last executing test programs: 11.575646476s ago: executing program 1 (id=938): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, r1, 0x2799f5eec7981083, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20040080}, 0x80) r2 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'veth0_to_bridge\x00'}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r6, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) listen(r4, 0xc) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r9, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r11, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, 0x0) 11.45655094s ago: executing program 1 (id=941): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prlimit64(0x0, 0x8, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) write$rfkill(r0, &(0x7f0000000080)={0x2020, 0x8, 0x3, 0x5, 0x1}, 0x8) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0xfffffffd, @local}, {0xa, 0x4e22, 0x800, @empty, 0x3d95}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x60) 10.330442538s ago: executing program 1 (id=947): mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) mount$overlay(0x0, 0x0, &(0x7f0000000300), 0x8, &(0x7f00000002c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) epoll_create1(0x0) r3 = syz_open_dev$media(0x0, 0x66, 0x180502) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000002f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x4000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r4 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r4, 0x12d, 0xffffffdc, 0x17, 0x0, 0x0) 9.108041431s ago: executing program 1 (id=952): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) fchown(0xffffffffffffffff, 0x0, 0xee01) mknodat$null(0xffffffffffffff9c, 0x0, 0x1d4e, 0x103) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000380)={@any, 0x3, 0x9, 0xa, 0xd, 0x0, "055b40d19d5869606b1cfe8c8b47814d68a12fb699b7312c537b64dfd7c0386591905843b384848e60e499b766d7aafefa65721decb5a6f3bdb47f132d322796f97a3551ccd2ffefa1900c07aa7ef67689efa1c2d056f5e09aedaed8bc7713aef3bec135388555f3a167b2c62dda27ee0191586ef012d348d418359079752612"}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) sched_setparam(0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'ip6tnl0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018010000202070250000"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) syslog(0x3, &(0x7f0000000000)=""/185, 0x64075da62934d5d1) sched_setscheduler(0x0, 0x6, &(0x7f0000000340)=0x9) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$cgroup_ro(r2, &(0x7f0000000300)='memory.numa_stat\x00', 0x275a, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x7e, 0x20203843, 0x3, [0x2], [0x800]}) mmap(&(0x7f00000fe000/0x3000)=nil, 0x3000, 0x1000002, 0x1010, 0xffffffffffffffff, 0x96a70000) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000180)={0x5, 0xfffffffffffffff8}, 0x0) 7.838863336s ago: executing program 2 (id=960): socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) clock_adjtime(0x0, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r2, 0x5421, 0x0) close(r2) r3 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000600)={{{@in=@broadcast, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x5, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x40000, 0x1000000000004, 0x2, 0xa78a}, 0xfffffffe, 0x0, 0x2, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x0, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3506, 0x4, 0x2, 0x2}}, 0xe8) 7.834573039s ago: executing program 1 (id=961): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x1e, 0x4, 0x0) r5 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r6 = dup3(r5, r4, 0x0) recvmmsg(r6, &(0x7f0000008840), 0x0, 0x40000001, 0x0) r7 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_int(r7, 0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x400c) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000080)=0x3) ioctl$TCFLSH(r8, 0x541b, 0xffefff1f00000000) 7.454707693s ago: executing program 2 (id=963): socket$nl_route(0x10, 0x3, 0x0) mremap(&(0x7f0000a29000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) r1 = add_key(0x0, &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6", 0x258, r1) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xc2ff}) unshare(0x22020400) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x2298, 0x1100, 0x5002004a, 0x0, 0x0, 0x0, 0x2200, 0x3c8, 0x3c8, 0x2200, 0x3c8, 0x3, 0x0, {[{{@uncond, 0x60, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x1, 0x7], 0x6, 0x2}, {0x2, [0x0, 0x6, 0x4, 0x9, 0x0, 0x89ce99baffcf6900], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x1, './cgroup.net/syz1\x00', 0x2, {0x5}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff0000ff], 0x4e22, 0x4c20, 0x4e24, 0x4e23, 0xc9, 0x0, 0x3b, 0x83, 0x25}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x22f8) 7.092373983s ago: executing program 1 (id=964): io_uring_setup(0xf08, &(0x7f0000000040)={0x0, 0xfb6e, 0x2, 0x7, 0xf0}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x804, &(0x7f0000000380)=ANY=[@ANYBLOB="756e695f786c6174653d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c73686f72746e616d653d6d697865642c757466383d302c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c757466383d312c6572726f72733d72656d6f756e742d726f2c636865636b3d7374726963742c73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c696f636861727365743d63703934392c757466383d302c636f6465706167653d3836392c00a8c083848e73321f9801dfbaddc615fa29c04eac3de3814ed0b60507d2eb356434ab8f52dfa5d498ced1d32d399d4bd8a72813cc3ef7026a6449360c807c7b7252b89f0af8422df7ae9a966c845aa03291cd9889c4c7ad6950b1bc19f680ee64eec3b4e734f1094591acb6dc3dd17df828333de719cf03c78268de6080d71f4417b812201d8627ee2322f6c25bce1116a6"], 0xfe, 0x28b, &(0x7f00000008c0)="$eJzs3cFqK2UUAOAzyaRJdJEsXIlwB3Th6nLrE7TIFcSCoGShLvTiTUGaUGghUBXTrnwCn8DncSO+gA+guLMLcWQykzSRSbU1beT2+zY9nP+c+c9khnaVv5+9Nj56fnx6ePH1z9HpJNHYi724TKIfjZg7j1o//VqfBwD+5y7zPH7LS+0ydbZa0VrTmTbufDgA4E4s//3f9iwAwP348KOP39s/OHj6QZZ1IsbfTgZJlD/L9f3D+CJGMYwn0Ys/IvKFMn7n3YOnkWaFfrwxnk4GRef40x+q6+//EjHr341e9Ov7d7PSUv90MmjFS9X+e6MYvv999OKV+v63avpjsBNvvr40/+PoxY+fx3GM4nk127z/m90sezv/7vevPimyRX8ynQzai7q0rG7e+8MBAAAAAAAAAAAAAAAAAAAAAOCF9Thb6K+evzM/+P+a9ZXzgS4XZ/IUpkvn8zzJsixPyvqr/jReTaujdQAAAAAAAAAAAAAAAAAAAOCBOz378ujZaDQ82Wgw/1p/zVL8uZppR8Tt93r0r4pbV5loVqONkoib7dWK9qzzn4ubN7yLbjHP8CRJY3OPIFlkustLj6Lcq8h0y2Ap859378QsmL9dR8+S9Q83nQWdupdkA0Fe8/o1V2saswlnmZ2/t3erO6i5cvea3XdevtXMeW/NUhIRrcWHef11Wpv9DMtNz+/p9xAAAAAAAAAAAAAAAAAAALD8/f+axYstDAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAW3D1//9vEEyr5nU1ebMI0qgyW75FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHoC/AgAA//9iBGi+") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x1, 0x5000003a, r0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000f40)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x10000000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200000d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000000000000030005000000000002000000ac1414aa000000000000000001001500000000000100140000000000010016"], 0x68}, 0x1, 0x7}, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) 5.27275242s ago: executing program 4 (id=970): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8922, &(0x7f0000000080)={'dummy0\x00', @ifru_hwaddr=@local}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/if_inet6\x00') pread64(r3, &(0x7f0000000040)=""/30, 0x1e, 0x800000000040042) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='veth0_virt_wifi\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x804, &(0x7f0000000480)={0x2, 0x4ea2, @multicast1}, 0x10) recvmmsg(r4, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0x40}], 0x1, 0x10160, 0x0) ioprio_set$pid(0x1, r0, 0x2007) 5.128177088s ago: executing program 0 (id=971): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r1 = socket$inet(0x2, 0x3, 0x33) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) removexattr(&(0x7f00000002c0)='./file0/file1\x00', &(0x7f0000000300)=@known='system.posix_acl_access\x00') ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth1_to_batadv\x00', 0x0}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0x10}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x9defcb4}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0xc004) 4.302319743s ago: executing program 4 (id=973): chdir(0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semget$private(0x0, 0x5, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)}}], 0x1, 0x0) socket(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$FICLONE(r6, 0x40049409, 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x10) 3.941464054s ago: executing program 0 (id=974): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x80880) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 3.346182354s ago: executing program 4 (id=975): socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118, 0x0, r5}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r6, &(0x7f00000004c0)={0x0, 0x400042cc, 0x10, 0x1, 0x80, 0x0, r7}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b40, 0x2, 0x4, 0x3aa, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 3.345780175s ago: executing program 3 (id=976): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x4f, &(0x7f0000000040)={&(0x7f00000000c0)=@bridge_dellink={0x2c, 0x13, 0x1, 0x1, 0x0, {0x7, 0x0, 0x0, r4, 0x20004, 0x141}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0x3}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x40000) r5 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_FMT(r5, 0xc0585605, &(0x7f0000000100)={0x1, 0x0, {0x280, 0x1e0, 0x3014, 0x1, 0x8, 0x8, 0x2}}) socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r6, 0x1, 0x1d, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$kcm(0x29, 0x2, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x4005, 0x0, 0x0) setsockopt$inet_pktinfo(r7, 0x0, 0x19, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) r8 = syz_open_dev$video(&(0x7f0000000280), 0x4, 0x2) ioctl$VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000300)={0x1, @pix={0x280, 0x1e0, 0x42474752, 0x1, 0x280, 0x4b000, 0x8}}) ioctl$VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000400)={0x2, 0x1, 0x1}) ioctl$VIDIOC_STREAMON(r8, 0x40045612, &(0x7f0000000600)=0x1) 3.250815918s ago: executing program 3 (id=977): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40080c0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x40, r6, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}]}]}, 0x40}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000040)=@security={'security\x00', 0xe, 0x4, 0x3b0, 0xffffffff, 0x248, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x3a8, 0x3a8, 0x3a8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @local, [0x0, 0xff000000, 0xffffff00], [0xff000000, 0xff000000, 0xff, 0xff000000], 'vlan1\x00', 'veth1_to_batadv\x00', {0xff}, {0xff}, 0x32, 0x5, 0x0, 0xe0}, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0xda, 0x28, "7eed4936aa4d30a2095b240a155fa6367f2f5307ae868132f9cf35b6ae43"}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8, 'syz0\x00', {0x25f}}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast2, [0xffffff00, 0xff000000, 0x7fffffff, 0xffffffff], 0x4e23, 0x4e21, 0x4e20, 0x4e24, 0x9, 0x5, 0x0, 0xfffffff8, 0x8}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x410) r7 = add_key$user(0x0, &(0x7f0000000440), &(0x7f00000006c0), 0x0, 0xfffffffffffffffd) r8 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_SUBMITURB(r8, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x1, 0x1}, 0xfffc, 0x1, 0x0, 0x52, 0xfffffffd, 0x0, 0x0, 0xfffc, 0x1, 0x0}) r9 = add_key$user(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000480)='\n', 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000480)={r9, r7, r7}, 0x0, 0x0, 0x0) io_uring_setup(0xe6e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.861299266s ago: executing program 0 (id=978): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f00000003c0)={{0x6, 0x2}, 0x100, './file2\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = io_uring_setup(0x2f35, &(0x7f0000000000)={0x0, 0x1fca1, 0x2, 0x2, 0x22, 0x0, r2}) io_uring_register$IORING_REGISTER_RING_FDS(r3, 0x13, &(0x7f0000001bc0), 0x2) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'lo\x00'}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x89f1, &(0x7f0000000900)={'ip6gre0\x00', @random="0600002000"}) syz_open_dev$ttys(0xc, 0x2, 0x0) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000240)='./file3\x00', 0x4010, &(0x7f00000001c0), 0x2, 0xbd8, &(0x7f00000083c0)="$eJzs3M1rHOcZAPBnRqu1ZKtduZRS91KVUmwoXUsuMrUp1C4uvfRQaK8FC3llhNYfSCquZB1W7T9Q2p5begk4MQk5xGdfEpJrLol9TcghYIJiJWBCsmH2Q1K8Wkm2dzWO/PvBu/O+887u8zwer2Ze2N0AXlhj2UMacSwiLiYRpdb+NCKKjd5QRK153PrayvTnayvTSdTrf/okiSQiHq6tTLdfK2ltj7QGQxHx7m+T+N4/OuMuLC3PTVWrlfnW+OTilesnF5aWfzF7Zepy5XLl6sTpX02emjw9fmayZ7U++uDcnc9+8vuPal+8/OXtT//9UhLnYqQ1t7WOXhmLsY1/k60KETHV62A5GWjVs7XOpLDLk9I+JwUAQFfplnu4H0QpBmLz5q0Ub76Xa3IAAABAT9QHIuoAAADAAZdY/wMAAMAB1/4cwMO1lel2y/cTCfvrwfmIGG3Wv95qzZlC1BrboRiMiMMPk9j6tdak+bRnNhYRH94/81rWouN7yP+71YMQO6qtRsQPtzv/SaP+0ca3uDvrTyNivAfxxx4b7/f/v2ep/1wP4uddPwAvprvnmxeyzutfunH/E9tc/wrbXLueRt7Xv/b933rH/d9m/QNd7v/+uMcYN2/990a3uaz+X9/53avtlsXPts9U1BN4sBrxo8J29Scb9Sdd6r+4xxilr25Uus3lXX/9/xHHY/v625Kdf5/o5MxstTLefNw2xuo7k690i593/dn5P9yl/vbvP3U7/9f3GOMvFy683rHz/mZ35/rTj4vJnxu9YmvP36YWF+cnIorJHzr3n9ohkdrmMe3XyOo/8dOd3//b1T/QfLnGXLYWWG1ts/HfHwv7m9s33+iWUnv998Tnf3jXI/Ykq/9Sl/O/tf63C53n/597jPGzt/51otvc1vVv1rL47bUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALSlETESSVre6KdpuRxxJCK+H4fT6rWFxZ/PXPvr1UvZXMRoDKYzs9XKeESUmuMkG080+pvjU4+NfxkRRyPiP6Xhxrg8fa16Ke/iAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2HAkIkYiScsRkUbEeilNy+W8swIAAAB6bjTvBAAAAIC+s/4HAACAg8/6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD47+uO795KIqJ0dbrRMsTU3mGtmQL+leScA5GYg7wSA3BTyTgDIzROu8d0uwAGU7DI/1HXmUM9zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD5dfzY3XtJRNTODjdaptiaG8w1M6Df0rwTAHIzsNNkYf/yAPaftzi8uKzxgWSX+aHNY2rfnDnUt5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeP6MNFqSliOi2NpXLkd8JyJGYzCZma1WxiPiuxHxfmnwUDaeyDlnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAem9haXluqlqtzGedNFqdjT3fgk4kzUr6HqsVp5Z/yTo96RTjKZ/+qF6v55183zu5/lkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnC0vLc1PVamV+Ie9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgLwtLC3PTVWrlfk+dvKuEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/HwdAAD///TiCwo=") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xa0242, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) truncate(&(0x7f0000000940)='./file1\x00', 0x200) ioctl$EXT4_IOC_MOVE_EXT(r6, 0x40305829, &(0x7f0000000100)={0x17c04, 0xffffffffffffffff, 0x6, 0x8100000002}) mount$overlay(0x0, 0x0, 0x0, 0x8, 0x0) 2.378305015s ago: executing program 4 (id=979): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, r0, 0x0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0, 0x80000080, 0x1}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r7, 0x5421, &(0x7f0000000100)=0x100000001) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r8, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r8, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000001, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, 0x0, 0x0) write(r8, &(0x7f00000000c0)="8f2a0a65bd", 0x5dc) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000080)={'ah\x00'}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000001180)='maps\x00') ioctl$KDSKBLED(r9, 0xc0686611, 0x20000081) connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) close(r7) 2.294760053s ago: executing program 3 (id=980): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x200000, &(0x7f0000000380), 0x3, 0x589, &(0x7f0000001580)="$eJzs3c1rHOUfAPDvbF76+vs1hVLUgwR6sFK7aRJfKgitR9FiQe91SbahZNMt2U1pYqHtwYJ4kSKIWBD/AO8eizcv+lcUtFCkBD14icxmtt1ks9kk3bqp8/nAtM8zz2yeeeaZ59nv7MyyAeTWaPpPIeLFiPgyiTjUUjYYWeHo6nbLj65PpUsSKysf/ZFEkq1rbp9k/x/IMi9ExE+fRZwotNdbW1yaLVUq5fksP1afuzJWW1w6eWmuNFOeKV+emJw8/cbkxNtvvdmztr56/q9vPrz33ukvji1//cODw3eSOBsHs7LWdjyFm62Z0RjNjslQnF234XgPKttNku1tPvys9oPtGcjG+VCkc8ChGMhGPfDfdyMiVoCcSox/yKlmHNC8tu/RdfBz4+G7qxdA7e0fXP1sJPY2ro32LydrrozS692RHtSf1vHj73fvpEt0+RziRg/qA2i6eSsiTg0Ots9/STb/7dypxofHm1tfR97ef6Cf7qXxz2sbxT+Fx/FPbBD/HNhg7O5E9/FfeNCDajpK4793Nox/H09dIwNZ7n+NmG8ouXipUj4VEf+PiOMxtCfNb3Y/5/Ty/ZVOZa3xX7qk9TdjwWw/HgzuWfua6VK99DRtbvXwVsRLT+LfJNrm/72NWHd9/6fH43ya+OXzrnUcLd99uVNZ9/a36n0EvPJ9xCsb9v+TO1rJ5vcnxxrnw1jzrGj35+2jv3aqf3vt7720//dv3v6RpPV+bW37dXy39+9yp7Kdnv/DyceNdPNG4rVSvT4/HjGcfNC+fuLJa5v55vZp+48f23z+2+j83xcRn2yx/beP3O646W7o/+lt9f/2E/ff//TbTvVvrf9fb6SOZ2u2Mv9tdQef5tgBAAAAAADAblOIiIORFIqP04VCsbj6fMeR2F+oVGv1ExerC5eno/Fd2ZEYKjTvdB9qeR5iPHsetpmfWJefjIjDEfHVwL5GvjhVrUz3u/EAAAAAAAAAAAAAAAAAAACwSxzo8P3/1G8D/d474Jnzk9+QX13Hfy9+6QnYlbz/Q34Z/5Bfxj/kl/EP+WX8Q34Z/5Bfxj/kl/EPAAAAAAAAAAAAAAAAAAAAAAAAAAAAPXX+3Ll0WVl+dH0qzU9fXVyYrV49OV2uzRbnFqaKU9X5K8WZanWmUi5OVee6/b1KtXplfCIWro3Vy7X6WG1x6cJcdeFy/cKludJM+UJ56F9pFQAAAAAAAAAAAAAAAAAAADxfaotLs6VKpTzfj8TPhYj+1b7lxJnYFbux40TSrZfPZCfD2qLhtjVrEpElBp/VzicR0e9Dl+NEnycmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjxTwAAAP///b4wHA==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x381081a, &(0x7f00000001c0)=ANY=[], 0xfc, 0x2de, &(0x7f0000000ac0)="$eJzs3T9rZFUUAPDzZiaTN1pMEBtF8IEWVmGDpU2irCCkEsbGZoObBZkJC1kIuKJxq/0CWi6Cn0KwsrP2GwhaCnbZInLl/cvkbTJh2JCNZH+/Zu/ee8+95907vKnm5M5be9O797N4dPRH5HkWvc3YjKdZrEUvWt/FUQAAN8fTlOKfFBEr9f+zMzNGCyIHvavNDAC4KvX3f0q+zAHg5fHXT+9/s7W9ffvTosjjjfHjg0kWEXuPDyb1+Na9+DJmsRu3YhzHEelE3f74k+3bMShKa/Hu3uHB5KCz/tbfMariN2Ica+fHbxS1Jn4SUf67Eq9EEVv3VtqlxvH6+fG/3DkbH5NhvPfOqfzXYxy/fxH3YxZ3o4ydx3+7URQfpR+Ovv683KaMz3oxWa3mNUYRqf/CLgUAAAAAAAAAAAAAAAAAAAAAgBtvvSiyunxPVb+n7Grq7/SPq/H1orXWrc9Tx5/UC67rA6VoSvQcpnjS1te5VRRFaibO4wfx5iAG1/PUAAAAAAAAAAAAAAAAAAAA8P/y4KuH053ZbHf/+Rt7T+qlpjuzthpA+7P+5115c7cXbc/b8XC601+84Orye52uNlDmeuHkGAziMseydCN+HZX5LJjzY5Nv09Nf/lRX55f7WRPeXswlc847H5vXPjzJsGjmtIc83cnqvRbnnLdDP58eGsbS+WRZp6e629nufqoO6jh17zTvHOZ8aLhoi++z6oO9zLGUVzN89dyhf1NKyz3OB3/Wd9T0ZFWJjeVuZ6VpnPuAZSM/e++/zXuefRUsfGX0L/XCAQAAAAAAAAAAAAAAAAAAFur+cPoZjy4M7V1ZUgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwgs3//n/byCOi23OmcdgEXzSnaQxj/0F3x9F1PCYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA33H8BAAD//7E2Pa8=") mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x111) getdents64(r2, &(0x7f0000002600)=""/4113, 0x1011) 1.946213258s ago: executing program 3 (id=981): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000009c0)=@newtfilter={0x80, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x50, 0x2, [@TCA_BASIC_EMATCHES={0x4c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xc}}, @TCA_EMATCH_TREE_LIST={0x40, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x6}, {0x7, 0x4f, 0x3, 0x2}}}, @TCF_EM_IPT={0x20, 0x2, 0x0, 0x0, {{0x3, 0x9, 0x1000}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x1c64eec146f37431}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x80}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000006c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x60}, 0x1, 0x0, 0x0, 0x8080}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0xc, 0x13, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}]}, 0x44}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) bind$packet(r8, &(0x7f00000004c0)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) 1.894571238s ago: executing program 0 (id=982): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x20a201, 0x0) close(r6) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xf, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x10000000, 0x807fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, 0x0, 0x36}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000640)="442ea407603a16ff", 0x8}], 0x2}, 0x20000085) 1.817739092s ago: executing program 2 (id=963): socket$nl_route(0x10, 0x3, 0x0) mremap(&(0x7f0000a29000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) r1 = add_key(0x0, &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6", 0x258, r1) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xc2ff}) unshare(0x22020400) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x2298, 0x1100, 0x5002004a, 0x0, 0x0, 0x0, 0x2200, 0x3c8, 0x3c8, 0x2200, 0x3c8, 0x3, 0x0, {[{{@uncond, 0x60, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x1, 0x7], 0x6, 0x2}, {0x2, [0x0, 0x6, 0x4, 0x9, 0x0, 0x89ce99baffcf6900], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x1, './cgroup.net/syz1\x00', 0x2, {0x5}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff0000ff], 0x4e22, 0x4c20, 0x4e24, 0x4e23, 0xc9, 0x0, 0x3b, 0x83, 0x25}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x22f8) 1.470843406s ago: executing program 3 (id=983): syz_mount_image$vfat(&(0x7f0000001040), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='iocharset=cp949,utf8=1,nonumtail=0,dos1xfloppy,shortname=mixed,iocharset=cp437,uni_xlate=0,utf8=0,,codepage=932,utf8=0,rodir,utf8=1,rodir,utf8=0,rodir,\x00'], 0x1, 0x2a6, &(0x7f0000001140)="$eJzs3c2KW2UYAOD35D/tIlm4EqEHdOGqdLyCKVJBHBCULNSFFpuCTEIhgUBUjF15BV6BCN6MG/EGvADFnV2IR05OfstJTKQzGfR5Vh/vT7/3+3oms8qZT14ZXj56Mn789MtfotVKonIe5/EsiW5UYunrKPXzb+VxAOCGe5Zl8Xs212oWoel2RX1HZ61y5cMBAFdi4/d/dupZAIDr8f4HH75z/+LiwXtp2ooYfjPpJRGtdf7+4/gsBtGPe9GJPyOylWL91tsXD6KW5rrx2nA26U16EcOPf1z2/xox7z+LTnTL+8/y7u+T2OifTXr1uLXY/3wQ/Xe/i068VN7/RlrY7I9eI15/dWP+u9GJnz6NJzGIR4vZlv1fnaXpm9m3f3zxUR7N+5PZpNdc1S2qq9f2nwIAAAAAAAAAAAAAAAAAAAAAwH/e3XSlu/3+neWL//fk97wfaLbxfp57aZpmSVG/7q/Fy7WonfLsAAAAAAAAAAAAAAAAAAAAcFOMp59fPhwM+qMDFlE5tHj5tf6SVPy1HWlGxCG7N0tTd8qK66X/TjFPVBejDZKII84+Gk/r0Zx3/nNx9ZhbHY2n7Xye/iipxTFd+Ul3X12yirQ3U3ei2CuPtIvFRuTg3X+4Xdzi86lWEVk+XZcPk+hX9t5Yq+wheQGLrOTxq+7sajwfaUf5AfPUnt0bt//VzFlnRyqJiPrqMrdr5j9kt9YPZP3F3mHpx0XjCj6CAAAAAAAAAAAAAAAAAACAhfWXfkuST08wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcwPrv/x+xmC2ad9Vk1XxRi0XkxEcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgf+DvAAAA//+zu1nK") openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x20000000000000, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x1, 0x0) 1.387508241s ago: executing program 4 (id=984): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000080), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000005c0)=@v1={0x0, @aes128, 0x0, @desc1}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x8004587d, &(0x7f0000000040)={@id={0x2, 0x0, @d}}) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setrlimit(0x0, &(0x7f0000000180)={0x259, 0x8}) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa62d6000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0xffff, 0x0) 1.260597166s ago: executing program 0 (id=985): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x40047438, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x20000000, 0x2ba7}) r4 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000180)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0xb1) r6 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, 0x0) prctl$PR_SET_IO_FLUSHER(0x41, 0x2) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) 870.937195ms ago: executing program 2 (id=986): r0 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendto$inet(r0, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) 488.497773ms ago: executing program 3 (id=987): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prlimit64(0x0, 0x8, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0xfffffffd, @local}, {0xa, 0x4e22, 0x800, @empty, 0x3d95}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x60) 443.00971ms ago: executing program 2 (id=988): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x200000, &(0x7f0000000380), 0x3, 0x589, &(0x7f0000001580)="$eJzs3c1rHOUfAPDvbF76+vs1hVLUgwR6sFK7aRJfKgitR9FiQe91SbahZNMt2U1pYqHtwYJ4kSKIWBD/AO8eizcv+lcUtFCkBD14icxmtt1ks9kk3bqp8/nAtM8zz2yeeeaZ59nv7MyyAeTWaPpPIeLFiPgyiTjUUjYYWeHo6nbLj65PpUsSKysf/ZFEkq1rbp9k/x/IMi9ExE+fRZwotNdbW1yaLVUq5fksP1afuzJWW1w6eWmuNFOeKV+emJw8/cbkxNtvvdmztr56/q9vPrz33ukvji1//cODw3eSOBsHs7LWdjyFm62Z0RjNjslQnF234XgPKttNku1tPvys9oPtGcjG+VCkc8ChGMhGPfDfdyMiVoCcSox/yKlmHNC8tu/RdfBz4+G7qxdA7e0fXP1sJPY2ro32LydrrozS692RHtSf1vHj73fvpEt0+RziRg/qA2i6eSsiTg0Ots9/STb/7dypxofHm1tfR97ef6Cf7qXxz2sbxT+Fx/FPbBD/HNhg7O5E9/FfeNCDajpK4793Nox/H09dIwNZ7n+NmG8ouXipUj4VEf+PiOMxtCfNb3Y/5/Ty/ZVOZa3xX7qk9TdjwWw/HgzuWfua6VK99DRtbvXwVsRLT+LfJNrm/72NWHd9/6fH43ya+OXzrnUcLd99uVNZ9/a36n0EvPJ9xCsb9v+TO1rJ5vcnxxrnw1jzrGj35+2jv3aqf3vt7720//dv3v6RpPV+bW37dXy39+9yp7Kdnv/DyceNdPNG4rVSvT4/HjGcfNC+fuLJa5v55vZp+48f23z+2+j83xcRn2yx/beP3O646W7o/+lt9f/2E/ff//TbTvVvrf9fb6SOZ2u2Mv9tdQef5tgBAAAAAADAblOIiIORFIqP04VCsbj6fMeR2F+oVGv1ExerC5eno/Fd2ZEYKjTvdB9qeR5iPHsetpmfWJefjIjDEfHVwL5GvjhVrUz3u/EAAAAAAAAAAAAAAAAAAACwSxzo8P3/1G8D/d474Jnzk9+QX13Hfy9+6QnYlbz/Q34Z/5Bfxj/kl/EP+WX8Q34Z/5Bfxj/kl/EPAAAAAAAAAAAAAAAAAAAAAAAAAAAAPXX+3Ll0WVl+dH0qzU9fXVyYrV49OV2uzRbnFqaKU9X5K8WZanWmUi5OVee6/b1KtXplfCIWro3Vy7X6WG1x6cJcdeFy/cKludJM+UJ56F9pFQAAAAAAAAAAAAAAAAAAADxfaotLs6VKpTzfj8TPhYj+1b7lxJnYFbux40TSrZfPZCfD2qLhtjVrEpElBp/VzicR0e9Dl+NEnycmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjxTwAAAP///b4wHA==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x381081a, &(0x7f00000001c0)=ANY=[], 0xfc, 0x2de, &(0x7f0000000ac0)="$eJzs3T9rZFUUAPDzZiaTN1pMEBtF8IEWVmGDpU2irCCkEsbGZoObBZkJC1kIuKJxq/0CWi6Cn0KwsrP2GwhaCnbZInLl/cvkbTJh2JCNZH+/Zu/ee8+95907vKnm5M5be9O797N4dPRH5HkWvc3YjKdZrEUvWt/FUQAAN8fTlOKfFBEr9f+zMzNGCyIHvavNDAC4KvX3f0q+zAHg5fHXT+9/s7W9ffvTosjjjfHjg0kWEXuPDyb1+Na9+DJmsRu3YhzHEelE3f74k+3bMShKa/Hu3uHB5KCz/tbfMariN2Ica+fHbxS1Jn4SUf67Eq9EEVv3VtqlxvH6+fG/3DkbH5NhvPfOqfzXYxy/fxH3YxZ3o4ydx3+7URQfpR+Ovv683KaMz3oxWa3mNUYRqf/CLgUAAAAAAAAAAAAAAAAAAAAAgBtvvSiyunxPVb+n7Grq7/SPq/H1orXWrc9Tx5/UC67rA6VoSvQcpnjS1te5VRRFaibO4wfx5iAG1/PUAAAAAAAAAAAAAAAAAAAA8P/y4KuH053ZbHf/+Rt7T+qlpjuzthpA+7P+5115c7cXbc/b8XC601+84Orye52uNlDmeuHkGAziMseydCN+HZX5LJjzY5Nv09Nf/lRX55f7WRPeXswlc847H5vXPjzJsGjmtIc83cnqvRbnnLdDP58eGsbS+WRZp6e629nufqoO6jh17zTvHOZ8aLhoi++z6oO9zLGUVzN89dyhf1NKyz3OB3/Wd9T0ZFWJjeVuZ6VpnPuAZSM/e++/zXuefRUsfGX0L/XCAQAAAAAAAAAAAAAAAAAAFur+cPoZjy4M7V1ZUgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwgs3//n/byCOi23OmcdgEXzSnaQxj/0F3x9F1PCYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA33H8BAAD//7E2Pa8=") mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x111) getdents64(r2, &(0x7f0000002600)=""/4113, 0x1011) 295.207542ms ago: executing program 0 (id=989): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x4, 0x55, 0x2, 0x5, 0xa0, @empty, @local, 0x8000, 0x10, 0x800, 0xb506}}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000001040)={0x1a, {"a2e3ad21ed6b52f99cfbf4c087f71e9b230963ff7fc6e5539b9b3b09719b711b5d31101b080d29428f0e1ac6e7049b3468959b189a242a9b45f3988f7ef319520100ffe8d178708c523c921b1b23380a169b63d336cd3b78130daa61d8e81aea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae11a973735b36d5b1b63e91c00305d9be7bd1d020000000000000075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801000000005b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c580263093ca9a34af674f3f39fe23491e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6fa94fc488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b412435111c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269caf12c31357c8219793e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a687974e7b4ab01b7f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fe32d0ad7bc946813591ad8deff4b05f60cea0da3710ac000000001a527777a5371f87d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ef06e288e810bac9c766000a5e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1386abdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f103000000416d59fdee5325928974d12dad99dac44c3f0008047096a44060fb30e900caab415db6578b4779415d97b9a6d601005c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3c901cd34e5c92f76cc4c24eeb8bc4e9ac292d9e53803ed000000009737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ffffff7f000000007f889b09114edb8e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca405d8c5f64fdb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb67ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe529003d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb40800000077d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e5e2c664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85e654fb39ddff3b484439d9921b379a3aca07f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd84e935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba30b4279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53dc10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227edff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fa6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b30f0b932a4d02da711b757fe43c06d21e759595e4e98b27faea8aa12bc8040000000000000033eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d0000010000000000fcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d080e8a96d5308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed704887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6ff7ffb1d62458d0741a12830052fcc460db043afe525629b40d7cee65802cb5e930ed624806c43a006dc9336d07c2b8081c188d26558f48261f7897084c2a1a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c0ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf475bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264c7b34252600c9654e502dcea39cb0800ebdf7f2e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc640df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c02b5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadbb25c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa7082ead01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058093fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d060000008926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000, '\x00', r0, 0x0, 0x0, 0xfffffffd}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setpriority(0x1, 0x0, 0xffffffffffffffcd) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r6, 0x8943, &(0x7f00000000c0)={'ipvlan0\x00', @ifru_hwaddr=@local}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/mtdblock0\x00', 0x42, 0x1ff) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/mtdblock0\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x110000) 294.694096ms ago: executing program 4 (id=990): r0 = socket(0x80000000000000a, 0x2, 0x0) sendto$inet(r0, &(0x7f0000000500)="60adc079f26bd0289f712134ac63255a75c2c9a3064f0a82e70c4b00a31669b2e16f6c3cda2bebd09b0c8fdcd1f09481469c80a0ef23250b164963f821ec024b101f44fd6d20761e", 0x48, 0x4000010, &(0x7f0000000580)={0x2, 0x4e20, @remote}, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-generic\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f00000003c0)=[{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000000e80)="fc", 0x1}], 0x1, 0x0, 0x0, 0x804}], 0x1, 0x4048091) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000480), &(0x7f00000004c0)=0x8) syz_clone(0x41000000, &(0x7f0000000840)="62e0dc3a8b7a526caaa18784514b63ee0bee0979836a74aac4371851fd4fa54adf5008f71b6ba6f874c6f94d82fe57a524c3e83bca45f90ac349404400a990f56c8e722c6353e505b70eaa07c8c03034586a56115c7ee57e0a2902998f754aa9ac3ce5420c50da0809de836f7e6dd3a43741029bc308e89a65c339e962ba94570e7de0e4ba2f02e399ad9731b9b93b723a8be5d8763c6ca15a2e28035bd3aefb23d5dbc3cee4f589ba4ef54557b475cebd7a5300f2a87e5bf9938283f63ebbb8d8eb1c3c8ad01febe6dd280fa5f78ff7bfc67d0b099b4e5fe99f25a57f61ac9213483bf1431367c5870d8c97a0377065a7a04760a080", 0xf6, &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)) sendmmsg$alg(r2, 0x0, 0x0, 0x20040894) socket$alg(0x26, 0x5, 0x0) accept4$alg(r0, 0x0, 0x0, 0x80800) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, 0x0, &(0x7f0000000440)) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}, 0x10) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000000}}}, 0x108) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0/bus/pci/devices/0000:00:00.0\x00', 0x0, 0x0) r4 = openat(r3, &(0x7f0000000200)='driver_override\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='8250_pericom\n', 0xd) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/bus/pci/drivers/8250_pericom\x00', 0x0, 0x0) r6 = openat(r5, &(0x7f0000000500)='bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000600)='0000:00:00.0\n', 0xd) r7 = openat(r5, &(0x7f0000000700)='new_id\x00', 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x8801) write(r7, &(0x7f0000000800)='8086 29', 0x7) 0s ago: executing program 2 (id=991): r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0xad82, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x84c18000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x48010) semctl$SETALL(0x0, 0x0, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000003c0)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x3, 0xcbf, 0x2e, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x20, 0x8, 0x101, 0x7}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl2\x00', r5, 0x29, 0x84, 0x4, 0x4038a0b, 0x11, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2={0xff, 0x5}, 0x20, 0x0, 0x0, 0x4}}) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') faccessat2(r6, &(0x7f0000000040)='\x00', 0x1, 0x1300) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)='127.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,mountport=2049,proto=tcp,mountproto=tcp,nolock,timeo=10,retrans=1\x00'}]}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x20000, 0x0) socket$kcm(0x29, 0x7, 0x0) kernel console output (not intermixed with test programs): 0-0000-0000-000000000000. [ 48.317438][ T5369] loop3: detected capacity change from 0 to 256 [ 48.321982][ T5369] vfat: Deprecated parameter 'posix' [ 48.322026][ T5369] FAT-fs: "posix" option is obsolete, not supported now [ 48.795944][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 48.808901][ T4710] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.838555][ T5375] loop2: detected capacity change from 0 to 512 [ 48.839167][ T5375] EXT4-fs: Ignoring removed nobh option [ 48.851506][ T5375] EXT4-fs (loop2): Test dummy encryption mode enabled [ 48.851523][ T5375] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 48.885340][ T5375] EXT4-fs (loop2): 1 truncate cleaned up [ 48.888153][ T5375] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.902643][ T5378] loop1: detected capacity change from 0 to 512 [ 48.903808][ T5378] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 48.904584][ T5378] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8842e11c, mo2=0102] [ 48.904662][ T5378] EXT4-fs (loop1): orphan cleanup on readonly fs [ 48.905405][ T5378] EXT4-fs error (device loop1): ext4_clear_blocks:876: inode #11: comm syz.1.124: attempt to clear invalid blocks 1024 len 1 [ 48.905426][ T5378] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 48.905744][ T5378] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.124: bg 0: block 361: padding at end of block bitmap is not set [ 48.905758][ T5378] loop1: lost filesystem error report for type 5 error -117 [ 48.905888][ T5378] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 48.905897][ T5378] loop1: lost filesystem error report for type 5 error -117 [ 48.906069][ T5378] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.124: invalid indirect mapped block 1811939328 (level 0) [ 48.906082][ T5378] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 48.906707][ T5378] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.124: invalid indirect mapped block 2185560079 (level 1) [ 48.906726][ T5378] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 48.907172][ T5378] EXT4-fs (loop1): 1 truncate cleaned up [ 48.907628][ T5378] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 49.186124][ T5384] EXT4-fs warning (device loop1): dx_probe:861: inode #2: comm syz.1.124: dx entry: limit 0 != root limit 125 [ 49.186257][ T5384] EXT4-fs warning (device loop1): dx_probe:934: inode #2: comm syz.1.124: Corrupt directory, running e2fsck is recommended [ 49.212374][ T5381] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2863: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 49.264392][ T5386] loop0: detected capacity change from 0 to 128 [ 49.264918][ T5386] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 50.006951][ T4710] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 50.013626][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.021789][ T5394] syzkaller0: entered promiscuous mode [ 50.021802][ T5394] syzkaller0: entered allmulticast mode [ 50.117596][ T5396] netlink: 40 bytes leftover after parsing attributes in process `syz.1.128'. [ 51.354328][ T5413] loop2: detected capacity change from 0 to 512 [ 51.602494][ T5413] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.133: corrupted in-inode xattr: invalid ea_ino [ 51.602517][ T5413] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 51.605972][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 51.605998][ C0] EXT4-fs (loop2): initial error at time 50: ext4_iget_extra_inode:5210: inode 15 [ 51.606018][ C0] EXT4-fs (loop2): last error at time 50: ext4_iget_extra_inode:5210: inode 15 [ 51.613971][ T5413] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.133: couldn't read orphan inode 15 (err -117) [ 51.613996][ T5413] loop2: lost filesystem error report for type 5 error -117 [ 51.614567][ T5413] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.178108][ T5434] netlink: 20 bytes leftover after parsing attributes in process `syz.4.137'. [ 52.180717][ T5434] bond0: (slave bond_slave_0): Releasing backup interface [ 52.270834][ T5434] bond_slave_0: entered promiscuous mode [ 52.271225][ T5434] bond_slave_0: entered allmulticast mode [ 52.557889][ T5451] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 52.559156][ T5451] loop4: detected capacity change from 0 to 128 [ 52.584602][ T5451] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 53.550798][ T5457] loop0: detected capacity change from 0 to 1024 [ 53.556658][ T4709] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 53.646136][ T5457] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.651643][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.861630][ T5463] Injecting memory failure for pfn 0x1205fd at process virtual address 0x20000000 [ 53.868073][ T5463] Memory failure: 0x1205fd: Sending SIGBUS to syz.3.139:5463 due to hardware memory corruption [ 53.868143][ T5463] Memory failure: 0x1205fd: recovery action for dirty LRU page: Recovered [ 53.868155][ T5463] Injecting memory failure for pfn 0x11d878 at process virtual address 0x20001000 [ 53.868215][ T5463] Memory failure: 0x11d878: Sending SIGBUS to syz.3.139:5463 due to hardware memory corruption [ 53.868233][ T5463] Memory failure: 0x11d878: dirty LRU page still referenced by 1024 users [ 53.868241][ T5463] Memory failure: 0x11d878: recovery action for dirty LRU page: Failed [ 54.683211][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.786462][ T5487] loop3: detected capacity change from 0 to 8 [ 55.020990][ T5491] process 'syz.0.144' launched './file0' with NULL argv: empty string added [ 56.361348][ T5514] loop4: detected capacity change from 0 to 1024 [ 56.374673][ T5514] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 56.390737][ T5514] bridge_slave_0: left allmulticast mode [ 56.390754][ T5514] bridge_slave_0: left promiscuous mode [ 56.390846][ T5514] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.393435][ T5514] bridge_slave_1: left allmulticast mode [ 56.393451][ T5514] bridge_slave_1: left promiscuous mode [ 56.393512][ T5514] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.412632][ T5514] bond0: (slave bond_slave_1): Releasing backup interface [ 56.430735][ T5514] team0: Port device team_slave_0 removed [ 56.665297][ T5514] team0: Port device team_slave_1 removed [ 56.665651][ T5514] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 56.665662][ T5514] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 56.667998][ T5514] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.668010][ T5514] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 56.669127][ T5514] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 57.873329][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 58.480174][ T5536] loop4: detected capacity change from 0 to 256 [ 58.877124][ T5553] loop3: detected capacity change from 0 to 512 [ 58.879560][ T5553] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 58.883024][ T5553] EXT4-fs (loop3): 1 truncate cleaned up [ 58.884221][ T5553] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.233809][ T5559] EXT4-fs error (device loop3): ext4_generic_delete_entry:2675: inode #2: block 13: comm syz.3.162: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 59.234077][ T5559] EXT4-fs (loop3): Remounting filesystem read-only [ 59.234099][ T5559] EXT4-fs warning (device loop3): ext4_rename_delete:3741: inode #2: comm syz.3.162: Deleting old file: nlink 4, error=-117 [ 59.436819][ T5563] loop1: detected capacity change from 0 to 128 [ 59.464416][ T5563] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 59.464926][ T5566] loop4: detected capacity change from 0 to 2048 [ 59.484710][ T5566] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.513354][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.538765][ T4710] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 59.604828][ T5576] netlink: 'syz.1.176': attribute type 1 has an invalid length. [ 59.617821][ T5576] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 59.946608][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.611347][ T5596] loop4: detected capacity change from 0 to 4096 [ 60.681071][ T5596] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 60.723879][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.892043][ T5606] loop4: detected capacity change from 0 to 512 [ 60.898284][ T5606] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 60.899642][ T5608] netlink: 'syz.1.173': attribute type 1 has an invalid length. [ 60.909604][ T5606] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8842e11c, mo2=0102] [ 60.909696][ T5606] EXT4-fs (loop4): orphan cleanup on readonly fs [ 60.910749][ T5606] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #11: comm syz.4.172: attempt to clear invalid blocks 1024 len 1 [ 60.910775][ T5606] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 60.911308][ T5606] EXT4-fs error (device loop4): ext4_validate_block_bitmap:445: comm syz.4.172: bg 0: block 361: padding at end of block bitmap is not set [ 60.911328][ T5606] loop4: lost filesystem error report for type 5 error -117 [ 60.912493][ C1] EXT4-fs (loop4): error count since last fsck: 2 [ 60.912506][ C1] EXT4-fs (loop4): initial error at time 59: ext4_clear_blocks:876: inode 11 [ 60.912526][ C1] EXT4-fs (loop4): last error at time 59: ext4_validate_block_bitmap:445 [ 60.929610][ T5612] tipc: Started in network mode [ 60.929632][ T5612] tipc: Node identity ac14140f, cluster identity 4711 [ 60.929746][ T5612] tipc: New replicast peer: 255.255.255.255 [ 60.930712][ T5612] tipc: Enabled bearer , priority 10 [ 60.937861][ T5606] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 60.937878][ T5606] loop4: lost filesystem error report for type 5 error -117 [ 60.938195][ T5606] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.172: invalid indirect mapped block 1811939328 (level 0) [ 60.938211][ T5606] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 60.938364][ T5606] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.172: invalid indirect mapped block 2185560079 (level 1) [ 60.938383][ T5606] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 60.938804][ T5606] EXT4-fs (loop4): 1 truncate cleaned up [ 60.939242][ T5606] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 60.941146][ T5612] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 60.941146][ T5612] Please contact the netfilter-devel mailing list or update your nftables rules. [ 60.992852][ T5608] netlink: 28 bytes leftover after parsing attributes in process `syz.1.173'. [ 60.994529][ T5608] 8021q: adding VLAN 0 to HW filter on device bond2 [ 61.048302][ T5615] FAULT_INJECTION: forcing a failure. [ 61.048302][ T5615] name failslab, interval 1, probability 0, space 0, times 0 [ 61.048321][ T5615] CPU: 1 UID: 0 PID: 5615 Comm: syz.1.175 Not tainted syzkaller #0 PREEMPT [ 61.048332][ T5615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 61.048337][ T5615] Call trace: [ 61.048340][ T5615] show_stack+0x2c/0x3c (C) [ 61.048361][ T5615] __dump_stack+0x30/0x40 [ 61.048375][ T5615] dump_stack_lvl+0xd8/0x12c [ 61.048387][ T5615] dump_stack+0x1c/0x28 [ 61.048398][ T5615] should_fail_ex+0x418/0x58c [ 61.048412][ T5615] should_failslab+0xc4/0x120 [ 61.048425][ T5615] kmem_cache_alloc_noprof+0x94/0x5d4 [ 61.048438][ T5615] inet_bind2_bucket_create+0x3c/0x84 [ 61.048451][ T5615] inet_csk_get_port+0xac4/0x1318 [ 61.048462][ T5615] __inet_bind+0x4c8/0x95c [ 61.048471][ T5615] inet_bind_sk+0x124/0x1f0 [ 61.048479][ T5615] inet_bind+0x54/0x68 [ 61.048487][ T5615] __sys_bind+0x1c4/0x268 [ 61.048497][ T5615] __arm64_sys_bind+0x84/0x9c [ 61.048506][ T5615] invoke_syscall+0x98/0x244 [ 61.048518][ T5615] el0_svc_common+0xec/0x23c [ 61.048529][ T5615] do_el0_svc+0x4c/0x5c [ 61.048541][ T5615] el0_svc+0x60/0x1d8 [ 61.048552][ T5615] el0t_64_sync_handler+0x44/0x104 [ 61.048562][ T5615] el0t_64_sync+0x198/0x19c [ 61.142783][ T5617] EXT4-fs warning (device loop4): dx_probe:861: inode #2: comm syz.4.172: dx entry: limit 0 != root limit 125 [ 61.142855][ T5617] EXT4-fs warning (device loop4): dx_probe:934: inode #2: comm syz.4.172: Corrupt directory, running e2fsck is recommended [ 61.387289][ T5622] netlink: 'syz.1.179': attribute type 1 has an invalid length. [ 61.727575][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 61.771553][ T5630] loop4: detected capacity change from 0 to 512 [ 61.783384][ T5630] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.182: corrupted in-inode xattr: invalid ea_ino [ 61.783410][ T5630] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 61.783548][ T5630] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.182: couldn't read orphan inode 15 (err -117) [ 61.783562][ T5630] loop4: lost filesystem error report for type 5 error -117 [ 61.786022][ T5630] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.802116][ T5625] loop1: detected capacity change from 0 to 2048 [ 61.887207][ T5625] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.909006][ T5637] syzkaller0: entered promiscuous mode [ 61.909022][ T5637] syzkaller0: entered allmulticast mode [ 61.922243][ T12] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 61.923735][ T12] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 61.923756][ T12] EXT4-fs (loop1): This should not happen!! Data will be lost [ 61.923756][ T12] [ 61.923766][ T12] EXT4-fs (loop1): Total free blocks count 0 [ 61.923773][ T12] EXT4-fs (loop1): Free/Dirty block details [ 61.923794][ T12] EXT4-fs (loop1): free_blocks=66060288 [ 61.923814][ T12] EXT4-fs (loop1): dirty_blocks=32 [ 61.923821][ T12] EXT4-fs (loop1): Block reservation details [ 61.923827][ T12] EXT4-fs (loop1): i_reserved_data_blocks=2 [ 61.924422][ T12] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 61.924614][ T5625] EXT4-fs warning (device loop1): ext4_evict_inode:196: inode #15: comm syz.1.180: data will be lost [ 62.170758][ T4892] tipc: Node number set to 2886997007 [ 62.263977][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.263993][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264000][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264007][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264013][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264019][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264024][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264030][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264035][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264041][ T5646] tc action pedit unable to extract header offset for header type (0x5) [ 62.264055][ T5646] 0: reclassify loop, rule prio 0, protocol 800 [ 62.295756][ T5648] capability: warning: `syz.2.188' uses 32-bit capabilities (legacy support in use) [ 63.396941][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.486259][ T5659] netlink: 'syz.1.191': attribute type 1 has an invalid length. [ 63.832295][ T5669] netlink: 'syz.3.193': attribute type 27 has an invalid length. [ 63.832313][ T5669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.193'. [ 63.911196][ T5659] bond4: (slave gretap1): Enslaving as a backup interface with an up link [ 64.028520][ T5669] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 64.626351][ T5688] Zero length message leads to an empty skb [ 64.804160][ T5685] loop2: detected capacity change from 0 to 4096 [ 64.812793][ T5685] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.875205][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.319131][ T5699] loop0: detected capacity change from 0 to 2048 [ 65.396292][ T5699] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 65.638841][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.367355][ T5727] loop0: detected capacity change from 0 to 256 [ 66.444111][ T5730] batman_adv: batadv0: Adding interface: dummy0 [ 66.444125][ T5730] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.444140][ T5730] batman_adv: batadv0: Interface activated: dummy0 [ 66.452273][ T5730] batadv0: mtu less than device minimum [ 66.454210][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.455959][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.457613][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.459269][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.460935][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.462623][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.464271][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.465925][ T5730] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.615299][ T1592] ieee802154 phy0 wpan0: encryption failed: -22 [ 66.615336][ T1592] ieee802154 phy1 wpan1: encryption failed: -22 [ 66.635827][ T10] cfg80211: failed to load regulatory.db [ 66.958794][ T5739] Bluetooth: MGMT ver 1.23 [ 67.079612][ T5746] loop0: detected capacity change from 0 to 512 [ 67.084687][ T5746] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 67.084734][ T5746] System zones: 1-12 [ 67.105702][ T5746] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.212: missing EA_INODE flag [ 67.105716][ T5746] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 67.105889][ T5746] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.212: error while reading EA inode 12 err=-117 [ 67.105905][ T5746] loop0: lost filesystem error report for type 5 error -117 [ 67.106019][ T5746] EXT4-fs (loop0): 1 orphan inode deleted [ 67.176949][ T5750] MPI: mpi too large (32264 bits) [ 67.263255][ T5746] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.226322][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.580851][ T5770] netlink: 4 bytes leftover after parsing attributes in process `syz.3.214'. [ 68.580874][ T5770] net_ratelimit: 11 callbacks suppressed [ 68.580881][ T5770] openvswitch: netlink: nsh attr 14691 is out of range max 3 [ 69.098608][ T5792] Config c/1 of g_uac2 needs at least one function. [ 69.098711][ T5792] udc usbip-vudc.0: failed to start g_uac2: -22 [ 69.098723][ T5792] configfs-gadget.g_uac2 gadget.1: probe with driver configfs-gadget.g_uac2 failed with error -22 [ 69.102909][ T5792] UDC core: g_uac2: couldn't find an available UDC or it's busy [ 69.208812][ T5801] netlink: 'syz.4.221': attribute type 1 has an invalid length. [ 69.238999][ T5801] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 69.301574][ T5808] netlink: 28 bytes leftover after parsing attributes in process `syz.4.221'. [ 69.302370][ T12] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 69.308703][ T5808] 8021q: adding VLAN 0 to HW filter on device bond1 [ 69.420407][ T3405] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 69.471644][ T5811] null_blk: disk my_zoned_dev created [ 69.936425][ T5817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.226'. [ 70.167902][ T5825] xt_cgroup: invalid path, errno=-2 [ 70.437635][ T5827] loop4: detected capacity change from 0 to 1024 [ 70.438041][ T5827] EXT4-fs: Ignoring removed oldalloc option [ 70.438059][ T5827] EXT4-fs: Ignoring removed bh option [ 70.451957][ T5829] loop0: detected capacity change from 0 to 2048 [ 70.462400][ T5827] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 70.469248][ T5829] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.365786][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 71.398821][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.663891][ T5877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.236'. [ 72.667638][ T5877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.236'. [ 72.668738][ T5877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.236'. [ 72.670404][ T5877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.236'. [ 75.830424][ T5951] No such timeout policy "syz1" [ 75.952598][ T5953] netlink: 4 bytes leftover after parsing attributes in process `syz.1.257'. [ 75.957889][ T5953] netlink: 4 bytes leftover after parsing attributes in process `syz.1.257'. [ 76.218158][ T5957] loop4: detected capacity change from 0 to 2048 [ 76.244507][ T5957] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 76.367813][ T5962] loop0: detected capacity change from 0 to 128 [ 76.581133][ T5962] FAT-fs (loop0): data area starts beyond volume (414 > 128) [ 76.581161][ T5962] FAT-fs (loop0): Can't find a valid FAT filesystem [ 76.615450][ T5967] loop2: detected capacity change from 0 to 512 [ 76.621773][ T5967] EXT4-fs: Mount option(s) incompatible with ext2 [ 76.638182][ T5965] Soft offlining pfn 0x2193cf at process virtual address 0x20000000 [ 76.638197][ T5965] Soft offline: 0x2193cf: page already poisoned [ 76.638241][ T5965] Soft offlining pfn 0x1353e2 at process virtual address 0x20001000 [ 76.667300][ T5965] Soft offlining pfn 0x2193cf at process virtual address 0x20002000 [ 76.667316][ T5965] Soft offline: 0x2193cf: page already poisoned [ 76.667331][ T5965] Soft offlining pfn 0x2193cf at process virtual address 0x20003000 [ 76.667337][ T5965] Soft offline: 0x2193cf: page already poisoned [ 76.672772][ T5965] syzkaller0: entered promiscuous mode [ 76.672785][ T5965] syzkaller0: entered allmulticast mode [ 77.117359][ T5978] loop0: detected capacity change from 0 to 128 [ 77.846748][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.863359][ T5984] loop2: detected capacity change from 0 to 2048 [ 77.945601][ T5984] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.998029][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.419501][ T6000] loop0: detected capacity change from 0 to 4096 [ 78.460101][ T6000] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.483750][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.861743][ T6016] netlink: 'syz.0.275': attribute type 1 has an invalid length. [ 78.876224][ T6016] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 78.883756][ T6016] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 79.190198][ T6023] ip6gretap2: entered allmulticast mode [ 79.191759][ T6023] batman_adv: batadv0: Adding interface: ip6gretap2 [ 79.191769][ T6023] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.192034][ T6023] batman_adv: batadv0: Interface activated: ip6gretap2 [ 79.210566][ T6028] loop0: detected capacity change from 0 to 256 [ 79.592593][ T6028] netlink: 112 bytes leftover after parsing attributes in process `syz.0.279'. [ 79.649370][ T6048] loop0: detected capacity change from 0 to 1024 [ 79.653231][ T6048] EXT4-fs: Ignoring removed oldalloc option [ 79.653243][ T6048] EXT4-fs: Ignoring removed orlov option [ 79.681508][ T6048] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.722284][ T6054] netlink: 'syz.2.285': attribute type 1 has an invalid length. [ 79.765535][ T6054] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 79.769844][ T6054] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 79.774913][ T6054] netlink: 28 bytes leftover after parsing attributes in process `syz.2.285'. [ 79.775434][ T5306] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 79.776998][ T6054] 8021q: adding VLAN 0 to HW filter on device bond1 [ 79.889542][ T12] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 80.034291][ T6058] loop2: detected capacity change from 0 to 4096 [ 80.052160][ T6058] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.122408][ T4715] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.310422][ T6074] netlink: 'syz.1.290': attribute type 1 has an invalid length. [ 80.652988][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 80.707240][ T6083] loop0: detected capacity change from 0 to 512 [ 80.708488][ T6086] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 80.720960][ T6083] EXT4-fs warning (device loop0): dx_probe:801: inode #2: comm syz.0.292: Unrecognised inode hash code 255 [ 80.720985][ T6083] EXT4-fs warning (device loop0): dx_probe:934: inode #2: comm syz.0.292: Corrupt directory, running e2fsck is recommended [ 80.731127][ T6086] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4223: comm syz.3.294: Allocating blocks 41-42 which overlap fs metadata [ 80.731146][ T6086] loop3: lost filesystem error report for type 5 error -117 [ 80.733965][ T6086] EXT4-fs (loop3): Remounting filesystem read-only [ 80.734028][ T6086] Quota error (device loop3): write_blk: dquota write failed [ 80.734037][ T6086] Quota error (device loop3): find_free_dqentry: Can't write quota data block 5 [ 80.734113][ T6086] Quota error (device loop3): write_blk: dquota write failed [ 80.734146][ T6086] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 80.734205][ T6086] EXT4-fs (loop3): 1 truncate cleaned up [ 80.738109][ T6083] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 80.738172][ T6083] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.292: corrupted in-inode xattr: invalid ea_ino [ 80.738189][ T6083] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 80.738514][ T6083] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.292: couldn't read orphan inode 15 (err -117) [ 80.738532][ T6083] loop0: lost filesystem error report for type 5 error -117 [ 80.763290][ T6086] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.819258][ T6083] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.082859][ T6096] EXT4-fs warning (device loop0): dx_probe:801: inode #2: comm syz.0.292: Unrecognised inode hash code 255 [ 81.083938][ T6096] EXT4-fs warning (device loop0): dx_probe:934: inode #2: comm syz.0.292: Corrupt directory, running e2fsck is recommended [ 81.084621][ T6096] EXT4-fs error (device loop0): ext4_readdir:280: inode #2: block 4: comm syz.0.292: path /63/file0: bad entry in directory: directory entry overrun - offset=512, inode=4294967295, rec_len=1024, size=1024 fake=0 [ 81.599172][ T6103] Illegal XDP return value 4294967283 on prog (id 15) dev N/A, expect packet loss! [ 81.643929][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.674442][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.710909][ T6108] set_capacity_and_notify: 1 callbacks suppressed [ 81.710926][ T6108] loop0: detected capacity change from 0 to 4096 [ 81.720417][ T6108] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.783178][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.844704][ T6123] netlink: 'syz.0.305': attribute type 1 has an invalid length. [ 84.475197][ T6180] netlink: 'syz.0.321': attribute type 1 has an invalid length. [ 85.481028][ T6207] netlink: 'syz.3.328': attribute type 1 has an invalid length. [ 85.782981][ T6207] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 85.843217][ T6220] loop0: detected capacity change from 0 to 2048 [ 85.874942][ T6220] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.887531][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.912037][ T6225] netlink: 'syz.0.333': attribute type 1 has an invalid length. [ 86.515867][ T6243] loop2: detected capacity change from 0 to 1024 [ 86.517602][ T6243] EXT4-fs: Ignoring removed nomblk_io_submit option [ 87.122036][ T6243] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 87.154450][ T6253] netlink: 'syz.1.339': attribute type 30 has an invalid length. [ 87.154464][ T6253] netlink: 8 bytes leftover after parsing attributes in process `syz.1.339'. [ 87.154479][ T6253] bond0: option arp_missed_max: invalid value (0) [ 87.154488][ T6253] bond0: option arp_missed_max: allowed values 1 - 255 [ 87.285060][ T6261] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 87.328833][ T6267] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 88.393273][ T6289] netlink: 'syz.2.351': attribute type 1 has an invalid length. [ 88.767602][ T6306] netlink: 'syz.1.357': attribute type 1 has an invalid length. [ 88.777870][ T6306] netlink: 28 bytes leftover after parsing attributes in process `syz.1.357'. [ 88.779225][ T6306] 8021q: adding VLAN 0 to HW filter on device bond6 [ 88.803569][ T6313] xt_cgroup: invalid path, errno=-2 [ 88.884714][ T6315] overlayfs: failed to clone upperpath [ 90.195530][ T6342] loop0: detected capacity change from 0 to 2048 [ 90.231231][ T6342] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.584247][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 90.650314][ T6352] netlink: 'syz.0.369': attribute type 1 has an invalid length. [ 90.680254][ T6352] netlink: 28 bytes leftover after parsing attributes in process `syz.0.369'. [ 90.682765][ T6352] 8021q: adding VLAN 0 to HW filter on device bond5 [ 90.781732][ T50] Bluetooth: hci2: ACL packet for unknown connection handle 0 [ 90.786792][ T6357] loop0: detected capacity change from 0 to 512 [ 90.791869][ T6357] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 90.803529][ T6357] EXT4-fs (loop0): 1 truncate cleaned up [ 90.804144][ T6357] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.832003][ T6360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.372'. [ 90.832088][ T6360] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 90.832102][ T6360] batadv0: mtu less than device minimum [ 90.833972][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.835861][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.837511][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.839144][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.840778][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.842409][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.844043][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.845677][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.847332][ T6360] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.969327][ T6360] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.129348][ T50] Bluetooth: hci4: command tx timeout [ 92.478633][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.062509][ T6395] netlink: 'syz.2.383': attribute type 1 has an invalid length. [ 93.077631][ T6398] loop0: detected capacity change from 0 to 512 [ 93.081253][ T6398] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 93.081291][ T6398] System zones: 1-12 [ 93.085091][ T6398] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.384: missing EA_INODE flag [ 93.085111][ T6398] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 93.085264][ T6398] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.384: error while reading EA inode 12 err=-117 [ 93.085278][ T6398] loop0: lost filesystem error report for type 5 error -117 [ 93.085426][ T6395] netlink: 28 bytes leftover after parsing attributes in process `syz.2.383'. [ 93.085604][ T6398] EXT4-fs (loop0): 1 orphan inode deleted [ 93.088039][ T6395] 8021q: adding VLAN 0 to HW filter on device bond3 [ 93.294726][ T6398] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 94.796758][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.957350][ T6437] loop3: detected capacity change from 0 to 1024 [ 95.958168][ T6437] EXT4-fs: Ignoring removed oldalloc option [ 95.958181][ T6437] EXT4-fs: Ignoring removed orlov option [ 96.519431][ T6437] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 96.731517][ T6454] EXT4-fs error (device loop3): ext4_validate_block_bitmap:445: comm syz.3.392: bg 0: block 112: padding at end of block bitmap is not set [ 96.736163][ T6454] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 18 with error 28 [ 96.736215][ T6454] EXT4-fs (loop3): This should not happen!! Data will be lost [ 96.736215][ T6454] [ 96.736245][ T6454] EXT4-fs (loop3): Total free blocks count 0 [ 96.736275][ T6454] EXT4-fs (loop3): Free/Dirty block details [ 96.736305][ T6454] EXT4-fs (loop3): free_blocks=0 [ 96.736335][ T6454] EXT4-fs (loop3): dirty_blocks=32 [ 96.736364][ T6454] EXT4-fs (loop3): Block reservation details [ 96.736392][ T6454] EXT4-fs (loop3): i_reserved_data_blocks=2 [ 97.867468][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 98.404961][ T6491] loop0: detected capacity change from 0 to 1024 [ 98.555745][ T6493] loop3: detected capacity change from 0 to 128 [ 98.556210][ T6493] ext2: Unknown parameter 'euid' [ 99.367210][ T6506] netlink: 'syz.2.410': attribute type 10 has an invalid length. [ 99.377241][ T6506] team0: Device vxcan1 is of different type [ 100.384898][ T6526] No such timeout policy "syz1" [ 102.326992][ T6567] 9p: Bad value for 'wfdno' [ 102.998718][ T6590] loop0: detected capacity change from 0 to 256 [ 103.935440][ T6600] warning: `syz.1.447' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 104.363202][ T6613] loop0: detected capacity change from 0 to 256 [ 105.879309][ T6636] loop0: detected capacity change from 0 to 512 [ 105.970033][ T6636] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 106.050540][ T6643] loop3: detected capacity change from 0 to 256 [ 106.050960][ T6643] vfat: Unknown parameter 'u' [ 107.037418][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 108.533838][ T6681] loop0: detected capacity change from 0 to 256 [ 108.731721][ T6684] loop3: detected capacity change from 0 to 128 [ 108.740468][ T6684] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 109.832249][ T4719] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 109.861336][ T6710] loop3: detected capacity change from 0 to 2048 [ 109.933101][ T6710] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 110.939477][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.253289][ T6740] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 111.253742][ T6739] xt_CT: You must specify a L4 protocol and not use inversions on it [ 114.290522][ T6789] 8021q: adding VLAN 0 to HW filter on device bond2 [ 114.302159][ T6789] netlink: 8 bytes leftover after parsing attributes in process `syz.4.483'. [ 114.302173][ T6789] netlink: 4 bytes leftover after parsing attributes in process `syz.4.483'. [ 114.306411][ T6789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.307875][ T6789] bond2: (slave bond0): making interface the new active one [ 114.308439][ T6789] bond2: (slave bond0): Enslaving as an active interface with an up link [ 114.321457][ T6789] netlink: 'syz.4.483': attribute type 4 has an invalid length. [ 114.321472][ T6789] netlink: 152 bytes leftover after parsing attributes in process `syz.4.483'. [ 114.322432][ T6789] .`: renamed from bond0 (while UP) [ 114.421028][ T6797] overlayfs: failed to clone upperpath [ 114.492082][ T6798] atomic_op 000000004cef1e2c conn xmit_atomic 0000000000000000 [ 114.506844][ T6800] loop3: detected capacity change from 0 to 512 [ 114.534812][ T6800] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 114.586479][ T6802] loop0: detected capacity change from 0 to 8192 [ 114.589507][ T6800] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:487: comm syz.3.487: Invalid block bitmap block 0 in block_group 0 [ 114.589525][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.590170][ T6800] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 114.590188][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.590664][ T6800] EXT4-fs error (device loop3): ext4_clear_blocks:876: inode #11: comm syz.3.487: attempt to clear invalid blocks 983261 len 1 [ 114.590687][ T6800] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 114.591309][ T6800] EXT4-fs error (device loop3): __ext4_get_inode_loc:4916: comm syz.3.487: Invalid inode table block 0 in block_group 0 [ 114.591332][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.592334][ C0] EXT4-fs (loop3): error count since last fsck: 4 [ 114.592372][ C0] EXT4-fs (loop3): initial error at time 108: ext4_read_block_bitmap_nowait:487 [ 114.592390][ C0] EXT4-fs (loop3): last error at time 108: __ext4_get_inode_loc:4916 [ 114.605397][ T6802] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 114.618147][ T6800] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 114.618166][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.622099][ T6800] EXT4-fs error (device loop3) in ext4_orphan_del:304: Corrupt filesystem [ 114.622119][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.622737][ T6800] EXT4-fs error (device loop3): __ext4_get_inode_loc:4916: comm syz.3.487: Invalid inode table block 0 in block_group 0 [ 114.622761][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.622944][ T6800] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 114.622954][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.623071][ T6800] EXT4-fs error (device loop3): ext4_truncate:4721: inode #11: comm syz.3.487: mark_inode_dirty error [ 114.623082][ T6800] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 114.623196][ T6800] EXT4-fs error (device loop3) in ext4_process_orphan:346: Corrupt filesystem [ 114.623204][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.623315][ T6800] EXT4-fs error (device loop3): __ext4_get_inode_loc:4916: comm syz.3.487: Invalid inode table block 0 in block_group 0 [ 114.623326][ T6800] loop3: lost filesystem error report for type 5 error -117 [ 114.623459][ T6800] EXT4-fs (loop3): 1 truncate cleaned up [ 114.654512][ T6800] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.034834][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.045777][ T6813] netlink: 'syz.2.490': attribute type 1 has an invalid length. [ 115.109592][ T6817] netlink: 28 bytes leftover after parsing attributes in process `syz.2.492'. [ 115.669902][ T6833] tipc: Enabled bearer , priority 0 [ 116.860680][ T6837] loop0: detected capacity change from 0 to 256 [ 117.312323][ T6851] loop0: detected capacity change from 0 to 1024 [ 117.328099][ T6851] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 117.850766][ T6865] netlink: 'syz.3.503': attribute type 1 has an invalid length. [ 118.160877][ T6872] atomic_op 000000007eda6a00 conn xmit_atomic 0000000000000000 [ 118.254587][ T4714] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.340845][ T50] Bluetooth: Wrong link type (-57) [ 120.363308][ T6914] netlink: 42 bytes leftover after parsing attributes in process `syz.2.516'. [ 120.834578][ T6925] fuse: Bad value for 'fd' [ 120.969587][ T6928] loop3: detected capacity change from 0 to 128 [ 121.143986][ T1248] IPVS: starting estimator thread 0... [ 121.220993][ T6928] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 121.537805][ T6931] IPVS: using max 64 ests per chain, 153600 per kthread [ 121.861292][ T4719] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 121.960713][ T6946] syzkaller0: entered promiscuous mode [ 121.960733][ T6946] syzkaller0: entered allmulticast mode [ 122.196363][ T6948] overlayfs: failed to clone upperpath [ 122.414695][ T6954] binder: BC_ACQUIRE_RESULT not supported [ 122.414760][ T6954] binder: 6951:6954 ioctl c0306201 20000300 returned -22 [ 122.416252][ T6954] netlink: 20 bytes leftover after parsing attributes in process `syz.0.526'. [ 122.835197][ T6957] netlink: 'syz.2.527': attribute type 1 has an invalid length. [ 123.011830][ T6966] xt_cgroup: invalid path, errno=-2 [ 123.224423][ T6967] tipc: Enabling of bearer rejected, failed to enable media [ 123.239540][ T6972] loop0: detected capacity change from 0 to 256 [ 123.248892][ T6970] syzkaller0: entered promiscuous mode [ 123.248907][ T6970] syzkaller0: entered allmulticast mode [ 123.259226][ T6970] tipc: Started in network mode [ 123.259247][ T6970] tipc: Node identity ca6a4dd8306, cluster identity 4711 [ 123.259345][ T6970] tipc: Enabled bearer , priority 0 [ 123.270083][ T6970] tipc: Resetting bearer [ 123.285972][ T6969] tipc: Resetting bearer [ 123.292283][ T6969] tipc: Disabling bearer [ 125.132879][ T7033] netlink: 1319 bytes leftover after parsing attributes in process `syz.1.545'. [ 125.644986][ T7041] xt_cgroup: invalid path, errno=-2 [ 126.748359][ T7062] fuse: Bad value for 'fd' [ 126.815356][ T7074] loop3: detected capacity change from 0 to 1024 [ 126.819557][ T7074] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 126.819577][ T7074] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (42152!=20869) [ 126.819621][ T7074] EXT4-fs (loop3): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 126.821849][ T7074] EXT4-fs error (device loop3): ext4_get_journal_inode:5927: inode #5: comm syz.3.556: unexpected bad inode w/o EXT4_IGET_BAD [ 126.821873][ T7074] loop3: lost file I/O error report for ino 5 type 5 pos 0x0 len 0x0 error -117 [ 126.822087][ T7074] EXT4-fs (loop3): no journal found [ 126.822095][ T7074] EXT4-fs (loop3): can't get journal size [ 126.827525][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 126.827543][ C0] EXT4-fs (loop3): initial error at time 120: ext4_get_journal_inode:5927: inode 5 [ 126.827565][ C0] EXT4-fs (loop3): last error at time 120: ext4_get_journal_inode:5927: inode 5 [ 126.869686][ T7074] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 127.105931][ T7080] xt_cgroup: invalid path, errno=-2 [ 127.752189][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.350561][ T7099] netlink: 'syz.1.563': attribute type 4 has an invalid length. [ 128.665790][ T7109] xt_cgroup: invalid path, errno=-2 [ 130.010686][ T7136] netlink: 4 bytes leftover after parsing attributes in process `syz.0.572'. [ 130.341323][ T7145] xt_cgroup: invalid path, errno=-2 [ 130.769071][ T7159] netlink: 'syz.2.579': attribute type 33 has an invalid length. [ 130.769087][ T7159] netlink: 8 bytes leftover after parsing attributes in process `syz.2.579'. [ 130.769101][ T7159] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 130.776542][ T7161] netlink: 'syz.4.577': attribute type 4 has an invalid length. [ 132.214137][ T7191] 9p: Bad value for 'rfdno' [ 133.316216][ T1592] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.316251][ T1592] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.511006][ T7216] xt_cgroup: invalid path, errno=-2 [ 134.058734][ T7220] loop3: detected capacity change from 0 to 512 [ 134.060717][ T7220] EXT4-fs (loop3): Test dummy encryption mode enabled [ 134.130241][ T7220] EXT4-fs error (device loop3): ext4_orphan_get:1403: inode #15: comm syz.3.595: inode has both inline data and extents flags [ 134.130267][ T7220] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 134.130690][ T7220] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.595: couldn't read orphan inode 15 (err -117) [ 134.130712][ T7220] loop3: lost filesystem error report for type 5 error -117 [ 134.132181][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 134.132198][ C0] EXT4-fs (loop3): initial error at time 126: ext4_orphan_get:1403: inode 15 [ 134.132216][ C0] EXT4-fs (loop3): last error at time 126: ext4_orphan_get:1408 [ 134.132722][ T7220] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 134.159191][ T7220] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-ce" [ 134.182874][ T7228] netlink: 'syz.1.594': attribute type 4 has an invalid length. [ 135.971788][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.118293][ T7264] loop3: detected capacity change from 0 to 1024 [ 136.372572][ T7264] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 136.456602][ T7274] netlink: 'syz.0.607': attribute type 1 has an invalid length. [ 136.458179][ T7274] netlink: 28 bytes leftover after parsing attributes in process `syz.0.607'. [ 136.788805][ T7281] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0 [ 136.795791][ T7272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.606'. [ 136.982739][ T7285] xt_cgroup: invalid path, errno=-2 [ 137.228357][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.395048][ T7315] loop3: detected capacity change from 0 to 1024 [ 138.404573][ T7315] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 139.278801][ T7336] atomic_op 0000000050e52170 conn xmit_atomic 0000000000000000 [ 139.611116][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.888642][ T7343] xt_hashlimit: size too large, truncated to 1048576 [ 139.888729][ T7343] xt_hashlimit: max too large, truncated to 1048576 [ 140.638090][ T7352] loop0: detected capacity change from 0 to 512 [ 140.681299][ T7352] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.626: bg 0: block 385: padding at end of block bitmap is not set [ 140.681320][ T7352] loop0: lost filesystem error report for type 5 error -117 [ 140.681777][ T7352] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 140.681799][ T7352] loop0: lost filesystem error report for type 5 error -117 [ 140.682339][ T7352] EXT4-fs (loop0): 2 truncates cleaned up [ 140.682825][ T7352] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 141.285917][ T7352] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.460924][ T7399] xt_cgroup: invalid path, errno=-2 [ 143.081415][ T7410] netlink: 28 bytes leftover after parsing attributes in process `syz.3.639'. [ 143.088990][ T7409] netlink: 'syz.0.640': attribute type 24 has an invalid length. [ 143.089005][ T7409] netlink: 8 bytes leftover after parsing attributes in process `syz.0.640'. [ 143.089018][ T7409] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 143.197852][ T7419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.198054][ T7419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.491670][ T7460] netlink: 28 bytes leftover after parsing attributes in process `syz.0.652'. [ 145.539675][ T7464] loop3: detected capacity change from 0 to 4096 [ 145.571205][ T7464] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.613083][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.682255][ T7468] xt_cgroup: invalid path, errno=-2 [ 146.220998][ T7479] netlink: 'syz.4.657': attribute type 4 has an invalid length. [ 146.473993][ T7487] netlink: 72 bytes leftover after parsing attributes in process `syz.0.661'. [ 147.058214][ T3405] IPVS: starting estimator thread 0... [ 147.151296][ T7496] IPVS: using max 56 ests per chain, 134400 per kthread [ 147.371926][ T7493] bond7: entered allmulticast mode [ 147.372380][ T7493] 8021q: adding VLAN 0 to HW filter on device bond7 [ 147.438094][ T7493] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 147.440304][ T7493] macvlan2: entered allmulticast mode [ 147.440316][ T7493] bond0: entered allmulticast mode [ 147.440323][ T7493] bond_slave_0: entered allmulticast mode [ 147.440333][ T7493] bond_slave_1: entered allmulticast mode [ 147.440405][ T7493] bond_slave_0: entered promiscuous mode [ 147.440417][ T7493] bond_slave_1: entered promiscuous mode [ 147.450734][ T7493] bond7: (slave macvlan2): Enslaving as a backup interface with an up link [ 147.451322][ T7506] netlink: 'syz.0.666': attribute type 1 has an invalid length. [ 147.458841][ T7506] netlink: 28 bytes leftover after parsing attributes in process `syz.0.666'. [ 147.459190][ T7506] 8021q: adding VLAN 0 to HW filter on device bond6 [ 147.555378][ T7512] netlink: 'syz.3.664': attribute type 8 has an invalid length. [ 147.736922][ T7497] ip6gretap2: entered allmulticast mode [ 147.737191][ T7497] bond7: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 147.755057][ T7497] netlink: 14 bytes leftover after parsing attributes in process `syz.1.663'. [ 147.759584][ T7497] bond_slave_0: left promiscuous mode [ 147.759611][ T7497] bond_slave_1: left promiscuous mode [ 147.841372][ T7497] bond0 (unregistering): left allmulticast mode [ 147.841389][ T7497] bond_slave_0: left allmulticast mode [ 147.841401][ T7497] bond_slave_1: left allmulticast mode [ 147.847407][ T7497] bond7: (slave macvlan2): Removing an active aggregator [ 147.847421][ T7497] net_ratelimit: 10 callbacks suppressed [ 147.847427][ T7497] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 147.847573][ T7497] bond7: (slave macvlan2): Releasing backup interface [ 147.847581][ T7497] bond7: (slave macvlan2): the permanent HWaddr of slave - ba:37:3b:f2:52:19 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 148.254972][ T5306] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 148.411624][ T7497] macvlan2 (unregistering): left allmulticast mode [ 148.798885][ T7497] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 148.818894][ T7497] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 148.861876][ T7497] bond0 (unregistering): Released all slaves [ 150.702729][ T7561] syzkaller0: entered promiscuous mode [ 150.702747][ T7561] syzkaller0: entered allmulticast mode [ 150.834853][ T50] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 150.835098][ T50] Bluetooth: hci2: Injecting HCI hardware error event [ 150.836500][ T50] Bluetooth: hci2: hardware error 0x00 [ 151.747204][ T7582] netlink: 'syz.1.685': attribute type 1 has an invalid length. [ 151.858919][ T7589] netlink: 20 bytes leftover after parsing attributes in process `syz.0.694'. [ 153.440541][ T50] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 154.833152][ T7633] loop3: detected capacity change from 0 to 1024 [ 154.856080][ T7633] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 155.907162][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 155.911107][ T7658] netlink: 'syz.2.708': attribute type 4 has an invalid length. [ 156.022279][ T7665] vlan2: entered allmulticast mode [ 156.022532][ T7665] bond0: entered allmulticast mode [ 156.022562][ T7665] bond_slave_0: entered allmulticast mode [ 156.022604][ T7665] bond_slave_1: entered allmulticast mode [ 156.613250][ T7679] netlink: 4 bytes leftover after parsing attributes in process `syz.1.713'. [ 157.209054][ T7693] loop3: detected capacity change from 0 to 256 [ 157.597683][ T4718] Bluetooth: hci1: command 0x0406 tx timeout [ 157.597716][ T4718] Bluetooth: hci4: command 0x0406 tx timeout [ 157.959330][ T30] audit: type=1326 audit(148.629:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86b79368 code=0x7ffc0000 [ 157.959367][ T30] audit: type=1326 audit(148.629:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=167 compat=0 ip=0xffff86b79368 code=0x7ffc0000 [ 157.959385][ T30] audit: type=1326 audit(148.629:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86b79368 code=0x7ffc0000 [ 157.959401][ T30] audit: type=1326 audit(148.629:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffff86b5c22c code=0x7ffc0000 [ 157.959417][ T30] audit: type=1326 audit(148.629:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86b79368 code=0x7ffc0000 [ 157.959431][ T30] audit: type=1326 audit(148.629:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffff86b7b358 code=0x7ffc0000 [ 157.959446][ T30] audit: type=1326 audit(148.629:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=206 compat=0 ip=0xffff86b5c22c code=0x7ffc0000 [ 157.959461][ T30] audit: type=1326 audit(148.629:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=207 compat=0 ip=0xffff86b5c22c code=0x7ffc0000 [ 157.959477][ T30] audit: type=1326 audit(148.629:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=222 compat=0 ip=0xffff86b79060 code=0x7ffc0000 [ 157.959491][ T30] audit: type=1326 audit(148.629:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7703 comm="syz.2.720" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffff86b7910c code=0x7ffc0000 [ 159.859671][ T7738] fuse: Bad value for 'fd' [ 160.399933][ T7749] tipc: Enabled bearer , priority 10 [ 161.526746][ T5019] tipc: Node number set to 113967442 [ 161.639113][ T7768] 8021q: VLANs not supported on tunl0 [ 161.993138][ T7776] loop3: detected capacity change from 0 to 1024 [ 162.004727][ T7776] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 162.936507][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.948595][ T7805] netlink: 'syz.2.746': attribute type 10 has an invalid length. [ 162.960910][ T7805] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 162.963066][ T7805] team0: Port device netdevsim1 added [ 163.120162][ T7812] netlink: 'syz.2.748': attribute type 1 has an invalid length. [ 163.141752][ T7812] netlink: 28 bytes leftover after parsing attributes in process `syz.2.748'. [ 163.981459][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 163.981474][ T30] audit: type=1326 audit(154.192:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7819 comm="syz.0.750" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffa4379368 code=0x0 [ 165.934438][ T7864] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 166.886142][ T7867] loop3: detected capacity change from 0 to 256 [ 166.911224][ T7867] FAT-fs (loop3): Directory bread(block 1285) failed [ 166.911247][ T7867] FAT-fs (loop3): Directory bread(block 1286) failed [ 166.911260][ T7867] FAT-fs (loop3): Directory bread(block 1287) failed [ 166.911298][ T7867] FAT-fs (loop3): Directory bread(block 1288) failed [ 166.918033][ T7867] FAT-fs (loop3): Directory bread(block 1285) failed [ 166.918054][ T7867] FAT-fs (loop3): Directory bread(block 1286) failed [ 166.918069][ T7867] FAT-fs (loop3): Directory bread(block 1287) failed [ 166.918084][ T7867] FAT-fs (loop3): Directory bread(block 1288) failed [ 167.198984][ T7877] netlink: 32 bytes leftover after parsing attributes in process `syz.2.762'. [ 167.199007][ T7877] netlink: 20 bytes leftover after parsing attributes in process `syz.2.762'. [ 168.521169][ T7891] overlayfs: missing 'lowerdir' [ 172.456778][ T7945] netlink: 'syz.1.780': attribute type 10 has an invalid length. [ 172.576713][ T7945] team0: Port device dummy0 added [ 173.161722][ T7961] loop3: detected capacity change from 0 to 512 [ 173.178353][ T7961] EXT4-fs (loop3): couldn't mount as ext3 due to feature incompatibilities [ 173.369494][ T7969] netlink: 12 bytes leftover after parsing attributes in process `syz.4.788'. [ 173.550163][ T7961] loop3: detected capacity change from 0 to 1024 [ 173.550940][ T7961] EXT4-fs: Mount option(s) incompatible with ext3 [ 173.566515][ T7962] overlayfs: failed to clone upperpath [ 174.500286][ T7983] 8021q: adding VLAN 0 to HW filter on device .` [ 174.688018][ T1248] bond1: (slave ip6gretap1): link status up again after 0 ms [ 174.688040][ T1248] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 174.818295][ T1248] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 174.941131][ T3405] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.328694][ T64] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.446693][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.607371][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.718087][ T1248] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.837477][ T1248] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 175.847154][ T8016] loop3: detected capacity change from 0 to 256 [ 175.956633][ T8020] 9pnet_virtio: no channels available for device 127.0.0.1 [ 175.964247][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 179.983876][ T8078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.986585][ T8078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.222647][ T1248] net_ratelimit: 15 callbacks suppressed [ 180.223191][ T1248] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 180.334702][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 180.635346][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 180.789027][ T64] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 180.934776][ T6027] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.095161][ T53] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.335915][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.450687][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.695555][ T53] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.808458][ T5306] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 181.916232][ T8102] netlink: 16 bytes leftover after parsing attributes in process `syz.0.821'. [ 182.235915][ T30] audit: type=1326 audit(171.198:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8103 comm="syz.2.822" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff86b79368 code=0x0 [ 182.428026][ T4710] tipc: Resetting bearer [ 182.439219][ T4710] tipc: Disabling bearer [ 182.593092][ T4717] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 182.595529][ T4717] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 182.595978][ T4717] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 182.596767][ T4717] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 182.597261][ T4717] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 182.618045][ T5306] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.687465][ T5306] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.723473][ T4717] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 182.724849][ T4717] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 182.725271][ T4717] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 182.726481][ T4717] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 182.726758][ T4717] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 182.790653][ T5306] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.844901][ T8111] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.845263][ T8111] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.845324][ T8111] bridge_slave_0: entered allmulticast mode [ 182.845867][ T8111] bridge_slave_0: entered promiscuous mode [ 182.853406][ T8111] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.853459][ T8111] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.853511][ T8111] bridge_slave_1: entered allmulticast mode [ 182.854063][ T8111] bridge_slave_1: entered promiscuous mode [ 182.882363][ T5306] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.888873][ T8111] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 182.889897][ T8111] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.899959][ T8111] team0: Port device team_slave_0 added [ 182.900693][ T8111] team0: Port device team_slave_1 added [ 182.932567][ T8111] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 182.932576][ T8111] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 182.932590][ T8111] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 182.933324][ T8111] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 182.933331][ T8111] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 182.933342][ T8111] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 183.027501][ T8111] hsr_slave_0: entered promiscuous mode [ 183.027861][ T8111] hsr_slave_1: entered promiscuous mode [ 183.028064][ T8111] debugfs: 'hsr0' already exists in 'hsr' [ 183.028075][ T8111] Cannot create hsr debugfs directory [ 183.075412][ T8122] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.077266][ T8122] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.077332][ T8122] bridge_slave_0: entered allmulticast mode [ 183.077991][ T8122] bridge_slave_0: entered promiscuous mode [ 183.349364][ T8122] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.349440][ T8122] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.349597][ T8122] bridge_slave_1: entered allmulticast mode [ 183.350036][ T8122] bridge_slave_1: entered promiscuous mode [ 183.384541][ T8122] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 183.388399][ T8122] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 183.421258][ T8149] loop3: detected capacity change from 0 to 8 [ 183.438187][ T5306] batman_adv: batadv0: Interface deactivated: ip6gretap2 [ 183.509250][ T5306] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 183.509457][ T5306] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 183.515514][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 183.516560][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 183.516912][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 183.517613][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 183.517861][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 183.561924][ T5306] batman_adv: batadv0: Removing interface: ip6gretap2 [ 183.594757][ T5306] bond2 (unregistering): (slave .`): Releasing backup interface [ 183.620621][ T5306] .` (unregistering): Released all slaves [ 183.702141][ T8156] SQUASHFS error: Unable to read directory block [631:26] [ 183.857537][ T5306] bond1 (unregistering): Released all slaves [ 183.862203][ T5306] bond2 (unregistering): Released all slaves [ 183.881146][ T8122] team0: Port device team_slave_0 added [ 183.892528][ T8122] team0: Port device team_slave_1 added [ 183.907224][ T8122] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 183.907236][ T8122] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 183.907251][ T8122] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 183.907768][ T8122] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 183.907775][ T8122] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 183.907797][ T8122] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 183.918313][ T8122] hsr_slave_0: entered promiscuous mode [ 183.918587][ T8122] hsr_slave_1: entered promiscuous mode [ 183.918769][ T8122] debugfs: 'hsr0' already exists in 'hsr' [ 183.918784][ T8122] Cannot create hsr debugfs directory [ 183.979360][ T5306] tipc: Left network mode [ 184.035396][ T5306] IPVS: stopping backup sync thread 7281 ... [ 184.134260][ T4401] 8021q: adding VLAN 0 to HW filter on device eth0 [ 184.210619][ T8151] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.210679][ T8151] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.210731][ T8151] bridge_slave_0: entered allmulticast mode [ 184.211257][ T8151] bridge_slave_0: entered promiscuous mode [ 184.217953][ T8151] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.218007][ T8151] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.218059][ T8151] bridge_slave_1: entered allmulticast mode [ 184.218595][ T8151] bridge_slave_1: entered promiscuous mode [ 184.290772][ T8151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 184.348456][ T5306] hsr_slave_0: left promiscuous mode [ 184.348766][ T5306] hsr_slave_1: left promiscuous mode [ 184.372871][ T5306] veth1_vlan: left promiscuous mode [ 184.372923][ T5306] veth0_vlan: left promiscuous mode [ 184.824833][ T50] Bluetooth: hci0: command tx timeout [ 184.995762][ T50] Bluetooth: hci1: command tx timeout [ 185.539151][ T8151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 185.561179][ T8111] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 185.562485][ T8111] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 185.562786][ T8111] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 185.563745][ T8111] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 185.564036][ T8111] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 185.564949][ T8111] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 185.565208][ T8111] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 185.566003][ T8111] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 185.674008][ T8122] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 185.688455][ T50] Bluetooth: hci2: command tx timeout [ 185.698746][ T8151] team0: Port device team_slave_0 added [ 185.706352][ T8151] team0: Port device team_slave_1 added [ 185.724713][ T8111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 185.725104][ T8151] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 185.725111][ T8151] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.725124][ T8151] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 185.725659][ T8151] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 185.725667][ T8151] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.725682][ T8151] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 185.748717][ T8111] 8021q: adding VLAN 0 to HW filter on device team0 [ 185.760547][ T8151] hsr_slave_0: entered promiscuous mode [ 185.760856][ T8151] hsr_slave_1: entered promiscuous mode [ 185.761038][ T8151] debugfs: 'hsr0' already exists in 'hsr' [ 185.761048][ T8151] Cannot create hsr debugfs directory [ 186.079208][ T8122] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.116051][ T3472] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.116097][ T3472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.139701][ T3472] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.139729][ T3472] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.195832][ T8122] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.232080][ T5306] IPVS: stop unused estimator thread 0... [ 186.338506][ T8122] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.411186][ T5306] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.499811][ T5306] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.526103][ T8122] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 186.535732][ T8122] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 186.536067][ T8122] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 186.537883][ T8122] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 186.538435][ T8122] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 186.541637][ T8122] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 186.542091][ T8122] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 186.543309][ T8122] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 186.564216][ T8111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 186.589974][ T5306] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.637159][ T8122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.678000][ T8122] 8021q: adding VLAN 0 to HW filter on device team0 [ 186.696774][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.696804][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.697336][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.697356][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.731467][ T8111] veth0_vlan: entered promiscuous mode [ 186.734189][ T8111] veth1_vlan: entered promiscuous mode [ 186.742230][ T8111] veth0_macvtap: entered promiscuous mode [ 186.743321][ T8111] veth1_macvtap: entered promiscuous mode [ 186.746917][ T8111] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 186.747935][ T8111] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 186.763418][ T1248] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.813032][ T5306] batman_adv: batadv0: Interface deactivated: netdevsim0 [ 186.829361][ T5306] batman_adv: batadv0: Removing interface: netdevsim0 [ 186.830105][ T5306] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.867852][ T3272] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.868071][ T3272] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.868191][ T3272] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.074735][ T50] Bluetooth: hci0: command tx timeout [ 187.097947][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.097957][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.104827][ T3472] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.104838][ T3472] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.169630][ T5306] bridge_slave_1: left allmulticast mode [ 187.169650][ T5306] bridge_slave_1: left promiscuous mode [ 187.170326][ T5306] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.188341][ T5306] bridge_slave_0: left allmulticast mode [ 187.188358][ T5306] bridge_slave_0: left promiscuous mode [ 187.188434][ T5306] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.203162][ T5306] bridge_slave_1: left allmulticast mode [ 187.203178][ T5306] bridge_slave_1: left promiscuous mode [ 187.203243][ T5306] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.207458][ T5306] bridge_slave_0: left allmulticast mode [ 187.207472][ T5306] bridge_slave_0: left promiscuous mode [ 187.207530][ T5306] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.216027][ T8317] loop4: detected capacity change from 0 to 256 [ 187.275997][ T50] Bluetooth: hci1: command tx timeout [ 187.602551][ T5306] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 187.602575][ T5306] bond1 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 1e:4c:79:cb:3f:5c - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 187.700196][ T5306] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 187.748366][ T5306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.770125][ T5306] bond_slave_0: left allmulticast mode [ 187.895171][ T8354] loop3: detected capacity change from 0 to 8192 [ 187.907314][ T8354] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 187.945945][ T50] Bluetooth: hci2: command tx timeout [ 188.094938][ T5306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.757395][ T5306] bond_slave_1: left allmulticast mode [ 188.758367][ T5306] bond0 (unregistering): Released all slaves [ 188.760715][ T5306] bond1 (unregistering): Released all slaves [ 188.764613][ T5306] bond2 (unregistering): Released all slaves [ 188.890072][ T8361] netlink: 8 bytes leftover after parsing attributes in process `syz.2.837'. [ 188.916850][ T5306] bond3 (unregistering): Released all slaves [ 188.927718][ T5306] bond4 (unregistering): Released all slaves [ 188.937033][ T5306] bond5 (unregistering): Released all slaves [ 188.949195][ T5306] bond6 (unregistering): Released all slaves [ 189.241046][ T5306] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 189.270670][ T5306] bond7 (unregistering): (slave ip6gretap2): Removing an active aggregator [ 189.270871][ T5306] bond7 (unregistering): (slave ip6gretap2): Releasing backup interface [ 189.296678][ T5306] ip6gretap2 (unregistering): left allmulticast mode [ 189.327307][ T5306] bond4 (unregistering): (slave gretap1): Releasing backup interface [ 189.329025][ T50] Bluetooth: hci0: command tx timeout [ 189.364547][ T5306] bond1 (unregistering): Released all slaves [ 189.369605][ T5306] bond2 (unregistering): Released all slaves [ 189.384142][ T5306] bond3 (unregistering): Released all slaves [ 189.388194][ T5306] bond4 (unregistering): Released all slaves [ 189.392176][ T5306] bond5 (unregistering): Released all slaves [ 189.400477][ T5306] bond6 (unregistering): Released all slaves [ 189.406525][ T5306] bond7 (unregistering): Released all slaves [ 189.469659][ T8122] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 189.477096][ T5306] tipc: Disabling bearer [ 189.477300][ T5306] tipc: Left network mode [ 189.480369][ T5306] tipc: Disabling bearer [ 189.483163][ T5306] tipc: Left network mode [ 189.499494][ T8122] veth0_vlan: entered promiscuous mode [ 189.502185][ T8122] veth1_vlan: entered promiscuous mode [ 189.502944][ T50] Bluetooth: hci1: command tx timeout [ 189.550871][ T8122] veth0_macvtap: entered promiscuous mode [ 189.553452][ T8122] veth1_macvtap: entered promiscuous mode [ 189.580581][ T8122] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 189.585389][ T8122] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 189.715965][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.718389][ T3272] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.718489][ T3272] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.718553][ T3272] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.250570][ T50] Bluetooth: hci2: command tx timeout [ 190.273673][ T50] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 190.273709][ T50] CPU: 0 UID: 0 PID: 50 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT [ 190.273720][ T50] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 190.273726][ T50] Workqueue: hci0 hci_rx_work [ 190.273745][ T50] Call trace: [ 190.273748][ T50] show_stack+0x2c/0x3c (C) [ 190.273765][ T50] __dump_stack+0x30/0x40 [ 190.273787][ T50] dump_stack_lvl+0xd8/0x12c [ 190.273799][ T50] dump_stack+0x1c/0x28 [ 190.273811][ T50] sysfs_warn_dup+0x9c/0xb8 [ 190.273823][ T50] sysfs_create_dir_ns+0x190/0x1f4 [ 190.273835][ T50] kobject_add_internal+0x290/0x6f0 [ 190.273849][ T50] kobject_add_varg+0x9c/0xe8 [ 190.273860][ T50] kobject_add+0x110/0x1c8 [ 190.273871][ T50] device_add+0x394/0x9e0 [ 190.273881][ T50] hci_conn_add_sysfs+0xbc/0x1e8 [ 190.273890][ T50] le_conn_complete_evt+0xc84/0x122c [ 190.273902][ T50] hci_le_conn_complete_evt+0x114/0x3d8 [ 190.273914][ T50] hci_le_meta_evt+0x2b0/0x46c [ 190.273922][ T50] hci_event_packet+0x4c0/0x9c8 [ 190.273930][ T50] hci_rx_work+0x2f4/0xd78 [ 190.273940][ T50] process_scheduled_works+0x91c/0x1250 [ 190.273951][ T50] worker_thread+0x798/0xbd0 [ 190.273961][ T50] kthread+0x304/0x3d4 [ 190.273970][ T50] ret_from_fork+0x10/0x20 [ 190.274036][ T50] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 190.274100][ T50] Bluetooth: hci0: failed to register connection device [ 190.401963][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.401979][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.459259][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.459278][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.472364][ T8151] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 190.475616][ T8151] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 190.476128][ T8151] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 190.483073][ T8151] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 190.611089][ T8151] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 190.614023][ T8151] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 190.614358][ T8151] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 190.615373][ T8151] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 191.034755][ T8151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 191.038882][ T8151] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.042459][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.042484][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.045740][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.045765][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.189531][ T5306] hsr_slave_0: left promiscuous mode [ 191.189793][ T5306] hsr_slave_1: left promiscuous mode [ 191.190176][ T5306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 191.190188][ T5306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 191.190523][ T5306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 191.190532][ T5306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 191.192280][ T5306] hsr_slave_0: left promiscuous mode [ 191.192509][ T5306] hsr_slave_1: left promiscuous mode [ 191.192741][ T5306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 191.192749][ T5306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 191.206214][ T5306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 191.206226][ T5306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 191.213897][ T5306] veth1_macvtap: left promiscuous mode [ 191.213928][ T5306] veth0_macvtap: left promiscuous mode [ 191.213974][ T5306] veth1_vlan: left promiscuous mode [ 191.214007][ T5306] veth0_vlan: left promiscuous mode [ 191.223575][ T5306] veth1_macvtap: left promiscuous mode [ 191.223595][ T5306] veth0_macvtap: left promiscuous mode [ 191.223638][ T5306] veth1_vlan: left promiscuous mode [ 191.223669][ T5306] veth0_vlan: left promiscuous mode [ 191.368221][ T5306] team0 (unregistering): Port device team_slave_1 removed [ 191.372183][ T5306] team0 (unregistering): Port device team_slave_0 removed [ 191.487295][ T8454] loop3: detected capacity change from 0 to 1024 [ 191.490657][ T8454] EXT4-fs: Ignoring removed bh option [ 191.507133][ T8454] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 191.556885][ T8454] Bluetooth: MGMT ver 1.23 [ 191.593145][ T50] Bluetooth: hci0: command tx timeout [ 191.614471][ T5306] team0 (unregistering): Port device team_slave_1 removed [ 191.623711][ T5306] team0 (unregistering): Port device team_slave_0 removed [ 191.672503][ T8461] loop4: detected capacity change from 0 to 8192 [ 191.679542][ T5306] team0 (unregistering): Port device dummy0 removed [ 191.706409][ T8454] Injecting memory failure for pfn 0x135357 at process virtual address 0x20000000 [ 191.757727][ T50] Bluetooth: hci1: command tx timeout [ 191.794771][ T8454] Memory failure: 0x135357: Sending SIGBUS to syz.3.847:8454 due to hardware memory corruption [ 191.798492][ T8454] Memory failure: 0x135357: recovery action for dirty LRU page: Recovered [ 191.799614][ T8454] Injecting memory failure for pfn 0x136bda at process virtual address 0x20001000 [ 192.036255][ T8454] Memory failure: 0x136bda: corrupted page was clean: dropped without side effects [ 192.037599][ T8454] Memory failure: 0x136bda: recovery action for clean LRU page: Recovered [ 192.037617][ T8454] Injecting memory failure for pfn 0x136bdb at process virtual address 0x20002000 [ 192.037897][ T8454] Memory failure: 0x136bdb: corrupted page was clean: dropped without side effects [ 192.037932][ T8454] Memory failure: 0x136bdb: recovery action for clean LRU page: Recovered [ 192.037942][ T8454] Injecting memory failure for pfn 0x136bdc at process virtual address 0x20003000 [ 192.037972][ T8454] Memory failure: 0x136bdc: corrupted page was clean: dropped without side effects [ 192.038048][ T8454] Memory failure: 0x136bdc: recovery action for clean LRU page: Recovered [ 192.038058][ T8454] Injecting memory failure for pfn 0x136bdd at process virtual address 0x20004000 [ 192.038084][ T8454] Memory failure: 0x136bdd: corrupted page was clean: dropped without side effects [ 192.038109][ T8454] Memory failure: 0x136bdd: recovery action for clean LRU page: Recovered [ 192.038117][ T8454] Injecting memory failure for pfn 0x136bde at process virtual address 0x20005000 [ 192.038141][ T8454] Memory failure: 0x136bde: corrupted page was clean: dropped without side effects [ 192.038165][ T8454] Memory failure: 0x136bde: recovery action for clean LRU page: Recovered [ 192.038173][ T8454] Injecting memory failure for pfn 0x136bdf at process virtual address 0x20006000 [ 192.038205][ T8454] Memory failure: 0x136bdf: corrupted page was clean: dropped without side effects [ 192.038230][ T8454] Memory failure: 0x136bdf: recovery action for clean LRU page: Recovered [ 192.038238][ T8454] Injecting memory failure for pfn 0x1350e8 at process virtual address 0x20007000 [ 192.039339][ T8454] Memory failure: 0x1350e8: corrupted page was clean: dropped without side effects [ 192.039399][ T8454] Memory failure: 0x1350e8: recovery action for clean LRU page: Recovered [ 192.039409][ T8454] Injecting memory failure for pfn 0x1350e9 at process virtual address 0x20008000 [ 192.039748][ T8454] Memory failure: 0x1350e9: corrupted page was clean: dropped without side effects [ 192.039788][ T8454] Memory failure: 0x1350e9: recovery action for clean LRU page: Recovered [ 192.039799][ T8454] Injecting memory failure for pfn 0x1350ea at process virtual address 0x20009000 [ 192.039829][ T8454] Memory failure: 0x1350ea: corrupted page was clean: dropped without side effects [ 192.039856][ T8454] Memory failure: 0x1350ea: recovery action for clean LRU page: Recovered [ 192.039864][ T8454] Injecting memory failure for pfn 0x1350eb at process virtual address 0x2000a000 [ 192.039889][ T8454] Memory failure: 0x1350eb: corrupted page was clean: dropped without side effects [ 192.039912][ T8454] Memory failure: 0x1350eb: recovery action for clean LRU page: Recovered [ 192.039920][ T8454] Injecting memory failure for pfn 0x1350ec at process virtual address 0x2000b000 [ 192.045197][ T8454] Memory failure: 0x1350ec: Sending SIGBUS to syz.3.847:8454 due to hardware memory corruption [ 192.045253][ T8454] Memory failure: 0x1350ec: recovery action for dirty LRU page: Recovered [ 192.045264][ T8454] Injecting memory failure for pfn 0x1350ed at process virtual address 0x2000c000 [ 192.045320][ T8454] Memory failure: 0x1350ed: Sending SIGBUS to syz.3.847:8454 due to hardware memory corruption [ 192.045358][ T8454] Memory failure: 0x1350ed: recovery action for dirty LRU page: Recovered [ 192.045367][ T8454] Injecting memory failure for pfn 0x1350ee at process virtual address 0x2000d000 [ 192.045392][ T8454] Memory failure: 0x1350ee: corrupted page was clean: dropped without side effects [ 192.045417][ T8454] Memory failure: 0x1350ee: recovery action for clean LRU page: Recovered [ 192.045425][ T8454] Injecting memory failure for pfn 0x1350ef at process virtual address 0x2000e000 [ 192.045448][ T8454] Memory failure: 0x1350ef: corrupted page was clean: dropped without side effects [ 192.045471][ T8454] Memory failure: 0x1350ef: recovery action for clean LRU page: Recovered [ 192.045479][ T8454] Injecting memory failure for pfn 0x135fc8 at process virtual address 0x2000f000 [ 192.045500][ T8454] Memory failure: 0x135fc8: corrupted page was clean: dropped without side effects [ 192.045523][ T8454] Memory failure: 0x135fc8: recovery action for clean LRU page: Recovered [ 192.045578][ T8454] Injecting memory failure for pfn 0x135fc9 at process virtual address 0x20010000 [ 192.045623][ T8454] Memory failure: 0x135fc9: corrupted page was clean: dropped without side effects [ 192.045646][ T8454] Memory failure: 0x135fc9: recovery action for clean LRU page: Recovered [ 192.045654][ T8454] Injecting memory failure for pfn 0x135fca at process virtual address 0x20011000 [ 192.045675][ T8454] Memory failure: 0x135fca: corrupted page was clean: dropped without side effects [ 192.045710][ T8454] Memory failure: 0x135fca: recovery action for clean LRU page: Recovered [ 192.045719][ T8454] Injecting memory failure for pfn 0x135fcb at process virtual address 0x20012000 [ 192.045740][ T8454] Memory failure: 0x135fcb: corrupted page was clean: dropped without side effects [ 192.064295][ T8454] Memory failure: 0x135fcb: recovery action for clean LRU page: Recovered [ 192.064321][ T8454] Injecting memory failure for pfn 0x135fcc at process virtual address 0x20013000 [ 192.064755][ T8454] Memory failure: 0x135fcc: corrupted page was clean: dropped without side effects [ 192.064813][ T8454] Memory failure: 0x135fcc: recovery action for clean LRU page: Recovered [ 192.064825][ T8454] Injecting memory failure for pfn 0x135fcd at process virtual address 0x20014000 [ 192.064859][ T8454] Memory failure: 0x135fcd: corrupted page was clean: dropped without side effects [ 192.064887][ T8454] Memory failure: 0x135fcd: recovery action for clean LRU page: Recovered [ 192.064896][ T8454] Injecting memory failure for pfn 0x135fce at process virtual address 0x20015000 [ 192.064922][ T8454] Memory failure: 0x135fce: corrupted page was clean: dropped without side effects [ 192.064946][ T8454] Memory failure: 0x135fce: recovery action for clean LRU page: Recovered [ 192.064955][ T8454] Injecting memory failure for pfn 0x135fcf at process virtual address 0x20016000 [ 192.064977][ T8454] Memory failure: 0x135fcf: corrupted page was clean: dropped without side effects [ 192.065001][ T8454] Memory failure: 0x135fcf: recovery action for clean LRU page: Recovered [ 192.065009][ T8454] Injecting memory failure for pfn 0x133bf8 at process virtual address 0x20017000 [ 192.065030][ T8454] Memory failure: 0x133bf8: corrupted page was clean: dropped without side effects [ 192.065053][ T8454] Memory failure: 0x133bf8: recovery action for clean LRU page: Recovered [ 192.065061][ T8454] Injecting memory failure for pfn 0x133bf9 at process virtual address 0x20018000 [ 192.065082][ T8454] Memory failure: 0x133bf9: corrupted page was clean: dropped without side effects [ 192.065105][ T8454] Memory failure: 0x133bf9: recovery action for clean LRU page: Recovered [ 192.065113][ T8454] Injecting memory failure for pfn 0x133bfa at process virtual address 0x20019000 [ 192.065134][ T8454] Memory failure: 0x133bfa: corrupted page was clean: dropped without side effects [ 192.065156][ T8454] Memory failure: 0x133bfa: recovery action for clean LRU page: Recovered [ 192.065163][ T8454] Injecting memory failure for pfn 0x133bfb at process virtual address 0x2001a000 [ 192.065184][ T8454] Memory failure: 0x133bfb: corrupted page was clean: dropped without side effects [ 192.065206][ T8454] Memory failure: 0x133bfb: recovery action for clean LRU page: Recovered [ 192.065214][ T8454] Injecting memory failure for pfn 0x133bfc at process virtual address 0x2001b000 [ 192.065234][ T8454] Memory failure: 0x133bfc: corrupted page was clean: dropped without side effects [ 192.065257][ T8454] Memory failure: 0x133bfc: recovery action for clean LRU page: Recovered [ 192.065264][ T8454] Injecting memory failure for pfn 0x15e032 at process virtual address 0x2001c000 [ 192.065285][ T8454] Memory failure: 0x15e032: corrupted page was clean: dropped without side effects [ 192.065307][ T8454] Memory failure: 0x15e032: recovery action for clean LRU page: Recovered [ 192.065315][ T8454] Injecting memory failure for pfn 0x15e033 at process virtual address 0x2001d000 [ 192.065335][ T8454] Memory failure: 0x15e033: corrupted page was clean: dropped without side effects [ 192.065357][ T8454] Memory failure: 0x15e033: recovery action for clean LRU page: Recovered [ 192.065365][ T8454] Injecting memory failure for pfn 0x15e034 at process virtual address 0x2001e000 [ 192.065556][ T8454] Memory failure: 0x15e034: corrupted page was clean: dropped without side effects [ 192.065578][ T8454] Memory failure: 0x15e034: recovery action for clean LRU page: Recovered [ 192.065586][ T8454] Injecting memory failure for pfn 0x15e035 at process virtual address 0x2001f000 [ 192.065607][ T8454] Memory failure: 0x15e035: corrupted page was clean: dropped without side effects [ 192.065629][ T8454] Memory failure: 0x15e035: recovery action for clean LRU page: Recovered [ 192.065672][ T8454] Injecting memory failure for pfn 0x137d40 at process virtual address 0x20020000 [ 192.068356][ T8454] Memory failure: 0x137d40: recovery action for clean LRU page: Recovered [ 192.068398][ T8454] Injecting memory failure for pfn 0x132e50 at process virtual address 0x20030000 [ 192.068529][ T8454] Memory failure: 0x132e50: recovery action for clean LRU page: Recovered [ 192.068554][ T8454] Injecting memory failure for pfn 0x134bf0 at process virtual address 0x20040000 [ 192.068605][ T8454] Memory failure: 0x134bf0: recovery action for clean LRU page: Recovered [ 192.068628][ T8454] Injecting memory failure for pfn 0x135818 at process virtual address 0x20050000 [ 192.068668][ T8454] Memory failure: 0x135818: recovery action for clean LRU page: Recovered [ 192.207720][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 192.450444][ T50] Bluetooth: hci2: command tx timeout [ 192.503308][ T8151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.141404][ T8151] veth0_vlan: entered promiscuous mode [ 193.146526][ T8111] FAT-fs (loop4): error, invalid access to FAT (entry 0x0000e1b1) [ 193.146542][ T8111] FAT-fs (loop4): Filesystem has been set read-only [ 193.149639][ T5306] IPVS: stop unused estimator thread 0... [ 193.166839][ T8151] veth1_vlan: entered promiscuous mode [ 193.228878][ T50] Bluetooth: hci4: ACL packet for unknown connection handle 0 [ 193.248055][ T8484] loop3: detected capacity change from 0 to 512 [ 193.249598][ T8484] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 193.275393][ T8151] veth0_macvtap: entered promiscuous mode [ 193.278482][ T8484] EXT4-fs (loop3): 1 truncate cleaned up [ 193.278928][ T8484] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 193.543771][ T8151] veth1_macvtap: entered promiscuous mode [ 193.555584][ T8491] loop4: detected capacity change from 0 to 1024 [ 193.555973][ T8491] EXT4-fs: Ignoring removed oldalloc option [ 193.555983][ T8491] EXT4-fs: Ignoring removed orlov option [ 193.556721][ T8151] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 193.559664][ T8151] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 193.580794][ T8491] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 193.676189][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.676323][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.676342][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.676361][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.713023][ T5306] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.713040][ T5306] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.953091][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.953104][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.496471][ T8111] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 195.089067][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.247778][ T4717] Bluetooth: hci0: command 0x0406 tx timeout [ 197.806715][ T8557] input: syz0 as /devices/virtual/input/input3 [ 198.018025][ T8561] netlink: 'syz.2.870': attribute type 4 has an invalid length. [ 198.044042][ T8563] loop3: detected capacity change from 0 to 256 [ 198.419881][ T8571] netlink: 28 bytes leftover after parsing attributes in process `syz.2.882'. [ 199.502626][ T8586] loop4: detected capacity change from 0 to 1024 [ 199.555554][ T8586] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 199.855691][ T1592] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.855724][ T1592] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.398800][ T8111] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.530577][ T8609] xt_cgroup: invalid path, errno=-2 [ 200.547275][ T8613] loop0: detected capacity change from 0 to 1024 [ 200.564880][ T8613] EXT4-fs: Ignoring removed bh option [ 200.631912][ T8613] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 200.659688][ T8613] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 201.214616][ T8624] netlink: 'syz.0.885': attribute type 18 has an invalid length. [ 201.390101][ T8632] Cannot find add_set index 0 as target [ 201.580670][ T8632] loop3: detected capacity change from 0 to 1024 [ 201.581082][ T8632] EXT4-fs: Ignoring removed bh option [ 201.581271][ T8632] EXT4-fs (loop3): unable to read superblock [ 201.609168][ T50] Bluetooth: hci4: unexpected event for opcode 0x0003 [ 201.634559][ T8151] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.672137][ T8638] loop4: detected capacity change from 0 to 256 [ 201.951162][ T8641] netlink: 36 bytes leftover after parsing attributes in process `syz.2.891'. [ 202.881644][ T8653] netlink: 'syz.1.893': attribute type 4 has an invalid length. [ 202.904230][ T8656] loop0: detected capacity change from 0 to 256 [ 202.961084][ T8657] xt_cgroup: invalid path, errno=-2 [ 203.417282][ T8668] loop3: detected capacity change from 0 to 128 [ 203.484772][ T8668] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 203.589490][ T8672] netlink: 'syz.2.898': attribute type 10 has an invalid length. [ 203.595702][ T8672] team0: Device vxcan1 is of different type [ 203.727987][ T8674] ptrace attach of ""[8675] was attempted by "ci-upstream-gce-arm64/syz-executor exec"[8674] [ 204.001251][ T8682] loop1: detected capacity change from 0 to 1024 [ 204.015784][ T8682] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 204.018866][ T8687] loop0: detected capacity change from 0 to 256 [ 204.384424][ T4719] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 204.812117][ T8700] loop4: detected capacity change from 0 to 512 [ 204.818249][ T8700] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.905: corrupted in-inode xattr: invalid ea_ino [ 204.818276][ T8700] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 204.818589][ T8700] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.905: couldn't read orphan inode 15 (err -117) [ 204.818889][ T8700] loop4: lost filesystem error report for type 5 error -117 [ 204.820080][ T8700] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 204.937546][ T8122] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.955880][ T8704] net_ratelimit: 4 callbacks suppressed [ 204.955895][ T8704] ip_tables: iptables: counters copy to user failed while replacing table [ 204.969886][ T8704] loop0: detected capacity change from 0 to 4096 [ 204.976689][ T8706] netlink: 8 bytes leftover after parsing attributes in process `syz.1.907'. [ 204.977485][ T8704] EXT4-fs (loop0): Test dummy encryption mode enabled [ 204.977633][ T8706] xt_policy: too many policy elements [ 204.980486][ T8704] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.069068][ T8708] overlayfs: missing 'lowerdir' [ 205.323126][ T8706] loop1: detected capacity change from 0 to 512 [ 205.324937][ T8706] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 205.742442][ T8715] fscrypt: AES-256-XTS using blk-crypto-fallback [ 205.974527][ T8719] loop3: detected capacity change from 0 to 512 [ 205.974911][ T8719] EXT4-fs: Ignoring removed nobh option [ 205.990697][ T8719] EXT4-fs (loop3): Test dummy encryption mode enabled [ 205.990719][ T8719] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 206.002385][ T8706] EXT4-fs error (device loop1): ext4_orphan_get:1429: comm syz.1.907: bad orphan inode 131083 [ 206.002405][ T8706] loop1: lost filesystem error report for type 5 error -117 [ 206.003364][ T8706] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 206.025479][ T8719] EXT4-fs (loop3): 1 truncate cleaned up [ 206.030290][ T8111] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.033156][ T8719] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 206.562152][ T8122] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.238154][ T8736] netlink: 28 bytes leftover after parsing attributes in process `syz.2.916'. [ 207.318752][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.356900][ T8151] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.452265][ T8747] loop0: detected capacity change from 0 to 512 [ 207.452719][ T8747] EXT4-fs: Ignoring removed nobh option [ 207.458195][ T8747] EXT4-fs (loop0): Test dummy encryption mode enabled [ 207.458210][ T8747] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 207.653821][ T8754] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 207.753335][ T5306] IPVS: starting estimator thread 0... [ 207.784446][ T8747] EXT4-fs (loop0): 1 truncate cleaned up [ 207.784915][ T8747] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 207.819191][ T8758] loop1: detected capacity change from 0 to 1024 [ 207.849641][ T8755] IPVS: using max 60 ests per chain, 144000 per kthread [ 207.870758][ T8758] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 208.116107][ T8761] Soft offlining pfn 0x13476a at process virtual address 0x20ffe000 [ 208.140732][ T8761] Soft offlining pfn 0x160671 at process virtual address 0x20fff000 [ 208.232442][ T8766] netlink: 'syz.2.921': attribute type 4 has an invalid length. [ 208.423886][ T8151] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.791217][ T8782] syz_tun: mtu less than device minimum [ 208.849367][ T8786] bond0: option arp_interval: invalid value ( ) [ 208.849387][ T8786] bond0: option arp_interval: allowed values 0 - 2147483647 [ 208.856282][ T8784] input: syz1 as /devices/virtual/input/input4 [ 209.004557][ T8122] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.143164][ T8815] netlink: 'syz.2.932': attribute type 4 has an invalid length. [ 210.162072][ T8818] loop1: detected capacity change from 0 to 256 [ 211.193178][ T8843] netlink: 28 bytes leftover after parsing attributes in process `syz.2.939'. [ 211.285415][ T8848] netlink: 'syz.3.937': attribute type 4 has an invalid length. [ 211.681198][ T8859] xt_cgroup: invalid path, errno=-2 [ 211.883346][ T8862] netlink: 'syz.0.944': attribute type 4 has an invalid length. [ 212.405211][ T3272] IPVS: starting estimator thread 0... [ 212.460181][ T8876] loop3: detected capacity change from 0 to 256 [ 212.504298][ T8869] IPVS: using max 63 ests per chain, 151200 per kthread [ 214.109111][ T8901] loop3: detected capacity change from 0 to 4096 [ 214.134743][ T8901] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 214.326741][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 214.557826][ T30] audit: type=1326 audit(201.509:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8909 comm="syz.4.957" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffa3979368 code=0x0 [ 214.661534][ T8921] loop3: detected capacity change from 0 to 256 [ 214.856706][ T8921] FAT-fs (loop3): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 214.856734][ T8921] FAT-fs (loop3): bogus number of directory entries (1) [ 214.856743][ T8921] FAT-fs (loop3): Can't find a valid FAT filesystem [ 214.873585][ T8920] netlink: 60 bytes leftover after parsing attributes in process `syz.3.959'. [ 215.489384][ T8926] loop0: detected capacity change from 0 to 256 [ 215.527353][ T8926] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 215.583018][ T3272] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.606700][ T8924] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 215.606719][ T8924] FAT-fs (loop0): Filesystem has been set read-only [ 215.607006][ T8924] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 215.607029][ T8924] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 215.682776][ T3272] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.705239][ T8931] veth0: entered promiscuous mode [ 215.705842][ T4717] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 215.707001][ T4717] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 215.707421][ T4717] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 215.710401][ T4717] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 215.710609][ T4717] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 215.716904][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 215.718277][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 215.718778][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 215.719117][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 215.719315][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 216.024957][ T3272] team0: Port device netdevsim1 removed [ 216.029884][ T3272] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.106606][ T3272] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.118384][ T8922] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 216.223310][ T8933] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.223399][ T8933] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.223462][ T8933] bridge_slave_0: entered allmulticast mode [ 216.223924][ T8933] bridge_slave_0: entered promiscuous mode [ 216.225685][ T8933] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.225706][ T8933] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.225758][ T8933] bridge_slave_1: entered allmulticast mode [ 216.226181][ T8933] bridge_slave_1: entered promiscuous mode [ 216.261530][ T8933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 216.270204][ T8933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 216.275519][ T8935] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.275543][ T8935] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.275609][ T8935] bridge_slave_0: entered allmulticast mode [ 216.276051][ T8935] bridge_slave_0: entered promiscuous mode [ 216.286088][ T8935] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.286140][ T8935] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.286198][ T8935] bridge_slave_1: entered allmulticast mode [ 216.288016][ T8935] bridge_slave_1: entered promiscuous mode [ 216.300708][ T3272] bridge_slave_1: left allmulticast mode [ 216.300726][ T3272] bridge_slave_1: left promiscuous mode [ 216.300815][ T3272] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.302066][ T3272] bridge_slave_0: left allmulticast mode [ 216.302077][ T3272] bridge_slave_0: left promiscuous mode [ 216.302181][ T3272] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.345578][ T3272] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 216.345737][ T3272] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 216.345749][ T3272] bond1 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 6e:a6:3e:53:5e:6e - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 216.412088][ T8969] loop0: detected capacity change from 0 to 4096 [ 216.413686][ T8969] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 216.413700][ T8969] EXT4-fs (loop0): Test dummy encryption mode enabled [ 216.421354][ T3272] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 216.425130][ T8969] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 216.468048][ T3272] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 216.472249][ T3272] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 216.485074][ T3272] bond0 (unregistering): Released all slaves [ 216.487621][ T3272] bond1 (unregistering): Released all slaves [ 216.491637][ T3272] bond2 (unregistering): Released all slaves [ 216.502410][ T3272] bond3 (unregistering): Released all slaves [ 216.507534][ T3272] bond4 (unregistering): Released all slaves [ 216.515370][ T3272] bond5 (unregistering): Released all slaves [ 216.526258][ T8935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 216.539851][ T8933] team0: Port device team_slave_0 added [ 216.541118][ T8933] team0: Port device team_slave_1 added [ 216.555974][ T8935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 216.560975][ T8933] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 216.560984][ T8933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 216.560998][ T8933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 216.562037][ T8933] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 216.562046][ T8933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 216.562061][ T8933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 216.574308][ T8935] team0: Port device team_slave_0 added [ 216.578692][ T8935] team0: Port device team_slave_1 added [ 216.799270][ T8972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.967'. [ 217.420384][ T8930] veth0: left promiscuous mode [ 217.505001][ T8935] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 217.505016][ T8935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 217.505031][ T8935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 217.505681][ T8935] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 217.505688][ T8935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 217.505701][ T8935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 217.515324][ T8935] hsr_slave_0: entered promiscuous mode [ 217.515601][ T8935] hsr_slave_1: entered promiscuous mode [ 217.515791][ T8935] debugfs: 'hsr0' already exists in 'hsr' [ 217.515801][ T8935] Cannot create hsr debugfs directory [ 217.578450][ T3272] tipc: Disabling bearer [ 217.578517][ T3272] tipc: Left network mode [ 217.607391][ T8151] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.608666][ T8978] loop3: detected capacity change from 0 to 256 [ 217.929015][ T50] Bluetooth: hci3: command tx timeout [ 217.959396][ T8933] hsr_slave_0: entered promiscuous mode [ 217.966487][ T8933] hsr_slave_1: entered promiscuous mode [ 217.966833][ T8933] debugfs: 'hsr0' already exists in 'hsr' [ 217.966845][ T8933] Cannot create hsr debugfs directory [ 218.016182][ T50] Bluetooth: hci1: command tx timeout [ 218.325191][ T4401] 8021q: adding VLAN 0 to HW filter on device eth0 [ 218.380394][ T3272] hsr_slave_0: left promiscuous mode [ 218.380939][ T3272] hsr_slave_1: left promiscuous mode [ 218.381213][ T3272] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.381225][ T3272] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.381508][ T3272] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.381517][ T3272] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.443664][ T3272] veth1_macvtap: left promiscuous mode [ 218.443697][ T3272] veth0_macvtap: left promiscuous mode [ 218.443753][ T3272] veth1_vlan: left promiscuous mode [ 218.819600][ T3272] team0 (unregistering): Port device team_slave_1 removed [ 218.823547][ T3272] team0 (unregistering): Port device team_slave_0 removed [ 219.428134][ T9029] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 219.439491][ T3272] IPVS: stop unused estimator thread 0... [ 219.450436][ T8935] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 219.460275][ T8935] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 219.460624][ T8935] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 219.464657][ T8935] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 219.465698][ T8935] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 219.483885][ T8935] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 219.484231][ T8935] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 219.490023][ T8935] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 219.523434][ T8933] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.581312][ T8935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.584699][ T8935] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.590378][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.590407][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.591037][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.591062][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.610050][ T8935] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 219.610068][ T8935] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 219.894924][ T9047] loop0: detected capacity change from 0 to 1024 [ 219.902961][ T9047] EXT4-fs: Ignoring removed bh option [ 219.914093][ T9047] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 219.915022][ T8933] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.940278][ T9047] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.044277][ T8933] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.077275][ T8935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.351949][ T4717] Bluetooth: hci1: command tx timeout [ 220.352008][ T50] Bluetooth: hci3: command tx timeout [ 220.399953][ T8935] veth0_vlan: entered promiscuous mode [ 220.402219][ T8935] veth1_vlan: entered promiscuous mode [ 220.437234][ T8935] veth0_macvtap: entered promiscuous mode [ 220.443195][ T8935] veth1_macvtap: entered promiscuous mode [ 220.444107][ T9081] loop3: detected capacity change from 0 to 1024 [ 220.464962][ T8935] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.466177][ T8935] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.509623][ T9081] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.528337][ T8933] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.802659][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.802673][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.807370][ T64] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.816399][ T6027] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.816428][ T6027] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.816444][ T6027] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.852158][ T8151] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.862708][ T4719] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.879015][ T6027] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.879029][ T6027] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.972633][ T3272] bridge_slave_1: left allmulticast mode [ 220.972655][ T3272] bridge_slave_1: left promiscuous mode [ 220.972733][ T3272] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.973850][ T3272] bridge_slave_0: left allmulticast mode [ 220.973863][ T3272] bridge_slave_0: left promiscuous mode [ 220.973922][ T3272] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.046748][ T3272] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 221.077464][ T3272] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 221.090711][ T3272] bond0 (unregistering): Released all slaves [ 221.097350][ T9097] syzkaller0: entered promiscuous mode [ 221.097365][ T9097] syzkaller0: entered allmulticast mode [ 221.124524][ T9105] xt_cgroup: invalid path, errno=-2 [ 221.358372][ T9107] loop3: detected capacity change from 0 to 256 [ 221.421712][ T9109] loop4: detected capacity change from 0 to 128 [ 221.422650][ T8933] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 221.428156][ T8933] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 221.428933][ T8933] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 221.430195][ T8933] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 221.430584][ T8933] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 221.431610][ T8933] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 221.431995][ T8933] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 221.439404][ T8933] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 221.442562][ T9109] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 221.885992][ T3272] hsr_slave_0: left promiscuous mode [ 221.886425][ T3272] hsr_slave_1: left promiscuous mode [ 221.886678][ T3272] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 221.886689][ T3272] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 221.887000][ T3272] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 221.887009][ T3272] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 221.900593][ T3272] veth1_macvtap: left promiscuous mode [ 221.900624][ T3272] veth0_macvtap: left promiscuous mode [ 221.900670][ T3272] veth1_vlan: left promiscuous mode [ 221.900709][ T3272] veth0_vlan: left promiscuous mode [ 221.958240][ T9125] netlink: 'syz.2.986': attribute type 4 has an invalid length. [ 222.045313][ T3272] team0 (unregistering): Port device team_slave_1 removed [ 222.050212][ T3272] team0 (unregistering): Port device team_slave_0 removed [ 222.183536][ T8933] 8021q: adding VLAN 0 to HW filter on device bond0 [ 222.199616][ T8933] 8021q: adding VLAN 0 to HW filter on device team0 [ 222.210025][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 222.210053][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 222.258621][ T5306] bridge0: port 2(bridge_slave_1) entered blocking state [ 222.258652][ T5306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 222.265126][ T8933] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 222.265142][ T8933] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 222.358068][ T9133] loop2: detected capacity change from 0 to 1024 [ 222.443445][ T8111] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 222.445922][ T9133] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 222.731530][ T50] Bluetooth: hci3: command tx timeout [ 222.731566][ T50] Bluetooth: hci1: command tx timeout [ 222.742753][ T9139] ================================================================== [ 222.742765][ T9139] BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xe4/0x138 ** replaying previous printk message ** [ 222.742765][ T9139] BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xe4/0x138 [ 222.742796][ T9139] Read of size 1 at addr ffff0000d8e8d254 by task syz.0.989/9139 [ 222.742805][ T9139] [ 222.742811][ T9139] CPU: 1 UID: 0 PID: 9139 Comm: syz.0.989 Not tainted syzkaller #0 PREEMPT [ 222.742822][ T9139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 222.742829][ T9139] Call trace: [ 222.742832][ T9139] show_stack+0x2c/0x3c (C) [ 222.742847][ T9139] __dump_stack+0x30/0x40 [ 222.742859][ T9139] dump_stack_lvl+0xd8/0x12c [ 222.742870][ T9139] print_address_description+0xb0/0x238 [ 222.742879][ T9139] print_report+0x68/0x84 [ 222.742887][ T9139] kasan_report+0x8c/0xc4 [ 222.742896][ T9139] __asan_report_load1_noabort+0x20/0x2c [ 222.742907][ T9139] fb_pad_aligned_buffer+0xe4/0x138 [ 222.742917][ T9139] cw_putcs+0x5d8/0x8bc [ 222.742925][ T9139] fbcon_putcs+0x258/0x390 [ 222.742933][ T9139] do_update_region+0x31c/0x3c8 [ 222.742942][ T9139] do_con_write+0x28c0/0x4264 [ 222.742952][ T9139] con_write+0x34/0x58 [ 222.742961][ T9139] n_tty_write+0x994/0xd90 [ 222.742970][ T9139] file_tty_write+0x3dc/0x66c [ 222.742977][ T9139] tty_write+0x44/0x54 [ 222.742984][ T9139] vfs_write+0x51c/0xa0c [ 222.742997][ T9139] ksys_write+0x12c/0x228 [ 222.743008][ T9139] __arm64_sys_write+0x84/0x98 [ 222.743020][ T9139] invoke_syscall+0x98/0x244 [ 222.743032][ T9139] el0_svc_common+0xec/0x23c [ 222.743043][ T9139] do_el0_svc+0x4c/0x5c [ 222.743054][ T9139] el0_svc+0x60/0x1d8 [ 222.743066][ T9139] el0t_64_sync_handler+0x44/0x104 [ 222.743076][ T9139] el0t_64_sync+0x198/0x19c [ 222.743085][ T9139] [ 222.743087][ T9139] Allocated by task 5980: [ 222.743092][ T9139] kasan_save_track+0x40/0x78 [ 222.743099][ T9139] kasan_save_alloc_info+0x40/0x50 [ 222.743107][ T9139] __kasan_kmalloc+0x9c/0xb4 [ 222.743114][ T9139] __kmalloc_noprof+0x34c/0x6c8 [ 222.743126][ T9139] font_data_rotate+0x100/0x2f0 [ 222.743138][ T9139] fbcon_rotate_font+0x218/0x374 [ 222.743145][ T9139] fbcon_modechanged+0x19c/0x698 [ 222.743156][ T9139] rotate_store+0x1f4/0x334 [ 222.743163][ T9139] dev_attr_store+0x6c/0x90 [ 222.743172][ T9139] sysfs_kf_write+0xe0/0x108 [ 222.743182][ T9139] kernfs_fop_write_iter+0x260/0x3b8 [ 222.743191][ T9139] vfs_write+0x51c/0xa0c [ 222.743201][ T9139] ksys_write+0x12c/0x228 [ 222.743211][ T9139] __arm64_sys_write+0x84/0x98 [ 222.743221][ T9139] invoke_syscall+0x98/0x244 [ 222.743231][ T9139] el0_svc_common+0xec/0x23c [ 222.743241][ T9139] do_el0_svc+0x4c/0x5c [ 222.743250][ T9139] el0_svc+0x60/0x1d8 [ 222.743258][ T9139] el0t_64_sync_handler+0x44/0x104 [ 222.743267][ T9139] el0t_64_sync+0x198/0x19c [ 222.743273][ T9139] [ 222.743275][ T9139] The buggy address belongs to the object at ffff0000d8e8c000 [ 222.743275][ T9139] which belongs to the cache kmalloc-4k of size 4096 [ 222.743282][ T9139] The buggy address is located 596 bytes to the right of [ 222.743282][ T9139] allocated 4096-byte region [ffff0000d8e8c000, ffff0000d8e8d000) [ 222.743291][ T9139] [ 222.743293][ T9139] The buggy address belongs to the physical page: [ 222.743297][ T9139] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118e88 [ 222.743304][ T9139] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 222.743311][ T9139] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 222.743319][ T9139] page_type: f5(slab) [ 222.743327][ T9139] raw: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 222.743334][ T9139] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 222.743342][ T9139] head: 05ffc00000000040 ffff0000c0002140 dead000000000100 dead000000000122 [ 222.743348][ T9139] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 222.743356][ T9139] head: 05ffc00000000003 fffffdffc363a201 00000000ffffffff 00000000ffffffff [ 222.743363][ T9139] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 222.743367][ T9139] page dumped because: kasan: bad access detected [ 222.743370][ T9139] [ 222.743372][ T9139] Memory state around the buggy address: [ 222.743376][ T9139] ffff0000d8e8d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 222.743381][ T9139] ffff0000d8e8d180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 222.743387][ T9139] >ffff0000d8e8d200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 222.743391][ T9139] ^ [ 222.743396][ T9139] ffff0000d8e8d280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 222.743401][ T9139] ffff0000d8e8d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 222.743405][ T9139] ================================================================== [ 222.747560][ T9139] Disabling lock debugging due to kernel taint [ 222.747714][ T9139] Unable to handle kernel paging request at virtual address ffff800093379f80 [ 222.747723][ T9139] KASAN: probably user-memory-access in range [0x0000000499bcfc00-0x0000000499bcfc07] [ 222.747731][ T9139] Mem abort info: [ 222.747734][ T9139] ESR = 0x0000000096000047 [ 222.747739][ T9139] EC = 0x25: DABT (current EL), IL = 32 bits [ 222.747745][ T9139] SET = 0, FnV = 0 [ 222.747748][ T9139] EA = 0, S1PTW = 0 [ 222.747752][ T9139] FSC = 0x07: level 3 translation fault [ 222.747757][ T9139] Data abort info: [ 222.747760][ T9139] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 222.747764][ T9139] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 222.747770][ T9139] GCS = 0, Overlay = 0, DirtyBit = 0 [ 222.747775][ T9139] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b16f000 [ 222.747787][ T9139] [ffff800093379f80] pgd=0000000000000000, p4d=1000000221473003, pud=1000000221474003, pmd=1000000106c84403, pte=0000000000000000 [ 222.747807][ T9139] Internal error: Oops: 0000000096000047 [#1] SMP [ 222.800288][ T9144] sctp: sctp_init_sock: sk:000000005f8caa0c [ 222.847303][ T9139] Modules linked in: [ 222.848045][ T9139] CPU: 1 UID: 0 PID: 9139 Comm: syz.0.989 Tainted: G B syzkaller #0 PREEMPT [ 222.849898][ T9139] Tainted: [B]=BAD_PAGE [ 222.850671][ T9139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 222.852461][ T9139] pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 222.853890][ T9139] pc : sys_imageblit+0xc30/0x1758 [ 222.854834][ T9139] lr : sys_imageblit+0xc28/0x1758 [ 222.855764][ T9139] sp : ffff8000946070a0 [ 222.856483][ T9139] x29: ffff800094607120 x28: dfff800000000000 x27: ffff800093378ff8 [ 222.857974][ T9139] x26: ffff800093379f80 x25: ffff0000c5048c00 x24: 0000000000000004 [ 222.859487][ T9139] x23: 0000000000000000 x22: ffff800093379f80 x21: 0000000000000000 [ 222.861042][ T9139] x20: ffff0000c5048c01 x19: ffff8000946070f8 x18: 1fffe00035bde028 [ 222.862573][ T9139] x17: 0000000000000003 x16: ffff800088a57000 x15: ffff800088b077e0 [ 222.864043][ T9139] x14: 0000000000001653 x13: 0000000000000001 x12: 0000000000000000 [ 222.865511][ T9139] x11: ffff800093079000 x10: 0000000000080000 x9 : 0000000000000000 [ 222.867087][ T9139] x8 : 0000000000000001 x7 : 0000000000000000 x6 : ffff8000804823d8 [ 222.868632][ T9139] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020 [ 222.870176][ T9139] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800093379f80 [ 222.871719][ T9139] Call trace: [ 222.872360][ T9139] sys_imageblit+0xc30/0x1758 (P) [ 222.873255][ T9139] drm_fbdev_shmem_defio_imageblit+0x38/0x144 [ 222.874361][ T9139] cw_putcs+0x69c/0x8bc [ 222.875119][ T9139] fbcon_putcs+0x258/0x390 [ 222.875921][ T9139] do_update_region+0x31c/0x3c8 [ 222.876775][ T9139] do_con_write+0x28c0/0x4264 [ 222.877597][ T9139] con_write+0x34/0x58 [ 222.878361][ T9139] n_tty_write+0x994/0xd90 [ 222.879170][ T9139] file_tty_write+0x3dc/0x66c [ 222.880037][ T9139] tty_write+0x44/0x54 [ 222.880833][ T9139] vfs_write+0x51c/0xa0c [ 222.881613][ T9139] ksys_write+0x12c/0x228 [ 222.882416][ T9139] __arm64_sys_write+0x84/0x98 [ 222.883292][ T9139] invoke_syscall+0x98/0x244 [ 222.884165][ T9139] el0_svc_common+0xec/0x23c [ 222.885076][ T9139] do_el0_svc+0x4c/0x5c [ 222.885842][ T9139] el0_svc+0x60/0x1d8 [ 222.886601][ T9139] el0t_64_sync_handler+0x44/0x104 [ 222.887575][ T9139] el0t_64_sync+0x198/0x19c [ 222.888475][ T9139] Code: aa1a03e0 97b7b22c aa1a03e0 d34416e9 (f8008415) [ 222.889814][ T9139] ---[ end trace 0000000000000000 ]--- [ 223.054379][ T8933] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 223.081708][ T8933] veth0_vlan: entered promiscuous mode [ 223.088325][ T8933] veth1_vlan: entered promiscuous mode [ 223.107889][ T8933] veth0_macvtap: entered promiscuous mode [ 223.113921][ T8933] veth1_macvtap: entered promiscuous mode [ 223.127813][ T8933] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 223.128943][ T8933] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 223.239512][ T9139] Kernel panic - not syncing: Oops: Fatal exception [ 223.248422][ T9139] SMP: stopping secondary CPUs [ 223.249301][ T9139] Kernel Offset: disabled [ 223.250090][ T9139] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 223.251354][ T9139] Memory Limit: none [ 223.594887][ T9139] Rebooting in 86400 seconds..