last executing test programs: 1m34.511989056s ago: executing program 2 (id=60): connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000240)=0x7, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e21, @local}, 0x10) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f00000003c0)={'veth0_macvtap\x00', {0x2, 0x4e1d, @broadcast}}) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="bd", 0x1}], 0x1) 1m34.501583898s ago: executing program 2 (id=61): socket$packet(0x11, 0x2, 0x300) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x800004, 0x0) ptrace(0x10, 0x0) ptrace$getregset(0x4205, 0x0, 0x402, &(0x7f0000000240)={&(0x7f0000000180)=""/108, 0x12}) r4 = fsopen(&(0x7f00000001c0)='binder\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) fsmount(r4, 0x0, 0xf) fsconfig$FSCONFIG_SET_FLAG(r4, 0x0, &(0x7f0000000240)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r4, 0x7, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r4, 0x7, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x21c91c, &(0x7f0000000440)={[{@dioread_nolock}, {@noblock_validity}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10000}}, {@resgid}, {@norecovery}, {@abort}, {@auto_da_alloc}, {@nouid32}, {@resgid, 0x32}]}, 0x1, 0x519, &(0x7f00000014c0)="$eJzs3V1PZGcdAPD/GZgtLCA0elGbtDZuDRDdAcRuiRe1Jkavmqj1viIMhDAwBIZ2IVVp/AAmxlgTr3rljYkfwMTsRzAmm+i9UeNLdFcvNtHdMefMy7LsmQV2ZxiE3y85nOc85zn8n/9M5pnzljMBXFqvRMS1iHhQr9enI2K8WV9oTnHQmNJ2d++8v5ROSdTrb/8jiUgadWmzqUP/c6S52VBEfPNrEd9JHo+7s7e/vliplLebyzO1ja2Znb3962sbi6vl1fLm/PzcjYXXF15bmO1KnqMR8cZX/vyTH/78q2/8+nPv/eGdv059L2nWRzzMo9saqRez16JlMCK2exGsTwazDAEA+H/Q2s//dERMx3gMZHtzAAAAwEVS/9Jo/DeJqJ/I0MmaAQAAAOdKIbsHNimUmvcBjMZLH5ZKjXt4PxFXC5XqTu2zK9XdzeXGvbITUSysrFXKs817hSeimKTLc1m5vRwR9w4vl+cj4vmI+PH4cLZcWqpWlvt98gMAAAAuiZEjx///frzJf/rRLwAAAKDLJvrdAQAAAKDnHP8DAADAxef4HwAAAC60r7/1VjrVW79/vfzu3u569d3ry+Wd9dLG7lJpqbq9VVqtVlezZ/ZtHPf/KtXq1hdic/fmTK38t7FGXXV3s/bO2iM/gQ0AAACcoec/dev3SUQcfHE4m1JX+t0p4EwMnqbxn3rXD+DsDfS7A0DfnOr7H7hQiv3uANB3yTHrhz76bv6K3/SiNwAAQC9MfjL/+v/AsecGDgpn1EWgR5z/g8vL9X+4vE57/d/+AlwcxRgIB/JwubUfATr8aP1Ic97x4R0nvv5frz9VxwAAgK4ZzaakUIrIzgOMRqFQKkWMZccExWRlrVKejYiPRcTvxovPpctz2ZZJJMfdNAwAAAAAAAAAAAAAAAAAAAAAAAAAZOr1JOqnsHCq1gAAAMB5EFH4S5I9zT9icvzV0aPnB64k98azeUS897O3P7y5WKttz6X1/2zX137arP98P85gAAAAAEe1jtOz+XC/ewMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADARXP3zvtLreks4/79yxExkRd/MIay+VAUI+Lqv5IYPLRdEhEDXYh/8EFEvJAXP0m7FRPNXuTFH+5z/JEuxIfL7FY6/ryZ9/krxCvZPP/zdyMboZ5d5/Gv0B7/BnLip3Vj7dKTvXj7lzMd438Q8eJg/vjTip/E2KPxDxrjz7UT5vjtb+3vd1pX/yhiMvf7J2m3SUsztY2tmZ29/etrG4ur5dXy5vz83I2F1xdeW5idWVmrlJt/c2P86KVfPXhS/lc7xJ9o558//r56wvzv37555+ONYrG9efIw/tS1/Pf/hQ7xC813/TPNcrp+slU+aJQPe/kXv325VX4zJ//lo/lPx5H3Pz//qRPmP/2NH/zxhE0BgDOws7e/vliplLcvdeGZXo10t+hcZPFMhSu9yiJ9Xc9DgnmF7z/t5unub4dVA51XnavC0DFtIp7r68gEAAB02+PHwAAAAAAAAAAAAAAAAAAAAMBZ6/GTxu6nheKRmAfZ3248PR8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoHv+FwAA//9xi8yk") 1m33.562894254s ago: executing program 2 (id=66): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmmsg(r0, &(0x7f0000001980)=[{{0x0, 0xffffffffffffffa1, 0x0}, 0x3}], 0x1, 0x12002, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) sendmsg$802154_raw(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000200)="c1e8d3e4dffd2aece18a02b0310000006c00"/28, 0x1c}, 0x1, 0x0, 0x0, 0x40040c4}, 0x0) 1m33.45580409s ago: executing program 2 (id=69): openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1395439, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x1, 0x2, 0x2, "feac64c361a7d83bb5684a562aaca1d2c5ed7ceca0fbd8c119922ab8c3cea6e8", 0xb5315258}) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x806, 0xfffa}, 0x3a, [0x0, 0xf, 0xf, 0x8, 0x80, 0x4, 0x3, 0x80000000, 0x20000006, 0x4d, 0x5, 0x5d, 0xa, 0x5, 0xffff2d38, 0xffffff03, 0x6, 0x3, 0x0, 0xe, 0x7, 0x0, 0x7, 0x23c5b, 0x1, 0xf, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x6, 0xdb63, 0x4000008c, 0x6, 0x5, 0x0, 0x4, 0x10, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x6, 0x3, 0x1, 0xf], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x2, 0x9, 0xfffffffe, 0xffffffff, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0x78, 0xe, 0xfffffffe, 0x4, 0x7, 0x7fff, 0x5, 0x400, 0x401, 0x0, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0x1, 0x4e2, 0xc, 0x4, 0xb, 0x10000, 0x9, 0x8, 0x1009, 0x6, 0x47, 0x8000, 0xc25, 0xfe000000, 0xffff, 0x0, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x94f, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x7, 0x5, 0xfffffffe, 0x6, 0x2, 0x9, 0x5, 0x8002, 0x4, 0x5, 0xb, 0x2, 0x5, 0x4, 0x0, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2, 0x4, 0x6d01, 0x3, 0x38, 0x800003, 0x208, 0x80, 0x3, 0x3ff, 0x2950bfaf, 0xc7, 0xa2, 0x7, 0xa9, 0x5, 0x8, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x1, 0x1c, 0x7, 0x3, 0x3, 0x5, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0x1, 0x5, 0x93a, 0x5, 0x2, 0xfffffffc, 0xb9, 0xce7, 0x203, 0x3, 0x57, 0x2, 0x3, 0x0, 0x10000, 0xb8, 0x3, 0x28, 0xa620, 0x2, 0x5, 0x1, 0x7ff, 0x14c, 0x20a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x10001, 0xffff, 0x100, 0x9, 0x7, 0xaf, 0x5, 0xfffffff9, 0x2000226, 0x5, 0x5, 0x8, 0x30b1d693, 0xb1f, 0x8, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000005c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000010000000f00000008000300", @ANYRES32=r5, @ANYBLOB="0500330003000000080032000700000008003100fc030000080034"], 0x44}}, 0x80) 1m31.965332905s ago: executing program 2 (id=92): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af0ff0700000018110000", @ANYRES32=r0, @ANYBLOB="000000000000000018010000646c6c2500000000002420207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000008500000006000000d7060001f0ffffffbfa300000000000007030000f0ffffffb704000004000000850000000200000095"], &(0x7f0000000280)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m30.75434425s ago: executing program 2 (id=111): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) 1m30.706484607s ago: executing program 32 (id=111): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) 58.239612124s ago: executing program 5 (id=445): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socket$inet6(0xa, 0xb0c8d8ad4c48b294, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = io_uring_setup(0x1249, &(0x7f0000000080)={0x0, 0xb9db, 0x2, 0x0, 0x1bd}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r6 = socket$netlink(0x10, 0x3, 0x8000000004) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000019080)='net/fib_trie\x00') pread64(r7, &(0x7f0000000080)=""/102356, 0x18fd4, 0x143) writev(r6, &(0x7f0000000300)=[{0x0}], 0x1) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x10, &(0x7f00000003c0)={0x7, 0x0, &(0x7f0000000180), 0x0}, 0x20) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 57.382637058s ago: executing program 5 (id=452): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', 0x2808080, &(0x7f0000000a00)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c73686f72746e616d653d77696e39352c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c636f6465706167653d313235302c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c6e6f6e756d7461696c3d302c6572726f72733d72656d6f756e742d726f2c636865636b3d7374726963742c696f636861727365743d63703433372c008d"], 0x1, 0x2ae, &(0x7f0000001980)="$eJzs3c+KI0UYAPCvJ52ZjArJwZMINujB07CzT7BBRljMSemDXlTcLMgkLEwgsCrGPXkXPPkOvoMP4MU38OBR8OYexJakO3+nM2wkZmX297vM11X1VVdV18xAoCufvD68fPBo9PDJV79Gq5XE0b24F0+T6MRRzH0TAMBt8rQo4o+iFHF8Y9t0Vl+0q6ujw4wQANi39f//AMCL4IMPP3qv2+tdvJ9lrYjht+M8iYhhMs7L+u7D+DwG0Y870Y6/IoqFMn7lfu8i0iybfxgwPo08Yvjxz9V19/eIWf55tKNzPf/d+72L86wUbw0n43x65+nPZryURHSLpOzobrTj1YiiGVUny/y7NfmRH8fbb/5Qjf/vfpxFO375LB7FIB7Muljmf32eZe8U3//5ZTmDPCKZjPOTWbulonGwhwIAAAAAAAAAAAAAAAAAAAAAwK13li10Vs/PmZ8GeHZWXz87H6hRcz5QdcLPZOV8nTtZls2P8RnnzSjz03gtjfS5Th4AAAAAAAAAAAAAAAAAAAD+J0aPv7j8dDDoX60FPxWbJTVB9UZ/VCXpSlW6XnVzPzXB5Y8Ru2c9SxCNamiD5Not5hN65g7T7Y1PdhnYaV0/cbRtDdNBlIP/bvdFeGOnCU6D4l+s83x3TTfJDY0bMXrcqt8kKzvztOrsajR7QKfbNu16UNQsXWNr1vGe9tjxy/vdtNMZNxeLud6mNX2SKyXNPf+mbEj+iz8/AAAAAAAAAAAAAAAAAADAiuVLv/Hbtconz2VIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBwy+//XwTR2SzZDCZVcr8ufSM4uRrV3LZz4GkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwy/0TAAD//0dFVzc=") r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) write$UHID_INPUT(r1, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f90750090987f70906d038e7ff7fc6e5539b0d3d0e8b089b39326d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b073a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe59}}, 0xfa) 57.287951852s ago: executing program 5 (id=454): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) userfaultfd(0x80001) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, 0x0, 0x4000054) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_open_dev$media(&(0x7f0000000000), 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000100)={[{@bsdgroups}, {@nobarrier}, {@noinit_itable}]}, 0xfc, 0x574, &(0x7f0000001980)="$eJzs3c9rHFUcAPDvbJI2/aFJoRT1IIEerNRumsQfFTzUk4gWC3qvS7INJZtuyW5KEwu2B3vxIkUQsSB69+6x+A/4VxS0UKQEPXiJzGY2XZPZNNlumm3384Fp35uZzZvvvvm+fbOzywbQt8bSfwoRL0fEN0nESMu2wcg2jq3tt/Lw+nS6JLG6+ulfSSTZuub+Sfb/oazyUkT89lXEycLmdmtLy3OlSqW8kNXH6/NXxmtLy6cuzZdmy7Ply5NTU2fempp89523uxbr6+f/+f6Tux+e+fr4yne/3D9yO4mzcTjb1hrHE7jRWhmLsew5GYqzG3ac6EJjvSTZ6wOgIwNZng9FOgaMxECW9blWR57moQG77Ms0rYE+lch/6FPNeUDz2r5L18HPjAfvr10AbY5/cO29kRhuXBsdXEn+d2WUXu+OdqH9tI1f/7xzO12i3fsQ+7vQEMAGN25GxOnBwc3jX5KNf507vY19NrbRb68/sJfupvOfN/LmP4X1+U/kzH8O5eRuJx6f/4X7XWimrXT+917u/Hf9ptXoQFZ7oTHnG0ouXqqU07HtxYg4EUP70/pERHyQfxPk88LKvdV27bfO/9Ilbb85F8yO4/7ghvnfTKleevLI1zy4GfFK7vw3We//JKf/0+fj/DbbOFa+82q7bY+Pf3et/hTxWm7/P+rMZOv7k+ON82G8eVZs9vetY7+3a3+v40/7/+DW8Y8mrfdraztv48fhf8vttnV6/u9LPmuU92XrrpXq9YWJiH3Jx5vXTz56bLPe3D+N/8Txrce/vPP/QJrY24z/1tFbrbsO7yz+3ZXGP7Oj/t954d5HX/zQrv3t9f+bjdKJbM12xr/tHuCTPHcAAAAAAADQawoRcTiSQnG9XCgUi2uf7zgaBwuVaq1+8mJ18fJMNL4rOxpDhead7pGWz0NMZJ+HbdYnN9SnIuJIRHw7cKBRL05XKzN7HTwAAAAAAAAAAAAAAAAAAAD0iEMRw3nf/0/9MZD/mDargWfRFj/5DTzn2ud/tqUbv/QE9CSv/9C/5D/0L/kP/Uv+Q/+S/9C/5D/0L/kP/Wsn+f/zuV08EAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+nD93Ll1WVx5en07rM1eXFueqV0/NlGtzxfnF6eJ0deFKcbZana2Ui9PV+cf9vUq1emViMhavjdfLtfp4bWn5wnx18XL9wqX50mz5QnnoqUQFAAAAAAAAAAAAAAAAAAAAz5ba0vJcqVIpLygodFQY7I3D6MFCoTcOo8PCXo9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDIfwEAAP//wGE62g==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143442, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x20020, 0x0, 0x1, 0x0, 0x0) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x10d080, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000080), 0x58, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = memfd_create(&(0x7f0000000000)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcdX\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9=\t\xbb\x0e\xbb\xb5\x02\x95u\x94r\xfd\x00\xb9\xf8z\xa0\xe6\xcc\x85QO\x1dD\xd5\xe2\xa56j\\', 0x1) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r5) pwritev2(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x86) read$FUSE(r1, &(0x7f0000003f00)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xa0242, 0x90) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file3\x00', &(0x7f0000000080), 0x1000) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000071, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) 56.283252158s ago: executing program 5 (id=476): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x200c080, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, 0x0, 0x152) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r1, &(0x7f0000000000)='./file0\x00', 0x8000, &(0x7f0000001dc0)={0x9, 0x4, 0x100000}, 0x20) 56.1963203s ago: executing program 5 (id=478): r0 = socket(0x1e, 0x4, 0x0) connect$tipc(r0, &(0x7f0000000040)=@id={0x1e, 0x3, 0x2, {0x4e22}}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x13, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000008000000000000001ada04006b11710000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000004400), 0x400000000000203, 0xfff5) 56.19597317s ago: executing program 0 (id=479): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000000203030008000000000000000000000008000100010000"], 0x1c}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/netfilter/nfnetlink_queue\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 56.19582572s ago: executing program 0 (id=480): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYRES32=r0], 0x7c}, 0x1, 0x0, 0x0, 0x4008040}, 0xc811) syz_genetlink_get_family_id$devlink(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, 0x0, 0x48800) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x8961, 0x0) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) preadv(0xffffffffffffffff, &(0x7f0000002380), 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x14, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x8094) 56.123419101s ago: executing program 0 (id=481): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x10483}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="03002cbd70000e0000000100000008000100", @ANYRES32=r3, @ANYBLOB="080002"], 0x34}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 56.085761116s ago: executing program 0 (id=482): r0 = syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1404c, &(0x7f00000007c0)={[{@noload}, {@resgid}, {@inlinecrypt}, {@usrquota}, {@discard}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x3}}, {@min_batch_time={'min_batch_time', 0x3d, 0x7}}, {@test_dummy_encryption_v1}, {@noblock_validity}]}, 0x5, 0x491, &(0x7f0000000300)="$eJzs3M1vG0UbAPBnN7HbvO3bhFK+Wj4CBVEhSPoF9MABEEgcioQEBzhaSahK3YKaINEqEimHckIIiTviyL/ACS4IcQGJK9yrShXqhZaT0dq7iZ1s7Ka1Y8C/n+T2md21Zx7PjjO7EyeAkTWd/ZNE7I6I3yJislXsPGC69d+N68tzN68vzyXRaLz5R9I87s/ry3PFocXzdrUXIokDJfUuXrh4plavL5zPy7NLZz+YXbxw8ZnTZ6v5phPHjx15/rmjz/Ylz12R5tFr73zx+snPOvJfl0efTHfb+USj0efqhuv/bfH4ENvB1ozl/VVpjv/JGGvrvcl49ZPVwsdDaiAwMI1Go7Fr890rDeA/LInOsiEPo6L4QV9c/5ZdB784sNnH8F17qXUBlOV9I3+09oyv3jGorLu+7afpiHh75a+vskcM5j4EAECH77L5z9PZbGd5Lpt7rM0/0ri37bg9+drQVETcFRF7I+LuOBf7IuKeiOax90XE/Vuou9q5SNKcZm6c/6RX7yjBHrL53wv52lbn/K+Y/cXUWLN0oVWISvLu6frC4fw9ORSVHVn5SJc6vn/l188329c+/8seWf3FXDBvx9XxHZ3Pma8t1W4/407XLkXsHy/LP1ldCUgi4oGI2F/2AmnvOk4/9c2Dm+2bnumVfxd9WGhqfB3xZKv/V2Jd/oWkc32ydmrh1MK5oyeK9cnZnVFfODxbnBUb/fTL5TfKtqe31P+DlfX//0rP/9X8p5L29drFrddx+fdPN72mma7kwRbO/5XaUq2avNWMi8Xij2pLS+ePRFSTk61Gt28/uvbcolwcn+V/6GD5+N8ba+/EgYjITuKHIuLhiHgk77tHI+KxiDjYJf8fX378vfXbJor8u/d/tcvL9kWW//yW+n8tqEbnlrTkmCwYO/PDtx2VTq2Fef43u3/+HW9Gh/Itt/L5t7EV5cGdvn8AAADwb5BGxO5I0pnVOE1nZlq/w7+vtfSd+fDcfOs7AlNRSYs7XZNt90OL3xFolS9FRKOtXF84FmnzvvGXYxPN8szc+/X5oWUNRP5dnbLxn7kyNuzWAQPnC1swuox/GF1dx39l+9oBbL8N47/rmN8x0LYA26vk5//EMNoBbL+y+b+/9wOjYd34t+wHI8T9fxhdxj+MLuMfRtLiRPT+knzXoHil23x6r2Ay4k5beGZn2a6fS/+mQf+CqAzqlf8ZQaQDr6I62FNrYEGStXlP9D74ytCbunkwvM8kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAfvo7AAD//1yDywo=") mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) move_mount(r0, &(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) 55.948396286s ago: executing program 0 (id=483): r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x1, 0x8, 0x801, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x44840) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) 55.828254513s ago: executing program 5 (id=485): r0 = syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000000c0)={0xffff, 0x9, {}, {0x0}, 0x6, 0x2}) chdir(&(0x7f00000003c0)='./bus\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0x7, &(0x7f0000000180)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) fanotify_init(0x4c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r1, 0x0) 55.790565109s ago: executing program 33 (id=485): r0 = syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000000c0)={0xffff, 0x9, {}, {0x0}, 0x6, 0x2}) chdir(&(0x7f00000003c0)='./bus\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0x7, &(0x7f0000000180)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) fanotify_init(0x4c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r1, 0x0) 55.527657287s ago: executing program 0 (id=493): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$inet6(0xa, 0x2, 0x0) r1 = getpid() fspick(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/cpuset.cpus\x00', 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x5) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x80}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) mount$9p_unix(&(0x7f0000000240)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000b40)='./file0\x00', 0x0, 0x12c9498, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c00028004f001003a00000014000180080001cd4bde2a0192000000000000000c001980080002"], 0x44}, 0x1, 0x0, 0x0, 0x40080}, 0x0) 55.481433123s ago: executing program 34 (id=493): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$inet6(0xa, 0x2, 0x0) r1 = getpid() fspick(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/cpuset.cpus\x00', 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x5) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x80}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) mount$9p_unix(&(0x7f0000000240)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000b40)='./file0\x00', 0x0, 0x12c9498, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c00028004f001003a00000014000180080001cd4bde2a0192000000000000000c001980080002"], 0x44}, 0x1, 0x0, 0x0, 0x40080}, 0x0) 15.512772906s ago: executing program 4 (id=823): unshare(0x22020400) bind$can_raw(0xffffffffffffffff, 0x0, 0x0) r0 = syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000012c0)={[{@grpid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x10}}, {@nodioread_nolock}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4f2040d2}}, {@auto_da_alloc}, {@stripe}, {@minixdf}, {@orlov}]}, 0x4, 0xbd0, &(0x7f0000002380)="$eJzs3M1rHOcZAPBnRqsvW+3KpZS6F6uUYkPbtewiU5tC7eLSSw+F9lqwkFdGaP2BpOJK1mHV/gOlzTmQSyCJSfAhPvuSQK65JM41JoEQExQrARMShdkPeW3t6sNeaYT0+8GreV+9M/s8z47XMy/ecQAH1kj2I404GhGXkohi4/dpRPTVegMR1fp+K8uLE18vL04ksbr6ty+SSCLi0fLiRPO1ksb2cGMwEBHv/zGJH/1nfdzZ+YXp8UqlPNMYn5y7euPk7PzCb6aujl8pXylfO3Xmd2Onx86Mnh3rWq2PPz5/96uf//mT6jevf3v7y/+/msT5GGrMtdbRLSMxsvaetCpExHi3g+Wkp1FPa51JYZOD0h1OCgCAjtKWe7ifRDF64snNWzHe+SDX5AAAAICuWO2JWAUAAAD2ucT6HwAAAPa55vcAHi0vTjRbvt9I2F0PL0TEcL3+lUarzxSiWtsORG9EHHqUROtjrUn9sBc2EhEPPjr7VtZih55D3kh1KSJ+2u78J7X6h2tPca+vP42I0S7EH3lmvNfq/3Vf5/rPdyF+3vUDcDDdu1C/kK2//qVr9z8Rj2v/TtR6/Su0uXY9j5HBp8e7ff1r3v+trLv/e1J/T4f7v79uMcat116+2Wkuew9/f/dPbzZbFj/bvlBR2/BwKeJnhXb1J2v1Jx3qv/TUK/V1jFH87ma501ze9a++EnE82tfflGz8/xOdnJyqlEfrP9vGWHpv7I1O8fOuPzv/hzrUv9n5v7HFGP+4ePFOp7nN608/60v+Xus1/4T9a3xubuZURF/yl/W/P914oL2D5j7N18jqP/GLjT//7erPQlQb70O2FlhqbLPxv5+J+Yfbt97eqP5s7Zfn+b/8nOf/v1uM8ct3/3ei01zr+jdrWfwHSX0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABNaUQMRZKW1vppWipFHI6IH8ehtHJ9du5Xk9f/ee1yNhcxHL3p5FSlPBoRxfo4ycanav0n49PPjH8bEUci4qXiYG1cmrheuZx38QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKw5HBFDkaSliEgjYqWYpqVS3lkBAAAAXTecdwIAAADAjrP+BwAAgP1vg/V/UtjNRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANivjhy7dz+JiOq5wVrL9DXmenPNDNhpad4JALnpyTsBIDeFvBMAcrPNNb7bBdiHkk3mBzrO9Hc9FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2ruNH791PIqJ6brDWMn2Nud62RxzbxeyAnZTmnQCQm56NJgu7lwew+3zE4eBqv8YHDo6eSDbZYyCiuU/16Zn+bcb6/NNtHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHjJUa0laioi01k/TUiniBxExHL3J5FSlPBoRP4yID4u9/dm4P++kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6LrZ+YXp8UqlPKOjo5NvJ9kbadQ7ef/NBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAHmbnF6bHK5XyzGzemQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5m51fmB6vVMozW+jc2c7OLZ28awQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/fBwAA//9VihLz") ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000300)) 15.398124113s ago: executing program 4 (id=824): r0 = io_uring_setup(0x1136, &(0x7f0000000240)={0x0, 0x9071, 0x10000, 0x0, 0x100025}) io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000002140)={0xa, 0x0, 0x0, '\x00', 0x1}, 0x1) io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000000080)={0xfdfc, 0xf, 0x1, '\x00', 0x4}, 0x1) 15.270363951s ago: executing program 4 (id=826): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@random="ffffffffffff", @random="aabbccddeeff", @void, {@generic={0x88ca, "5b500028003a00000000000001000001000012670000000000000000000000001122334411223344"}}}, 0x0) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x2c, r1, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x10, 0x13, @l2={'eth', 0x3a, 'syz_tun\x00'}}}}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) 15.20688894s ago: executing program 4 (id=827): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x3c5093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 15.099992625s ago: executing program 4 (id=829): r0 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4000000, &(0x7f0000000200)={0xa, 0x0, 0x0, @private2}, 0x1c) 14.1683064s ago: executing program 4 (id=830): mlock2(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x134) keyctl$reject(0x13, 0x0, 0x0, 0x202, 0x0) r0 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x3, 0xc8, "211326495dc664b1"}}}, 0xe) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r2) unshare(0x2040400) pidfd_send_signal(0xffffffffffffffff, 0x23, &(0x7f0000000180)={0x5, 0x3, 0x80}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000080)=0xe, 0x4) sendto$inet(r4, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x300, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 14.069872775s ago: executing program 35 (id=830): mlock2(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x134) keyctl$reject(0x13, 0x0, 0x0, 0x202, 0x0) r0 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x3, 0xc8, "211326495dc664b1"}}}, 0xe) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r2) unshare(0x2040400) pidfd_send_signal(0xffffffffffffffff, 0x23, &(0x7f0000000180)={0x5, 0x3, 0x80}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000080)=0xe, 0x4) sendto$inet(r4, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x300, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 9.05784699s ago: executing program 3 (id=890): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x8000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 7.836378916s ago: executing program 3 (id=895): r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtaction={0x14, 0x30, 0x1, 0x0, 0x0, {0x7a}}, 0x14}}, 0x40) 7.836070136s ago: executing program 6 (id=896): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000140)='m', 0x1}], 0x1}, 0x815) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000500)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f00000000c0)={0x6, {"8d0000f692ee930d00000000000100", "000900000000000200"}, 0x7, 0x4}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2040) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="5c0000001000010426bd7000000000fe00000000", @ANYRES32=0x0, @ANYBLOB="42d4010028000100280012800b00010065727370616e00001800028008001500bb23000004001200050016"], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x810) msgget(0x1, 0x240) 7.835931536s ago: executing program 3 (id=897): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x4) rseq(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) openat(0xffffffffffffffff, &(0x7f00000000c0)='./sys\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000001014d9ec29bd7010f4d9df25080003000100000008004c000000000008004b001300000008004a000000000008004b0013000000080003000000"], 0x58}, 0x1, 0x0, 0x0, 0x4004005}, 0x4004080) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x24044884) socket(0x10, 0x3, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r0, &(0x7f0000000080), 0x10) 7.216299306s ago: executing program 7 (id=900): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000300)="06f4ff00", 0x4) 7.216027076s ago: executing program 7 (id=901): socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x1, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_lsm={0x6, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000c30100000001000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x24}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32=r2, @ANYBLOB="200001"], 0x38}}, 0x0) 7.215345556s ago: executing program 7 (id=902): socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x2, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000280)={&(0x7f0000100000)=""/8153, 0x2000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'team_slave_0\x00', 0x0}) bind$xdp(r1, &(0x7f00000003c0)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x80000000) pselect6(0x40, &(0x7f0000000400)={0x0, 0x8001, 0x9, 0x0, 0x1, 0x0, 0xffff}, 0x0, &(0x7f0000000200)={0x3ff, 0x4, 0x8000000000000, 0x9, 0x0, 0x1000001000059, 0x7ffffffffffffffc, 0x9}, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e740062"], 0x0, 0x8e}, 0x28) 5.904067696s ago: executing program 1 (id=906): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x5e, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x17, 0x18, 0x5, 0x2, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r1, &(0x7f00000002c0)="05031614d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.238281196s ago: executing program 6 (id=907): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) 2.2132961s ago: executing program 7 (id=908): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) 2.140376911s ago: executing program 6 (id=909): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000f40)=@newtfilter={0x48, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x1c, 0x2, [@TCA_FW_INDEV={0x14, 0x3, 'lo\x00'}, @TCA_FW_POLICE={0x4}]}}]}, 0x48}}, 0x0) 2.1399511s ago: executing program 6 (id=910): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x81) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r3 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x240880c0, &(0x7f0000000280)={0xa, 0xe20, 0x0, @mcast1}, 0x1c) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084) recvmmsg$unix(r4, 0x0, 0x0, 0x60, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, 0x0, {0x10}, {0xa, 0x3}, {0xfff2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20040098}, 0x880) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40400c0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) 2.139671431s ago: executing program 1 (id=911): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) r1 = getpid() syz_pidfd_open(r1, 0x0) 2.119449983s ago: executing program 3 (id=912): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) accept4(r0, 0x0, 0x0, 0x80000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001b40)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4a, 0x4a, 0x3, [@datasec={0x1, 0x4, 0x0, 0xf, 0x1, [{0x4, 0x5, 0xcd}, {0x2, 0x6, 0x80000000}, {0x2, 0x1, 0x59e}, {0x3, 0x7, 0xb}], 'M'}, @datasec={0xa, 0x0, 0x0, 0xf, 0x1, [], "b5"}]}, {0x0, [0x30]}}, &(0x7f00000000c0)=""/9, 0x67, 0x9, 0x1, 0x5}, 0x28) 1.765547275s ago: executing program 7 (id=913): r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0xc0ed4040, &(0x7f0000000080)={[{@noblock_validity}, {@lazytime}, {@journal_dev={'journal_dev', 0x3d, 0x3}}, {@min_batch_time={'min_batch_time', 0x3d, 0x4a}}, {@nobarrier}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x3}}, {@nolazytime}, {@noload}]}, 0xf5, 0x48b, &(0x7f0000000f40)="$eJzs3MtvVNUfAPDvvZ2WlscPfogPCGgVjMRHS8tDFiZGowkLjUZdYFzVaSFIAQM1EUIUXWCMC0Pi3rg08S9wpRujrkx0iXtDQgwb0NWYO/fePoaZtkMHpjCfT3KZc+6Dc75z7rk999zbBtCzhrN/koj1EXE5IjZGRKVxh+H848a189V/rp2vJlGrvfl3kh0W16+drxb/RX3JrMtX1GpFfk2Tci++EzExPT11usiPzpx4f/TM2XPPHDsxcXTq6NTJ8YMH9+3dMXBgfH9H4sziur7to1Pbtx56+9Kr1cOX3v3lu6y+64vtZRydNJx/u0093unCumzDvHRS6WJFaEvWbv3FcjlqfX0xNLttY7z8aVcrB9xulWY/nwsXasA9LBuoA72o/EGf3f+Wy1LjhQ6OPbru6gt5RFncN4ol31KJtNinv+H+tpMGI+LwhX+/zpa4TfMQAADz/ZCNf55uNv5L44F5+/2veIayKSL+HxGbI+K+iNgSEfdH1Pd9MCIearP8xickN49/0isLsrW+NktYXDb+e654trVw/FeO/mJTX5HbUI+/PzlybHpqT/Gd7I7+NVl+bMEhC/340u9fNq77ophmH543/suWrPyFEaZXGifoJidmJlYeee7qJxHbKs3iT2YH+klEbI2IbbdYxrEnv93ealuz+Mux8JI6cCdS+ybiibz9L0RD/KWk5fPJsWcPjO8fHYzpqT2j5Vlxs19/u/h6q/JXFH8HZO2/tun5n8ef3SMmgxFnzp47Xn9ee+YWCvnzs2rSYtOWIv7+lvHffP5Xd0UMJG/V0wPlXsXnQPJK9jFUrv9wYmbm9PjcsWW+/jmWx79751z8EzHX/zfnt2eR/PHG7PE7IuLhiHikaLtHI+KxiNi5SPg/v7jrvVbbWrf/IrPyHZTFP7lI+2eXvCw11/7tJ/qO//R9q/JrS57/Wfvvq6d2F2uWc/1bbgVX8t0BAADA3SKtvwOfpCOz6TQdGcnf4d8Sa9NKRDx15NQHJyfzd+U3RX9aznRtnDcfOlbMDZf58Yb83mLe+Ku+oXp+pHpqerLbwUOPW9ei/2f+6uyjFmA1uqfe6APaov9D79L/oXfp/9C7nu92BYDuGGi++uM7XQ+gK9of/w/elnoAd577f+hd+j/0Lv0felLL341PV/Qr/3drorI6qtE0MbQ6qlEmIl1yn3SVVHV5idc+z7vEaqlPmags+49Z3GJiTdNNTS8Xh9bf2csTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiv0XAAD//1ub24E=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_rr_get_interval(0x0, &(0x7f0000000340)) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x88802, 0x0) sysinfo(&(0x7f00000002c0)=""/112) keyctl$search(0xb, 0x0, &(0x7f0000000240)='big_key\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x18, 0x68, 0x5fb9a818fb7378e9}, 0x18}}, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$nl_route(r4, 0x0, 0x4000) r5 = socket(0x10, 0x2, 0x0) sendto$inet6(r5, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040010000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) 1.765380375s ago: executing program 3 (id=914): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x65, 0x24, 0x1, 0x70bd2c, 0x25cfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfffb}, {0xffff, 0xffff}, {0x2, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.704353303s ago: executing program 1 (id=915): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x1c}, @void, @eth={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@void}, {@ipv6={0x86dd, @generic={0x5, 0x6, "864a04", 0x10, 0x29, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1={0xfc, 0x1, '\x00', 0x1}, {[@fragment={0x2b, 0x0, 0x48, 0x0, 0x0, 0x3, 0x64}, @dstopts={0x84}]}}}}}}, 0x4e) 546.471161ms ago: executing program 6 (id=916): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5", 0x37c}, {&(0x7f00000005c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859007067c10aa7352abbdf98e9bf033a4784a11e84639d3b9164d9c5d729f3", 0x3e}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb", 0x1f}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 546.252591ms ago: executing program 6 (id=917): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) shutdown(0xffffffffffffffff, 0x1) setxattr$incfs_metadata(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)="d9c4cd02ee54d1b4b8816d2c9f4c2d3f9e18c4f39e07b0aa5e02b577433b9b1a01d2d9b6a284485d29e53759c6267f816aad827a9e18c48f90a63a225759ef", 0x3f, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) 491.846489ms ago: executing program 3 (id=918): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=@newsa={0x148, 0x1c, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@dev={0xac, 0x14, 0x14, 0xd}, 0x0, 0xecdf, 0x0, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0xfffffffffffffffe, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x3, 0x10000000400804, 0x9, 0x292}, {0x1cb00000}, 0x0, 0x0, 0xa, 0x4, 0x4, 0x2c}, [@algo_crypt={0x57, 0x2, {{'cbc(twofish)\x00'}, 0x78, "11000b00a7e5ffffff000000002266"}}]}, 0x148}}, 0x44050) 488.461479ms ago: executing program 7 (id=919): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setns(0xc9, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001600010300007090083b00000c00000093060163f9e328c4cdca"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) 403.733532ms ago: executing program 1 (id=920): r0 = syz_io_uring_setup(0x31bc, &(0x7f00000010c0)={0x0, 0xc3af, 0x8, 0x1, 0x278}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x1f36, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd=r0, 0x8, 0x0, 0x91a, 0x2}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 284.373539ms ago: executing program 1 (id=921): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x288000, 0x0) unshare(0x22020600) preadv(r0, 0x0, 0x0, 0x0, 0x0) 284.098249ms ago: executing program 8 (id=831): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000180)) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600}}, 0x20) bpf$LINK_DETACH(0x22, 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f00000001c0)=r0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r2 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r2, 0xc0487c04, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x63, 0x0, 0x0, 0x2a, 0x0, 0xffffffffffffffff, 0x46, 0x0, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x9, 0x8b02) r3 = fsopen(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000003e40)=ANY=[@ANYBLOB="15000000080000003c"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x3, 0x14, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000140)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2406000005000000000000000c240000e9fffff5ffffffff092403", @ANYRES8=r4, @ANYBLOB="05", @ANYRES16=r4], 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) 0s ago: executing program 1 (id=922): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4d2, @rand_addr=0xac141415}, 0x10) listen(r0, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x100, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x50, 0x1, 0x0, 0x80000000}, {0x6, 0x80, 0xfd, 0xfffffffd}]}, 0x10) connect$inet(r1, &(0x7f0000000400)={0x2, 0x4d2, @rand_addr=0xac141415}, 0x10) kernel console output (not intermixed with test programs): binder: cannot allocate buffer: vma cleared, target dead or dying [ 82.501834][ T5082] binder: 5081:5082 transaction reply to 5081:5082 failed 17/29189/-3, size 0-0 line 3247 [ 82.507373][ T5082] binder: send failed reply for transaction 16 to 5081:5082 [ 82.518848][ T3901] binder: release 5081:5082 transaction 9 out, still active [ 82.520854][ T3901] binder: undelivered TRANSACTION_ERROR: 29190 [ 82.522458][ T3901] binder: release 5081:5082 transaction 9 in, still active [ 82.523976][ T3901] binder: send failed reply for transaction 9, target dead [ 82.525954][ T3901] binder: undelivered TRANSACTION_COMPLETE [ 82.527133][ T3901] binder: undelivered TRANSACTION_ERROR: 29189 [ 82.804258][ T48] Bluetooth: hci4: command 0x040f tx timeout [ 84.476136][ T4625] team0 (unregistering): Port device team_slave_1 removed [ 84.638053][ T4625] team0 (unregistering): Port device team_slave_0 removed [ 84.805173][ T4625] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 84.874338][ T48] Bluetooth: hci4: command 0x0419 tx timeout [ 85.005097][ T4625] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.455807][ T4625] bond0 (unregistering): Released all slaves [ 86.769104][ T753] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.770539][ T753] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.801765][ T1662] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.827099][ T753] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.828506][ T753] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.830295][ T5054] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.922356][ T5102] loop1: detected capacity change from 0 to 8 [ 86.965132][ T5102] SQUASHFS error: zlib decompression failed, data probably corrupt [ 86.966709][ T5102] SQUASHFS error: Failed to read block 0x9b: -5 [ 86.967701][ T5102] SQUASHFS error: Unable to read metadata cache entry [99] [ 86.969016][ T5102] SQUASHFS error: Unable to read inode 0x127 [ 87.900337][ T5133] loop1: detected capacity change from 0 to 512 [ 87.971619][ T5133] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #2: comm syz.1.207: missing EA_INODE flag [ 87.974068][ T5133] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.207: error while reading EA inode 2 err=-117 [ 87.990460][ T5133] EXT4-fs (loop1): 1 orphan inode deleted [ 87.991558][ T5133] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 88.488956][ T5163] loop0: detected capacity change from 0 to 2048 [ 88.546404][ T5163] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 88.886481][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 88.891500][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 88.997355][ T5193] FAULT_INJECTION: forcing a failure. [ 88.997355][ T5193] name failslab, interval 1, probability 0, space 0, times 0 [ 88.999883][ T5193] CPU: 0 PID: 5193 Comm: syz.4.223 Not tainted syzkaller #0 [ 89.001176][ T5193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 89.003088][ T5193] Call trace: [ 89.003697][ T5193] dump_backtrace+0x1c4/0x1f0 [ 89.004567][ T5193] show_stack+0x2c/0x3c [ 89.005316][ T5193] __dump_stack+0x30/0x40 [ 89.006097][ T5193] dump_stack_lvl+0xf4/0x15c [ 89.006948][ T5193] dump_stack+0x1c/0x5c [ 89.007710][ T5193] should_fail_ex+0x3cc/0x524 [ 89.008572][ T5193] __should_failslab+0xc0/0x11c [ 89.009464][ T5193] should_failslab+0x10/0x28 [ 89.010318][ T5193] kmem_cache_alloc_node+0x8c/0x344 [ 89.011249][ T5193] alloc_vmap_area+0x13c/0x169c [ 89.012153][ T5193] __get_vm_area_node+0x178/0x31c [ 89.013054][ T5193] __vmalloc_node_range+0x1d4/0xe70 [ 89.013981][ T5193] vmalloc+0x9c/0xd4 [ 89.014686][ T5193] bpf_jit_alloc_exec+0x20/0x30 [ 89.015542][ T5193] bpf_jit_binary_alloc+0xd8/0x1e8 [ 89.016436][ T5193] bpf_int_jit_compile+0xd2c/0x1090 [ 89.017363][ T5193] bpf_prog_select_runtime+0x3c4/0x698 [ 89.018309][ T5193] bpf_prog_load+0xe50/0x12c0 [ 89.019110][ T5193] __sys_bpf+0x494/0x660 [ 89.019836][ T5193] __arm64_sys_bpf+0x80/0x98 [ 89.020629][ T5193] invoke_syscall+0x98/0x290 [ 89.021450][ T5193] el0_svc_common+0x13c/0x258 [ 89.022284][ T5193] do_el0_svc+0x5c/0x134 [ 89.023030][ T5193] el0_svc+0x58/0x128 [ 89.023674][ T5193] el0t_64_sync_handler+0x84/0xf0 [ 89.024542][ T5193] el0t_64_sync+0x18c/0x190 [ 89.039855][ T5193] syz.4.223: vmalloc error: size 4096, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz4,mems_allowed=0 [ 89.042653][ T5193] CPU: 0 PID: 5193 Comm: syz.4.223 Not tainted syzkaller #0 [ 89.044046][ T5193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 89.045865][ T5193] Call trace: [ 89.046443][ T5193] dump_backtrace+0x1c4/0x1f0 [ 89.047277][ T5193] show_stack+0x2c/0x3c [ 89.048006][ T5193] __dump_stack+0x30/0x40 [ 89.048791][ T5193] dump_stack_lvl+0xf4/0x15c [ 89.049610][ T5193] dump_stack+0x1c/0x5c [ 89.050381][ T5193] warn_alloc+0x214/0x324 [ 89.051185][ T5193] __vmalloc_node_range+0x24c/0xe70 [ 89.052144][ T5193] vmalloc+0x9c/0xd4 [ 89.052843][ T5193] bpf_jit_alloc_exec+0x20/0x30 [ 89.053708][ T5193] bpf_jit_binary_alloc+0xd8/0x1e8 [ 89.054668][ T5193] bpf_int_jit_compile+0xd2c/0x1090 [ 89.055656][ T5193] bpf_prog_select_runtime+0x3c4/0x698 [ 89.056723][ T5193] bpf_prog_load+0xe50/0x12c0 [ 89.057564][ T5193] __sys_bpf+0x494/0x660 [ 89.058355][ T5193] __arm64_sys_bpf+0x80/0x98 [ 89.059230][ T5193] invoke_syscall+0x98/0x290 [ 89.060065][ T5193] el0_svc_common+0x13c/0x258 [ 89.060944][ T5193] do_el0_svc+0x5c/0x134 [ 89.061743][ T5193] el0_svc+0x58/0x128 [ 89.062465][ T5193] el0t_64_sync_handler+0x84/0xf0 [ 89.063411][ T5193] el0t_64_sync+0x18c/0x190 [ 89.089031][ T5193] Mem-Info: [ 89.089633][ T5193] active_anon:8045 inactive_anon:0 isolated_anon:0 [ 89.089633][ T5193] active_file:4960 inactive_file:2113 isolated_file:0 [ 89.089633][ T5193] unevictable:768 dirty:655 writeback:0 [ 89.089633][ T5193] slab_reclaimable:19255 slab_unreclaimable:91706 [ 89.089633][ T5193] mapped:32136 shmem:3804 pagetables:672 [ 89.089633][ T5193] sec_pagetables:0 bounce:0 [ 89.089633][ T5193] kernel_misc_reclaimable:0 [ 89.089633][ T5193] free:1442322 free_pcp:3562 free_cma:7360 [ 89.117991][ T5193] Node 0 active_anon:32832kB inactive_anon:0kB active_file:19848kB inactive_file:8384kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:128540kB dirty:2604kB writeback:0kB shmem:16000kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:8504kB pagetables:2776kB sec_pagetables:0kB all_unreclaimable? no [ 89.120769][ T5208] Bluetooth: MGMT ver 1.22 [ 89.133623][ T5193] Node 0 DMA free:3076864kB boost:0kB min:20664kB low:25828kB high:30992kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:29440kB [ 89.143956][ T5193] lowmem_reserve[]: 0 0 3550 3550 3550 [ 89.148305][ T5193] Node 0 Normal free:2692424kB boost:0kB min:24388kB low:30484kB high:36580kB reserved_highatomic:0KB active_anon:34732kB inactive_anon:0kB active_file:19848kB inactive_file:8384kB unevictable:3072kB writepending:2604kB present:5242880kB managed:3639600kB mlocked:0kB bounce:0kB free_pcp:11576kB local_pcp:2032kB free_cma:0kB [ 89.169764][ T5193] lowmem_reserve[]: 0 0 0 0 0 [ 89.170595][ T5193] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 0*2048kB 751*4096kB (MC) = 3076864kB [ 89.179821][ T5193] Node 0 Normal: 311*4kB (UME) 95*8kB (UME) 40*16kB (UME) 150*32kB (UME) 61*64kB (UME) 80*128kB (UME) 32*256kB (UM) 15*512kB (UME) 12*1024kB (UME) 2*2048kB (ME) 644*4096kB (M) = 2691668kB [ 89.191959][ T5193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 89.197378][ T5193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 89.200998][ T5193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 89.212265][ T5193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 89.214984][ T5193] 10883 total pagecache pages [ 89.216020][ T5193] 0 pages in swap cache [ 89.216800][ T5193] Free swap = 124996kB [ 89.219773][ T5193] Total swap = 124996kB [ 89.220574][ T5193] 2097152 pages RAM [ 89.223563][ T5193] 0 pages HighMem/MovableOnly [ 89.227758][ T5193] 417204 pages reserved [ 89.229868][ T5193] 8192 pages cma reserved [ 89.230668][ T5193] 0 pages hwpoisoned [ 89.323808][ T5220] loop4: detected capacity change from 0 to 512 [ 89.654977][ T5220] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 89.656798][ T5220] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 89.658698][ T5220] System zones: 0-1, 15-15, 18-18, 34-34 [ 89.668571][ T5220] EXT4-fs (loop4): orphan cleanup on readonly fs [ 89.674043][ T5220] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 89.680177][ T5220] EXT4-fs warning (device loop4): ext4_enable_quotas:7093: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 89.697391][ T5220] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 89.703849][ T5220] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.229: bg 0: block 40: padding at end of block bitmap is not set [ 89.719381][ T5220] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 89.721542][ T5220] EXT4-fs (loop4): 1 truncate cleaned up [ 89.722804][ T5220] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 89.727270][ T5220] EXT4-fs (loop4): shut down requested (1) [ 89.738657][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 89.957806][ T5247] loop1: detected capacity change from 0 to 128 [ 89.978565][ T5247] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 89.991764][ T5252] loop5: detected capacity change from 0 to 512 [ 90.016831][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 90.024042][ T5252] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 90.098541][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 90.148647][ T5260] FAULT_INJECTION: forcing a failure. [ 90.148647][ T5260] name failslab, interval 1, probability 0, space 0, times 0 [ 90.155257][ T5260] CPU: 0 PID: 5260 Comm: syz.1.244 Not tainted syzkaller #0 [ 90.156459][ T5260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 90.158100][ T5260] Call trace: [ 90.158699][ T5260] dump_backtrace+0x1c4/0x1f0 [ 90.159507][ T5260] show_stack+0x2c/0x3c [ 90.160271][ T5260] __dump_stack+0x30/0x40 [ 90.161070][ T5260] dump_stack_lvl+0xf4/0x15c [ 90.161887][ T5260] dump_stack+0x1c/0x5c [ 90.162635][ T5260] should_fail_ex+0x3cc/0x524 [ 90.163469][ T5260] __should_failslab+0xc0/0x11c [ 90.164369][ T5260] should_failslab+0x10/0x28 [ 90.165184][ T5260] __kmem_cache_alloc_node+0x7c/0x318 [ 90.166167][ T5260] __kmalloc_node+0xc8/0x184 [ 90.167018][ T5260] __vmalloc_node_range+0x448/0xe70 [ 90.168002][ T5260] vzalloc+0x9c/0xd4 [ 90.168724][ T5260] n_tty_open+0x24/0x174 [ 90.169516][ T5260] tty_ldisc_setup+0x190/0x40c [ 90.170436][ T5260] tty_init_dev+0x208/0x3f4 [ 90.171250][ T5260] tty_open+0x6dc/0xb5c [ 90.171996][ T5260] chrdev_open+0x3d0/0x51c [ 90.172803][ T5260] do_dentry_open+0x738/0xf8c [ 90.173660][ T5260] vfs_open+0x7c/0x90 [ 90.174403][ T5260] path_openat+0x1fc0/0x27a0 [ 90.175229][ T5260] do_filp_open+0x198/0x38c [ 90.176040][ T5260] do_sys_openat2+0x134/0x3fc [ 90.176870][ T5260] __arm64_sys_openat+0x11c/0x150 [ 90.177772][ T5260] invoke_syscall+0x98/0x290 [ 90.178616][ T5260] el0_svc_common+0x13c/0x258 [ 90.179518][ T5260] do_el0_svc+0x5c/0x134 [ 90.180306][ T5260] el0_svc+0x58/0x128 [ 90.181035][ T5260] el0t_64_sync_handler+0x84/0xf0 [ 90.181935][ T5260] el0t_64_sync+0x18c/0x190 [ 90.193527][ T5260] pty pty23: ldisc open failed (-12), clearing slot 23 [ 90.197450][ T5264] loop5: detected capacity change from 0 to 256 [ 91.075167][ T5277] loop5: detected capacity change from 0 to 512 [ 91.109398][ T5277] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 91.120304][ T5277] System zones: 1-12 [ 91.130652][ T5277] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: inode #12: comm syz.5.249: missing EA_INODE flag [ 91.140824][ T5277] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.249: error while reading EA inode 12 err=-117 [ 91.156209][ T5277] EXT4-fs (loop5): 1 orphan inode deleted [ 91.167443][ T5277] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 92.286857][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 92.314031][ T5291] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.382589][ T5313] loop5: detected capacity change from 0 to 1024 [ 92.385679][ T5313] EXT4-fs: Ignoring removed bh option [ 92.416091][ T5291] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.438658][ T5323] loop1: detected capacity change from 0 to 1024 [ 92.448648][ T5323] EXT4-fs: Ignoring removed nomblk_io_submit option [ 92.452107][ T5313] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 92.455945][ T5323] EXT4-fs warning (device loop1): ext4_multi_mount_protect:298: Invalid MMP block in superblock [ 92.495691][ T5291] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.517945][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 92.540655][ T5328] Injecting memory failure for pfn 0x119e6a at process virtual address 0x20000000 [ 92.547774][ T5328] Memory failure: 0x119e6a: corrupted page was clean: dropped without side effects [ 92.551161][ T5328] Memory failure: 0x119e6a: recovery action for clean LRU page: Recovered [ 92.552568][ T5328] Injecting memory failure for pfn 0x11f065 at process virtual address 0x20001000 [ 92.557415][ T5328] Memory failure: 0x11f065: corrupted page was clean: dropped without side effects [ 92.559515][ T5328] Memory failure: 0x11f065: recovery action for clean LRU page: Recovered [ 92.561474][ T5328] Injecting memory failure for pfn 0x118ad4 at process virtual address 0x20002000 [ 92.562913][ T5328] Memory failure: 0x118ad4: corrupted page was clean: dropped without side effects [ 92.566762][ T5328] Memory failure: 0x118ad4: recovery action for clean LRU page: Recovered [ 92.568512][ T5328] Injecting memory failure for pfn 0x135b13 at process virtual address 0x20003000 [ 92.570889][ T5328] Memory failure: 0x135b13: corrupted page was clean: dropped without side effects [ 92.572890][ T5328] Memory failure: 0x135b13: recovery action for clean LRU page: Recovered [ 92.575365][ T5328] Injecting memory failure for pfn 0x11a2ab at process virtual address 0x20004000 [ 92.579399][ T5328] Memory failure: 0x11a2ab: corrupted page was clean: dropped without side effects [ 92.581175][ T5328] Memory failure: 0x11a2ab: recovery action for clean LRU page: Recovered [ 92.582648][ T5328] Injecting memory failure for pfn 0x12e42d at process virtual address 0x20005000 [ 92.587196][ T5328] Memory failure: 0x12e42d: corrupted page was clean: dropped without side effects [ 92.589002][ T5328] Memory failure: 0x12e42d: recovery action for clean LRU page: Recovered [ 92.590596][ T5328] Injecting memory failure for pfn 0x104c52 at process virtual address 0x20006000 [ 92.592427][ T5328] Memory failure: 0x104c52: corrupted page was clean: dropped without side effects [ 92.594094][ T5328] Memory failure: 0x104c52: recovery action for clean LRU page: Recovered [ 92.596324][ T5328] Injecting memory failure for pfn 0x125c7a at process virtual address 0x20007000 [ 92.598036][ T5328] Memory failure: 0x125c7a: corrupted page was clean: dropped without side effects [ 92.599774][ T5328] Memory failure: 0x125c7a: recovery action for clean LRU page: Recovered [ 92.602807][ T5328] Injecting memory failure for pfn 0x118c37 at process virtual address 0x20008000 [ 92.605230][ T5328] Memory failure: 0x118c37: corrupted page was clean: dropped without side effects [ 92.607055][ T5328] Memory failure: 0x118c37: recovery action for clean LRU page: Recovered [ 92.608629][ T5328] Injecting memory failure for pfn 0x11e3bb at process virtual address 0x20009000 [ 92.610618][ T5328] Memory failure: 0x11e3bb: corrupted page was clean: dropped without side effects [ 92.612414][ T5328] Memory failure: 0x11e3bb: recovery action for clean LRU page: Recovered [ 92.614364][ T5328] Injecting memory failure for pfn 0x120131 at process virtual address 0x2000a000 [ 92.616066][ T5328] Memory failure: 0x120131: corrupted page was clean: dropped without side effects [ 92.618028][ T5328] Memory failure: 0x120131: recovery action for clean LRU page: Recovered [ 92.619716][ T5328] Injecting memory failure for pfn 0x121002 at process virtual address 0x2000b000 [ 92.621521][ T5328] Memory failure: 0x121002: corrupted page was clean: dropped without side effects [ 92.623304][ T5328] Memory failure: 0x121002: recovery action for clean LRU page: Recovered [ 92.626389][ T5328] Injecting memory failure for pfn 0x10b239 at process virtual address 0x2000c000 [ 92.628051][ T5328] Memory failure: 0x10b239: corrupted page was clean: dropped without side effects [ 92.629624][ T5328] Memory failure: 0x10b239: recovery action for clean LRU page: Recovered [ 92.631203][ T5328] Injecting memory failure for pfn 0x11a820 at process virtual address 0x2000d000 [ 92.632701][ T5328] Memory failure: 0x11a820: corrupted page was clean: dropped without side effects [ 92.636763][ T5328] Memory failure: 0x11a820: recovery action for clean LRU page: Recovered [ 92.638165][ T5328] Injecting memory failure for pfn 0x118c77 at process virtual address 0x2000e000 [ 92.639612][ T5328] Memory failure: 0x118c77: corrupted page was clean: dropped without side effects [ 92.641070][ T5328] Memory failure: 0x118c77: recovery action for clean LRU page: Recovered [ 92.642529][ T5328] Injecting memory failure for pfn 0x11e025 at process virtual address 0x2000f000 [ 92.644623][ T5328] Memory failure: 0x11e025: corrupted page was clean: dropped without side effects [ 92.646521][ T5328] Memory failure: 0x11e025: recovery action for clean LRU page: Recovered [ 92.648764][ T5328] Injecting memory failure for pfn 0x103ff0 at process virtual address 0x20010000 [ 92.651157][ T5328] Memory failure: 0x103ff0: corrupted page was clean: dropped without side effects [ 92.653319][ T5328] Memory failure: 0x103ff0: recovery action for clean LRU page: Recovered [ 92.657552][ T5328] Injecting memory failure for pfn 0x11081f at process virtual address 0x20011000 [ 92.659204][ T5328] Memory failure: 0x11081f: corrupted page was clean: dropped without side effects [ 92.660824][ T5328] Memory failure: 0x11081f: recovery action for clean LRU page: Recovered [ 92.662301][ T5328] Injecting memory failure for pfn 0x11ab09 at process virtual address 0x20012000 [ 92.664002][ T5328] Memory failure: 0x11ab09: corrupted page was clean: dropped without side effects [ 92.666317][ T5328] Memory failure: 0x11ab09: recovery action for clean LRU page: Recovered [ 92.668318][ T5328] Injecting memory failure for pfn 0x10ad2d at process virtual address 0x20013000 [ 92.670109][ T5328] Memory failure: 0x10ad2d: corrupted page was clean: dropped without side effects [ 92.671801][ T5328] Memory failure: 0x10ad2d: recovery action for clean LRU page: Recovered [ 92.673301][ T5328] Injecting memory failure for pfn 0x110cc0 at process virtual address 0x20014000 [ 92.680531][ T5291] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.684438][ T5328] Memory failure: 0x110cc0: corrupted page was clean: dropped without side effects [ 92.686473][ T5328] Memory failure: 0x110cc0: recovery action for clean LRU page: Recovered [ 92.687969][ T5328] Injecting memory failure for pfn 0x10a2d2 at process virtual address 0x20015000 [ 92.689681][ T5328] Memory failure: 0x10a2d2: corrupted page was clean: dropped without side effects [ 92.691299][ T5328] Memory failure: 0x10a2d2: recovery action for clean LRU page: Recovered [ 92.692707][ T5328] Injecting memory failure for pfn 0x12e2fc at process virtual address 0x20016000 [ 92.697725][ T5328] Memory failure: 0x12e2fc: corrupted page was clean: dropped without side effects [ 92.699770][ T5328] Memory failure: 0x12e2fc: recovery action for clean LRU page: Recovered [ 92.701472][ T5328] Injecting memory failure for pfn 0x10d4d8 at process virtual address 0x20017000 [ 92.703385][ T5328] Memory failure: 0x10d4d8: corrupted page was clean: dropped without side effects [ 92.707705][ T5328] Memory failure: 0x10d4d8: recovery action for clean LRU page: Recovered [ 92.709323][ T5328] Injecting memory failure for pfn 0x115874 at process virtual address 0x20018000 [ 92.742874][ T5345] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 92.744698][ T5345] overlayfs: missing 'lowerdir' [ 92.762489][ T5328] Memory failure: 0x115874: corrupted page was clean: dropped without side effects [ 92.765863][ T5328] Memory failure: 0x115874: recovery action for clean LRU page: Recovered [ 92.767286][ T5328] Injecting memory failure for pfn 0x11f067 at process virtual address 0x20019000 [ 92.771922][ T5328] Memory failure: 0x11f067: corrupted page was clean: dropped without side effects [ 92.773683][ T5328] Memory failure: 0x11f067: recovery action for clean LRU page: Recovered [ 92.783754][ T5328] Injecting memory failure for pfn 0x12e093 at process virtual address 0x2001a000 [ 93.125822][ T5328] Memory failure: 0x12e093: corrupted page was clean: dropped without side effects [ 93.128051][ T5328] Memory failure: 0x12e093: recovery action for clean LRU page: Recovered [ 93.133145][ T5328] Injecting memory failure for pfn 0x11c344 at process virtual address 0x2001b000 [ 93.277737][ T5328] Memory failure: 0x11c344: corrupted page was clean: dropped without side effects [ 93.420388][ T5328] Memory failure: 0x11c344: recovery action for clean LRU page: Recovered [ 93.422042][ T5328] Injecting memory failure for pfn 0x12e121 at process virtual address 0x2001c000 [ 93.423749][ T5328] Memory failure: 0x12e121: corrupted page was clean: dropped without side effects [ 93.427067][ T5328] Memory failure: 0x12e121: recovery action for clean LRU page: Recovered [ 93.428993][ T5328] Injecting memory failure for pfn 0x13622b at process virtual address 0x2001d000 [ 93.430718][ T5328] Memory failure: 0x13622b: corrupted page was clean: dropped without side effects [ 93.432630][ T5328] Memory failure: 0x13622b: recovery action for clean LRU page: Recovered [ 93.434249][ T5328] Injecting memory failure for pfn 0x11e1ff at process virtual address 0x2001e000 [ 93.436022][ T5328] Memory failure: 0x11e1ff: corrupted page was clean: dropped without side effects [ 93.437713][ T5328] Memory failure: 0x11e1ff: recovery action for clean LRU page: Recovered [ 93.439317][ T5328] Injecting memory failure for pfn 0x118edf at process virtual address 0x2001f000 [ 93.441128][ T5328] Memory failure: 0x118edf: corrupted page was clean: dropped without side effects [ 93.443005][ T5328] Memory failure: 0x118edf: recovery action for clean LRU page: Recovered [ 93.443547][ T5291] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.455425][ T5291] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.459215][ T5291] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.463713][ T5291] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.770398][ T5392] netlink: 'syz.0.282': attribute type 29 has an invalid length. [ 95.054694][ T5392] netlink: 'syz.0.282': attribute type 29 has an invalid length. [ 95.071677][ T5399] loop1: detected capacity change from 0 to 512 [ 95.087873][ T5399] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 95.126793][ T5405] FAULT_INJECTION: forcing a failure. [ 95.126793][ T5405] name failslab, interval 1, probability 0, space 0, times 0 [ 95.129878][ T5405] CPU: 1 PID: 5405 Comm: syz.5.288 Not tainted syzkaller #0 [ 95.131151][ T5405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 95.132980][ T5405] Call trace: [ 95.133565][ T5405] dump_backtrace+0x1c4/0x1f0 [ 95.134417][ T5405] show_stack+0x2c/0x3c [ 95.135175][ T5405] __dump_stack+0x30/0x40 [ 95.135980][ T5405] dump_stack_lvl+0xf4/0x15c [ 95.136856][ T5405] dump_stack+0x1c/0x5c [ 95.137603][ T5405] should_fail_ex+0x3cc/0x524 [ 95.138470][ T5405] __should_failslab+0xc0/0x11c [ 95.139401][ T5405] should_failslab+0x10/0x28 [ 95.140276][ T5405] __kmem_cache_alloc_node+0x7c/0x318 [ 95.141332][ T5405] __kmalloc+0xc4/0x180 [ 95.142092][ T5405] find_asymmetric_key+0x88/0x410 [ 95.143072][ T5405] pkcs7_validate_trust+0x2f8/0x628 [ 95.143987][ T5405] verify_pkcs7_message_sig+0x18c/0x27c [ 95.145072][ T5405] verify_pkcs7_signature+0x84/0xb4 [ 95.146079][ T5405] pkcs7_preparse+0xa0/0xd0 [ 95.146959][ T5405] key_create_or_update+0x394/0x868 [ 95.147937][ T5405] __arm64_sys_add_key+0x40c/0x520 [ 95.148902][ T5405] invoke_syscall+0x98/0x290 [ 95.149779][ T5405] el0_svc_common+0x13c/0x258 [ 95.150654][ T5405] do_el0_svc+0x5c/0x134 [ 95.151384][ T5405] el0_svc+0x58/0x128 [ 95.152146][ T5405] el0t_64_sync_handler+0x84/0xf0 [ 95.153139][ T5405] el0t_64_sync+0x18c/0x190 [ 95.189260][ T5399] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 95.197725][ T5399] Quota error (device loop1): do_check_range: Getting dqdh_next_free 4294967294 out of range 0-8 [ 95.199976][ T5399] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 95.202440][ T5399] EXT4-fs error (device loop1): ext4_acquire_dquot:6841: comm syz.1.286: Failed to acquire dquot type 0 [ 95.217736][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 95.566564][ T5421] netlink: 'syz.1.291': attribute type 1 has an invalid length. [ 95.577696][ T5423] overlayfs: failed to get inode (-116) [ 95.579472][ T5423] overlayfs: failed to get inode (-116) [ 95.615900][ T5430] loop1: detected capacity change from 0 to 512 [ 95.655218][ T5430] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.296: bg 0: block 5: invalid block bitmap [ 95.662193][ T5430] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 95.667225][ T5430] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.296: invalid indirect mapped block 393216 (level 0) [ 95.670499][ T5430] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.296: invalid indirect mapped block 3 (level 2) [ 95.673709][ T5430] EXT4-fs (loop1): 1 orphan inode deleted [ 95.676817][ T5430] EXT4-fs (loop1): 1 truncate cleaned up [ 95.678021][ T5430] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 95.700727][ T5441] loop0: detected capacity change from 0 to 1024 [ 95.707463][ T5441] EXT4-fs: Ignoring removed oldalloc option [ 95.708727][ T5441] EXT4-fs: Ignoring removed orlov option [ 95.761427][ T5441] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 95.770633][ T5441] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm syz.0.301: lblock 0 mapped to illegal pblock 0 (length 6) [ 95.773476][ T5441] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 6 with error 117 [ 95.780277][ T5441] EXT4-fs (loop0): This should not happen!! Data will be lost [ 95.780277][ T5441] [ 95.786298][ T5441] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #15: comm syz.0.301: lblock 0 mapped to illegal pblock 0 (length 1) [ 95.803756][ T4625] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm kworker/u4:9: bg 0: block 112: padding at end of block bitmap is not set [ 95.809140][ T4625] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 48 with error 28 [ 95.813111][ T4625] EXT4-fs (loop0): This should not happen!! Data will be lost [ 95.813111][ T4625] [ 95.866676][ T5449] Cannot find add_set index 0 as target [ 95.893415][ T5449] loop5: detected capacity change from 0 to 1024 [ 95.900866][ T5449] EXT4-fs: Ignoring removed bh option [ 95.902978][ T5449] EXT4-fs (loop5): unable to read superblock [ 96.131364][ T4625] EXT4-fs (loop0): Total free blocks count 0 [ 96.135798][ T4625] EXT4-fs (loop0): Free/Dirty block details [ 96.136879][ T4625] EXT4-fs (loop0): free_blocks=0 [ 96.137658][ T4625] EXT4-fs (loop0): dirty_blocks=48 [ 96.139011][ T5095] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 96.155133][ T4625] EXT4-fs (loop0): Block reservation details [ 96.226498][ T5459] loop4: detected capacity change from 0 to 512 [ 96.274127][ T5459] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 96.322631][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 96.373155][ T5451] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.375150][ T5451] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.397870][ T5473] loop4: detected capacity change from 0 to 2048 [ 96.429880][ T5473] loop4: p1 < > p4 [ 96.429880][ T5473] p4: [ 96.433174][ T5473] loop4: p4 size 722688 extends beyond EOD, truncated [ 96.526497][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 97.081947][ T5451] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 97.101225][ T5451] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.719218][ T5451] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.720869][ T5451] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.722250][ T5451] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.723650][ T5451] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.235135][ T5519] loop1: detected capacity change from 0 to 256 [ 98.338843][ T5524] overlayfs: failed to clone upperpath [ 98.627276][ T5526] loop4: detected capacity change from 0 to 256 [ 98.630084][ T5526] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 98.657978][ T5530] loop0: detected capacity change from 0 to 256 [ 98.670775][ T5530] FAT-fs (loop0): Directory bread(block 64) failed [ 98.672232][ T5530] FAT-fs (loop0): Directory bread(block 65) failed [ 98.682511][ T5530] FAT-fs (loop0): Directory bread(block 66) failed [ 98.689076][ T5530] FAT-fs (loop0): Directory bread(block 67) failed [ 98.692497][ T5530] FAT-fs (loop0): Directory bread(block 68) failed [ 98.698013][ T5530] FAT-fs (loop0): Directory bread(block 69) failed [ 98.700513][ T5530] FAT-fs (loop0): Directory bread(block 70) failed [ 98.701799][ T5530] FAT-fs (loop0): Directory bread(block 71) failed [ 98.704497][ T5530] FAT-fs (loop0): Directory bread(block 72) failed [ 98.707426][ T5530] FAT-fs (loop0): Directory bread(block 73) failed [ 98.964463][ T5535] loop4: detected capacity change from 0 to 1024 [ 98.968164][ T5535] ext4: Unknown parameter 'fowner' [ 100.242490][ T5547] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 100.294016][ T5547] capability: warning: `syz.4.329' uses 32-bit capabilities (legacy support in use) [ 100.437597][ T5569] FAULT_INJECTION: forcing a failure. [ 100.437597][ T5569] name failslab, interval 1, probability 0, space 0, times 0 [ 100.445091][ T5569] CPU: 0 PID: 5569 Comm: syz.4.334 Not tainted syzkaller #0 [ 100.446420][ T5569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 100.448286][ T5569] Call trace: [ 100.448898][ T5569] dump_backtrace+0x1c4/0x1f0 [ 100.449748][ T5569] show_stack+0x2c/0x3c [ 100.450524][ T5569] __dump_stack+0x30/0x40 [ 100.451355][ T5569] dump_stack_lvl+0xf4/0x15c [ 100.452205][ T5569] dump_stack+0x1c/0x5c [ 100.452993][ T5569] should_fail_ex+0x3cc/0x524 [ 100.453893][ T5569] __should_failslab+0xc0/0x11c [ 100.454709][ T5569] should_failslab+0x10/0x28 [ 100.455542][ T5569] kmem_cache_alloc+0x88/0x310 [ 100.456361][ T5569] vm_area_dup+0x30/0x1c4 [ 100.457108][ T5569] __split_vma+0xc8/0x44c [ 100.457904][ T5569] split_vma+0xa0/0xf8 [ 100.458657][ T5569] mprotect_fixup+0x3e4/0x610 [ 100.459499][ T5569] __arm64_sys_mprotect+0x5f0/0xa10 [ 100.460444][ T5569] invoke_syscall+0x98/0x290 [ 100.461270][ T5569] el0_svc_common+0x13c/0x258 [ 100.462129][ T5569] do_el0_svc+0x5c/0x134 [ 100.462873][ T5569] el0_svc+0x58/0x128 [ 100.463570][ T5569] el0t_64_sync_handler+0x84/0xf0 [ 100.464452][ T5569] el0t_64_sync+0x18c/0x190 [ 101.172960][ T5588] device syzkaller0 entered promiscuous mode [ 101.181430][ T5588] tipc: Enabled bearer , priority 0 [ 101.188248][ T5587] tipc: Resetting bearer [ 101.326416][ T5587] tipc: Disabling bearer [ 101.746655][ T5615] loop1: detected capacity change from 0 to 1024 [ 101.748262][ T5615] EXT4-fs: Ignoring removed oldalloc option [ 101.749377][ T5615] EXT4-fs: Ignoring removed orlov option [ 101.799369][ T5615] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 101.808776][ T5615] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm syz.1.345: lblock 0 mapped to illegal pblock 0 (length 1) [ 101.816080][ T5615] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 101.818484][ T5615] EXT4-fs (loop1): This should not happen!! Data will be lost [ 101.818484][ T5615] [ 101.842662][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 102.366292][ T5676] netlink: 4 bytes leftover after parsing attributes in process `syz.3.358'. [ 102.430917][ T5687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.361'. [ 102.434020][ T5687] device hsr_slave_0 left promiscuous mode [ 102.468323][ T5687] device hsr_slave_1 left promiscuous mode [ 102.471807][ T5692] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 102.770351][ T5711] syz.5.367 (5711): /proc/5710/oom_adj is deprecated, please use /proc/5710/oom_score_adj instead. [ 102.809710][ T5714] netlink: 28 bytes leftover after parsing attributes in process `syz.5.368'. [ 102.811326][ T5714] netlink: 28 bytes leftover after parsing attributes in process `syz.5.368'. [ 102.812709][ T5714] netlink: 8 bytes leftover after parsing attributes in process `syz.5.368'. [ 103.709303][ T5749] loop1: detected capacity change from 0 to 2048 [ 103.802665][ T5749] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 103.871985][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 103.919643][ T5776] loop5: detected capacity change from 0 to 1024 [ 103.935638][ T5776] EXT4-fs: Ignoring removed orlov option [ 103.999156][ T5776] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 104.021616][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 104.425070][ T5792] netlink: 8 bytes leftover after parsing attributes in process `syz.4.384'. [ 104.613244][ T27] audit: type=1326 audit(104.600:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.620503][ T27] audit: type=1326 audit(104.600:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.633356][ T27] audit: type=1326 audit(104.600:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.648198][ T27] audit: type=1326 audit(104.600:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.658789][ T27] audit: type=1326 audit(104.600:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.663233][ T5830] netlink: 80 bytes leftover after parsing attributes in process `syz.4.395'. [ 104.667353][ T27] audit: type=1326 audit(104.600:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.671600][ T27] audit: type=1326 audit(104.600:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.677475][ T27] audit: type=1326 audit(104.600:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 104.681707][ T27] audit: type=1326 audit(104.600:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5822 comm="syz.5.392" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff80d79368 code=0x7ffc0000 [ 105.101423][ T5842] binder: 5841:5842 ioctl c0306201 20000080 returned -14 [ 105.150506][ T5848] device syzkaller0 entered promiscuous mode [ 105.154952][ T5850] loop1: detected capacity change from 0 to 128 [ 105.161536][ T5850] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 105.163009][ T5850] System zones: 1-3, 19-19, 35-36 [ 105.165243][ T5850] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 105.181981][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 105.204434][ T5853] loop1: detected capacity change from 0 to 128 [ 105.206643][ T5853] EXT4-fs (loop1): VFS: Found ext4 filesystem with unknown checksum algorithm. [ 105.227217][ T5095] udevd[5095]: incorrect ext4 checksum on /dev/loop1 [ 105.373134][ T5855] device veth0 entered promiscuous mode [ 105.611623][ T5868] device syzkaller0 entered promiscuous mode [ 105.633720][ T5870] loop5: detected capacity change from 0 to 512 [ 105.646418][ T5870] EXT4-fs: Ignoring removed nobh option [ 105.661596][ T5870] EXT4-fs (loop5): Test dummy encryption mode enabled [ 105.666740][ T5870] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 105.686719][ T5870] EXT4-fs (loop5): 1 truncate cleaned up [ 105.689007][ T5870] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 106.050160][ T5854] device veth0 left promiscuous mode [ 106.944664][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 108.467514][ T5954] loop0: detected capacity change from 0 to 512 [ 108.476057][ T5954] FAT-fs (loop0): Unrecognized mount option "01777777777777777777777’’’’18446744073709551615’’’’0xffffffffffffffff18446744073709551615" or missing value [ 108.529689][ T5961] loop1: detected capacity change from 0 to 8 [ 109.002838][ T5975] FAULT_INJECTION: forcing a failure. [ 109.002838][ T5975] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 109.008036][ T5975] CPU: 1 PID: 5975 Comm: syz.4.458 Not tainted syzkaller #0 [ 109.009507][ T5975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 109.011410][ T5975] Call trace: [ 109.012019][ T5975] dump_backtrace+0x1c4/0x1f0 [ 109.012905][ T5975] show_stack+0x2c/0x3c [ 109.013696][ T5975] __dump_stack+0x30/0x40 [ 109.014482][ T5975] dump_stack_lvl+0xf4/0x15c [ 109.015354][ T5975] dump_stack+0x1c/0x5c [ 109.016145][ T5975] should_fail_ex+0x3cc/0x524 [ 109.017041][ T5975] should_fail_alloc_page+0x74/0xb8 [ 109.018105][ T5975] prepare_alloc_pages+0x1b8/0x4f0 [ 109.019131][ T5975] __alloc_pages+0x134/0x544 [ 109.020003][ T5975] alloc_pages+0x434/0x6fc [ 109.020844][ T5975] skb_copy_ubufs+0x714/0x14d8 [ 109.021747][ T5975] __skb_tstamp_tx+0x428/0x6c4 [ 109.022669][ T5975] __dev_queue_xmit+0x18f8/0x3154 [ 109.023621][ T5975] ip_finish_output2+0xc08/0x10a8 [ 109.024548][ T5975] __ip_finish_output+0x1b0/0x448 [ 109.025502][ T5975] ip_finish_output+0x40/0x264 [ 109.026397][ T5975] ip_output+0x3b4/0x554 [ 109.027195][ T5975] ip_send_skb+0x138/0x2b4 [ 109.028007][ T5975] udp_send_skb+0x7dc/0x12c8 [ 109.028902][ T5975] udp_sendmsg+0x147c/0x1db0 [ 109.029804][ T5975] inet_sendmsg+0x154/0x27c [ 109.030649][ T5975] ____sys_sendmsg+0x588/0x90c [ 109.031518][ T5975] __sys_sendmmsg+0x320/0x7ec [ 109.032415][ T5975] __arm64_sys_sendmmsg+0xa4/0xc0 [ 109.033398][ T5975] invoke_syscall+0x98/0x290 [ 109.034302][ T5975] el0_svc_common+0x13c/0x258 [ 109.035221][ T5975] do_el0_svc+0x5c/0x134 [ 109.036053][ T5975] el0_svc+0x58/0x128 [ 109.036828][ T5975] el0t_64_sync_handler+0x84/0xf0 [ 109.037786][ T5975] el0t_64_sync+0x18c/0x190 [ 109.415887][ T5992] loop5: detected capacity change from 0 to 256 [ 109.472012][ T5994] netlink: 8 bytes leftover after parsing attributes in process `syz.0.453'. [ 109.490757][ T5996] loop5: detected capacity change from 0 to 1024 [ 109.519121][ T5996] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 109.592273][ T6001] binder: 6000:6001 tried to acquire reference to desc 0, got 1 instead [ 109.597607][ T6001] binder: 6000:6001 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 109.599943][ T6001] binder: 6001 RLIMIT_NICE not set [ 109.601024][ T6001] binder: 6001 RLIMIT_NICE not set [ 109.602132][ T6001] binder: 6000:6001 ioctl c0306201 0 returned -14 [ 109.603478][ T6001] binder: release 6000:6001 transaction 24 in, still active [ 109.605338][ T6001] binder: send failed reply for transaction 24 to 6000:6001 [ 109.607454][ T14] binder: undelivered TRANSACTION_COMPLETE [ 109.608599][ T14] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.652901][ T6003] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 109.655484][ T6003] overlayfs: failed to set xattr on upper [ 109.658272][ T6003] overlayfs: ...falling back to index=off,metacopy=off. [ 110.011270][ T6021] netlink: 4 bytes leftover after parsing attributes in process `syz.3.466'. [ 110.013042][ T6021] netlink: 8 bytes leftover after parsing attributes in process `syz.3.466'. [ 110.113848][ T6033] netlink: 12 bytes leftover after parsing attributes in process `syz.0.472'. [ 110.122600][ T6033] netlink: 4 bytes leftover after parsing attributes in process `syz.0.472'. [ 110.125866][ T6033] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.127473][ T6033] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.128876][ T6033] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.130208][ T6033] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 110.160536][ T6036] netlink: 56 bytes leftover after parsing attributes in process `syz.0.473'. [ 110.182244][ T14] kernel write not supported for file /uhid (pid: 14 comm: kworker/0:1) [ 110.503021][ T4763] EXT4-fs (loop5): unmounting filesystem. [ 110.684421][ T6052] netlink: 16 bytes leftover after parsing attributes in process `syz.0.481'. [ 110.731114][ T6057] loop0: detected capacity change from 0 to 512 [ 110.734951][ T6057] EXT4-fs: inline encryption not supported [ 110.743745][ T6057] EXT4-fs (loop0): Test dummy encryption mode enabled [ 110.748483][ T6057] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 110.764795][ T6057] EXT4-fs error (device loop0): ext4_orphan_get:1435: comm syz.0.482: bad orphan inode 131083 [ 110.767383][ T6057] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 110.798306][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 111.004040][ T6076] overlayfs: failed to clone upperpath [ 111.060295][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 111.062526][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 111.066324][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 111.068344][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 111.070094][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 111.071554][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 111.175806][ T6077] chnl_net:caif_netlink_parms(): no params data found [ 111.193007][ T6077] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.194999][ T6077] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.196770][ T6077] device bridge_slave_0 entered promiscuous mode [ 111.200172][ T6077] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.201682][ T6077] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.203526][ T6077] device bridge_slave_1 entered promiscuous mode [ 111.212153][ T6077] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 111.215552][ T6077] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 111.226382][ T6077] team0: Port device team_slave_0 added [ 111.229053][ T6077] team0: Port device team_slave_1 added [ 111.236959][ T6077] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.238391][ T6077] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.243013][ T6077] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.247306][ T6077] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.248674][ T6077] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.253462][ T6077] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.315827][ T6077] device hsr_slave_0 entered promiscuous mode [ 111.344820][ T48] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 111.346720][ T48] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 111.349432][ T48] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 111.351455][ T48] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 111.352927][ T48] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 111.355164][ T6077] device hsr_slave_1 entered promiscuous mode [ 111.361811][ T48] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 111.440759][ T6077] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 111.496323][ T6077] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 111.517714][ T6077] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 111.567983][ T6077] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 111.623636][ T6077] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.625199][ T6077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.626501][ T6077] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.627772][ T6077] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.655230][ T6105] chnl_net:caif_netlink_parms(): no params data found [ 111.673305][ T6077] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.683206][ T5500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 111.685618][ T5500] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.687636][ T5500] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.693976][ T6105] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.695604][ T6105] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.697265][ T6105] device bridge_slave_0 entered promiscuous mode [ 111.699388][ T6105] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.700826][ T6105] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.702538][ T6105] device bridge_slave_1 entered promiscuous mode [ 111.712580][ T6077] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.716345][ T6105] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 111.719585][ T6105] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 111.729818][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 111.731628][ T4673] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.732952][ T4673] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.742523][ T6105] team0: Port device team_slave_0 added [ 111.746086][ T6105] team0: Port device team_slave_1 added [ 111.750116][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 111.751900][ T4673] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.753137][ T4673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.756762][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 111.758830][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 111.772292][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 111.773998][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 111.776556][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 111.779894][ T6077] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 111.784661][ T6105] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.786133][ T6105] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.790812][ T6105] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.794954][ T6105] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.796517][ T6105] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.801462][ T6105] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.848759][ T6105] device hsr_slave_0 entered promiscuous mode [ 111.884539][ T6105] device hsr_slave_1 entered promiscuous mode [ 111.934357][ T6105] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 111.935689][ T6105] Cannot create hsr debugfs directory [ 111.972238][ T6077] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.975823][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 111.977290][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 112.003792][ T6105] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 112.045960][ T6105] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 112.096206][ T6105] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 112.135514][ T6105] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 112.203429][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 112.205863][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 112.216300][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 112.217925][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 112.219691][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 112.221134][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 112.231013][ T6077] device veth0_vlan entered promiscuous mode [ 112.236684][ T6105] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.239413][ T6077] device veth1_vlan entered promiscuous mode [ 112.245412][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 112.246981][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 112.248596][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 112.250238][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 112.253916][ T6105] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.257854][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 112.259501][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 112.261158][ T753] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.262425][ T753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.263931][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 112.272597][ T6077] device veth0_macvtap entered promiscuous mode [ 112.275243][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 112.277103][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 112.278717][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 112.282921][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 112.285190][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 112.286820][ T5354] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.288143][ T5354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.289566][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 112.297992][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 112.301233][ T6077] device veth1_macvtap entered promiscuous mode [ 112.304128][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 112.307453][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 112.310900][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 112.317859][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 112.319650][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 112.324797][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 112.331870][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 112.336508][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 112.339899][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.341868][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.343835][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.346304][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.348171][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.350365][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.352257][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.354896][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.357580][ T6077] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.359473][ T6105] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 112.361810][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 112.363570][ T5354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 112.372650][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.376094][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.380044][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.387501][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.389209][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.391018][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.392735][ T6077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.395197][ T6077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.397696][ T6077] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.400432][ T6077] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.401901][ T6077] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.403606][ T6077] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.409399][ T6077] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.452546][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 112.456205][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 112.469771][ T4673] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.472059][ T4673] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.485339][ T753] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 113.145172][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 113.273968][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.275664][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.277047][ T5500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 113.298629][ T27] audit: type=1326 audit(113.290:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.330235][ T27] audit: type=1326 audit(113.320:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.335736][ T27] audit: type=1326 audit(113.330:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.339604][ T27] audit: type=1326 audit(113.330:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.343509][ T27] audit: type=1326 audit(113.330:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.373178][ T6105] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.374796][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 113.376196][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 113.393853][ T6149] loop4: detected capacity change from 0 to 512 [ 113.408813][ T27] audit: type=1326 audit(113.330:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.434797][ T48] Bluetooth: hci4: command 0x0409 tx timeout [ 113.438573][ T27] audit: type=1326 audit(113.330:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.451257][ T6149] EXT4-fs error (device loop4): ext4_orphan_get:1435: comm syz.4.505: bad orphan inode 15 [ 113.452931][ T6149] ext4_test_bit(bit=14, block=5) = 0 [ 113.454971][ T6149] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 113.463873][ T6152] netlink: 40 bytes leftover after parsing attributes in process `syz.1.506'. [ 113.469896][ T27] audit: type=1326 audit(113.330:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6145 comm="syz.1.504" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff7f979368 code=0x7ffc0000 [ 113.591553][ T6159] ip_tables: iptables: counters copy to user failed while replacing table [ 113.728425][ T6165] netlink: 16 bytes leftover after parsing attributes in process `syz.4.505'. [ 114.377818][ T6169] Injecting memory failure for pfn 0x137617 at process virtual address 0x20000000 [ 114.450043][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 114.451910][ T4622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 114.467861][ T6175] loop6: detected capacity change from 0 to 256 [ 114.500208][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 114.502014][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 114.503768][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 114.506468][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 114.519142][ T6105] device veth0_vlan entered promiscuous mode [ 114.606354][ T6105] device veth1_vlan entered promiscuous mode [ 114.623625][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 114.625615][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 114.627701][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 114.629768][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 114.633496][ T6105] device veth0_macvtap entered promiscuous mode [ 114.642072][ T6105] device veth1_macvtap entered promiscuous mode [ 114.714142][ C0] sched: RT throttling activated [ 114.722603][ T6169] Memory failure: 0x137617: recovery action for dirty LRU page: Recovered [ 114.732739][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 114.737107][ T6169] Injecting memory failure for pfn 0x210db1 at process virtual address 0x20001000 [ 114.739408][ T6169] Memory failure: 0x210db1: recovery action for reserved kernel page: Ignored [ 115.195302][ T4344] Bluetooth: hci0: command 0x041b tx timeout [ 115.389805][ T6191] bpf setsockopt: ignoring program buffer with optlen=4609 (max_optlen=4096) [ 115.724896][ T4344] Bluetooth: hci4: command 0x041b tx timeout [ 115.748076][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.749907][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.751568][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.761732][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.764097][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.767327][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.769529][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.771635][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.944206][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.946598][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.951381][ T6105] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.953675][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 115.956360][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 115.958026][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 115.959607][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 115.973144][ T6198] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 116.004314][ T6198] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 116.008493][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.010297][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.011992][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.018359][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.020132][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.021877][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.024452][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.026146][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.027798][ T6105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.029960][ T6105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.033027][ T6105] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.039085][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 116.040824][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 116.044539][ T6105] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.046027][ T6105] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.047398][ T6105] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.050996][ T6105] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.110309][ T6212] netlink: 12 bytes leftover after parsing attributes in process `syz.6.526'. [ 116.132985][ T5500] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.134481][ T5500] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.149302][ T5500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 116.154085][ T5500] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.159692][ T5500] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.160962][ T4394] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 116.217196][ T48] Bluetooth: hci3: unexpected cc 0x1407 length: 11 > 9 [ 116.762092][ T6234] FAULT_INJECTION: forcing a failure. [ 116.762092][ T6234] name failslab, interval 1, probability 0, space 0, times 0 [ 116.768182][ T6234] CPU: 1 PID: 6234 Comm: syz.6.532 Not tainted syzkaller #0 [ 116.769528][ T6234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 116.771318][ T6234] Call trace: [ 116.771922][ T6234] dump_backtrace+0x1c4/0x1f0 [ 116.772805][ T6234] show_stack+0x2c/0x3c [ 116.773580][ T6234] __dump_stack+0x30/0x40 [ 116.774389][ T6234] dump_stack_lvl+0xf4/0x15c [ 116.775254][ T6234] dump_stack+0x1c/0x5c [ 116.776038][ T6234] should_fail_ex+0x3cc/0x524 [ 116.776908][ T6234] __should_failslab+0xc0/0x11c [ 116.777831][ T6234] should_failslab+0x10/0x28 [ 116.778678][ T6234] kmem_cache_alloc_node+0x8c/0x344 [ 116.779641][ T6234] alloc_vmap_area+0x13c/0x169c [ 116.780557][ T6234] __get_vm_area_node+0x178/0x31c [ 116.781490][ T6234] __vmalloc_node_range+0x1d4/0xe70 [ 116.782417][ T6234] __vmalloc+0xa4/0xe0 [ 116.783166][ T6234] bpf_prog_alloc_no_stats+0x4c/0x3a0 [ 116.784157][ T6234] bpf_prog_alloc+0x38/0x1dc [ 116.785014][ T6234] bpf_prog_create_from_user+0x9c/0x464 [ 116.786035][ T6234] do_seccomp+0x900/0xea4 [ 116.786842][ T6234] __arm64_sys_seccomp+0x7c/0x90 [ 116.787727][ T6234] invoke_syscall+0x98/0x290 [ 116.788550][ T6234] el0_svc_common+0x13c/0x258 [ 116.789419][ T6234] do_el0_svc+0x5c/0x134 [ 116.790232][ T6234] el0_svc+0x58/0x128 [ 116.790936][ T6234] el0t_64_sync_handler+0x84/0xf0 [ 116.791836][ T6234] el0t_64_sync+0x18c/0x190 [ 116.792968][ T6234] syz.6.532: vmalloc error: size 4096, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=syz6,mems_allowed=0 [ 116.796603][ T6234] CPU: 0 PID: 6234 Comm: syz.6.532 Not tainted syzkaller #0 [ 116.797798][ T6234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 116.799536][ T6234] Call trace: [ 116.800108][ T6234] dump_backtrace+0x1c4/0x1f0 [ 116.800931][ T6234] show_stack+0x2c/0x3c [ 116.801691][ T6234] __dump_stack+0x30/0x40 [ 116.802461][ T6234] dump_stack_lvl+0xf4/0x15c [ 116.803281][ T6234] dump_stack+0x1c/0x5c [ 116.804068][ T6234] warn_alloc+0x214/0x324 [ 116.804862][ T6234] __vmalloc_node_range+0x24c/0xe70 [ 116.805827][ T6234] __vmalloc+0xa4/0xe0 [ 116.806576][ T6234] bpf_prog_alloc_no_stats+0x4c/0x3a0 [ 116.807562][ T6234] bpf_prog_alloc+0x38/0x1dc [ 116.808379][ T6234] bpf_prog_create_from_user+0x9c/0x464 [ 116.809358][ T6234] do_seccomp+0x900/0xea4 [ 116.810138][ T6234] __arm64_sys_seccomp+0x7c/0x90 [ 116.811057][ T6234] invoke_syscall+0x98/0x290 [ 116.811872][ T6234] el0_svc_common+0x13c/0x258 [ 116.812725][ T6234] do_el0_svc+0x5c/0x134 [ 116.813496][ T6234] el0_svc+0x58/0x128 [ 116.814237][ T6234] el0t_64_sync_handler+0x84/0xf0 [ 116.815139][ T6234] el0t_64_sync+0x18c/0x190 [ 116.819315][ T6234] Mem-Info: [ 116.819890][ T6234] active_anon:9166 inactive_anon:0 isolated_anon:0 [ 116.819890][ T6234] active_file:5062 inactive_file:2241 isolated_file:0 [ 116.819890][ T6234] unevictable:768 dirty:291 writeback:0 [ 116.819890][ T6234] slab_reclaimable:19780 slab_unreclaimable:95397 [ 116.819890][ T6234] mapped:29319 shmem:3813 pagetables:754 [ 116.819890][ T6234] sec_pagetables:0 bounce:0 [ 116.819890][ T6234] kernel_misc_reclaimable:0 [ 116.819890][ T6234] free:1434629 free_pcp:4341 free_cma:7360 [ 116.831877][ T6234] Node 0 active_anon:37064kB inactive_anon:0kB active_file:20248kB inactive_file:8964kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:117676kB dirty:1164kB writeback:0kB shmem:15652kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:9008kB pagetables:3016kB sec_pagetables:0kB all_unreclaimable? no [ 116.838756][ T6234] Node 0 DMA free:3076864kB boost:0kB min:20664kB low:25828kB high:30992kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:29440kB [ 116.850563][ T6234] lowmem_reserve[]: 0 0 3550 3550 3550 [ 116.851845][ T6234] Node 0 Normal free:2657368kB boost:0kB min:24388kB low:30484kB high:36580kB reserved_highatomic:0KB active_anon:41064kB inactive_anon:0kB active_file:20248kB inactive_file:8964kB unevictable:3072kB writepending:1164kB present:5242880kB managed:3639600kB mlocked:0kB bounce:0kB free_pcp:16920kB local_pcp:5480kB free_cma:0kB [ 116.857642][ T6234] lowmem_reserve[]: 0 0 0 0 0 [ 116.858726][ T6234] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 0*2048kB 751*4096kB (MC) = 3076864kB [ 116.861604][ T6234] Node 0 Normal: 22*4kB (UME) 2*8kB (UE) 1*16kB (U) 200*32kB (ME) 58*64kB (M) 21*128kB (UME) 26*256kB (ME) 54*512kB (UME) 11*1024kB (UME) 6*2048kB (UM) 631*4096kB (UM) = 2655352kB [ 116.868621][ T6234] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 116.870624][ T6234] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 116.872591][ T6234] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 116.875772][ T6234] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 116.877409][ T6234] 13566 total pagecache pages [ 116.878630][ T6234] 0 pages in swap cache [ 116.879376][ T6234] Free swap = 124484kB [ 116.880321][ T6234] Total swap = 124996kB [ 116.880968][ T6234] 2097152 pages RAM [ 116.881770][ T6234] 0 pages HighMem/MovableOnly [ 116.882582][ T6234] 417204 pages reserved [ 116.883656][ T6234] 8192 pages cma reserved [ 116.891184][ T6234] 34 pages hwpoisoned [ 117.014071][ T6242] netlink: 60 bytes leftover after parsing attributes in process `syz.1.533'. [ 117.719435][ T6259] FAULT_INJECTION: forcing a failure. [ 117.719435][ T6259] name failslab, interval 1, probability 0, space 0, times 0 [ 117.721780][ T6259] CPU: 1 PID: 6259 Comm: syz.1.540 Not tainted syzkaller #0 [ 117.722975][ T6259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 117.724667][ T6259] Call trace: [ 117.725261][ T6259] dump_backtrace+0x1c4/0x1f0 [ 117.726152][ T6259] show_stack+0x2c/0x3c [ 117.726938][ T6259] __dump_stack+0x30/0x40 [ 117.727779][ T6259] dump_stack_lvl+0xf4/0x15c [ 117.728646][ T6259] dump_stack+0x1c/0x5c [ 117.729417][ T6259] should_fail_ex+0x3cc/0x524 [ 117.730302][ T6259] __should_failslab+0xc0/0x11c [ 117.731233][ T6259] should_failslab+0x10/0x28 [ 117.732051][ T6259] __kmem_cache_alloc_node+0x7c/0x318 [ 117.733041][ T6259] __kmalloc_node+0xc8/0x184 [ 117.733892][ T6259] kvmalloc_node+0x88/0x1d4 [ 117.734744][ T6259] simple_xattr_set+0xac/0x498 [ 117.735620][ T6259] shmem_xattr_handler_set+0x5c/0xf4 [ 117.736613][ T6259] __vfs_setxattr+0x374/0x390 [ 117.737504][ T6259] __vfs_setxattr_noperm+0x120/0x56c [ 117.738497][ T6259] __vfs_setxattr_locked+0x1e8/0x214 [ 117.739531][ T6259] vfs_setxattr+0x158/0x2a8 [ 117.740495][ T6259] setxattr+0x258/0x2d8 [ 117.741266][ T6259] path_setxattr+0x130/0x260 [ 117.742162][ T6259] __arm64_sys_setxattr+0xc4/0xe0 [ 117.743118][ T6259] invoke_syscall+0x98/0x290 [ 117.743997][ T6259] el0_svc_common+0x13c/0x258 [ 117.744890][ T6259] do_el0_svc+0x5c/0x134 [ 117.745704][ T6259] el0_svc+0x58/0x128 [ 117.746463][ T6259] el0t_64_sync_handler+0x84/0xf0 [ 117.747439][ T6259] el0t_64_sync+0x18c/0x190 [ 117.971788][ T6280] loop6: detected capacity change from 0 to 512 [ 117.983425][ T6280] EXT4-fs error (device loop6): ext4_clear_blocks:883: inode #13: comm syz.6.550: attempt to clear invalid blocks 2 len 1 [ 117.988106][ T6280] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 117.991275][ T6280] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.550: invalid indirect mapped block 1819239214 (level 0) [ 117.994440][ T6280] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.550: invalid indirect mapped block 1819239214 (level 1) [ 118.000242][ T6280] EXT4-fs (loop6): 1 truncate cleaned up [ 118.001219][ T6280] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 118.052073][ T6286] FAULT_INJECTION: forcing a failure. [ 118.052073][ T6286] name failslab, interval 1, probability 0, space 0, times 0 [ 118.056613][ T6286] CPU: 0 PID: 6286 Comm: syz.4.552 Not tainted syzkaller #0 [ 118.057960][ T6286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 118.059892][ T6286] Call trace: [ 118.060519][ T6286] dump_backtrace+0x1c4/0x1f0 [ 118.061424][ T6286] show_stack+0x2c/0x3c [ 118.062245][ T6286] __dump_stack+0x30/0x40 [ 118.063112][ T6286] dump_stack_lvl+0xf4/0x15c [ 118.063928][ T6286] dump_stack+0x1c/0x5c [ 118.064674][ T6286] should_fail_ex+0x3cc/0x524 [ 118.065492][ T6286] __should_failslab+0xc0/0x11c [ 118.066335][ T6286] should_failslab+0x10/0x28 [ 118.067142][ T6286] kmem_cache_alloc+0x88/0x310 [ 118.068016][ T6286] radix_tree_node_alloc+0xa0/0x348 [ 118.068958][ T6286] idr_get_free+0x25c/0x8c4 [ 118.069726][ T6286] idr_alloc+0x160/0x29c [ 118.070502][ T6286] loop_add+0x15c/0x810 [ 118.071274][ T6286] loop_control_ioctl+0x130/0x514 [ 118.072209][ T6286] __arm64_sys_ioctl+0x14c/0x1c8 [ 118.073062][ T6286] invoke_syscall+0x98/0x290 [ 118.073903][ T6286] el0_svc_common+0x13c/0x258 [ 118.074733][ T6286] do_el0_svc+0x5c/0x134 [ 118.075483][ T6286] el0_svc+0x58/0x128 [ 118.076205][ T6286] el0t_64_sync_handler+0x84/0xf0 [ 118.077117][ T6286] el0t_64_sync+0x18c/0x190 [ 118.102505][ T6289] binder: 6288 invalid dec weak, ref 26 desc 0 s 1 w 0 [ 118.496834][ T6301] loop7: detected capacity change from 0 to 512 [ 118.527536][ T6301] EXT4-fs: Ignoring removed bh option [ 118.585319][ T6301] EXT4-fs (loop7): Test dummy encryption mode enabled [ 118.880134][ T6077] EXT4-fs (loop6): unmounting filesystem. [ 118.922084][ T6301] EXT4-fs error (device loop7): ext4_xattr_inode_iget:401: comm syz.7.555: inode #1: comm syz.7.555: iget: illegal inode # [ 118.928555][ T6301] EXT4-fs error (device loop7): ext4_xattr_inode_iget:406: comm syz.7.555: error while reading EA inode 1 err=-117 [ 118.991763][ T6301] EXT4-fs (loop7): 1 orphan inode deleted [ 118.993080][ T6301] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 119.017022][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 119.354011][ T6341] loop1: detected capacity change from 0 to 512 [ 119.383619][ T6341] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.564: bad orphan inode 15 [ 119.385981][ T6341] ext4_test_bit(bit=14, block=5) = 0 [ 119.387352][ T6341] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 119.683769][ T6351] netlink: 16 bytes leftover after parsing attributes in process `syz.1.564'. [ 122.752917][ T6330] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 122.767845][ T6283] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 123.170884][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 123.210051][ T6369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.569'. [ 123.211640][ T6369] netlink: 12 bytes leftover after parsing attributes in process `syz.1.569'. [ 123.229694][ T6369] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.231409][ T6369] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.232781][ T6369] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.234297][ T6369] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.245005][ T6369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.569'. [ 123.247928][ T6369] netlink: 12 bytes leftover after parsing attributes in process `syz.1.569'. [ 123.282084][ T6373] netlink: 8 bytes leftover after parsing attributes in process `syz.4.570'. [ 123.283672][ T6373] netlink: 12 bytes leftover after parsing attributes in process `syz.4.570'. [ 123.302817][ T6373] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.304441][ T6373] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.306010][ T6373] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.307564][ T6373] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 123.409988][ T6373] netlink: 8 bytes leftover after parsing attributes in process `syz.4.570'. [ 123.411786][ T6373] netlink: 12 bytes leftover after parsing attributes in process `syz.4.570'. [ 123.441709][ T6382] FAULT_INJECTION: forcing a failure. [ 123.441709][ T6382] name failslab, interval 1, probability 0, space 0, times 0 [ 123.444203][ T6382] CPU: 1 PID: 6382 Comm: syz.1.574 Not tainted syzkaller #0 [ 123.445610][ T6382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 123.447530][ T6382] Call trace: [ 123.448155][ T6382] dump_backtrace+0x1c4/0x1f0 [ 123.449058][ T6382] show_stack+0x2c/0x3c [ 123.449859][ T6382] __dump_stack+0x30/0x40 [ 123.450676][ T6382] dump_stack_lvl+0xf4/0x15c [ 123.451573][ T6382] dump_stack+0x1c/0x5c [ 123.452392][ T6382] should_fail_ex+0x3cc/0x524 [ 123.453285][ T6382] __should_failslab+0xc0/0x11c [ 123.454246][ T6382] should_failslab+0x10/0x28 [ 123.455123][ T6382] __kmem_cache_alloc_node+0x7c/0x318 [ 123.456164][ T6382] __kmalloc+0xc4/0x180 [ 123.456965][ T6382] sk_prot_alloc+0xc4/0x1e8 [ 123.457866][ T6382] sk_alloc+0x44/0x3a0 [ 123.458614][ T6382] tun_chr_open+0x7c/0x43c [ 123.459440][ T6382] misc_open+0x310/0x388 [ 123.460253][ T6382] chrdev_open+0x3d0/0x51c [ 123.461100][ T6382] do_dentry_open+0x738/0xf8c [ 123.462004][ T6382] vfs_open+0x7c/0x90 [ 123.462733][ T6382] path_openat+0x1fc0/0x27a0 [ 123.463604][ T6382] do_filp_open+0x198/0x38c [ 123.464454][ T6382] do_sys_openat2+0x134/0x3fc [ 123.465316][ T6382] __arm64_sys_openat+0x11c/0x150 [ 123.466305][ T6382] invoke_syscall+0x98/0x290 [ 123.467218][ T6382] el0_svc_common+0x13c/0x258 [ 123.468120][ T6382] do_el0_svc+0x5c/0x134 [ 123.468957][ T6382] el0_svc+0x58/0x128 [ 123.469699][ T6382] el0t_64_sync_handler+0x84/0xf0 [ 123.470674][ T6382] el0t_64_sync+0x18c/0x190 [ 124.520456][ T6406] netlink: 16 bytes leftover after parsing attributes in process `syz.6.584'. [ 124.581091][ T6410] netlink: 8 bytes leftover after parsing attributes in process `syz.7.586'. [ 125.027617][ T6421] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 125.030607][ T6421] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 125.059792][ T6421] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 125.414626][ T6422] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 125.421294][ T6422] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 125.498043][ T6422] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 125.533625][ T6431] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 125.547492][ T6436] binder: 6435:6436 ioctl c0306201 20000080 returned -14 [ 125.554307][ T6436] binder: 6435:6436 tried to acquire reference to desc 0, got 1 instead [ 125.555730][ T6436] binder: 6435:6436 ioctl c0306201 200003c0 returned -14 [ 125.557153][ T6436] binder: 6435:6436 got transaction with invalid parent offset or type [ 125.558616][ T6436] binder: 6436:6435 failed to fixup parent [ 125.567532][ T6436] binder: 6435:6436 transaction call to 6435:0 failed 31/29201/-22, size 112-24 line 3557 [ 125.572037][ T14] binder: undelivered TRANSACTION_ERROR: 29201 [ 125.595584][ T14] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 125.601446][ T14] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 125.650336][ T6441] fido_id[6441]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 125.679020][ T6447] binder: 6446:6447 tried to acquire reference to desc 0, got 1 instead [ 125.681067][ T6447] binder: tried to use weak ref as strong ref [ 125.682260][ T6447] binder: 6446:6447 got transaction to invalid handle, 1 [ 125.686170][ T6447] binder: 6447:6446 cannot find target node [ 125.687209][ T6447] binder: 6446:6447 transaction async to 0:0 failed 43/29201/-22, size 0-0 line 3062 [ 125.700731][ T6386] binder: undelivered TRANSACTION_COMPLETE [ 125.722096][ T6386] binder: undelivered TRANSACTION_ERROR: 29201 [ 125.723281][ T6386] binder: undelivered transaction 36, process died. [ 125.761365][ T6454] binder: 6453:6454 ioctl 4018620d 0 returned -22 [ 126.249693][ T2064] ieee802154 phy0 wpan0: encryption failed: -22 [ 126.253803][ T2064] ieee802154 phy1 wpan1: encryption failed: -22 [ 126.454916][ T6464] binder: 6462:6464 tried to acquire reference to desc 0, got 1 instead [ 126.457351][ T6471] binder: 6462:6471 got transaction with invalid parent offset or type [ 126.459050][ T6471] binder: 6462:6471 transaction async to 6462:0 failed 48/29201/-22, size 80-24 line 3456 [ 126.461519][ T4382] binder: undelivered TRANSACTION_ERROR: 29201 [ 126.484961][ T6473] loop4: detected capacity change from 0 to 1024 [ 126.512518][ T6473] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 126.519157][ T6473] EXT4-fs error (device loop4): ext4_free_blocks:6220: comm syz.4.608: Freeing blocks not in datazone - block = 0, count = 16 [ 126.530483][ T6473] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.608: bg 0: block 112: padding at end of block bitmap is not set [ 126.537554][ T6473] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 126.556586][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 126.592510][ T6478] loop4: detected capacity change from 0 to 512 [ 126.628837][ T6478] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 126.676041][ T6487] loop7: detected capacity change from 0 to 512 [ 126.692981][ T6489] device sit0 entered promiscuous mode [ 126.715339][ T6478] EXT4-fs error (device loop4): ext4_xattr_block_get:543: inode #15: comm syz.4.609: corrupted xattr block 33 [ 126.720516][ T6478] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 126.720925][ T6487] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.611: bad orphan inode 15 [ 126.729194][ T6489] netlink: 'syz.6.621': attribute type 1 has an invalid length. [ 126.738421][ T6470] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 1 with error 28 [ 126.740572][ T6470] EXT4-fs (loop4): This should not happen!! Data will be lost [ 126.740572][ T6470] [ 126.742311][ T6470] EXT4-fs (loop4): Total free blocks count 0 [ 126.742311][ T6487] ext4_test_bit(bit=14, block=5) = 0 [ 126.743288][ T6470] EXT4-fs (loop4): Free/Dirty block details [ 126.744269][ T6487] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 126.749698][ T6470] EXT4-fs (loop4): free_blocks=65280 [ 126.750730][ T6470] EXT4-fs (loop4): dirty_blocks=1 [ 126.763639][ T6470] EXT4-fs (loop4): Block reservation details [ 126.764664][ T6470] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 126.786761][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 127.667787][ T6498] loop1: detected capacity change from 0 to 512 [ 127.698203][ T6498] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.614: bad orphan inode 15 [ 127.730743][ T6498] ext4_test_bit(bit=14, block=5) = 0 [ 127.732092][ T6498] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 127.996827][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 128.155674][ T6516] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 128.157419][ T6516] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 128.161415][ T6516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.166357][ T6516] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.404110][ T6516] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 128.412469][ T6523] __nla_validate_parse: 6 callbacks suppressed [ 128.412481][ T6523] netlink: 9 bytes leftover after parsing attributes in process `syz.7.618'. [ 128.430194][ T6523] netlink: 9 bytes leftover after parsing attributes in process `syz.7.618'. [ 129.822940][ T6537] netlink: 'syz.3.626': attribute type 3 has an invalid length. [ 130.356901][ T6552] device vlan2 entered promiscuous mode [ 130.382754][ T6552] netlink: 4 bytes leftover after parsing attributes in process `syz.7.629'. [ 130.400502][ T6552] device hsr_slave_0 left promiscuous mode [ 130.880202][ T6283] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 130.891817][ T6560] ip_tables: iptables: counters copy to user failed while replacing table [ 131.114889][ T6571] loop7: detected capacity change from 0 to 256 [ 131.117725][ T6570] ip_tables: iptables: counters copy to user failed while replacing table [ 131.610988][ T6578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.640'. [ 131.742596][ T6580] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 131.875153][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 131.978429][ T6580] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 132.024785][ T6584] loop6: detected capacity change from 0 to 1024 [ 132.040714][ T6584] EXT4-fs: Ignoring removed nobh option [ 132.045197][ T6584] EXT4-fs: Ignoring removed orlov option [ 132.055166][ T6584] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 132.116197][ T6584] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 132.192264][ T6077] EXT4-fs (loop6): unmounting filesystem. [ 132.260482][ T6605] netlink: 12 bytes leftover after parsing attributes in process `syz.6.648'. [ 132.334655][ T48] block nbd0: Receive control failed (result -107) [ 132.467633][ T6616] loop4: detected capacity change from 0 to 512 [ 132.475341][ T6612] loop6: detected capacity change from 0 to 512 [ 132.494821][ T6616] EXT4-fs: Ignoring removed bh option [ 132.501276][ T6616] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 132.574647][ T6612] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 132.611638][ T6616] EXT4-fs error (device loop4): ext4_iget_extra_inode:4763: inode #15: comm syz.4.652: corrupted in-inode xattr [ 132.614667][ T6616] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.652: couldn't read orphan inode 15 (err -117) [ 132.618651][ T6616] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 132.924862][ T6616] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.652: Unrecognised inode hash code 4 [ 132.926901][ T6616] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.652: Corrupt directory, running e2fsck is recommended [ 132.933109][ T6616] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.652: Unrecognised inode hash code 4 [ 132.934944][ T6616] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.652: Corrupt directory, running e2fsck is recommended [ 132.938953][ T6077] EXT4-fs (loop6): unmounting filesystem. [ 132.987187][ T4342] EXT4-fs (loop4): unmounting filesystem. [ 134.693398][ T6653] device gre0 entered promiscuous mode [ 134.714013][ T6653] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 134.740401][ T6655] loop6: detected capacity change from 0 to 128 [ 134.813818][ T6655] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 134.848836][ T6670] netlink: 'syz.4.667': attribute type 12 has an invalid length. [ 134.851220][ T6077] EXT4-fs (loop6): unmounting filesystem. [ 134.852781][ T6667] netlink: 4 bytes leftover after parsing attributes in process `syz.1.665'. [ 134.932153][ T6671] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 135.154475][ T6668] netlink: 20 bytes leftover after parsing attributes in process `syz.3.666'. [ 135.732015][ T6708] capability: warning: `syz.6.680' uses deprecated v2 capabilities in a way that may be insecure [ 135.743028][ T6710] loop7: detected capacity change from 0 to 512 [ 135.764956][ T6710] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.679: bad orphan inode 15 [ 135.767099][ T6710] ext4_test_bit(bit=14, block=5) = 0 [ 135.768015][ T6710] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 136.053900][ T6719] netlink: 16 bytes leftover after parsing attributes in process `syz.7.679'. [ 136.725067][ T6595] EXT4-fs error (device loop7): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 136.925620][ T6732] netlink: 'syz.4.688': attribute type 39 has an invalid length. [ 137.442956][ T6737] device veth0_macvtap left promiscuous mode [ 138.237149][ T6686] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 138.302147][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 138.302378][ T6747] ubi0: attaching mtd0 [ 138.304999][ T6747] ubi0 error: ubi_attach_mtd_dev: bad VID header (16) or data offsets (80) [ 139.269866][ T6760] netlink: 'syz.6.696': attribute type 18 has an invalid length. [ 139.671662][ T6784] loop7: detected capacity change from 0 to 4096 [ 139.676574][ T6784] EXT4-fs: Ignoring removed orlov option [ 139.682365][ T6784] EXT4-fs (loop7): Test dummy encryption mode enabled [ 139.730292][ T6784] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 139.780600][ T3994] device veth0_macvtap entered promiscuous mode [ 139.847182][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 139.881892][ T27] audit: type=1326 audit(139.722:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6797 comm="syz.3.706" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf379368 code=0x7ffc0000 [ 139.888475][ T27] audit: type=1326 audit(139.722:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6797 comm="syz.3.706" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=188 compat=0 ip=0xffffaf379368 code=0x7ffc0000 [ 139.892234][ T27] audit: type=1326 audit(139.722:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6797 comm="syz.3.706" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf379368 code=0x7ffc0000 [ 140.233823][ T6844] FAULT_INJECTION: forcing a failure. [ 140.233823][ T6844] name failslab, interval 1, probability 0, space 0, times 0 [ 140.236004][ T6844] CPU: 1 PID: 6844 Comm: syz.6.719 Not tainted syzkaller #0 [ 140.237298][ T6844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 140.239059][ T6844] Call trace: [ 140.239656][ T6844] dump_backtrace+0x1c4/0x1f0 [ 140.240554][ T6844] show_stack+0x2c/0x3c [ 140.241329][ T6844] __dump_stack+0x30/0x40 [ 140.242179][ T6844] dump_stack_lvl+0xf4/0x15c [ 140.243080][ T6844] dump_stack+0x1c/0x5c [ 140.243882][ T6844] should_fail_ex+0x3cc/0x524 [ 140.244742][ T6844] __should_failslab+0xc0/0x11c [ 140.245611][ T6844] should_failslab+0x10/0x28 [ 140.246452][ T6844] __kmem_cache_alloc_node+0x7c/0x318 [ 140.247458][ T6844] __kmalloc+0xc4/0x180 [ 140.248250][ T6844] tcf_idr_create+0x74/0x664 [ 140.249143][ T6844] tcf_bpf_init+0x27c/0x6dc [ 140.250032][ T6844] tcf_action_init_1+0x388/0x614 [ 140.251000][ T6844] tcf_action_init+0x25c/0x8b0 [ 140.251936][ T6844] tc_ctl_action+0x304/0x9d8 [ 140.252784][ T6844] rtnetlink_rcv_msg+0x694/0xcc4 [ 140.253702][ T6844] netlink_rcv_skb+0x220/0x3ec [ 140.254585][ T6844] rtnetlink_rcv+0x28/0x38 [ 140.255433][ T6844] netlink_unicast+0x5fc/0x80c [ 140.256326][ T6844] netlink_sendmsg+0x6f0/0x9d8 [ 140.257198][ T6844] ____sys_sendmsg+0x588/0x90c [ 140.258068][ T6844] __sys_sendmsg+0x288/0x374 [ 140.258950][ T6844] __arm64_sys_sendmsg+0x80/0x94 [ 140.259880][ T6844] invoke_syscall+0x98/0x290 [ 140.260767][ T6844] el0_svc_common+0x13c/0x258 [ 140.261660][ T6844] do_el0_svc+0x5c/0x134 [ 140.262496][ T6844] el0_svc+0x58/0x128 [ 140.263272][ T6844] el0t_64_sync_handler+0x84/0xf0 [ 140.264219][ T6844] el0t_64_sync+0x18c/0x190 [ 141.522557][ T6894] loop4: detected capacity change from 0 to 128 [ 141.820112][ T6925] loop1: detected capacity change from 0 to 512 [ 141.932717][ T6937] netlink: 8 bytes leftover after parsing attributes in process `syz.6.745'. [ 141.939574][ T6937] netlink: 12 bytes leftover after parsing attributes in process `syz.6.745'. [ 141.945048][ T6937] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 141.946791][ T6937] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 141.948116][ T6937] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 141.949457][ T6937] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 141.962516][ T6937] IPv6: ADDRCONF(NETDEV_CHANGE): vxlan0: link becomes ready [ 142.714792][ T6925] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 142.750446][ T6925] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 142.770784][ T6938] device macsec1 entered promiscuous mode [ 142.806118][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 143.062331][ T6955] bond0: no command found in slaves file - use +ifname or -ifname [ 143.516888][ T6973] No such timeout policy "syz1" [ 144.403767][ T6998] netlink: 12 bytes leftover after parsing attributes in process `syz.1.758'. [ 145.223187][ T7002] FAULT_INJECTION: forcing a failure. [ 145.223187][ T7002] name failslab, interval 1, probability 0, space 0, times 0 [ 145.233183][ T7002] CPU: 0 PID: 7002 Comm: syz.4.762 Not tainted syzkaller #0 [ 145.234569][ T7002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 145.236526][ T7002] Call trace: [ 145.237113][ T7002] dump_backtrace+0x1c4/0x1f0 [ 145.237975][ T7002] show_stack+0x2c/0x3c [ 145.238675][ T7002] __dump_stack+0x30/0x40 [ 145.239468][ T7002] dump_stack_lvl+0xf4/0x15c [ 145.240305][ T7002] dump_stack+0x1c/0x5c [ 145.241081][ T7002] should_fail_ex+0x3cc/0x524 [ 145.241954][ T7002] __should_failslab+0xc0/0x11c [ 145.242861][ T7002] should_failslab+0x10/0x28 [ 145.243724][ T7002] slab_pre_alloc_hook+0x6c/0x31c [ 145.244656][ T7002] kmem_cache_alloc_lru+0x60/0x284 [ 145.245582][ T7002] sock_alloc_inode+0x2c/0xcc [ 145.246453][ T7002] new_inode_pseudo+0x68/0x1cc [ 145.247328][ T7002] __sock_create+0x138/0x8a8 [ 145.248164][ T7002] __sys_socket+0xc0/0x1b0 [ 145.248986][ T7002] __arm64_sys_socket+0x7c/0x94 [ 145.249851][ T7002] invoke_syscall+0x98/0x290 [ 145.250702][ T7002] el0_svc_common+0x13c/0x258 [ 145.251589][ T7002] do_el0_svc+0x5c/0x134 [ 145.252395][ T7002] el0_svc+0x58/0x128 [ 145.253154][ T7002] el0t_64_sync_handler+0x84/0xf0 [ 145.254099][ T7002] el0t_64_sync+0x18c/0x190 [ 145.320584][ T7002] socket: no more sockets [ 145.337449][ T7002] netlink: 264 bytes leftover after parsing attributes in process `syz.4.762'. [ 145.494388][ T7018] FAULT_INJECTION: forcing a failure. [ 145.494388][ T7018] name failslab, interval 1, probability 0, space 0, times 0 [ 145.514412][ T7018] CPU: 0 PID: 7018 Comm: syz.4.764 Not tainted syzkaller #0 [ 145.515925][ T7018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 145.517782][ T7018] Call trace: [ 145.518391][ T7018] dump_backtrace+0x1c4/0x1f0 [ 145.519275][ T7018] show_stack+0x2c/0x3c [ 145.520051][ T7018] __dump_stack+0x30/0x40 [ 145.520843][ T7018] dump_stack_lvl+0xf4/0x15c [ 145.521679][ T7018] dump_stack+0x1c/0x5c [ 145.522404][ T7018] should_fail_ex+0x3cc/0x524 [ 145.523213][ T7018] __should_failslab+0xc0/0x11c [ 145.524094][ T7018] should_failslab+0x10/0x28 [ 145.524965][ T7018] __kmem_cache_alloc_node+0x7c/0x318 [ 145.525967][ T7018] __kmalloc_node+0xc8/0x184 [ 145.526824][ T7018] crypto_create_tfm_node+0x90/0x338 [ 145.527786][ T7018] crypto_alloc_tfm_node+0x148/0x304 [ 145.528747][ T7018] crypto_alloc_shash+0x40/0x54 [ 145.529640][ T7018] x509_get_sig_params+0x158/0x418 [ 145.530576][ T7018] x509_cert_parse+0x3fc/0x6e0 [ 145.531438][ T7018] x509_key_preparse+0x74/0x5c8 [ 145.532289][ T7018] asymmetric_key_preparse+0xcc/0x17c [ 145.533243][ T7018] key_create_or_update+0x394/0x868 [ 145.534178][ T7018] __arm64_sys_add_key+0x40c/0x520 [ 145.535103][ T7018] invoke_syscall+0x98/0x290 [ 145.535944][ T7018] el0_svc_common+0x13c/0x258 [ 145.536806][ T7018] do_el0_svc+0x5c/0x134 [ 145.537599][ T7018] el0_svc+0x58/0x128 [ 145.538314][ T7018] el0t_64_sync_handler+0x84/0xf0 [ 145.539232][ T7018] el0t_64_sync+0x18c/0x190 [ 145.558377][ T7025] bridge0: port 3(syz_tun) entered blocking state [ 145.559762][ T7025] bridge0: port 3(syz_tun) entered disabled state [ 145.561691][ T7025] device syz_tun entered promiscuous mode [ 145.563282][ T7025] bridge0: port 3(syz_tun) entered blocking state [ 145.564419][ T7025] bridge0: port 3(syz_tun) entered forwarding state [ 145.584989][ T7025] bridge0: port 3(syz_tun) entered disabled state [ 145.599840][ T7025] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.616321][ T7025] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.093239][ T7045] overlayfs: failed to clone upperpath [ 146.095322][ T7045] overlayfs: failed to clone upperpath [ 146.463985][ T7064] binder: 7061:7064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 146.519556][ T7067] loop7: detected capacity change from 0 to 8192 [ 146.535447][ T7067] FAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 146.604884][ T7078] Injecting memory failure for pfn 0x210db1 at process virtual address 0x20001000 [ 146.606782][ T7078] Memory failure: 0x210db1: already hardware poisoned [ 146.619066][ T7078] loop6: detected capacity change from 0 to 256 [ 146.729332][ T7091] overlayfs: failed to clone upperpath [ 146.871808][ T7099] ksmbd: Unknown IPC event: 1, ignore. [ 147.243574][ T7114] loop1: detected capacity change from 0 to 512 [ 147.285591][ T7114] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.791: bad orphan inode 15 [ 147.287551][ T7114] ext4_test_bit(bit=14, block=5) = 0 [ 147.288455][ T7114] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 147.400546][ T7124] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 147.407087][ T27] audit: type=1326 audit(147.212:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7107 comm="syz.4.788" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffb1179368 code=0x0 [ 147.509901][ T7126] netlink: 16 bytes leftover after parsing attributes in process `syz.1.791'. [ 148.393728][ T7129] loop7: detected capacity change from 0 to 1024 [ 148.476050][ T7129] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 148.643201][ T7141] device ipvlan0 entered promiscuous mode [ 148.862830][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 149.342760][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 149.357726][ T7144] netlink: 8 bytes leftover after parsing attributes in process `syz.1.796'. [ 149.836917][ T7170] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 150.266896][ T7184] loop7: detected capacity change from 0 to 4096 [ 150.271819][ T7177] loop6: detected capacity change from 0 to 1024 [ 150.289526][ T7184] EXT4-fs: Ignoring removed i_version option [ 150.291557][ T7184] EXT4-fs: Ignoring removed mblk_io_submit option [ 150.334077][ T7184] EXT4-fs (loop7): Test dummy encryption mode enabled [ 150.343028][ T7177] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 2: comm syz.6.807: lblock 2 mapped to illegal pblock 2 (length 1) [ 150.348321][ T7184] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 150.353956][ T7177] Quota error (device loop6): qtree_write_dquot: dquota write failed [ 150.355300][ T7177] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 48: comm syz.6.807: lblock 0 mapped to illegal pblock 48 (length 1) [ 150.392906][ T7177] Quota error (device loop6): v2_write_file_info: Can't write info structure [ 150.394769][ T7177] EXT4-fs error (device loop6): ext4_acquire_dquot:6841: comm syz.6.807: Failed to acquire dquot type 0 [ 150.400230][ T7177] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 150.402853][ T7177] EXT4-fs error (device loop6): ext4_evict_inode:281: inode #11: comm syz.6.807: mark_inode_dirty error [ 150.411642][ T7177] EXT4-fs warning (device loop6): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 150.432584][ T7177] EXT4-fs (loop6): 1 orphan inode deleted [ 150.433685][ T7177] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 150.449811][ T7181] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:21: lblock 1 mapped to illegal pblock 1 (length 1) [ 150.453447][ T7181] Quota error (device loop6): remove_tree: Can't read quota data block 1 [ 150.454951][ T7181] EXT4-fs error (device loop6): ext4_release_dquot:6877: comm kworker/u4:21: Failed to release dquot type 0 [ 150.535858][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 150.609155][ T7213] FAULT_INJECTION: forcing a failure. [ 150.609155][ T7213] name failslab, interval 1, probability 0, space 0, times 0 [ 150.616220][ T7213] CPU: 0 PID: 7213 Comm: syz.7.815 Not tainted syzkaller #0 [ 150.617662][ T7213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 150.619479][ T7213] Call trace: [ 150.620104][ T7213] dump_backtrace+0x1c4/0x1f0 [ 150.620987][ T7213] show_stack+0x2c/0x3c [ 150.621377][ T7215] FAULT_INJECTION: forcing a failure. [ 150.621377][ T7215] name failslab, interval 1, probability 0, space 0, times 0 [ 150.621828][ T7213] __dump_stack+0x30/0x40 [ 150.624922][ T7213] dump_stack_lvl+0xf4/0x15c [ 150.625785][ T7213] dump_stack+0x1c/0x5c [ 150.626536][ T7213] should_fail_ex+0x3cc/0x524 [ 150.627422][ T7213] __should_failslab+0xc0/0x11c [ 150.628324][ T7213] should_failslab+0x10/0x28 [ 150.629184][ T7213] kmem_cache_alloc+0x88/0x310 [ 150.630215][ T7213] security_inode_alloc+0x38/0x11c [ 150.631306][ T7213] inode_init_always+0x6c8/0xb28 [ 150.632340][ T7213] new_inode_pseudo+0x7c/0x1cc [ 150.633299][ T7213] new_inode+0x38/0x174 [ 150.634079][ T7213] shmem_get_inode+0x2cc/0xa8c [ 150.634952][ T7213] shmem_mknod+0x64/0x1c4 [ 150.635756][ T7213] shmem_mkdir+0x38/0x78 [ 150.636554][ T7213] vfs_mkdir+0x314/0x4d8 [ 150.637343][ T7213] do_mkdirat+0x1b8/0x3ec [ 150.638138][ T7213] __arm64_sys_mkdirat+0x90/0xa8 [ 150.639088][ T7213] invoke_syscall+0x98/0x290 [ 150.639940][ T7213] el0_svc_common+0x13c/0x258 [ 150.640817][ T7213] do_el0_svc+0x5c/0x134 [ 150.641629][ T7213] el0_svc+0x58/0x128 [ 150.642386][ T7213] el0t_64_sync_handler+0x84/0xf0 [ 150.643293][ T7213] el0t_64_sync+0x18c/0x190 [ 150.922746][ T7215] CPU: 1 PID: 7215 Comm: syz.1.817 Not tainted syzkaller #0 [ 150.924043][ T7215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 150.925881][ T7215] Call trace: [ 150.926517][ T7215] dump_backtrace+0x1c4/0x1f0 [ 150.927392][ T7215] show_stack+0x2c/0x3c [ 150.928188][ T7215] __dump_stack+0x30/0x40 [ 150.928988][ T7215] dump_stack_lvl+0xf4/0x15c [ 150.929845][ T7215] dump_stack+0x1c/0x5c [ 150.930652][ T7215] should_fail_ex+0x3cc/0x524 [ 150.931490][ T7215] __should_failslab+0xc0/0x11c [ 150.932381][ T7215] should_failslab+0x10/0x28 [ 150.933236][ T7215] kmem_cache_alloc+0x88/0x310 [ 150.934130][ T7215] skb_clone+0x194/0x308 [ 150.934947][ T7215] __netlink_deliver_tap+0x364/0x6d8 [ 150.935980][ T7215] netlink_deliver_tap+0x1ac/0x1b0 [ 150.936956][ T7215] netlink_sendskb+0x78/0x164 [ 150.937860][ T7215] netlink_unicast+0x2cc/0x80c [ 150.938803][ T7215] netlink_ack+0xb14/0xf40 [ 150.939685][ T7215] netlink_rcv_skb+0x1fc/0x3ec [ 150.940555][ T7215] rtnetlink_rcv+0x28/0x38 [ 150.941316][ T7215] netlink_unicast+0x5fc/0x80c [ 150.942189][ T7215] netlink_sendmsg+0x6f0/0x9d8 [ 150.943053][ T7215] ____sys_sendmsg+0x588/0x90c [ 150.943955][ T7215] __sys_sendmsg+0x288/0x374 [ 150.944790][ T7215] __arm64_sys_sendmsg+0x80/0x94 [ 150.945705][ T7215] invoke_syscall+0x98/0x290 [ 150.946580][ T7215] el0_svc_common+0x13c/0x258 [ 150.947466][ T7215] do_el0_svc+0x5c/0x134 [ 150.948408][ T7215] el0_svc+0x58/0x128 [ 150.949257][ T7215] el0t_64_sync_handler+0x84/0xf0 [ 150.950206][ T7215] el0t_64_sync+0x18c/0x190 [ 151.232119][ T7247] loop4: detected capacity change from 0 to 128 [ 151.316005][ T7251] loop4: detected capacity change from 0 to 4096 [ 151.323290][ T7251] EXT4-fs: Ignoring removed orlov option [ 151.350723][ T7251] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 151.372830][ T7251] EXT4-fs (loop4): unmounting filesystem. [ 151.518927][ T6077] EXT4-fs (loop6): unmounting filesystem. [ 151.520261][ T6077] EXT4-fs error (device loop6): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 151.524036][ T6077] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 151.531021][ T7268] tipc: Enabling of bearer rejected, failed to enable media [ 151.534108][ T6077] EXT4-fs error (device loop6): ext4_quota_off:7147: inode #3: comm syz-executor: mark_inode_dirty error [ 151.809413][ T7278] netlink: 48 bytes leftover after parsing attributes in process `syz.6.825'. [ 152.725736][ T7281] loop7: detected capacity change from 0 to 512 [ 152.816052][ T7281] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 152.845778][ T4344] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 152.848075][ T4344] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 152.851682][ T4344] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 152.856237][ T4344] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 152.857882][ T4344] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 152.859372][ T4344] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 152.869149][ T48] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 152.878182][ T48] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 152.880072][ T48] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 152.882497][ T48] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 152.884444][ T48] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 152.885832][ T48] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 153.196711][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 153.530296][ T7181] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 153.563528][ T7181] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.582747][ T7305] [U] ²Ūt [ 153.670351][ T7181] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 153.672267][ T7181] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.743830][ T7329] loop7: detected capacity change from 0 to 512 [ 153.779325][ T7336] ip_tables: iptables: counters copy to user failed while replacing table [ 153.786618][ T7329] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.845: bad orphan inode 15 [ 153.788597][ T7329] ext4_test_bit(bit=14, block=5) = 0 [ 153.789856][ T7329] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 153.864201][ T7181] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 153.866220][ T7181] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.887933][ T7291] chnl_net:caif_netlink_parms(): no params data found [ 153.905520][ T7291] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.914179][ T7291] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.915852][ T7291] device bridge_slave_0 entered promiscuous mode [ 154.940962][ T4344] Bluetooth: hci3: command 0x0409 tx timeout [ 154.950807][ T7181] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 154.952593][ T7181] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.059475][ T7291] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.060716][ T7291] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.066187][ T7291] device bridge_slave_1 entered promiscuous mode [ 155.073924][ T7354] netlink: 16 bytes leftover after parsing attributes in process `syz.7.845'. [ 155.116621][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 155.126178][ T7291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 155.153454][ T7291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 155.176476][ T7291] team0: Port device team_slave_0 added [ 155.178671][ T7291] team0: Port device team_slave_1 added [ 155.581514][ T7291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.582916][ T7291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.593015][ T7291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.601111][ T7291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.602602][ T7291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.607937][ T7291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.619751][ T7181] netdevsim netdevsim4 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.632119][ T7181] netdevsim netdevsim4 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.666051][ T7291] device hsr_slave_0 entered promiscuous mode [ 155.694975][ T7291] device hsr_slave_1 entered promiscuous mode [ 155.725416][ T7291] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 155.728642][ T7291] Cannot create hsr debugfs directory [ 155.736117][ T7181] netdevsim netdevsim4 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.742563][ T7181] netdevsim netdevsim4 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.842267][ T7181] tipc: Disabling bearer [ 155.844935][ T7181] tipc: Left network mode [ 155.931617][ T7410] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 155.932674][ T7291] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 156.279708][ T7291] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 156.380335][ T7291] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 156.403786][ T7426] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(8) [ 156.405141][ T7426] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 156.408652][ T7426] vhci_hcd vhci_hcd.0: Device attached [ 156.419190][ T7291] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 156.667198][ T7291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 156.732459][ T4381] usb 17-1: SetAddress Request (2) to port 0 [ 156.733795][ T4381] usb 17-1: new SuperSpeed USB device number 2 using vhci_hcd [ 157.128230][ T48] Bluetooth: hci3: command 0x041b tx timeout [ 157.144717][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 157.146588][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 157.147971][ T7436] vhci_hcd: connection reset by peer [ 157.153914][ T39] vhci_hcd: stop threads [ 157.155765][ T39] vhci_hcd: release socket [ 157.156969][ T39] vhci_hcd: disconnect device [ 157.218430][ T7291] 8021q: adding VLAN 0 to HW filter on device team0 [ 157.276071][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 157.278074][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 157.279778][ T4673] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.281153][ T4673] bridge0: port 1(bridge_slave_0) entered forwarding state [ 157.299117][ T7291] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 157.301666][ T7291] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 157.460736][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 157.462696][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 157.464636][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 157.466408][ T4673] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.467618][ T4673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 157.469063][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 157.470838][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 157.473057][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 157.475261][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 157.477114][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 157.478825][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 157.480736][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 157.482924][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 157.484900][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 157.486636][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 157.488337][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 157.490060][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 157.529561][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 157.531114][ T4673] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 157.536581][ T7291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 157.547083][ T7487] loop6: detected capacity change from 0 to 512 [ 157.577649][ T7487] EXT4-fs (loop6): unable to read superblock [ 158.237108][ T7525] loop1: detected capacity change from 0 to 512 [ 158.434779][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 158.450721][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 158.514730][ T7525] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.893: bg 0: block 385: padding at end of block bitmap is not set [ 158.520275][ T7525] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 158.523633][ T7525] EXT4-fs (loop1): 2 truncates cleaned up [ 158.524845][ T7525] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 158.786718][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 158.797489][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 158.801715][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 158.805046][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 158.814022][ T7291] device veth0_vlan entered promiscuous mode [ 158.819950][ T7291] device veth1_vlan entered promiscuous mode [ 158.932669][ T7181] device hsr_slave_0 left promiscuous mode [ 158.974048][ T7181] device hsr_slave_1 left promiscuous mode [ 158.976473][ T4340] EXT4-fs (loop1): unmounting filesystem. [ 159.289163][ T4344] Bluetooth: hci3: command 0x040f tx timeout [ 159.340959][ T7181] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 159.385622][ T7181] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 159.402611][ T7181] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 159.405262][ T7181] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 159.406898][ T7181] device bridge_slave_1 left promiscuous mode [ 159.410627][ T7181] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.451320][ T7181] device bridge_slave_0 left promiscuous mode [ 159.452660][ T7181] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.641147][ T7181] device veth1_macvtap left promiscuous mode [ 159.642407][ T7181] device veth1_vlan left promiscuous mode [ 159.643493][ T7181] device veth0_vlan left promiscuous mode [ 161.368698][ T48] Bluetooth: hci3: command 0x0419 tx timeout [ 161.840119][ T4381] usb 17-1: device descriptor read/8, error -110 [ 162.093566][ T7181] team0 (unregistering): Port device team_slave_1 removed [ 162.264180][ T4381] usb usb17-port1: attempt power cycle [ 162.264434][ T7181] team0 (unregistering): Port device team_slave_0 removed [ 162.452891][ T7181] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 162.664357][ T7181] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 162.904600][ T4381] usb usb17-port1: unable to enumerate USB device [ 164.190800][ T7181] bond0 (unregistering): Released all slaves [ 164.492963][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 164.494780][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 164.496303][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 164.497905][ T6338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 164.502060][ T7291] device veth0_macvtap entered promiscuous mode [ 164.504991][ T7291] device veth1_macvtap entered promiscuous mode [ 164.514905][ T7557] netlink: 20 bytes leftover after parsing attributes in process `syz.6.896'. [ 164.518762][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.520619][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.522209][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.523896][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.525408][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.527018][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.528577][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.530328][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.537270][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.539017][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.545270][ T7291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.621913][ T6470] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 164.623785][ T6470] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 164.625557][ T6470] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 164.642159][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.643838][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.645390][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.647105][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.648701][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.650269][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.662094][ T7600] FAULT_INJECTION: forcing a failure. [ 164.662094][ T7600] name failslab, interval 1, probability 0, space 0, times 0 [ 164.664278][ T7600] CPU: 0 PID: 7600 Comm: syz.1.911 Not tainted syzkaller #0 [ 164.665505][ T7600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 164.667230][ T7600] Call trace: [ 164.667735][ T7600] dump_backtrace+0x1c4/0x1f0 [ 164.668556][ T7600] show_stack+0x2c/0x3c [ 164.669280][ T7600] __dump_stack+0x30/0x40 [ 164.670053][ T7600] dump_stack_lvl+0xf4/0x15c [ 164.670893][ T7600] dump_stack+0x1c/0x5c [ 164.671014][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.673413][ T7600] should_fail_ex+0x3cc/0x524 [ 164.674244][ T7600] __should_failslab+0xc0/0x11c [ 164.675116][ T7600] should_failslab+0x10/0x28 [ 164.675137][ T7600] kmem_cache_alloc+0x88/0x310 [ 164.675146][ T7600] security_file_alloc+0x38/0x11c [ 164.675954][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.676752][ T7600] __alloc_file+0xac/0x234 [ 164.677548][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.679237][ T7600] alloc_empty_file+0xa0/0x184 [ 164.679255][ T7600] alloc_file+0x64/0x564 [ 164.679264][ T7600] alloc_file_pseudo+0x16c/0x1f4 [ 164.679949][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.681828][ T7600] anon_inode_getfile+0xc4/0x16c [ 164.681851][ T7600] __pidfd_prepare+0xac/0x188 [ 164.681859][ T7600] pidfd_prepare+0x64/0x8c [ 164.681865][ T7600] __arm64_sys_pidfd_open+0xf0/0x288 [ 164.681872][ T7600] invoke_syscall+0x98/0x290 [ 164.681879][ T7600] el0_svc_common+0x13c/0x258 [ 164.681886][ T7600] do_el0_svc+0x5c/0x134 [ 164.681892][ T7600] el0_svc+0x58/0x128 [ 164.692420][ T7600] el0t_64_sync_handler+0x84/0xf0 [ 164.693347][ T7600] el0t_64_sync+0x18c/0x190 [ 164.710667][ T7291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 165.001174][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 165.003162][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 165.040387][ T7610] loop7: detected capacity change from 0 to 512 [ 165.066925][ T7610] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.913: bad orphan inode 15 [ 165.068773][ T7610] ext4_test_bit(bit=14, block=5) = 0 [ 165.069965][ T7610] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 165.085199][ T7609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.914'. [ 165.090095][ T7291] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.092909][ T7291] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.096745][ T7291] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.098869][ T7291] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.161769][ T1662] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.168335][ T1662] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.177938][ T7609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.914'. [ 166.254121][ T6183] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 166.257881][ T7621] netlink: 16 bytes leftover after parsing attributes in process `syz.7.913'. [ 166.294361][ T6470] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.295851][ T6470] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.298180][ T1662] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 166.309881][ T6105] EXT4-fs (loop7): unmounting filesystem. [ 166.482949][ T7649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.681557][ T7646] netlink: 308 bytes leftover after parsing attributes in process `syz.3.918'. [ 166.743746][ T7649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.909965][ T7657] [ 166.910467][ T7657] ====================================================== [ 166.911719][ T7657] WARNING: possible circular locking dependency detected [ 166.912935][ T7657] syzkaller #0 Not tainted [ 166.913743][ T7657] ------------------------------------------------------ [ 166.915046][ T7657] syz.1.922/7657 is trying to acquire lock: [ 166.916074][ T7657] ffff0000dc319f98 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0xe4/0x1ec [ 166.918201][ T7657] [ 166.918201][ T7657] but task is already holding lock: [ 166.919538][ T7657] ffff0000dc318130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x1e8/0x514 [ 166.921365][ T7657] [ 166.921365][ T7657] which lock already depends on the new lock. [ 166.921365][ T7657] [ 166.923239][ T7657] [ 166.923239][ T7657] the existing dependency chain (in reverse order) is: [ 166.924902][ T7657] [ 166.924902][ T7657] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 166.926387][ T7657] lock_sock_nested+0x70/0x130 [ 166.927411][ T7657] smc_listen_out+0xf0/0x3b8 [ 166.928361][ T7657] smc_listen_work+0x480/0xdd0 [ 166.929367][ T7657] process_one_work+0x7e4/0x13bc [ 166.930439][ T7657] worker_thread+0x8cc/0xfe8 [ 166.931533][ T7657] kthread+0x254/0x2e0 [ 166.932518][ T7657] ret_from_fork+0x10/0x20 [ 166.933559][ T7657] [ 166.933559][ T7657] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 166.935589][ T7657] __lock_acquire+0x2808/0x6634 [ 166.936571][ T7657] lock_acquire+0x20c/0x638 [ 166.937522][ T7657] __flush_work+0x10c/0x1ec [ 166.938435][ T7657] __cancel_work_timer+0x2f8/0x450 [ 166.939466][ T7657] cancel_work_sync+0x24/0x38 [ 166.940425][ T7657] smc_clcsock_release+0x64/0xe8 [ 166.941469][ T7657] __smc_release+0x56c/0x6c0 [ 166.942427][ T7657] smc_close_non_accepted+0xd8/0x254 [ 166.943441][ T7657] smc_close_active+0x9c0/0xd58 [ 166.944392][ T7657] __smc_release+0x490/0x6c0 [ 166.945294][ T7657] smc_release+0x258/0x514 [ 166.946190][ T7657] sock_close+0xac/0x1ec [ 166.947059][ T7657] __fput+0x1b4/0x7b0 [ 166.947893][ T7657] ____fput+0x20/0x30 [ 166.948750][ T7657] task_work_run+0x1f4/0x280 [ 166.949673][ T7657] do_notify_resume+0x20f8/0x2c84 [ 166.950676][ T7657] el0_svc+0x98/0x128 [ 166.951455][ T7657] el0t_64_sync_handler+0x84/0xf0 [ 166.952471][ T7657] el0t_64_sync+0x18c/0x190 [ 166.953409][ T7657] [ 166.953409][ T7657] other info that might help us debug this: [ 166.953409][ T7657] [ 166.955238][ T7657] Possible unsafe locking scenario: [ 166.955238][ T7657] [ 166.956640][ T7657] CPU0 CPU1 [ 166.957579][ T7657] ---- ---- [ 166.958509][ T7657] lock(sk_lock-AF_SMC/1); [ 166.959323][ T7657] lock((work_completion)(&new_smc->smc_listen_work)); [ 166.960898][ T7657] lock(sk_lock-AF_SMC/1); [ 166.962105][ T7657] lock((work_completion)(&new_smc->smc_listen_work)); [ 166.963297][ T7657] [ 166.963297][ T7657] *** DEADLOCK *** [ 166.963297][ T7657] [ 166.964674][ T7657] 2 locks held by syz.1.922/7657: [ 166.965538][ T7657] #0: ffff0000e1b9a610 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: sock_close+0x74/0x1ec [ 166.967514][ T7657] #1: ffff0000dc318130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x1e8/0x514 [ 166.969352][ T7657] [ 166.969352][ T7657] stack backtrace: [ 166.970407][ T7657] CPU: 0 PID: 7657 Comm: syz.1.922 Not tainted syzkaller #0 [ 166.971713][ T7657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 166.973573][ T7657] Call trace: [ 166.974190][ T7657] dump_backtrace+0x1c4/0x1f0 [ 166.975066][ T7657] show_stack+0x2c/0x3c [ 166.975860][ T7657] __dump_stack+0x30/0x40 [ 166.976677][ T7657] dump_stack_lvl+0xf4/0x15c [ 166.977548][ T7657] dump_stack+0x1c/0x5c [ 166.978310][ T7657] print_circular_bug+0x148/0x1b0 [ 166.979229][ T7657] check_noncircular+0x264/0x2f8 [ 166.980141][ T7657] __lock_acquire+0x2808/0x6634 [ 166.980980][ T7657] lock_acquire+0x20c/0x638 [ 166.981777][ T7657] __flush_work+0x10c/0x1ec [ 166.982569][ T7657] __cancel_work_timer+0x2f8/0x450 [ 166.983483][ T7657] cancel_work_sync+0x24/0x38 [ 166.984338][ T7657] smc_clcsock_release+0x64/0xe8 [ 166.985224][ T7657] __smc_release+0x56c/0x6c0 [ 166.986050][ T7657] smc_close_non_accepted+0xd8/0x254 [ 166.987024][ T7657] smc_close_active+0x9c0/0xd58 [ 166.987939][ T7657] __smc_release+0x490/0x6c0 [ 166.988779][ T7657] smc_release+0x258/0x514 [ 166.989579][ T7657] sock_close+0xac/0x1ec [ 166.990325][ T7657] __fput+0x1b4/0x7b0 [ 166.991036][ T7657] ____fput+0x20/0x30 [ 166.991760][ T7657] task_work_run+0x1f4/0x280 [ 166.992586][ T7657] do_notify_resume+0x20f8/0x2c84 [ 166.993523][ T7657] el0_svc+0x98/0x128 [ 166.994270][ T7657] el0t_64_sync_handler+0x84/0xf0 [ 166.995216][ T7657] el0t_64_sync+0x18c/0x190