nvme0: failed to connect socket: -512 [ 184.084406][ T5614] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 184.220864][ T7887] BTRFS info (device loop6): relocating block group 5242880 flags data|metadata [ 184.344659][ T7887] BTRFS info (device loop6): balance: canceled [ 184.400839][ T5614] usb 6-1: USB disconnect, device number 5 [ 184.466680][ T7949] netlink: 12 bytes leftover after parsing attributes in process `syz.0.574'. [ 184.618135][ T5630] udevd[5630]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 184.634161][ T5772] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 184.680850][ T6126] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 184.781912][ T5772] usb 8-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 184.796948][ T5772] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.796996][ T5772] usb 8-1: Product: syz [ 184.797022][ T5772] usb 8-1: Manufacturer: syz [ 184.797047][ T5772] usb 8-1: SerialNumber: syz [ 184.838370][ T5772] input: syz syz as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/input/input5 [ 184.951588][ T7954] netlink: 'syz.5.576': attribute type 3 has an invalid length. [ 184.963297][ T7954] netlink: 'syz.5.576': attribute type 3 has an invalid length. [ 185.515854][ T7967] team0 (unregistering): Port device team_slave_0 removed [ 185.598703][ T7967] team0 (unregistering): Port device team_slave_1 removed [ 185.690533][ T7974] syzkaller0: entered promiscuous mode [ 185.690582][ T7974] syzkaller0: entered allmulticast mode [ 186.990091][ T7984] loop6: detected capacity change from 0 to 32768 [ 187.542096][ T5793] usb 8-1: USB disconnect, device number 2 [ 187.902368][ T7997] loop5: detected capacity change from 0 to 32768 [ 187.924814][ T7997] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 187.924858][ T7997] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 188.032390][ T7997] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 188.221850][ T1219] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 188.221895][ T1219] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 188.571293][ T5614] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 188.586733][ T1219] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 364ms [ 188.599483][ T1219] gfs2: fsid=syz:syz.0: jid=0: Done [ 188.600297][ T7997] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 188.733391][ T5614] usb 8-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 188.734844][ T5614] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.837251][ T5614] usb 8-1: config 0 descriptor?? [ 188.889875][ T5614] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 189.331604][ T1219] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 189.482689][ T1219] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b6e, bcdDevice=9c.00 [ 189.482798][ T1219] usb 7-1: too many configurations: 129, using maximum allowed: 8 [ 189.505877][ T1219] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.527393][ T1219] usb 7-1: config 0 descriptor?? [ 189.799962][ T1219] usb 7-1: string descriptor 0 read error: -71 [ 189.841721][ T1219] usb 7-1: USB disconnect, device number 6 [ 190.098831][ T8040] tipc: Started in network mode [ 190.098893][ T8040] tipc: Node identity ac14140f, cluster identity 4711 [ 190.120405][ T8040] tipc: New replicast peer: 255.255.255.255 [ 190.142800][ T8040] tipc: Enabled bearer , priority 10 [ 190.154247][ T8040] tipc: New replicast peer: fc02:0000:0000:0000:0000:0000:0000:0001 [ 190.681954][ T8044] overlayfs: failed to clone upperpath [ 190.706677][ T5614] usb 8-1: USB disconnect, device number 3 [ 190.746224][ T8038] loop5: detected capacity change from 0 to 131072 [ 190.751560][ T8038] F2FS-fs (loop5): Invalid log sectorsize (67108873) [ 190.751582][ T8038] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 190.754237][ T8038] F2FS-fs (loop5): invalid crc value [ 190.847881][ T8038] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 190.879822][ T8038] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 190.879869][ T8038] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 190.967879][ T31] audit: type=1800 audit(1788479368.159:47): pid=8038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.599" name="file1" dev="loop5" ino=7 res=0 errno=0 [ 191.145225][ T1219] tipc: Node number set to 2886997007 [ 191.253795][ T8051] FAULT_INJECTION: forcing a failure. [ 191.253795][ T8051] name failslab, interval 1, probability 0, space 0, times 0 [ 191.254305][ T8051] CPU: 1 UID: 0 PID: 8051 Comm: syz.6.605 Tainted: G L syzkaller #0 PREEMPT(full) [ 191.254354][ T8051] Tainted: [L]=SOFTLOCKUP [ 191.254364][ T8051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 191.254380][ T8051] Call Trace: [ 191.254391][ T8051] [ 191.254403][ T8051] dump_stack_lvl+0xe8/0x150 [ 191.254448][ T8051] should_fail_ex+0x410/0x560 [ 191.254496][ T8051] should_failslab+0xa8/0x100 [ 191.254530][ T8051] __kmalloc_noprof+0xfe/0x720 [ 191.254572][ T8051] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.254603][ T8051] ? sock_kmalloc+0xd6/0x160 [ 191.254632][ T8051] ? sock_kmalloc+0xd6/0x160 [ 191.254669][ T8051] sock_kmalloc+0xd6/0x160 [ 191.254703][ T8051] hash_recvmsg+0x1d0/0x860 [ 191.254744][ T8051] ? __pfx_hash_recvmsg+0x10/0x10 [ 191.254783][ T8051] sock_recvmsg_nosec+0x130/0x170 [ 191.254824][ T8051] ____sys_recvmsg+0x3e3/0x4a0 [ 191.254864][ T8051] ? __pfx_____sys_recvmsg+0x10/0x10 [ 191.254912][ T8051] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.254943][ T8051] ? import_iovec+0x73/0xa0 [ 191.254977][ T8051] ___sys_recvmsg+0x213/0x5a0 [ 191.255013][ T8051] ? __pfx____sys_recvmsg+0x10/0x10 [ 191.255049][ T8051] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.255079][ T8051] ? lock_acquire+0x115/0x350 [ 191.255130][ T8051] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.255170][ T8051] do_recvmmsg+0x31a/0x7f0 [ 191.255210][ T8051] ? __pfx_do_recvmmsg+0x10/0x10 [ 191.255240][ T8051] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.255271][ T8051] ? do_futex+0x3e7/0x4e0 [ 191.255318][ T8051] ? fd_install+0x94/0x3d0 [ 191.255368][ T8051] __x64_sys_recvmmsg+0x198/0x250 [ 191.255403][ T8051] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 191.255449][ T8051] do_syscall_64+0x166/0x520 [ 191.255488][ T8051] ? trace_irq_disable+0x3b/0x140 [ 191.255514][ T8051] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.255547][ T8051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.255574][ T8051] RIP: 0033:0x7f703c39e159 [ 191.255597][ T8051] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 191.255623][ T8051] RSP: 002b:00007f703d197028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 191.255650][ T8051] RAX: ffffffffffffffda RBX: 00007f703c625fa0 RCX: 00007f703c39e159 [ 191.255670][ T8051] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000005 [ 191.255688][ T8051] RBP: 00007f703c435024 R08: 0000000000000000 R09: 0000000000000000 [ 191.255705][ T8051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 191.255721][ T8051] R13: 00007f703c626038 R14: 00007f703c625fa0 R15: 00007ffec7828698 [ 191.255762][ T8051] [ 192.098348][ T8058] loop7: detected capacity change from 0 to 1024 [ 192.119192][ T8058] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 192.149824][ T8058] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 192.149961][ T8058] System zones: 0-1, 3-36 [ 192.237153][ T8058] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 192.342955][ T8068] capability: warning: `syz.7.608' uses 32-bit capabilities (legacy support in use) [ 192.351320][ T8061] FAULT_INJECTION: forcing a failure. [ 192.351320][ T8061] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 192.351359][ T8061] CPU: 0 UID: 0 PID: 8061 Comm: syz.6.609 Tainted: G L syzkaller #0 PREEMPT(full) [ 192.351392][ T8061] Tainted: [L]=SOFTLOCKUP [ 192.351402][ T8061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 192.351417][ T8061] Call Trace: [ 192.351427][ T8061] [ 192.351438][ T8061] dump_stack_lvl+0xe8/0x150 [ 192.351480][ T8061] should_fail_ex+0x410/0x560 [ 192.351526][ T8061] _copy_from_user+0x2d/0xb0 [ 192.351555][ T8061] sctp_setsockopt+0x1c4/0x12c0 [ 192.351591][ T8061] ? srso_alias_return_thunk+0x5/0xfbef5 [ 192.351621][ T8061] ? sock_common_setsockopt+0x36/0xc0 [ 192.351659][ T8061] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 192.351698][ T8061] do_sock_setsockopt+0x17c/0x1b0 [ 192.351729][ T8061] __x64_sys_setsockopt+0x13d/0x1b0 [ 192.351762][ T8061] do_syscall_64+0x166/0x520 [ 192.351800][ T8061] ? trace_irq_disable+0x3b/0x140 [ 192.351831][ T8061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.351864][ T8061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.351890][ T8061] RIP: 0033:0x7f703c39e159 [ 192.351913][ T8061] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.351935][ T8061] RSP: 002b:00007f703d197028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 192.351964][ T8061] RAX: ffffffffffffffda RBX: 00007f703c625fa0 RCX: 00007f703c39e159 [ 192.351983][ T8061] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 192.351999][ T8061] RBP: 00007f703c435024 R08: 000000000000feef R09: 0000000000000000 [ 192.352016][ T8061] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 192.352032][ T8061] R13: 00007f703c626038 R14: 00007f703c625fa0 R15: 00007ffec7828698 [ 192.352071][ T8061] [ 192.562924][ T8068] EXT4-fs error (device loop7): ext4_iget_extra_inode:5210: inode #15: comm syz.7.608: corrupted in-inode xattr: ea_inode specified without ea_inode feature enabled [ 192.797432][ T6969] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 192.926325][ T8072] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 192.926371][ T8072] IPv6: NLM_F_CREATE should be set when creating new route [ 193.240108][ T8072] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.240885][ T8072] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.347611][ T8081] loop2: detected capacity change from 0 to 128 [ 193.358636][ T8081] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 193.381473][ T8081] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 193.524435][ T8083] xt_hashlimit: size too large, truncated to 1048576 [ 193.544556][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.544640][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.835752][ T8072] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 193.885979][ T8072] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.373276][ T12] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.374978][ T12] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.375022][ T12] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.375062][ T12] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.698253][ T8108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 195.091212][ T5772] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 195.163522][ T8119] netlink: 4 bytes leftover after parsing attributes in process `syz.6.630'. [ 195.245006][ T5772] usb 3-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 195.249212][ T5772] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 195.261224][ T5772] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.261253][ T5772] usb 3-1: Product: syz [ 195.261271][ T5772] usb 3-1: Manufacturer: syz [ 195.261288][ T5772] usb 3-1: SerialNumber: syz [ 195.725725][ T8128] netlink: 'syz.7.634': attribute type 1 has an invalid length. [ 195.948151][ T8128] 8021q: adding VLAN 0 to HW filter on device bond1 [ 196.057715][ T8130] 8021q: adding VLAN 0 to HW filter on device bond1 [ 196.061985][ T8130] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 196.063342][ T8130] bond1: (slave gre1): Error -95 calling set_mac_address [ 196.249443][ T5772] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 196.278425][ T5772] usb 3-1: cannot request logical cluster ID: 3 (err: -71) [ 196.278484][ T5772] usb 3-1: unit 80 not found! [ 196.306713][ T8134] gretap1: entered promiscuous mode [ 196.329763][ T8134] bond1: (slave gretap1): making interface the new active one [ 196.338512][ T8134] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 196.609610][ T8151] loop6: detected capacity change from 0 to 128 [ 196.634204][ T8151] FAT-fs (loop6): error, fat_get_cluster: invalid start cluster (i_pos 1, start 0000000d) [ 196.658117][ T8151] netlink: 4 bytes leftover after parsing attributes in process `syz.6.640'. [ 196.721865][ T8154] netlink: 4 bytes leftover after parsing attributes in process `syz.6.640'. [ 196.757871][ T5772] usb 3-1: USB disconnect, device number 12 [ 197.133090][ T5630] udevd[5630]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 197.347109][ T8160] netlink: 20 bytes leftover after parsing attributes in process `syz.2.643'. [ 197.433324][ T8160] bond_slave_0: entered promiscuous mode [ 197.439164][ T8160] bond_slave_0: entered allmulticast mode [ 197.757488][ T8166] dummy0: left promiscuous mode [ 197.779905][ T8166] vlan0: left promiscuous mode [ 197.799453][ T8166] bond1: left allmulticast mode [ 198.809111][ T8202] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 199.661000][ T8233] loop5: detected capacity change from 0 to 128 [ 199.717607][ T8233] EXT4-fs (loop5): mounting ext2 file system using the ext4 subsystem [ 199.769248][ T8233] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 199.806238][ T8235] loop6: detected capacity change from 0 to 512 [ 199.807295][ T8235] EXT4-fs: Ignoring removed i_version option [ 199.807374][ T8235] EXT4-fs: Ignoring removed oldalloc option [ 199.829405][ T8233] ext2 filesystem being mounted at /96/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 199.869613][ T8235] EXT4-fs (loop6): Test dummy encryption mode enabled [ 199.923635][ T8235] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 200.278392][ T6126] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.737793][ T5610] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 202.107963][ T8284] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 202.108008][ T8284] IPv6: NLM_F_CREATE should be set when creating new route [ 202.792463][ T8307] fuse: fd is not a fuse device [ 202.925620][ T8310] loop2: detected capacity change from 0 to 256 [ 202.945755][ T8310] exfat: Deprecated parameter 'utf8' [ 202.945895][ T8310] exfat: Deprecated parameter 'namecase' [ 203.007500][ T8310] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xd956ea23, utbl_chksum : 0xe619d30d) [ 203.699598][ T8326] loop5: detected capacity change from 0 to 2048 [ 203.735193][ T8326] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 203.938567][ T31] audit: type=1800 audit(1788479381.129:48): pid=8326 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.684" name="file1" dev="loop5" ino=1415 res=0 errno=0 [ 205.894655][ T5621] Bluetooth: hci3: command 0x0406 tx timeout [ 205.896213][ T5625] Bluetooth: hci5: command 0x0406 tx timeout [ 205.897864][ T5632] Bluetooth: hci2: command 0x0406 tx timeout [ 205.897931][ T4925] Bluetooth: hci1: command 0x0406 tx timeout [ 209.466864][ T8418] loop2: detected capacity change from 0 to 512 [ 209.569728][ T8418] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 209.569855][ T8418] ext4 filesystem being mounted at /112/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 209.927791][ T5611] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.003042][ T8445] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 210.255961][ T8456] netlink: 14 bytes leftover after parsing attributes in process `syz.7.725'. [ 210.315875][ T8456] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 210.358271][ T8456] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 210.435843][ T8456] bond0 (unregistering): Released all slaves [ 211.130829][ T8479] loop2: detected capacity change from 0 to 512 [ 211.137442][ T8479] EXT4-fs (loop2): Test dummy encryption mode enabled [ 211.137466][ T8479] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 211.137482][ T8479] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 211.193440][ T8479] EXT4-fs (loop2): 1 truncate cleaned up [ 211.203926][ T8479] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 211.575540][ T8494] netlink: 4 bytes leftover after parsing attributes in process `syz.6.735'. [ 212.936315][ T5611] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 214.281380][ T8535] warning: `syz.7.745' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 218.190297][ T8593] loop6: detected capacity change from 0 to 32768 [ 219.187206][ C0] vxcan0: j1939_tp_rxtimer: 0xffff88806573c000: rx timeout, send abort [ 219.190350][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff88806573c000: 0x0f000: (3) A timeout occurred and this is the connection abort to close the session. [ 219.296597][ T8632] netlink: 8 bytes leftover after parsing attributes in process `syz.7.773'. [ 219.296650][ T8632] netlink: 8 bytes leftover after parsing attributes in process `syz.7.773'. [ 222.035850][ T8691] fuse: fd is not a fuse device [ 222.808515][ T8709] fuse: fd is not a fuse device [ 224.179785][ T8728] netlink: 12 bytes leftover after parsing attributes in process `syz.7.806'. [ 224.423055][ T31] audit: type=1800 audit(1788479401.619:49): pid=8684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.791" name="bus" dev="ramfs" ino=19107 res=0 errno=0 [ 225.658289][ T8745] uprobe: syz.6.811:8745 failed to unregister, leaking uprobe [ 225.658390][ T8745] uprobe: syz.6.811:8745 failed to unregister, leaking uprobe [ 225.729664][ T8746] overlayfs: missing 'lowerdir' [ 226.395878][ T31] audit: type=1326 audit(1788479403.589:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.396181][ T31] audit: type=1326 audit(1788479403.589:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.396341][ T31] audit: type=1326 audit(1788479403.589:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.396560][ T31] audit: type=1326 audit(1788479403.589:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.396783][ T31] audit: type=1326 audit(1788479403.589:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=99 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.397844][ T31] audit: type=1326 audit(1788479403.589:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.398301][ T31] audit: type=1326 audit(1788479403.589:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2ff99e159 code=0x7ffc0000 [ 226.400573][ T31] audit: type=1326 audit(1788479403.589:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc2ff95e98e code=0x7ffc0000 [ 226.407967][ T31] audit: type=1326 audit(1788479403.589:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8761 comm="syz.5.819" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc2ff95e98e code=0x7ffc0000 [ 227.826759][ T8792] netlink: 4 bytes leftover after parsing attributes in process `syz.5.825'. [ 228.200584][ T8802] netlink: 'syz.0.829': attribute type 1 has an invalid length. [ 228.519555][ T8802] 8021q: adding VLAN 0 to HW filter on device bond2 [ 228.657675][ T8804] vlan2: entered allmulticast mode [ 228.657729][ T8804] bond2: entered allmulticast mode [ 228.747840][ T8805] bond2: (slave geneve2): making interface the new active one [ 228.759264][ T8805] geneve2: entered allmulticast mode [ 228.799449][ T8805] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 228.908878][ T5627] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 228.924306][ T5627] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 228.932823][ T5627] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 228.946553][ T5627] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 228.960818][ T5627] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 229.879263][ T8816] netlink: 40 bytes leftover after parsing attributes in process `syz.5.833'. [ 229.895430][ T8816] netlink: 40 bytes leftover after parsing attributes in process `syz.5.833'. [ 230.593080][ T8842] fuse: fd is not a fuse device [ 231.063267][ T5615] Bluetooth: hci6: command tx timeout [ 231.089282][ T8853] tmpfs: Unknown parameter '¤Xè¿ùɵš–ÂhÒÒ|s€?>uúœçˆãòg+]D' [ 231.128910][ T8808] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.130600][ T8808] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.130748][ T8808] bridge_slave_0: entered allmulticast mode [ 231.135706][ T8808] bridge_slave_0: entered promiscuous mode [ 231.162867][ T8808] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.163024][ T8808] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.163177][ T8808] bridge_slave_1: entered allmulticast mode [ 231.169005][ T8808] bridge_slave_1: entered promiscuous mode [ 231.295488][ T8808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 231.299010][ T8808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 231.352038][ T8808] team0: Port device team_slave_0 added [ 231.361508][ T8808] team0: Port device team_slave_1 added [ 231.464259][ T5615] Bluetooth: hci4: command 0x0406 tx timeout [ 231.505918][ T8808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 231.514280][ T8808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 231.541264][ T8808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 231.557789][ T8808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 231.559880][ T8857] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 231.574416][ T8808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 231.574478][ T8808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.681249][ T8808] hsr_slave_0: entered promiscuous mode [ 231.687948][ T8808] hsr_slave_1: entered promiscuous mode [ 231.695374][ T8808] debugfs: 'hsr0' already exists in 'hsr' [ 231.701232][ T8808] Cannot create hsr debugfs directory [ 231.782269][ T8866] jffs2: notice: (8866) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 231.885865][ T8866] overlayfs: missing 'lowerdir' [ 232.093016][ T8871] netlink: 'syz.6.847': attribute type 39 has an invalid length. [ 232.410840][ T8883] netlink: 'syz.0.851': attribute type 1 has an invalid length. [ 232.454621][ T8808] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 232.483780][ T8808] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 232.624562][ T8883] 8021q: adding VLAN 0 to HW filter on device bond3 [ 232.635680][ T8808] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 232.667611][ T8808] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 232.682835][ T8808] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 232.707860][ T8808] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 232.744664][ T8885] macvlan3: entered promiscuous mode [ 232.744712][ T8885] macvlan3: entered allmulticast mode [ 232.745125][ T8885] bond3: entered allmulticast mode [ 232.745204][ T8885] bond3: entered promiscuous mode [ 232.777195][ T8885] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 232.803182][ T8885] team0: Port device macvlan3 added [ 232.831318][ T8808] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 232.938024][ T8808] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 233.141302][ T5627] Bluetooth: hci6: command tx timeout [ 233.282389][ T8808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 233.319665][ T8808] 8021q: adding VLAN 0 to HW filter on device team0 [ 233.364687][ T7580] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.364826][ T7580] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.403902][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.404042][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.528482][ T8904] netlink: 'syz.7.857': attribute type 1 has an invalid length. [ 233.706526][ T8906] bond0: (slave bridge2): making interface the new active one [ 233.714337][ T8906] bond0: (slave bridge2): Enslaving as an active interface with an up link [ 234.776918][ T12] IPVS: starting estimator thread 0... [ 234.891530][ T8937] IPVS: using max 28 ests per chain, 67200 per kthread [ 234.966357][ T31] kauditd_printk_skb: 245 callbacks suppressed [ 234.966420][ T31] audit: type=1804 audit(1788479412.159:304): pid=8938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.867" name="file0" dev="tmpfs" ino=435 res=1 errno=0 [ 235.225134][ T5627] Bluetooth: hci6: command tx timeout [ 235.457485][ T8808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 236.307102][ T8808] veth0_vlan: entered promiscuous mode [ 236.315966][ T8808] veth1_vlan: entered promiscuous mode [ 236.378108][ T8808] veth0_macvtap: entered promiscuous mode [ 236.383905][ T8808] veth1_macvtap: entered promiscuous mode [ 236.419454][ T8808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.425388][ T8808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 236.882071][ T7580] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.891363][ T7270] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.891457][ T7270] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.892453][ T12] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.045444][ T8976] 9p: Bad value for 'rfdno' [ 237.083817][ T7576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.083873][ T7576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 237.133556][ T7576] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.133607][ T7576] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 237.258057][ T8982] binder: 8981:8982 ioctl c0306201 200000000080 returned -14 [ 237.268185][ T8982] binder: 8981:8982 ioctl c0306201 2000000003c0 returned -14 [ 237.305835][ T5627] Bluetooth: hci6: command tx timeout [ 237.640518][ T8997] overlayfs: failed to clone upperpath [ 237.662100][ T8994] netlink: 8 bytes leftover after parsing attributes in process `syz.7.884'. [ 238.569770][ T5627] Bluetooth: hci1: unexpected event for opcode 0x0401 [ 238.783553][ T9027] xt_hashlimit: max too large, truncated to 1048576 [ 239.116445][ T9037] fuse: fd is not a fuse device [ 239.721357][ T5764] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 239.894480][ T5764] usb 7-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 239.911482][ T5764] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.919254][ T5764] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.919282][ T5764] usb 7-1: Product: syz [ 239.919300][ T5764] usb 7-1: Manufacturer: syz [ 239.919317][ T5764] usb 7-1: SerialNumber: syz [ 239.966531][ T5764] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 240.671259][ T5764] gspca_mr97310a: reg read [21] error -110 [ 240.671375][ T5764] mr97310a 7-1:1.0: probe with driver mr97310a failed with error -110 [ 241.266119][ T9072] sctp: [Deprecated]: syz.1.914 (pid 9072) Use of int in max_burst socket option. [ 241.266119][ T9072] Use struct sctp_assoc_value instead [ 241.348421][ T9073] sctp: [Deprecated]: syz.1.914 (pid 9073) Use of struct sctp_assoc_value in delayed_ack socket option. [ 241.348421][ T9073] Use struct sctp_sack_info instead [ 241.352288][ T9073] ip6_vti0: Caught tx_queue_len zero misconfig [ 241.762812][ T9084] netlink: 16402 bytes leftover after parsing attributes in process `syz.7.919'. [ 241.917348][ T9090] sctp: [Deprecated]: syz.7.922 (pid 9090) Use of struct sctp_assoc_value in delayed_ack socket option. [ 241.917348][ T9090] Use struct sctp_sack_info instead [ 242.151361][ T1219] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 242.314369][ T1219] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 242.316146][ T1219] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 242.316172][ T1219] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 242.318146][ T1219] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 242.318172][ T1219] usb 9-1: SerialNumber: syz [ 242.591474][ T1219] usb 9-1: 0:2 : does not exist [ 242.620857][ T5616] usb 7-1: USB disconnect, device number 7 [ 242.662062][ T5627] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 242.662148][ T5627] Bluetooth: hci1: Injecting HCI hardware error event [ 242.664032][ T5615] Bluetooth: hci1: hardware error 0x00 [ 243.488070][ T1219] usb 9-1: USB disconnect, device number 2 [ 243.740289][ T5630] udevd[5630]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 244.911609][ T5615] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 247.676705][ T9178] netlink: 52 bytes leftover after parsing attributes in process `syz.1.951'. [ 247.712558][ T9178] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.713031][ T9178] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.745251][ T9181] netlink: 76 bytes leftover after parsing attributes in process `syz.1.951'. [ 247.786413][ T9181] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.786555][ T9181] bridge0: port 2(bridge_slave_1) entered forwarding state [ 247.786906][ T9181] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.787031][ T9181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 247.793276][ T9181] netlink: 52 bytes leftover after parsing attributes in process `syz.1.951'. [ 247.800470][ T9181] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.803145][ T9181] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.123587][ T9185] MTD: Couldn't look up './dev/mtdblock0': -2 [ 248.324437][ T31] audit: type=1326 audit(1788479425.519:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9188 comm="syz.8.956" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x0 [ 249.536556][ T9215] netlink: 'syz.6.968': attribute type 1 has an invalid length. [ 249.633872][ T9220] netlink: 'syz.1.969': attribute type 1 has an invalid length. [ 249.642566][ T9215] 8021q: adding VLAN 0 to HW filter on device bond5 [ 249.713349][ T9219] bond5: (slave geneve2): making interface the new active one [ 249.723102][ T9219] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 249.812199][ T9220] 8021q: adding VLAN 0 to HW filter on device bond1 [ 249.821813][ T7581] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.830649][ T7581] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.830696][ T7581] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.830746][ T7581] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.876238][ T9218] bond1: (slave veth0_to_bond): making interface the new active one [ 249.887458][ T9218] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 249.981881][ T9222] macvlan2: entered promiscuous mode [ 249.989355][ T9222] macvlan2: entered allmulticast mode [ 249.996932][ T9222] bond1: entered promiscuous mode [ 250.004384][ T9222] veth0_to_bond: entered promiscuous mode [ 250.231725][ T9222] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 250.262625][ T31] audit: type=1800 audit(1788479427.389:306): pid=9225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.970" name="addr_trtype" dev="configfs" ino=22073 res=0 errno=0 [ 250.370156][ T9222] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 250.768363][ T9222] bond1: left promiscuous mode [ 250.768455][ T9222] veth0_to_bond: left promiscuous mode [ 251.979464][ T9233] binder: 9231:9233 unknown command 0 [ 251.979515][ T9233] binder: 9231:9233 ioctl c0306201 200000004a40 returned -22 [ 252.699624][ T9253] loop8: detected capacity change from 0 to 1764 [ 253.020966][ T10] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 253.171789][ T10] usb 9-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 253.188471][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.188520][ T10] usb 9-1: Product: syz [ 253.188557][ T10] usb 9-1: Manufacturer: syz [ 253.188582][ T10] usb 9-1: SerialNumber: syz [ 254.202134][ T10] usb 9-1: config 0 descriptor?? [ 254.215132][ T10] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 254.251295][ T5627] Bluetooth: hci7: command 0x1003 tx timeout [ 254.251465][ T5615] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 255.208504][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.209116][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.211120][ T10] sonixb 9-1:0.0: Error reading register 00: -110 [ 255.575272][ T9264] netlink: 'syz.1.985': attribute type 1 has an invalid length. [ 255.785206][ T9264] bond2: entered promiscuous mode [ 255.792881][ T9264] 8021q: adding VLAN 0 to HW filter on device bond2 [ 256.054679][ T9270] 8021q: adding VLAN 0 to HW filter on device bond2 [ 256.055206][ T9270] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 256.055261][ T9270] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 256.100212][ T9270] bond2: (slave ip6gre1): making interface the new active one [ 256.111070][ T9270] ip6gre1: entered promiscuous mode [ 256.127030][ T9270] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 256.333546][ T5627] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 256.344635][ T5627] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 256.353404][ T5627] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 256.368873][ T5627] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 256.378574][ T5627] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 256.734635][ T5863] usb 9-1: USB disconnect, device number 3 [ 256.826271][ T9296] lo: Caught tx_queue_len zero misconfig [ 257.406947][ T9307] netlink: 32 bytes leftover after parsing attributes in process `syz.5.994'. [ 258.501318][ T5627] Bluetooth: hci7: command tx timeout [ 258.899410][ T9282] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.899693][ T9282] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.900211][ T9282] bridge_slave_0: entered allmulticast mode [ 258.909468][ T9282] bridge_slave_0: entered promiscuous mode [ 258.920681][ T9282] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.923049][ T9282] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.923188][ T9282] bridge_slave_1: entered allmulticast mode [ 258.938568][ T9282] bridge_slave_1: entered promiscuous mode [ 259.226253][ C0] Unknown status report in ack skb [ 259.255681][ T9282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 259.287436][ T9282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 259.476459][ T9344] batman_adv: batadv0: Adding interface: dummy0 [ 259.485413][ T9344] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.512253][ T9344] batman_adv: batadv0: Interface activated: dummy0 [ 259.549103][ T9345] batadv0: mtu less than device minimum [ 259.563209][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.564762][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.566266][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.567774][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.569303][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.570864][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.572372][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.573929][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.575428][ T9345] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 259.724916][ T9282] team0: Port device team_slave_0 added [ 259.756730][ T9282] team0: Port device team_slave_1 added [ 259.957938][ T9282] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 259.957980][ T9282] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.958030][ T9282] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 259.968352][ T9282] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 259.968368][ T9282] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.968408][ T9282] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 260.681573][ T5627] Bluetooth: hci7: command tx timeout [ 261.123364][ T7270] IPVS: starting estimator thread 0... [ 261.168478][ T31] audit: type=1804 audit(1788479438.359:307): pid=9360 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1014" name="bus" dev="ramfs" ino=22367 res=1 errno=0 [ 261.204659][ T31] audit: type=1804 audit(1788479438.399:308): pid=9367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1014" name="bus" dev="ramfs" ino=22367 res=1 errno=0 [ 261.221307][ T9366] IPVS: using max 26 ests per chain, 62400 per kthread [ 261.311405][ T9282] hsr_slave_0: entered promiscuous mode [ 261.324847][ T9282] hsr_slave_1: entered promiscuous mode [ 261.338290][ T9282] debugfs: 'hsr0' already exists in 'hsr' [ 261.338329][ T9282] Cannot create hsr debugfs directory [ 262.124492][ T5863] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 262.284089][ T5863] usb 9-1: unable to get BOS descriptor or descriptor too short [ 262.284159][ T5863] usb 9-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice= 6.38 [ 262.288224][ T5863] usb 9-1: config 114 has an invalid interface number: 240 but max is 0 [ 262.288252][ T5863] usb 9-1: config 114 has no interface number 0 [ 262.288296][ T5863] usb 9-1: config 114 interface 240 altsetting 232 bulk endpoint 0x1 has invalid maxpacket 1023 [ 262.288326][ T5863] usb 9-1: config 114 interface 240 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 262.288362][ T5863] usb 9-1: config 114 interface 240 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 262.288392][ T5863] usb 9-1: config 114 interface 240 has no altsetting 0 [ 262.307120][ T5863] usb 9-1: string descriptor 0 read error: -22 [ 262.307261][ T5863] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.337690][ T9380] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 262.337842][ T9380] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 262.372671][ T5863] ir_usb 9-1:114.240: IR Dongle converter detected [ 262.572907][ T5863] usb 9-1: IR Dongle converter now attached to ttyUSB0 [ 262.740915][ T5627] Bluetooth: hci7: command tx timeout [ 262.756347][ T10] usb 9-1: USB disconnect, device number 4 [ 262.822823][ T10] ir-usb ttyUSB0: IR Dongle converter now disconnected from ttyUSB0 [ 262.851801][ T10] ir_usb 9-1:114.240: device disconnected [ 263.075213][ T9282] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 263.108432][ T9282] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 263.109378][ T9282] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 263.140615][ T9282] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 263.146188][ T9282] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 263.165069][ T9282] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 263.167885][ T9282] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 263.210526][ T9282] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 263.456237][ T9282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.494778][ T9282] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.531271][ T1219] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 263.535522][ T7270] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.535631][ T7270] bridge0: port 1(bridge_slave_0) entered forwarding state [ 263.581127][ T7273] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.581260][ T7273] bridge0: port 2(bridge_slave_1) entered forwarding state [ 263.694238][ T1219] usb 7-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 263.709743][ T1219] usb 7-1: config index 0 descriptor too short (expected 65069, got 45) [ 263.711025][ T1219] usb 7-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 255 [ 263.711557][ T1219] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.711573][ T9412] fuse: fd is not a fuse device [ 263.714039][ T1219] usb 7-1: config 0 has no interfaces? [ 263.714099][ T1219] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.787963][ T1219] usb 7-1: config 0 descriptor?? [ 264.038381][ T1219] usb 7-1: USB disconnect, device number 8 [ 264.097741][ T9418] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1031'. [ 264.097807][ T9418] bond0: option arp_validate: invalid value (18446744072707910257) [ 264.821796][ T5627] Bluetooth: hci7: command tx timeout [ 264.831600][ T9435] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1036'. [ 264.831646][ T9435] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1036'. [ 265.457147][ T9452] hsr_slave_0: left promiscuous mode [ 265.486523][ T9452] hsr_slave_1: left promiscuous mode [ 265.565078][ T9282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 265.726362][ T9453] bond0: entered promiscuous mode [ 265.726411][ T9453] bond_slave_0: entered promiscuous mode [ 265.726652][ T9453] bond_slave_1: entered promiscuous mode [ 265.729559][ T9453] gretap0: entered promiscuous mode [ 265.731750][ T9453] dummy0: entered promiscuous mode [ 265.732827][ T9453] debugfs: 'hsr0' already exists in 'hsr' [ 265.732862][ T9453] Cannot create hsr debugfs directory [ 266.766781][ T9472] loop8: detected capacity change from 0 to 512 [ 266.778998][ T9472] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 266.779047][ T9472] EXT4-fs (loop8): invalid inodes per group: 0 [ 266.912691][ T9472] netlink: 'syz.8.1045': attribute type 4 has an invalid length. [ 266.999638][ T9472] netlink: 'syz.8.1045': attribute type 4 has an invalid length. [ 267.408096][ T9282] veth0_vlan: entered promiscuous mode [ 267.988299][ T9282] veth1_vlan: entered promiscuous mode [ 268.304464][ T9496] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1052'. [ 268.579964][ T9491] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.580602][ T9491] bridge0: port 1(bridge_slave_0) entered disabled state [ 269.555754][ T9491] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 269.577270][ T9491] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 269.816267][ T9517] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 269.816267][ T9517] The task syz.5.1058 (9517) triggered the difference, watch for misbehavior. [ 269.881600][ T7270] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.913089][ T6355] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.913371][ T6355] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.913434][ T6355] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.918575][ T9282] veth0_macvtap: entered promiscuous mode [ 269.929165][ T9282] veth1_macvtap: entered promiscuous mode [ 269.974403][ T9282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 270.033142][ T9282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 270.102524][ T7278] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.161724][ T152] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.161801][ T152] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.161864][ T152] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.491730][ T9528] net_ratelimit: 10 callbacks suppressed [ 270.491809][ T9528] openvswitch: netlink: Duplicate or invalid key (type 0). [ 271.190317][ T7581] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 271.217466][ T7581] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 271.398296][ T7580] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 271.398341][ T7580] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 272.239213][ T9548] netlink: 'syz.1.1068': attribute type 13 has an invalid length. [ 273.648717][ T9564] overlayfs: failed to resolve './cgroup': -2 [ 274.760343][ C0] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 276.038172][ T31] audit: type=1326 audit(1788479453.229:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.039009][ T31] audit: type=1326 audit(1788479453.229:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.039082][ T31] audit: type=1326 audit(1788479453.229:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.039367][ T31] audit: type=1326 audit(1788479453.229:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.061639][ T9591] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1081'. [ 276.840568][ T31] audit: type=1326 audit(1788479454.029:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc361b5e98e code=0x7ffc0000 [ 276.869386][ T9591] ip6gre1: entered promiscuous mode [ 276.869410][ T9591] ip6gre1: entered allmulticast mode [ 276.883995][ T31] audit: type=1326 audit(1788479454.079:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.916624][ T31] audit: type=1326 audit(1788479454.109:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9584 comm="syz.7.1079" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fc361b9e159 code=0x7ffc0000 [ 276.981398][ T9591] netlink: 'syz.8.1081': attribute type 6 has an invalid length. [ 276.981423][ T9591] netlink: 72 bytes leftover after parsing attributes in process `syz.8.1081'. [ 277.276942][ T9602] Bluetooth: ISO socket layer initialized [ 277.295469][ T5627] Bluetooth: hci5: unexpected event for opcode 0x2003 [ 278.042779][ T9614] loop8: detected capacity change from 0 to 256 [ 278.621030][ T9625] tipc: Failed to remove unknown binding: 66,0,0/0:2345398237/2345398239 [ 278.621093][ T9625] tipc: Failed to remove unknown binding: 66,0,0/0:2345398237/2345398238 [ 278.624734][ T9625] tipc: Failed to remove unknown binding: 66,0,0/0:2345398237/2345398239 [ 278.624765][ T9625] tipc: Failed to remove unknown binding: 66,0,0/0:2345398237/2345398238 [ 279.076760][ T9634] netlink: 'syz.7.1093': attribute type 1 has an invalid length. [ 279.151385][ T7580] IPVS: starting estimator thread 0... [ 279.254551][ T9634] 8021q: adding VLAN 0 to HW filter on device bond2 [ 279.269891][ T9637] bond2: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 279.271278][ T9638] IPVS: using max 33 ests per chain, 79200 per kthread [ 279.303973][ T9637] bond2: entered allmulticast mode [ 279.317315][ T9634] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1093'. [ 279.317670][ T9634] bond2: left allmulticast mode [ 279.318029][ T9634] 8021q: adding VLAN 0 to HW filter on device bond2 [ 279.410693][ T9640] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 279.451169][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 279.562075][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 279.562118][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 279.601679][ T9646] syz_tun: entered allmulticast mode [ 279.677125][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 279.677180][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 279.782966][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 279.783029][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 279.892760][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 279.892833][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 280.001239][ T6355] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 281.129513][ T9671] netlink: 460 bytes leftover after parsing attributes in process `syz.6.1105'. [ 282.282835][ T9691] netlink: 'syz.5.1112': attribute type 1 has an invalid length. [ 282.464561][ T9691] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1112'. [ 282.625836][ T9694] bond2: (slave geneve2): making interface the new active one [ 282.663711][ T9694] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 282.673509][ T41] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 282.694515][ T9691] 8021q: adding VLAN 0 to HW filter on device bond2 [ 282.695190][ T6355] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 282.821087][ T41] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 282.833148][ T41] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 282.880353][ T9706] cifs: Unknown parameter 'timeo' [ 284.463930][ T9735] loop6: detected capacity change from 0 to 4096 [ 284.540957][ T7278] net_ratelimit: 120 callbacks suppressed [ 284.541011][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 284.541044][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 284.654308][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 284.654371][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 284.764433][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 284.764492][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 284.871661][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 284.871730][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 284.905851][ T31] audit: type=1326 audit(1788479718.100:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.906817][ T31] audit: type=1326 audit(1788479718.100:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.932620][ T31] audit: type=1326 audit(1788479718.130:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.933207][ T31] audit: type=1326 audit(1788479718.130:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.939543][ T31] audit: type=1326 audit(1788479718.130:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=5 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.939597][ T31] audit: type=1326 audit(1788479718.130:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.939647][ T31] audit: type=1326 audit(1788479718.130:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.940273][ T31] audit: type=1326 audit(1788479718.130:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.940549][ T31] audit: type=1326 audit(1788479718.130:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f703c39e159 code=0x7ffc0000 [ 284.966501][ T31] audit: type=1326 audit(1788479718.160:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9733 comm="syz.6.1121" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f703c39cfc7 code=0x7ffc0000 [ 285.036617][ T67] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 285.036652][ T67] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 287.539139][ T9776] netlink: 'syz.5.1132': attribute type 1 has an invalid length. [ 287.674628][ T9782] fuse: fd is not a fuse device [ 287.803553][ T9780] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 287.878547][ T9783] macvlan2: entered promiscuous mode [ 287.878598][ T9783] macvlan2: entered allmulticast mode [ 287.894781][ T9783] bond3: entered promiscuous mode [ 287.918674][ T9783] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 287.936842][ T9783] bond3: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 287.955318][ T9783] bond3: left promiscuous mode [ 289.694966][ T12] net_ratelimit: 72 callbacks suppressed [ 289.695029][ T12] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 289.713214][ T12] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 289.725436][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 289.985545][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 289.994033][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 290.306703][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 290.377549][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 290.560146][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 290.717448][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 290.849932][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 291.131836][ T9817] fuse: fd is not a fuse device [ 291.386441][ T9824] bridge_slave_0: left allmulticast mode [ 291.399136][ T9824] bridge_slave_0: left promiscuous mode [ 291.405471][ T9824] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.448810][ T9824] bridge_slave_1: left allmulticast mode [ 291.456778][ T9824] bridge_slave_1: left promiscuous mode [ 291.464173][ T9824] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.528613][ T9824] bond0: (slave bond_slave_0): Releasing backup interface [ 291.568850][ T9824] bond0: (slave bond_slave_1): Releasing backup interface [ 291.614311][ T9824] team0: Port device team_slave_0 removed [ 291.635482][ T9824] team0: Port device team_slave_1 removed [ 291.643513][ T9824] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 291.651500][ T9824] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 291.705606][ T9824] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 291.705646][ T9824] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.038714][ T41] net_ratelimit: 75 callbacks suppressed [ 295.038784][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 295.038819][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 295.133611][ T31] kauditd_printk_skb: 63 callbacks suppressed [ 295.133669][ T31] audit: type=1800 audit(1788479728.330:389): pid=9871 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.1158" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 295.147559][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 295.147591][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 295.252947][ T12] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 295.253003][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 296.238543][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 296.243412][ T152] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 296.603711][ T7584] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 296.603763][ T7584] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 296.733338][ T7584] IPVS: starting estimator thread 0... [ 296.831408][ T9893] IPVS: using max 26 ests per chain, 62400 per kthread [ 297.102852][ T9885] syz.6.1161 (9885): drop_caches: 2 [ 298.908191][ T9917] netdevsim netdevsim9: loading /lib/firmware/. failed with error -22 [ 298.908242][ T9917] netdevsim netdevsim9: Direct firmware load for . failed with error -22 [ 298.908280][ T9917] netdevsim netdevsim9: Falling back to sysfs fallback for: . [ 299.231527][ T5764] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 299.391866][ T5764] usb 7-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 299.393315][ T5764] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 299.393345][ T5764] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 299.393394][ T5764] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.137249][ T41] net_ratelimit: 24 callbacks suppressed [ 300.148612][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.148661][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 300.244210][ T5764] ums-alauda 7-1:1.0: USB Mass Storage device detected [ 300.251865][ T7584] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.251928][ T7584] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 300.356080][ T9945] Bluetooth: MGMT ver 1.23 [ 300.361750][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.361780][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 300.365730][ T5764] ums-alauda 7-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 300.365730][ T5764] Please send a copy of this message to and [ 300.474768][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.500399][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.500458][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 300.528131][ T5764] usb 7-1: USB disconnect, device number 9 [ 300.605529][ T7584] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 300.671225][ T5757] usb 10-1: new full-speed USB device number 2 using dummy_hcd [ 300.835684][ T5757] usb 10-1: unable to get BOS descriptor or descriptor too short [ 300.844045][ T5757] usb 10-1: not running at top speed; connect to a high speed hub [ 300.844106][ T5757] usb 10-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 300.865445][ T5757] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 300.865493][ T5757] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 300.881236][ T5757] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.881264][ T5757] usb 10-1: Product: syz [ 300.881283][ T5757] usb 10-1: Manufacturer: syz [ 300.881300][ T5757] usb 10-1: SerialNumber: syz [ 300.959764][ T9952] kexec: Could not allocate control_code_buffer [ 301.200442][ T5757] usb 10-1: 0:1 : does not exist [ 302.167996][ T5757] usb 10-1: USB disconnect, device number 2 [ 302.470028][ T9823] udevd[9823]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 303.547707][ T9997] netlink: 'syz.1.1197': attribute type 83 has an invalid length. [ 303.639720][T10002] netlink: 'syz.7.1199': attribute type 4 has an invalid length. [ 303.648949][T10002] netlink: 17 bytes leftover after parsing attributes in process `syz.7.1199'. [ 303.902859][T10012] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1200'. [ 304.166415][T10014] bridge2: port 1(veth3) entered blocking state [ 304.173288][T10014] bridge2: port 1(veth3) entered disabled state [ 304.180378][T10014] veth3: entered allmulticast mode [ 304.198605][T10014] veth3: entered promiscuous mode [ 304.242599][T10012] bond1: (slave veth0_to_bond): Releasing active interface [ 304.278179][T10012] bridge2: port 2(veth0_to_bond) entered blocking state [ 304.278361][T10012] bridge2: port 2(veth0_to_bond) entered disabled state [ 304.278563][T10012] veth0_to_bond: entered allmulticast mode [ 304.303812][T10012] veth0_to_bond: entered promiscuous mode [ 305.020486][ T5627] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 305.169097][T10047] coredump: 392(syz.7.1212): Core dump to core aborted: cannot preserve file permissions [ 305.221845][ T6352] net_ratelimit: 101 callbacks suppressed [ 305.221909][ T6352] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 305.221937][ T6352] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 305.333308][ T6352] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 305.333378][ T6352] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 305.441862][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 305.450902][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 305.576456][ T6352] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 305.592707][ T6352] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 305.710830][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 305.710886][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 307.038292][T10070] loop6: detected capacity change from 0 to 4096 [ 308.723414][T10074] fuse: fd is not a fuse device [ 308.957110][T10087] futex_wake_op: syz.9.1223 tries to shift op by 144; fix this program [ 310.272757][ T12] net_ratelimit: 66 callbacks suppressed [ 310.272889][ T12] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 310.272986][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 310.382223][ T6352] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 310.382274][ T6352] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 310.505121][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 310.521244][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 310.630829][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 310.630884][ T152] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 310.698252][ T7580] IPVS: starting estimator thread 0... [ 310.753248][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 310.753307][ T152] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 310.782322][T10120] IPVS: using max 25 ests per chain, 60000 per kthread [ 311.421319][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 312.697233][T10136] syz.7.1236 (10136) used greatest stack depth: 18912 bytes left [ 312.818637][T10138] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1238'. [ 313.087473][T10146] netlink: 'syz.9.1241': attribute type 10 has an invalid length. [ 313.087528][T10146] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1241'. [ 313.395098][T10158] FAULT_INJECTION: forcing a failure. [ 313.395098][T10158] name failslab, interval 1, probability 0, space 0, times 0 [ 313.395169][T10158] CPU: 0 UID: 0 PID: 10158 Comm: syz.9.1246 Tainted: G L syzkaller #0 PREEMPT(full) [ 313.395209][T10158] Tainted: [L]=SOFTLOCKUP [ 313.395219][T10158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 313.395235][T10158] Call Trace: [ 313.395245][T10158] [ 313.395257][T10158] dump_stack_lvl+0xe8/0x150 [ 313.395300][T10158] should_fail_ex+0x410/0x560 [ 313.395348][T10158] should_failslab+0xa8/0x100 [ 313.395377][T10158] ? radix_tree_node_alloc+0x82/0x3a0 [ 313.395416][T10158] kmem_cache_alloc_noprof+0xa1/0x600 [ 313.395455][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.395486][T10158] ? look_up_lock_class+0x57/0x110 [ 313.395526][T10158] ? radix_tree_node_alloc+0x82/0x3a0 [ 313.395571][T10158] radix_tree_node_alloc+0x82/0x3a0 [ 313.395617][T10158] idr_get_free+0x28f/0xa10 [ 313.395667][T10158] idr_alloc_u32+0x18a/0x330 [ 313.395715][T10158] ? __pfx_idr_alloc_u32+0x10/0x10 [ 313.395759][T10158] ? net_generic+0x1e/0x240 [ 313.395797][T10158] ? l2tp_session_register+0xd7/0x11a0 [ 313.395836][T10158] l2tp_session_register+0x187/0x11a0 [ 313.395872][T10158] ? __pfx___mutex_lock+0x10/0x10 [ 313.395926][T10158] ? __pfx_l2tp_session_register+0x10/0x10 [ 313.395961][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396003][T10158] pppol2tp_connect+0xda1/0x18b0 [ 313.396043][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396087][T10158] ? __pfx_pppol2tp_connect+0x10/0x10 [ 313.396125][T10158] ? lock_acquire+0x115/0x350 [ 313.396158][T10158] ? __pfx_aa_sk_perm+0x10/0x10 [ 313.396184][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396220][T10158] ? apparmor_socket_connect+0x13e/0x210 [ 313.396266][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396295][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396331][T10158] __sys_connect+0x316/0x450 [ 313.396376][T10158] ? __pfx___sys_connect+0x10/0x10 [ 313.396432][T10158] ? srso_alias_return_thunk+0x5/0xfbef5 [ 313.396462][T10158] ? rcu_is_watching+0x16/0xb0 [ 313.396508][T10158] __x64_sys_connect+0x7a/0x90 [ 313.396550][T10158] do_syscall_64+0x166/0x520 [ 313.396588][T10158] ? trace_irq_disable+0x3b/0x140 [ 313.396613][T10158] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.396646][T10158] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.396673][T10158] RIP: 0033:0x7f643599e159 [ 313.396697][T10158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.396718][T10158] RSP: 002b:00007f6436889028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 313.396746][T10158] RAX: ffffffffffffffda RBX: 00007f6435c25fa0 RCX: 00007f643599e159 [ 313.396766][T10158] RDX: 000000000000002e RSI: 0000200000000000 RDI: 0000000000000005 [ 313.396783][T10158] RBP: 00007f6435a35024 R08: 0000000000000000 R09: 0000000000000000 [ 313.396800][T10158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 313.396815][T10158] R13: 00007f6435c26038 R14: 00007f6435c25fa0 R15: 00007ffcd9e3bd88 [ 313.396856][T10158] [ 315.361216][ T41] net_ratelimit: 34 callbacks suppressed [ 315.361295][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 315.361435][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 315.472351][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 315.472574][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 315.592587][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 315.592643][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 315.703058][ T6352] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 315.704943][ T6352] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 315.736074][T10183] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 315.929831][ T41] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 315.961410][ T41] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 316.129130][T10197] TCP: TCP_TX_DELAY enabled [ 316.423029][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.429622][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.843227][T10202] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1262'. [ 316.956313][T10215] erspan0: entered promiscuous mode [ 316.956516][T10215] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1263'. [ 317.047530][T10212] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1261'. [ 317.587821][T10232] veth1_to_bond: entered allmulticast mode [ 317.588679][T10232] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1270'. [ 318.059044][T10249] jffs2: notice: (10249) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 319.401937][T10277] netlink: 'syz.6.1280': attribute type 1 has an invalid length. [ 319.459255][T10279] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1280'. [ 319.688574][T10279] 8021q: adding VLAN 0 to HW filter on device bond6 [ 319.740204][T10282] bond6: (slave bridge1): making interface the new active one [ 319.749598][T10282] bond6: (slave bridge1): Enslaving as an active interface with an up link [ 319.977808][T10290] netlink: 'syz.6.1284': attribute type 10 has an invalid length. [ 319.979824][T10290] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 320.054118][T10290] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 320.463360][ T59] net_ratelimit: 120 callbacks suppressed [ 320.470450][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 320.478467][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 320.743156][ T7271] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 320.752674][ T7271] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 320.892313][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 320.914995][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 320.962110][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 320.970105][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 321.076741][ T7585] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 321.076913][ T7585] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 321.507240][T10311] tipc: Started in network mode [ 321.507287][T10311] tipc: Node identity 4, cluster identity 4711 [ 321.507302][T10311] tipc: Node number set to 4 [ 321.589024][T10318] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 321.648824][T10322] netlink: 'syz.1.1294': attribute type 6 has an invalid length. [ 321.682228][T10325] syzkaller0: entered promiscuous mode [ 321.682274][T10325] syzkaller0: entered allmulticast mode [ 322.102669][ T7271] wlan1: Trigger new scan to find an IBSS to join [ 323.761697][T10353] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1304'. [ 323.781589][T10353] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1304'. [ 323.875693][T10356] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1304'. [ 324.033008][T10354] bond7: (slave geneve3): Enslaving as an active interface with an up link [ 324.052088][T10356] 8021q: adding VLAN 0 to HW filter on device bond7 [ 324.071721][ T7583] netdevsim netdevsim6 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 324.081760][ T7583] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 324.091133][ T7583] netdevsim netdevsim6 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 324.100114][ T7583] netdevsim netdevsim6 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 324.513924][T10369] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1306'. [ 324.574800][T10368] loop6: detected capacity change from 0 to 512 [ 324.584308][T10368] EXT4-fs: Invalid want_extra_isize 1969 [ 324.933481][T10366] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1306'. [ 325.576567][ T7278] net_ratelimit: 71 callbacks suppressed [ 325.576626][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.576660][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 325.685573][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.685628][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 325.788696][T10392] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1316'. [ 325.801493][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.821007][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.840815][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.869658][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.882924][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.904402][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 325.932730][T10399] bond4: entered promiscuous mode [ 325.932780][T10399] bond4: entered allmulticast mode [ 326.101924][ T159] wlan1: Trigger new scan to find an IBSS to join [ 326.319481][T10409] tipc: Started in network mode [ 326.325849][T10409] tipc: Node identity 4, cluster identity 4711 [ 326.334740][T10409] tipc: Node number set to 4 [ 327.707140][ T7579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.916946][T10435] loop6: detected capacity change from 0 to 512 [ 328.949064][T10435] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 328.990783][T10435] EXT4-fs error (device loop6): ext4_orphan_get:1403: inode #15: comm syz.6.1326: iget: bad i_size value: 38620345925642 [ 328.991031][T10435] loop6: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 329.007107][T10435] EXT4-fs error (device loop6): ext4_orphan_get:1408: comm syz.6.1326: couldn't read orphan inode 15 (err -117) [ 329.007342][T10435] loop6: lost filesystem error report for type 5 error -117 [ 329.010724][ C0] EXT4-fs (loop6): error count since last fsck: 2 [ 329.010746][ C0] EXT4-fs (loop6): initial error at time 1788479762: ext4_orphan_get:1403: inode 15 [ 329.010782][ C0] EXT4-fs (loop6): last error at time 1788479762: ext4_orphan_get:1408 [ 329.034519][T10435] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 330.383724][ T6126] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 331.168709][ T7278] net_ratelimit: 43 callbacks suppressed [ 331.168767][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 331.168799][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 332.898798][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 332.898860][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 333.004682][ T7585] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 333.012849][ T7585] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 333.133058][ T7271] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 333.133112][ T7271] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 333.259875][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 333.259948][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 335.645252][T10497] netlink: 'syz.7.1344': attribute type 3 has an invalid length. [ 335.653228][T10497] netlink: 11575 bytes leftover after parsing attributes in process `syz.7.1344'. [ 335.938966][T10502] loop6: detected capacity change from 0 to 1024 [ 336.034678][T10504] lo speed is unknown, defaulting to 1000 [ 336.035671][T10504] lo speed is unknown, defaulting to 1000 [ 336.629815][ T7585] net_ratelimit: 60 callbacks suppressed [ 336.629875][ T7585] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 336.629915][ T7585] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 336.722119][T10504] lo speed is unknown, defaulting to 1000 [ 336.730535][T10504] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 336.730592][T10504] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 336.730633][T10504] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 336.733795][T10504] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 336.740970][ T7278] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 336.741011][ T7278] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 336.741176][T10504] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 336.779682][T10504] lo speed is unknown, defaulting to 1000 [ 336.850312][T10504] lo speed is unknown, defaulting to 1000 [ 336.852859][ T7579] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 336.852889][ T7579] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 336.870649][T10504] lo speed is unknown, defaulting to 1000 [ 336.872583][T10504] lo speed is unknown, defaulting to 1000 [ 336.874158][T10504] lo speed is unknown, defaulting to 1000 [ 336.875795][T10504] lo speed is unknown, defaulting to 1000 [ 336.877311][T10504] lo speed is unknown, defaulting to 1000 [ 336.878986][T10504] lo speed is unknown, defaulting to 1000 [ 336.997928][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 336.997961][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 337.050882][T10502] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 337.105347][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 337.105408][ T3019] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 339.170142][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 340.473586][ T6126] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 340.507031][T10544] loop9: detected capacity change from 0 to 8 [ 340.770250][T10544] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1355'. [ 341.629691][ T7273] net_ratelimit: 69 callbacks suppressed [ 341.629748][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.650427][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.669934][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.690462][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.709971][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.734276][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.768963][ T3019] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.789611][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.818522][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 341.833568][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 342.350022][ T31] audit: type=1800 audit(1788479775.551:390): pid=10570 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1363" name="syzkaller0" dev="sda1" ino=2055 res=0 errno=0 [ 342.796847][ T31] audit: type=1326 audit(1788479775.991:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.827649][ T31] audit: type=1326 audit(1788479775.991:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.855411][ T31] audit: type=1326 audit(1788479776.022:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=441 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.855501][ T31] audit: type=1326 audit(1788479776.052:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.855554][ T31] audit: type=1326 audit(1788479776.052:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.896942][ T31] audit: type=1326 audit(1788479776.082:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.897499][ T31] audit: type=1326 audit(1788479776.082:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 342.903476][ T31] audit: type=1326 audit(1788479776.082:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10575 comm="syz.8.1365" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8c3479e159 code=0x7ffc0000 [ 343.576202][T10586] geneve1: Caught tx_queue_len zero misconfig [ 343.854139][T10590] bond0: Error: CAN devices cannot be enslaved [ 346.717215][ T7576] net_ratelimit: 133 callbacks suppressed [ 346.717284][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 346.717319][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 346.828363][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 346.828421][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 346.940139][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 346.940196][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 347.056976][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 347.057032][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 347.168870][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 347.168938][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 349.600674][ T7278] IPVS: starting estimator thread 0... [ 349.685059][T10644] IPVS: using max 24 ests per chain, 57600 per kthread [ 350.733127][T10673] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1398'. [ 351.860178][T10245] net_ratelimit: 48 callbacks suppressed [ 351.860238][T10245] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 351.860883][T10245] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 351.966819][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 351.966887][ T6591] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 351.982860][T10682] syz_tun: entered allmulticast mode [ 352.077514][ T7271] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 352.077570][ T7271] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 352.225102][ T7579] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 352.244385][ T13] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 352.244432][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 352.355417][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 353.420670][ T5616] libceph: connect (1)[c::]:6789 error -101 [ 353.420930][ T5616] libceph: mon0 (1)[c::]:6789 connect error [ 353.476471][ T5616] libceph: connect (1)[c::]:6789 error -101 [ 353.476672][ T5616] libceph: mon0 (1)[c::]:6789 connect error [ 353.481929][T10703] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1407'. [ 353.532877][T10696] ceph: No mds server is up or the cluster is laggy [ 353.660299][T10703] tipc: Enabling of bearer rejected, failed to enable media [ 353.736230][ T5616] libceph: connect (1)[c::]:6789 error -101 [ 353.736486][ T5616] libceph: mon0 (1)[c::]:6789 connect error [ 354.349902][ T5615] Bluetooth: hci6: command 0x0406 tx timeout [ 357.373423][ C1] net_ratelimit: 49 callbacks suppressed [ 357.373486][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 357.845622][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 357.869737][ T5800] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 357.986854][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 357.986917][ T5800] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 358.076579][T10741] uprobe: syz.5.1422:10741 failed to unregister, leaking uprobe [ 358.094462][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 358.094495][ T6591] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 358.119517][T10755] loop6: detected capacity change from 0 to 164 [ 358.175747][T10760] fuse: fd is not a fuse device [ 358.288904][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 358.300047][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 358.429528][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 359.118250][T10769] rock: directory entry would overflow storage [ 359.118288][T10769] rock: sig=0x4f50, size=4, remaining=3 [ 359.118329][T10769] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 359.167161][T10771] No such timeout policy "s" [ 359.617222][T10781] binder_alloc: 10779: pid 10779 spamming oneway? 1 buffers allocated for a total size of 4096 [ 361.253349][T10245] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 361.424282][T10823] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1444'. [ 361.546347][T10826] loop9: detected capacity change from 0 to 512 [ 361.575346][T10826] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 361.575413][T10826] EXT4-fs (loop9): feature flags set on rev 0 fs, running e2fsck is recommended [ 361.775455][T10826] EXT4-fs error (device loop9): ext4_orphan_get:1429: comm syz.9.1448: bad orphan inode 13 [ 361.775515][T10826] loop9: lost filesystem error report for type 5 error -117 [ 361.786278][ C1] EXT4-fs (loop9): error count since last fsck: 1 [ 361.786302][ C1] EXT4-fs (loop9): last error at time 1788479794: ext4_orphan_get:1429 [ 361.786844][T10826] ext4_test_bit(bit=12, block=18) = 1 [ 361.786863][T10826] is_bad_inode(inode)=0 [ 361.786874][T10826] NEXT_ORPHAN(inode)=10485760 [ 361.786885][T10826] max_ino=32 [ 361.786895][T10826] i_nlink=1 [ 361.848538][T10826] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0008-000000000000 r/w without journal. Quota mode: writeback. [ 361.900331][T10831] CIFS: Attempting to mount //127.0.0.1/share [ 361.975774][T10835] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1 [ 362.011450][T10836] EXT4-fs warning (device loop9): ext4_update_dynamic_rev:1148: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 362.033000][T10835] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1 [ 362.065350][T10831] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 362.065480][T10831] CIFS: VFS: cifs_mount failed w/return code = -11 [ 362.084985][T10836] EXT4-fs error (device loop9): ext4_validate_block_bitmap:445: comm syz.9.1448: bg 0: block 248: padding at end of block bitmap is not set [ 362.130044][T10836] Quota error (device loop9): write_blk: dquota write failed [ 362.130168][T10836] Quota error (device loop9): qtree_write_dquot: Error -28 occurred while creating quota [ 362.130247][T10836] EXT4-fs error (device loop9): ext4_acquire_dquot:7069: comm syz.9.1448: Failed to acquire dquot type 1 [ 362.390278][ T59] net_ratelimit: 81 callbacks suppressed [ 362.390335][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.412676][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.429525][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.451709][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.469537][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.493476][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.509980][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.528920][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.551627][ T5800] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 362.572410][T10555] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 363.242756][ T9282] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0008-000000000000. [ 364.964599][T10896] netlink: 'syz.8.1462': attribute type 10 has an invalid length. [ 367.316606][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 368.124578][ T7580] net_ratelimit: 60 callbacks suppressed [ 368.124622][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 368.124648][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 368.239921][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 368.251432][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 368.369704][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 368.369822][ T159] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 368.549223][ T6591] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 368.561145][ T6591] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 368.677238][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 368.677288][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 371.694892][T10949] netlink: 'syz.5.1479': attribute type 9 has an invalid length. [ 373.137263][T10913] syz.9.1468 (10913): drop_caches: 2 [ 373.144113][ T7580] net_ratelimit: 36 callbacks suppressed [ 373.144152][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.144185][ T7580] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 373.144701][ T31] audit: type=1800 audit(1788479806.346:399): pid=10935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1474" name="bus" dev="ramfs" ino=34316 res=0 errno=0 [ 373.255569][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.255626][ T7270] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 373.313560][T10960] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1482'. [ 373.379001][ T7580] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.402270][T10555] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.419594][T10555] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.436684][ T7270] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.455619][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.473974][ T159] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 373.520595][T10960] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1482'. [ 373.720095][T10972] netlink: 'syz.6.1483': attribute type 2 has an invalid length. [ 373.897716][T10979] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1487'. [ 373.990104][T10974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 374.021741][T10974] 8021q: adding VLAN 0 to HW filter on device team0 [ 374.105987][T10974] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 374.238578][T10987] loop6: detected capacity change from 0 to 128 [ 374.399266][T10974] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 374.399324][T10974] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 374.502100][T10974] veth1_vlan: left promiscuous mode [ 374.508793][T10974] veth0_vlan: left promiscuous mode [ 374.521665][T10974] veth0_vlan: entered promiscuous mode [ 374.552939][T10974] veth1_vlan: entered promiscuous mode [ 374.592801][T10974] veth1_macvtap: left promiscuous mode [ 374.605708][T10974] veth0_macvtap: left promiscuous mode [ 374.615126][T10974] veth0_macvtap: entered promiscuous mode [ 374.622901][T10974] veth1_macvtap: entered promiscuous mode [ 374.683981][T10974] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 374.707735][T10974] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 374.717529][T10974] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 374.726516][T10974] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 374.738274][T10974] 8021q: adding VLAN 0 to HW filter on device bond1 [ 374.755030][T10974] 8021q: adding VLAN 0 to HW filter on device bond3 [ 374.786743][T10974] 8021q: adding VLAN 0 to HW filter on device bond4 [ 374.797050][ T6126] FAT-fs (loop6): error, corrupted directory (invalid entries) [ 374.806132][ T159] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.830811][ T6126] FAT-fs (loop6): error, corrupted directory (invalid entries) [ 374.842194][ T159] bond3: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 374.870256][ T159] bond3: (slave veth0_to_bond): making interface the new active one [ 374.895080][ T159] bond3: active interface up! [ 374.904838][ T7270] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.906997][ T152] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.907778][ T152] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.932028][ T5764] lo speed is unknown, defaulting to 1000 [ 374.941006][ T5764] syz0: Port: 1 Link ACTIVE [ 374.992528][T10996] fuse: fd is not a fuse device [ 375.220519][T11004] x_tables: duplicate entry at hook 1 [ 375.270632][T10988] netlink: 140 bytes leftover after parsing attributes in process `syz.1.1489'. [ 375.297875][T11007] netlink: 'syz.7.1495': attribute type 4 has an invalid length. [ 375.417622][ T6126] syz_tun (unregistering): left allmulticast mode [ 375.928037][T11019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1498'. [ 375.942323][T11019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1498'. [ 377.325929][T11034] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1503'. [ 377.344280][T11032] key id 00000001 not found [ 377.344967][T11032] key id 00000001 not found [ 377.843880][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.843964][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.077816][T11045] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1507'. [ 378.112951][T11048] netlink: 'syz.1.1507': attribute type 8 has an invalid length. [ 378.112993][T11048] netlink: 11575 bytes leftover after parsing attributes in process `syz.1.1507'. [ 378.180547][ T7273] net_ratelimit: 132 callbacks suppressed [ 378.180604][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 378.203288][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 378.203341][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 378.326849][ T7273] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 378.326897][ T7273] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 378.468108][ T152] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 378.468171][ T152] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 378.572807][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 378.572869][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 378.782345][T10245] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 379.729805][T11063] netlink: 'syz.7.1513': attribute type 4 has an invalid length. [ 379.920853][ T5627] Bluetooth: hci7: command 0x0406 tx timeout [ 383.084307][T11088] netlink: 'syz.7.1521': attribute type 12 has an invalid length. [ 383.275520][ T59] net_ratelimit: 23 callbacks suppressed [ 383.275586][ T59] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 383.275622][ T59] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 383.510235][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 383.518528][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 383.647860][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 383.656509][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 383.772056][ T7271] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 383.781173][ T7271] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 383.903686][ T7576] bond2: (slave ip6gretap1): link status up, enabling it in 0 ms [ 383.926773][ T7576] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 384.693262][T11097] syz_tun: entered allmulticast mode [ 384.709257][T11097] syz_tun: left allmulticast mode [ 387.139001][ T32] INFO: task syz.0.908:9054 blocked for more than 144 seconds. [ 387.139053][ T32] Tainted: G L syzkaller #0 [ 387.139085][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 387.139104][ T32] task:syz.0.908 state:D stack:28808 pid:9054 tgid:9050 ppid:5609 task_flags:0x400040 flags:0x00080002 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 387.139196][ T32] Call Trace: [ 387.139212][ T32] [ 387.139235][ T32] __schedule+0x17db/0x58f0 [ 387.139283][ T32] ? __lock_acquire+0x6df/0x2e50 [ 387.139335][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.139384][ T32] ? __pfx___schedule+0x10/0x10 [ 387.139429][ T32] ? lock_acquire+0x115/0x350 [ 387.139469][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.139511][ T32] ? schedule+0x90/0x2b0 [ 387.139556][ T32] schedule+0x164/0x2b0 [ 387.139601][ T32] cgroup_lock_and_drain_offline+0x51a/0x650 [ 387.139666][ T32] ? __pfx_cgroup_lock_and_drain_offline+0x10/0x10 [ 387.139715][ T32] ? __pfx_autoremove_wake_function+0x10/0x10 [ 387.139758][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.139811][ T32] cgroup_kn_lock_live+0x120/0x230 [ 387.139860][ T32] cgroup_subtree_control_write+0x4b5/0x1080 [ 387.139925][ T32] ? __pfx_cgroup_subtree_control_write+0x10/0x10 [ 387.139973][ T32] ? kernfs_root+0x1c/0x230 [ 387.140017][ T32] ? kernfs_root+0x1c/0x230 [ 387.140063][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.140100][ T32] ? kernfs_root+0x1ea/0x230 [ 387.140147][ T32] ? __pfx_cgroup_subtree_control_write+0x10/0x10 [ 387.140195][ T32] cgroup_file_write+0x331/0x8f0 [ 387.140238][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.140282][ T32] ? __pfx_cgroup_file_write+0x10/0x10 [ 387.140342][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.266941][ T32] ? __kmalloc_noprof+0x38c/0x720 [ 387.266999][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.267038][ T32] ? __pfx_cgroup_file_write+0x10/0x10 [ 387.307309][ T32] kernfs_fop_write_iter+0x3a4/0x540 [ 387.307358][ T32] vfs_write+0x612/0xba0 [ 387.307406][ ** replaying previous printk message ** [ 387.307406][ T32] ? __pfx_vfs_write+0x10/0x10 [ 387.307456][ T32] ? __fget_files+0x2a/0x420 [ 387.307495][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.307531][ T32] ksys_write+0x150/0x270 [ 387.307571][ T32] ? __pfx_ksys_write+0x10/0x10 [ 387.307607][ T32] ? __pfx_kcov_ioctl+0x10/0x10 [ 387.307644][ T32] do_syscall_64+0x166/0x520 [ 387.307682][ T32] ? trace_irq_disable+0x3b/0x140 [ 387.307708][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.307741][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.307767][ T32] RIP: 0033:0x7f60d999e159 [ 387.307791][ T32] RSP: 002b:00007f60da7fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 387.307818][ T32] RAX: ffffffffffffffda RBX: 00007f60d9c26090 RCX: 00007f60d999e159 [ 387.307838][ T32] RDX: 000000000000000b RSI: 0000200000000180 RDI: 0000000000000007 [ 387.307855][ T32] RBP: 00007f60d9a35024 R08: 0000000000000000 R09: 0000000000000000 [ 387.307872][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 387.307888][ T32] R13: 00007f60d9c26128 R14: 00007f60d9c26090 R15: 00007ffcad5ea898 [ 387.307935][ T32] [ 387.307984][ T32] [ 387.307984][ T32] Showing all locks held in the system: [ 387.307997][ T32] locks held by pr/ttyS0/16: 2, last CPU#1: [ 387.308015][ T32] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 387.308085][ T32] #1: ffffffff9ad32098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 387.308160][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 387.308178][ T32] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 387.308246][ T32] locks held by kworker/u8:7/159: 4, last CPU#0: [ 387.308265][ T32] #0: ffff88803196b940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 387.308338][ T32] #1: ffffc90002e47c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 387.308427][ T32] #2: ffff888033d5e1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 [ 387.308503][ T32] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: psi_task_switch+0x57/0x7d0 [ 387.347470][ T32] locks held by getty/5367: 2, on CPU#0: [ 387.347489][ T32] #0: ffff8880318f00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 387.347562][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 387.347627][ T32] locks held by syz-executor/5596: 2, last CPU#0: [ 387.347646][ T32] #0: ffff888025695038 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 387.347718][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 387.347789][ T32] locks held by syz-executor/5612: 1, last CPU#0: [ 387.347807][ T32] #0: ffff8880318242e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 387.347882][ T32] locks held by syz-executor/6969: 1, on CPU#0: [ 387.347900][ T32] #0: ffff8880318242e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 387.347970][ T32] locks held by kworker/u8:16/7273: 2, on CPU#0: [ 387.347988][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 387.348061][ T32] #1: ffffc90003407c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 387.348137][ T32] locks held by syz.2.740/8522: 3, on CPU#1: [ 387.348155][ T32] #0: ffff88807949a7f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 387.348226][ T32] #1: ffff8880326fa460 (sb_writers#35){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 387.348305][ T32] #2: ffffffff8f09e400 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x3b1/0x610 [ 387.348377][ T32] locks held by syz.0.908/9054: 3, on CPU#0: [ 387.348395][ T32] #0: ffff8880775a5eb0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 387.348465][ T32] #1: ffff888035a92460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 387.348543][ T32] #2: ffff88802c72fc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 387.348616][ T32] locks held by syz.7.1478/10946: 3, last CPU#0: [ 387.348634][ T32] #0: ffff888079644460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0x3766/0x4530 [ 387.348707][ T32] #1: ffff888076451078 (&mm->mmap_lock){++++}-{4:4}, at: dump_user_range+0x1c5/0x12c0 [ 387.348773][ T32] #2: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 387.348841][ T32] locks held by udevd/11072: 3, last CPU#0: [ 387.348859][ T32] #0: ffff88807daf7678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 387.348937][ T32] #1: ffff88802ab51070 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0x119/0x720 [ 387.349025][ T32] #2: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 387.349093][ T32] locks held by syz.8.1528/11102: 2, last CPU#0: [ 387.349112][ T32] #0: ffff8880355c03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 387.349182][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 387.349252][ T32] locks held by syz.9.1526/11100: 1, last CPU#0: [ 387.349271][ T32] #0: ffff8880b863bb20 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb2/0x160 [ 387.371743][ T32] locks held by modprobe/11104: 2, last CPU#0: [ 387.371763][ T32] #0: ffff8880764529f8 (&mm->mmap_lock){++++}-{4:4}, at: do_mprotect_pkey+0x25c/0xd10 [ 387.371829][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 387.371897][ T32] locks held by syz.5.1531/11116: 1, last CPU#0: [ 387.371922][ T32] #0: ffff8880355c1078 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x182/0x390 [ 387.371992][ T32] [ 387.371998][ T32] ============================================= [ 387.371998][ T32] [ 387.372010][ T32] NMI backtrace for cpu 0 [ 387.372028][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 387.372060][ T32] Tainted: [L]=SOFTLOCKUP [ 387.372069][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 387.372084][ T32] Call Trace: [ 387.372095][ T32] [ 387.372105][ T32] dump_stack_lvl+0xe8/0x150 [ 387.372144][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 387.372176][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 387.372218][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 387.372253][ T32] sys_info+0x135/0x170 [ 387.372280][ T32] watchdog+0xfd7/0x1030 [ 387.372314][ T32] ? watchdog+0x1c7/0x1030 [ 387.372346][ T32] kthread+0x38b/0x480 [ 387.372372][ T32] ? __pfx_watchdog+0x10/0x10 [ 387.372395][ T32] ? __pfx_kthread+0x10/0x10 [ 387.372422][ T32] ret_from_fork+0x514/0xb70 [ 387.372450][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 387.372489][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.372518][ T32] ? __switch_to+0xc89/0x1420 [ 387.372557][ T32] ? __pfx_kthread+0x10/0x10 [ 387.372584][ T32] ret_from_fork_asm+0x1a/0x30 [ 387.372639][ T32] [ 387.372649][ T32] Sending NMI from CPU 0 to CPUs 1: [ 387.372675][ C1] NMI backtrace for cpu 1 [ 387.372691][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 387.372721][ C1] Tainted: [L]=SOFTLOCKUP [ 387.372729][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 387.372743][ C1] RIP: 0010:check_preemption_disabled+0x1/0xd0 [ 387.372768][ C1] Code: 20 94 6d 8c 48 c7 c6 60 94 6d 8c eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 <41> 57 41 56 53 65 8b 05 4b 1e b0 07 65 48 8b 0d 1b 1e b0 07 85 c9 [ 387.372788][ C1] RSP: 0018:ffffc900001578a8 EFLAGS: 00000097 [ 387.372807][ C1] RAX: 8000000000000002 RBX: 0000000000000993 RCX: ffffffff9a9db503 [ 387.372824][ C1] RDX: 0000000000000001 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420 [ 387.372840][ C1] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004 [ 387.372855][ C1] R10: dffffc0000000000 R11: ffffffff8be2d6c0 R12: 1ffffffff35a646d [ 387.372872][ C1] R13: 00000000ffffffff R14: 000000e222a780a9 R15: 000000000000078f [ 387.372891][ C1] FS: 0000000000000000(0000) GS:ffff888124dd9000(0000) knlGS:0000000000000000 [ 387.372911][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 387.372927][ C1] CR2: 00007f6ae18b9a90 CR3: 0000000033e59000 CR4: 0000000000350ef0 [ 387.372945][ C1] Call Trace: [ 387.372953][ C1] [ 387.372962][ C1] delay_tsc+0x6c/0xd0 [ 387.372990][ C1] wait_for_lsr+0x147/0x2f0 [ 387.373030][ C1] __serial8250_console_fifo_write+0xcd/0x3e0 [ 387.373064][ C1] serial8250_console_write+0xaa1/0x1200 [ 387.373100][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 387.373140][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 387.373174][ C1] ? __schedule+0x17f1/0x58f0 [ 387.373211][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.373243][ C1] nbcon_emit_next_record+0xef5/0x1a90 [ 387.373280][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 387.373312][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.373339][ C1] ? nbcon_context_try_acquire+0x819/0xbd0 [ 387.373376][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.373408][ C1] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 387.373442][ C1] nbcon_kthread_func+0x679/0x880 [ 387.373472][ C1] ? nbcon_kthread_func+0x163/0x880 [ 387.373495][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 387.373520][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.373551][ C1] ? __kthread_parkme+0x71/0x1f0 [ 387.373587][ C1] ? __kthread_parkme+0x199/0x1f0 [ 387.373625][ C1] kthread+0x38b/0x480 [ 387.373647][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 387.373670][ C1] ? __pfx_kthread+0x10/0x10 [ 387.373693][ C1] ret_from_fork+0x514/0xb70 [ 387.373717][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 387.373753][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 387.373781][ C1] ? __switch_to+0xc89/0x1420 [ 387.373815][ C1] ? __pfx_kthread+0x10/0x10 [ 387.373839][ C1] ret_from_fork_asm+0x1a/0x30 [ 387.373887][ C1] [ 387.404245][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 388.365196][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 388.375863][ T32] Tainted: [L]=SOFTLOCKUP [ 388.380169][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 388.390210][ T32] Call Trace: [ 388.393478][ T32] [ 388.396425][ T32] vpanic+0x56d/0xa60 [ 388.400412][ T32] ? __pfx___schedule+0x10/0x10 [ 388.405267][ T32] ? __pfx_vpanic+0x10/0x10 [ 388.409767][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 388.415404][ T32] panic+0xc5/0xd0 [ 388.419124][ T32] ? __pfx_panic+0x10/0x10 [ 388.423536][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 388.428992][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 388.434357][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 388.440545][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 388.446701][ T32] watchdog+0x1030/0x1030 [ 388.451058][ T32] ? watchdog+0x1c7/0x1030 [ 388.455469][ T32] kthread+0x38b/0x480 [ 388.459526][ T32] ? __pfx_watchdog+0x10/0x10 [ 388.464189][ T32] ? __pfx_kthread+0x10/0x10 [ 388.468776][ T32] ret_from_fork+0x514/0xb70 [ 388.473357][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 388.478468][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 388.484092][ T32] ? __switch_to+0xc89/0x1420 [ 388.488768][ T32] ? __pfx_kthread+0x10/0x10 [ 388.493348][ T32] ret_from_fork_asm+0x1a/0x30 [ 388.498127][ T32] [ 388.501340][ T32] Kernel Offset: disabled [ 388.505645][ T32] Rebooting in 86400 seconds..