last executing test programs: 1m7.06200454s ago: executing program 3 (id=503): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x5d, {0x0, "48b8008000000000000066ba6100b8555ad4abef2fad21e6e60c0020000f23f86592927716b9800000c00f3235000800000f30d035000100000f006080000f47dff2b00f30"}}], 0x8d}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x80000004, 0x5, 0xcb, 0x4f, 0x7c, 0x2, 0x80, 0x1, 0x3, 0x44, 0x8, 0x2, 0xe}, {0xe, 0xfffd, 0x6, 0x8, 0x9, 0xff, 0x8, 0x4, 0xa, 0x13, 0x3, 0xc8, 0x1}, {0x1ff, 0x7, 0xd, 0x0, 0x25, 0x1, 0x81, 0xfb, 0x4, 0x4, 0x0, 0x2}], 0x9}) ioctl$KVM_GET_MSRS_sys(0xffffffffffffffff, 0xc008ae88, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000340)={0x0, &(0x7f0000000140)=[@code={0xa, 0x5c, {"0f20d80f22d896410f28d5d544aec4a14dc6bb005000000066ba210066b80a0066ef0f98328ee8660f71d5b366400f3833edc7442400d6001600c7442402a481eba6f3470f5d65ff407418"}}], 0x5c}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000140)={0xbe, 0x0, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000240)={0xe0003, 0x0, {[0x8, 0x7, 0x4, 0x8, 0x3, 0x8, 0x4, 0x4]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m5.709946326s ago: executing program 3 (id=508): socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x21, 0x2, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff30}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4020845) 1m2.740574187s ago: executing program 3 (id=517): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x8, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) read$FUSE(r1, &(0x7f0000000000)={0x2020}, 0x2020) syz_clone3(&(0x7f000000dd80)={0x100000, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) listen(0xffffffffffffffff, 0x80010040) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) 59.51763317s ago: executing program 3 (id=532): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x715}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={0xffffffffffffffff, 0x0, 0x0}, 0x20) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) 59.242296618s ago: executing program 3 (id=535): r0 = syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000240)=ANY=[@ANYBLOB="120110030000002066241080400001020301090269000301061002080b0100010c200009040000000101200009240180ff070900040904050000010220000904010101010220000905010910000c02090825018030ad0001090402000001022000090402010101"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x4, 0x8, 0x100, 0x0, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1c, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000050000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x14, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020692500000000002022206b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000f00000085000000060000007a0af0ff0000000018110000", @ANYRES32=r1], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae03, 0xc9) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000380)=ANY=[@ANYRES64=r2, @ANYRESDEC=0x0, @ANYRES64=r3, @ANYRES16=r3, @ANYRESOCT=r3]}, 0x0) 58.864931315s ago: executing program 3 (id=539): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000180)={'lo\x00', 0x0}) lstat(0x0, &(0x7f0000000340)) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910710007e570966f4366ec9d4"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)=0x3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) recvmmsg$unix(r2, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 58.186252846s ago: executing program 32 (id=539): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000180)={'lo\x00', 0x0}) lstat(0x0, &(0x7f0000000340)) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910710007e570966f4366ec9d4"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)=0x3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) recvmmsg$unix(r2, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 15.01160405s ago: executing program 2 (id=698): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0xe, 0x492f, 0x7f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r3}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r3, 0x0, &(0x7f0000000580)=""/24}, 0x20) 9.894911241s ago: executing program 2 (id=692): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$rxrpc(0x21, 0x2, 0xa) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x4a781000) r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x40008, 0x5}) preadv(r0, &(0x7f0000000400)=[{&(0x7f0000000140)=""/19, 0x13}], 0x1, 0x1, 0xa) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000100)) 8.995470259s ago: executing program 5 (id=693): socket$inet6_tcp(0xa, 0x1, 0x0) setns(0xc9, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r4, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r5, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x44) sendmsg$NL80211_CMD_ABORT_SCAN(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x1c, r0, 0xd9b2794f6a139537, 0x0, 0xe7030000, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}}, 0x0) 8.920524861s ago: executing program 4 (id=694): ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(0xffffffffffffffff, 0xc008aec1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xffffffffffffffff) keyctl$read(0x2, r3, &(0x7f00000000c0)=""/4096, 0x1000) 8.85888213s ago: executing program 0 (id=695): bpf$MAP_CREATE(0x0, 0x0, 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x0, 0x10001, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) write$uinput_user_dev(r7, &(0x7f0000000100)={'syz1\x00', {0xfff3, 0x3f8, 0x7, 0xf001}, 0x4e, [0x100, 0xffffff5a, 0x7, 0x4, 0x1ff, 0x8cf, 0x2, 0x8, 0x7701, 0xfffffff7, 0x3a, 0x0, 0x4, 0xffffffc0, 0x1000, 0xbaf, 0x10001, 0x4, 0x0, 0xff, 0x101, 0x8, 0x2, 0x47, 0x100, 0x100, 0x3, 0x5, 0x4, 0x80, 0x7fff, 0x3, 0x4, 0x4e, 0x16, 0x29, 0x10000, 0x4, 0x7fff, 0x8, 0x0, 0xd644, 0xfffffffe, 0x0, 0x0, 0x1, 0x7, 0xca86, 0x7, 0x9, 0x6, 0x5, 0x1, 0x7, 0x4, 0xfffffffd, 0x80000001, 0x8000, 0xf03b, 0x5, 0x3, 0xfffff001, 0x5000, 0x9], [0x1, 0x6, 0x3, 0xffffcb85, 0x3, 0x14178b7b, 0x6, 0x1, 0x3, 0x0, 0x9, 0x80, 0x7, 0x8, 0x8, 0x7, 0x8001, 0x1000, 0x7fffffff, 0xfffffff3, 0x31c, 0x5, 0x0, 0x4, 0x1, 0x2, 0xffff8001, 0x8, 0x9, 0xb2c, 0x3, 0x2, 0x3, 0x1, 0x1, 0xfffffff1, 0x3, 0x8, 0x8, 0x8, 0x6, 0x101, 0xffff, 0x0, 0x100, 0x10, 0x5, 0x9, 0xbf23, 0x10000000, 0x1, 0x1c000000, 0x7ff, 0x6, 0x8001, 0x6, 0x6, 0x1000, 0xe, 0x7, 0x8, 0x3, 0x9], [0x8, 0x5, 0x2, 0x8, 0x5, 0x8, 0x3, 0x1, 0x10, 0x2, 0xf, 0x2, 0x0, 0x3, 0x7f, 0x200, 0x9479, 0x7, 0x40, 0x3, 0xfffffff2, 0x6e, 0x9, 0x5, 0x7, 0x9e, 0x5, 0x5, 0x7, 0x7, 0xdda9, 0x4, 0x8, 0x4, 0x9, 0x0, 0x3, 0xfffffff9, 0x81, 0xffff7fff, 0x100, 0x40, 0x401, 0xd1e4, 0x9, 0x8, 0x8, 0x1, 0xc0000000, 0xfffffff9, 0x8, 0x80000001, 0x6, 0x0, 0xfffff000, 0x6, 0x5, 0x8, 0x175, 0x6, 0x2, 0x8, 0x1, 0x1000], [0xfb, 0x4, 0x3, 0x5, 0x7fffffff, 0xf0, 0x7, 0x9, 0xa1, 0x7f, 0xff, 0x2, 0x1, 0x6, 0x1, 0x100, 0xf42, 0x3, 0x8, 0x4, 0x7, 0x3, 0x1ff, 0x8, 0x5, 0xffff, 0x0, 0x5, 0x602, 0x9, 0x4, 0x101, 0x0, 0x4, 0x0, 0xda2, 0x7, 0xd2ce, 0x4, 0x3, 0x3, 0x8000, 0x8, 0x39, 0x8001, 0x4, 0x6, 0x9, 0xc01, 0xe, 0x1, 0x1, 0x3, 0x27, 0xe, 0x0, 0x7ff, 0x867, 0xfffffff8, 0x80000000, 0x5a, 0xdbdb, 0x9, 0x3]}, 0x45c) 8.044132996s ago: executing program 5 (id=696): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x24, r4, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) alarm(0x400) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000240)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x1, {0x43, 0x0, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x1) 7.947839138s ago: executing program 1 (id=697): sched_setscheduler(0x0, 0x1, 0x0) r0 = gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) read(r1, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x27d, @tick=0xe, 0x52, {}, 0x0, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f00000000c0)={0x8180, 0x7, 0x1, 'queue1\x00', 0x80000000}) tkill(r0, 0x7) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) 7.945401809s ago: executing program 4 (id=699): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c00000010000700"/20, @ANYRES32=0x0, @ANYBLOB="04010100010a0000140003007866726d30000000000000000000000008000a00", @ANYRES32=r5, @ANYBLOB="49b9309bc1bf245e210e9341ff7486"], 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x20042000) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) r6 = syz_open_procfs(0x0, 0x0) read$eventfd(r6, &(0x7f0000000000), 0x8) 7.36076187s ago: executing program 0 (id=700): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) 7.274106661s ago: executing program 5 (id=701): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r4, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) 6.280319758s ago: executing program 0 (id=702): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x6e22, 0x9, @empty, 0x6}, 0x1c) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff30}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r2 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4020845) 6.276898616s ago: executing program 2 (id=704): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r4}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 5.853682745s ago: executing program 4 (id=705): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r6}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x312, 0x800}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 5.785549641s ago: executing program 5 (id=706): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') epoll_create1(0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 5.678503336s ago: executing program 1 (id=707): r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socket(0x10, 0x3, 0x0) shmctl$IPC_RMID(r0, 0x0) remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) 5.440537829s ago: executing program 1 (id=708): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f0000000000)='ceph\x00', 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) r7 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000600)={'syzkaller1\x00', 0x41}) r8 = dup(r5) syz_ublk_setup_queues(r8, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x230}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc48f, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0xce7, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x20084884) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40840}, 0x40) 4.70512058s ago: executing program 4 (id=709): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket(0x2, 0x80805, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000b40)='source', 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000640)='./file1\x00', 0xc004, &(0x7f0000002280)=ANY=[@ANYRES32=0x0, @ANYRES64=0x0, @ANYRESOCT, @ANYRESDEC, @ANYRES64, @ANYRES8=0x0, @ANYRESDEC, @ANYBLOB="42d79d38ac60ed35a87fafb4c105f0ee95018a20c930a43aa84ad5ca7ac773dfe54855be74335886e6b246a4feff42b115a32e698a60ba396278741f30e8822e9da57f3f0e7a98e47b82ad8885a56217c9d5093bd80ccfee50324d2b371c2e1b5034f4b8ec522ec22a38cc3c851a29c20243a01eef9ea205826196270812975dc7226f528f186146d5b37636f85dfd0b61296f961c5def5226a1cc68f899aadb77f16fd0f7c17d3b0f7501766341daa8fe29c8cbceec54c3f11d6544a9ca45d34971664ea87a938219f7c1ad696ac6bb8f3b80a2d942bf796d38e1c76358226cae74e6d3fe04fbee91e5b0d6a90ee00b2685fbdb12b87a1035c000ec3f031164aaa2f1d5083959c3602dfe42b06bc3a5a1c731899e2e2c638b1bc634ca52962aa3c9ae1cb8a99ebfe031a1f194a45b830bbf133d4905055a88a0ff15b9fe9c3be8dc0786521545159c4a67a855ed672a4c98de18c1eafd72b4dba8f30527bcba54d0dbfd445862c44046b38b94dfd32efb9e9b881da12fb767f700abbee09d8ff9481f446f7c379edb615515e0bc368feb57465218d1110cd2e6e41ada3b43577f629b5170f6971669ac6644b4230dfed17175e954ce0bd3c87c8577666112bfc825f23d2e9b8c31274426c4060f825a35a4580504f03ca4e540d53c061300a3489db061e230ac612df3179f788bdbe8c6249decb686b025d648ae374d55334d71f19e5e25b16732beae71204b035ee870080225a839af6965dd7f3b878e5cbb09fac8306bb94ff7ecbdc89e19049d8f61ce033964b2204d8c4c9817350391132c9124b1eebb2f848d2aa933a64758272d0c9a707ad28a75895ef08141b03ca902ead08a79af20a6f1639069f8f51552bbdef0a42de9930a0e16102e5207bfb976515d0fbb7627156aad9bffab0191b33227b2a9a42ab69a164f8185fe63ebd3356a9655ccb0b58c8e7f6e69bf3d530d2d889d745e3fe5e748b6d89e61e23e5d32c62a623b8290360c95b90b91902315026844e2dbd0a00e93be6b2fd69e6c4a7ca4f6e81d663611575c76ce99031e61cdb833cdbed182d203fa5b0f39236753d936f495ad34c1c09ad8be117828fe32763abc6c4b7975594f23f21aea91d6a759d757aaa03cbcc961278ae9a64d49ebf6899ca1732b33bc30cd852bf73b714b0348a1023d60a0b2333c234126160fb898276d366969cc65458d17e937b7ab02ca1ee1a2a9d395eba287a0a1ed0455de7133746fb8a612acc1b7985abb8e20b91b69faa94dcca8733cb007a4d2ae8bca78898fa715c1d1afb669c255fe473c7a9039ad04bfea3f53e47ef8d672658e386c1383583fca236968367374907bf7a7de0886e2ccc003252efc416c7e35113afcce4f47036a3af72d0c4078ec2f1f1c5e22adb35e136f7c6fe8d34ceb0d2d58a1c2f70eb92e7209f73b76510add5b9ec36809a4c356e7eb7f693e1032462138c54e1f4963b808893c204f24728be7c7576877ea08d8aa9d9e76e8f92a6deb0b4bb2dc5c9bdce0a109376391fda6f19289a6ea7ed21f8d60b0476cfeb7d223376fa1345888ee8577fae1747097596381a9368692e8d19b8b13b7ad62ec959f1b0bcc438adc583dfbc822c2272f49bf5ed83a64df29089dfe698a56b15f581e82881fa35f5b6e1935bfd4c83da863c1b75c9d3b7d6344465eda609c699c566f69862aaa28d64a60c9b1d5003986af0f90223c9efc08607114cdf8a06c6aa6cdb285cfacb4cb5fcb123c3e2a93743eee878b5add0bbe2b80a4a5c90cec797de3524410cb51dd15ae85ccf16dd1b0d7e062c33818c3bf6fbb018866a5358f5deb882661dc68e3a93e2fa15808a0f271a454ffefb15accf3ef141ef62ce0b496a0ea2f9b4a53bba8e63d5b09a5bf9797b768b0429bfac2d2ee38fd8005fd951c08be4abd74a94f55f2905a0c56a6211e25fd6e6436e18d4aae204fb8f2ec98958bdabb66a3d20c5d2bebae05d198f3c23df9f26377e3c798229e22530c69757835b6e875dcd80b5cc4cdccefb54decd0a422ca2a21e1bffc204c72e216ee54b81c59decad3a5e62fa98cecf149d32148583a8768cc53fb6c3503505176ed3edc8e81c397ac57a21a0c32cc65535bfa8b60e91c8079fa8073d208c343e3fc42ff0866111b02f3cc8fdb360d681e0a34b6f7738cf1158b3c1d689204c5c7e0373e0f4d764690578ee2d92438fcdb36b18604c990ad43a928e7cf6c2be3c586d604aba1224e37b5c506eb1c215f6e1810d4b2ff0cdd4ea9672b2556262f5691ccc4ef592ba751552935dbe57473d210daf0bacc27536138ff374072fa991c88ed4357ea4c8dae999a95d3eb419edd6477805ce2423350abaab7fac96197fffc06dfce88accfbf13c0a7392cd585e40910660abe5cd2f3aef798bd751439ed6c20100814c3fe83aacf45741a2ee652ad47b839c590655dbc7782bbbd4399533569c1646407cbf2a8ac3967fe261378a537fe3b66bb2877d55f3f1976bd2216b2b4190ee909bfdfd5699aa992dc8b818c6003b665034d98653812edb596a9d1bb60a3207e9d361aebd59ce6196704fe4e8f47ce328a144398b7fff7a61cd86846dd7f388a993d610e09f4fa0bab557639c5c48b37fb0059f5e045aa90e62d4be896f326f610d82f2cbf15b0f14793010668ad27b291436b10c4e436644c19a9616dc678e12d04bb45e13d66e2ca023a0ff9919756dafde87a8d89a9f2e26d7f92fa186a8c7e8d870c5491f556d307569693bd477ecb47c981e5aee036acdb8279251825557bd17b4303ea2818816adf0f8a460d7679f9e010f47e65c3d320d3eb43d392f52b33376a19a26e69c3143247f7a6bb56c77eafba41ced78952327cee1e6cb423dc98008232240ce56572700383593bd8132aa09fd189e71b74f279d6457c5d9530d7f27f95e29fd9a7e07df204b9dda7e66a8916580ba0376bddf13d2b1dc892c9366be5b3c432c30b6f3463d13d68540b1238e282dcfcbd4f8e52b839cd2b9d52fef32684bb7cb7f905387f9e8e66b2e825636b4a27a8b4b70f73394477fa9df9229bf9f29d086f6028505ae7728f088e70ade42cb0a992c68f891013a533baa411b2ad8179a6ca5251869066ad187769cd37ee377ae81b862998225b831672251c9cf2b7c09454aa7feb5d6ae0e44ca8dc097a7a445c22b19ef3cc53e231590427937aa5c86aa762b0844a6ca0b6d5287cdfe122146bd001c2103826c62e672687916f617afaad0f373c8c54292b11f5cf46f81aef99211f52df90138c6dfed796d570e545a41501c7a0c18e7e42edfa8d946a02509fe273fb15e7b4681ee573d913364fbf0ac64be383293c668483ba400cca25cd3aefe62122e87ce0267114ebe7a17c2b6ed948d01bb3bcf0332feaeb632b3971711361cbc19923be0c04e80311390831410fb9b65e038013a984b13cbb53f9ea432547c86e2dd920fd2946f07fb7d827bb55e73dc84ed49fdd2fbafe0793f32b0a8cf89d391c838ca4284f98faf604e86c30af873000cf8236a8b6902c60d7ed24e16e53e05923e2c111506421ebb8e1272625ecadec5eeb380b56eda220044ebb4c14e1427f63d72c3463b0893372176a3fd75758a4f66d44faafef08771e41b1a78991b062a5797ea7e271134ae243081b8bfe616ad62003e7f8b7a6caef4b097835d4b3e49421746d2031f8ad0c70ba62f7a5420d8d6fbfe5632393540527495cf8c8d1a196f08a601bbbc23eee32b39f625725a641b7b93a9cb48ab92b6447e2ccc2a7603019856307dd6af80dd84b18f3dfbec5530166f36e72196945a869acedaaf3892148a572ba1d226e172cad4f957c2b406a4175083b7ed20293d5e50ae33af6011c003d2f2dae248b4e6fe30391311dd7aaea3e8d4db304451ead9d233f22c17578ca202fca518a1ffee05d8509beadc8cbb3eb5082fe494e9c6273edb5aefcc19291a5dd1d099a2399aa190d9e9b72a82c7c4e96019b9ec0ad5b33f1686f7ab3270de06a164be2bf37b2965c2774ef1b4289c62684ecec8e8f3e66b9b97ecbb54c0779070e8b324c9259f26b28ba1f1f844af79cea00131ac27840bb2408de68d3bcd6e56cf592f5cf00d45893355526cbc102803062b3dd2e8853d2f241e83832afb690d0722570fed07949a96c8336df720680f19b476c48adbabe1308c6722d71e6d9cd82a868294f6eb49071d32ff0a6cc60b3c7e8483c511c9471b865a82091b389f322204f2e01ae2edbffedb2f14f2f271b90d95dfdc08244ce53ca4196b7ef26905fed0c765fbc56d99e264188224ed26c85a484094105a54d77eb86e9c9dc314002b6217658b75b2a7efdd1606fc05fdb249c8e4ea33711aad7b7f535d1a49e2ffb91a3a9198be27999704a365db596fa42acb9ad5c9304af08ce13fd039b178ba6d8a470b7658ca6666b29a08413d0f4b1ab369b4da6074d6b3983f6b07f5a4c733486312db717137dacd5d617b685d5756cb13780a85dea4497faa04968e5f144ad952136a3dfd153abbf593596ae48773c14bb0848af1e5c50185753e027b2e94854dd030fb164561554e1ec574afc61d6ae8f72ab677c621369207a07e81b7506d67beff17eeb965ea660d9cb503e7edb4bb475e47af0835f1dcb77b336058689e73548d975248c181e42fcab5e98a9c832b5e00baa01cc28478a2e9509ef8ff4bcb0b7909a2179b756c85fd118b0130549f65b639b96208019d19d9fed0dffb0ebfd32a7c942c8af62e0735ef2523340af50463ccb053a0ee914578d7fe78562ab9a0ae19cc25dd19ac6e8531e16d4f47407e3a41b3aa227febb456131d98fd445e0b45b44a2bf1466ff454781f5eb34e1e1651e20878e31d4e2b681ccd1b735a464cdddcfd2d95fda836670edd1ded23cd488f05c5e9c09f7c7d23da5397ac3cf6ead73706a3e7cd4634ef0ca27c6030acc1dbe34b943bfe810b7d2c4408f56a6ae63ca3f9dd188de2b22fa384ace53345fcfc1e3c0d3ce9156166a9cc264eeda1b2ebf8de774b93e90d2f8a4d14df3d294f007ed7debff458f29d678e04111f18124959b1cd5fc18ee568e48d0d7d7300ecd4b01538621d8e87ce9c53bd062334ba5893e9a83d3726901c5ba7ee75daeab7f77761c0d09451acf9aee513f40b70f0d9d16692b7c970b6329f9058c0a6bed9faf2e14aee4ba63a31a9420ccf66bccbf3fcf9a3874886d7ca53d55751e23e918c5051c5ab54937a4e4767d878fddfb6d4797b9f7d86732984d7c0f7e71e300f7d18cd7a0ec5cde1f7dfb93aa8242f3391496c3cac6a97cdaa33256e5b15e1d14b4c0dca4c27285e3a93d3e5b4c35378435d2b166189500c63da73aac418e2656c1b48335cc28279407ec7cf863746b02ae92376c9227c6edc5b213ff78a9e263ddddea388d109170faaa8e1aa1d0d5a4a16b43923fe032e773d3d9b7efa0642d8c11fe2f3f1c93f53fa9bed6ae5320ff4b3798b12d81b1b3cc2743171c16a92f1f7ac1faa19fea1c38ca4108cf93f684f59b03342b4c42c52e33971a71f6981ab89ee2917306c5a16d1988f948ba237e3ad1a8cc04ad1934bccaa72516edc62f5ad5f01a5246250d6ab23d06601b5590e108cecbbd95bd969636aabd37e02438384cd1c8e1edbfbf17340271290beee29494eaa83bb345313d94d0881e8a2698554f39eac881eede0b7dc12a2b911378585780f00ac1b8cd649f28723d2e9a56a4bc60e23bfa4c81930f5f7051a55b0425948ee20f508f9781d9ca4f3538fc5c5e0d2f406459fa0392ff2dd7cee65756d4481b660df15f813b22"], 0x1, 0x5f7, &(0x7f0000000c80)="$eJzs3UFvHGcZB/D/bBxnHUTquEkbUCWsIlUIi2RtSyTlApSCLFShShw4W8RJrGzSynaR2wMExKHi1I9QhPwFEMci5UB74ACnno16ROLum9HMzqzXydZ1Yte7bn4/afZ9Zt6Zd595dnYys1Y0AZ5ZS3OZeJgiS3NvbJbz21uL3e2txXtNnORcklbSTlKUi/+W5LPkQXpTvtF0DLSP+fSj9u1PPvj4/d5cOVa7mOitXxy03eH0c5nu5Vq1xzXewtHH27eHM0lmjzweHIPdxn+Gdh/xewkAjLMiOTNs+XRyvr5gL+8DelfFvWvsU+3BqBMAAACAE/DcTnaymQujzgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOk/r5/0U9tZp4NkXz/P/Jelnq+FR7OOoEAAAAAAAAAOAYfGsnO9nMhWZ+t6j+5v9yNXOpev1a3sl6VrKWq9nMcjaykbXMJ5keGGhyc3ljY23+EFsuDN1y4WT2FwAAAAAAAAC+ov6Qpb2//wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDgokjO9ppouNfF0WhNJ2kkmy/UeJP9u4tPs4agTAAAAgBPw3E52spkLzfxuUd3zv1Dd97fzTu5nI6vZSDcruVn9FtC7629tby12t7cW75XTo6NO5Mf/e6I0qhHT++1h+DtfqdaYyq2sVkuu5td5K93cTKvasnSlyWd4Xr8vcyp+WDtkZjfrttzzn9fteJiuKnK2X5FOnVtZjYsHV+IJP51H32k+rf4vP5e+hJqfr9tyf14f65ovDBx9LxxciWTmV3+6fqd7/+6dW+tz47NLT6E9pBKLA5V48ZmpRKlTVeJyf34pP8svM5fZvJm1rOY3Wc5GVjKb16touT6ey9fpgyv1o31zb35RJpP159I7iz5ZTi9X217Ian6Rt3Kz+kQ7uZ7rWcj382o6+z7hy0Pz/t1u3b2zu7ub1pN967/9nTo4m+SndTseyrpeHKjr4Dl3uuobXLJXpZnjPzdOfLMOyqPntbE7N1585F+JphLPH1yJP1cHznr3/t21O8tvH/L9XqnbsgI/6Vdiol66e+ZYduqplMfLTD+X/UdH2ff80L75qu9Sv6/1WN/lft8XfVMn62u4x0daqPpeHNrX2+7KQN+w6y0Axt75756fnPrv1L+mPpz649SdqTfar527ce6lyZz9x9kfTHTOvNJ6qfhrPsxv9+7/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAACAp7f+7nt3l7vdlbWnDponER11HIFgfIPmoWTjks+XH4zyrASchGsb996+tv7ue99bvbd8e+X2yv1XOzduzM/PX+9cu7XaXalfR50lAHCc9i76R50JAAAAAAAAAAAAAADweU7ivxOPeh8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICvtqW5TDxMkfnO1U45v7212C2nJt5bs52kKIO/J/kseZDelOmB4YrPe59PP2rf/uSDj9/fG6tdrf/PhePYi325tB7J6ajjLQyM95dmja8fYpRWExT9yswmmalbGLn/BwAA///m5gNq") newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x1000) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 3.299600535s ago: executing program 4 (id=710): bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xff, 0xfdfffffffffffffc}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r0 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000240)="8a", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x2, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) 3.115744512s ago: executing program 2 (id=711): timerfd_create(0x8, 0x0) timerfd_create(0x9, 0x0) memfd_secret(0x80000) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, 0x0, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x2, 0x4000091}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20000, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec73, 0x10000, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4a4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffe}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1.944135124s ago: executing program 5 (id=712): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x4}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000240)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x72, {"b8010000000f01d966ba2000b047eeb9800000c00f3235000400000f30410f01f80fc77dd1c744240200000000c744240600000000c482f2f7500048b83c000000000000000f23d8420f210035000000e00f23f8e999b90000c48285bce4f3dfcd"}}], 0x72}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, 0x0}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000002c0)={[{0x5, 0x4, 0x5, 0x5, 0x2, 0x12, 0x5, 0xd, 0xb6, 0x3, 0xe, 0x5, 0x201}, {0x804, 0x1, 0x4, 0x45, 0x7, 0xfb, 0x2, 0x3, 0x1f, 0x3, 0x4, 0x7b, 0x20e}, {0x6, 0x15, 0x18, 0x34, 0x48, 0xfd, 0x3, 0x84, 0x0, 0x4, 0x4, 0x7, 0x1}], 0xfaffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000500)={[0x7f, 0x88, 0x0, 0x40, 0x0, 0x7f, 0x2004cb, 0x1, 0xfffffd, 0x5, 0x5, 0x745, 0x8, 0x3, 0x0, 0x9], 0x1, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.703759445s ago: executing program 1 (id=713): r0 = msgget$private(0x0, 0x19b) msgsnd(r0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0200"], 0x401, 0xbe573b18f6e31390) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) bpf$LINK_DETACH(0x22, &(0x7f00000000c0), 0x4) msgrcv(r0, 0x0, 0x0, 0x3, 0x2000) msgctl$IPC_RMID(r0, 0x0) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, 0x0, 0x0) syz_mount_image$udf(&(0x7f0000000c40), &(0x7f0000000c80)='./file0\x00', 0x800000, &(0x7f00000000c0)=ANY=[@ANYBLOB='lastblock=00000000000000000226,adinicb,gid=forget,nostrict,unhide,uid=', @ANYRESDEC=0x0, @ANYBLOB="2c73686f727461642c7569643d69676e6f72652c73686f727461642c766f6c756d653d30303030303030303030303030303030303030362c001829935912ddb19b617db523a6bb7c0d782285ef952b9282ba93ba5ef9353deee866199e1a1a16f9b8980aa11304cc9667f126de9a575a9cb3c29169cb6e8bd4820f0d3882914f9f4dd2ac97c7c5181676dc89c5fd4f9c455fcdbd2eef48adb33cdc1f9e9a7f3a2bcb07fb13cffd272aa79076e8039f7ab310e76e7400"/192, @ANYRES64], 0x4, 0xc24, &(0x7f0000000d00)="$eJzs3V9oXOl5B+D3myOtJW/TzG42zh/nYmAD2Xqzi2R51yregBwrIgvGa1ZWLhYKGluyO6w0kiW5eEMJLiSUkLa45CKXNWwCvauvWggNuFfbEgKiV6UXxW03Zns3CaQtvViVM/ONNNLalrK2JXn9PMb+nTnznpnvzOrVnDN7zpwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACK+/o2TQ8Npr0cBAOymM5NvDo14/weAJ8o5+/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwvRRHfjRTv/qCVptu3OwZON5pXrk6NT9x9scEUKSpRtOvLvwPDR0eOvfLq8dFu3n/5h+0L8cbkuZO1Uwvzi0uzy8uzM7WpZuPCwszsjh/hQZff6kj7BajNv31l5uLF5drRl0c23X21eufA04eqJ0YPj7zVrZ0an5iY7Knp6//Yz/4R6eE9FJ8gT0UR34wU7730QapHRCUevBe2+d3xqA1GX9l/7ZWYGp9or8hco95cKe9MlVzVF1HtWWis2yO70IsPZCziWvnfqRzwkXL1JhfrS/Xzc7O1s/WllcZKY6GZKp3RlutTjUqMpojFiGgVez149pv+KOJYpLjz61Y6HxFFtw9ePDP55tDI9g/QtwuDvMfTVouI1XgMehb2qQNRxF9Gih9OD8WF3Ffttnk/4itlvhZxucxbKa7n26n8BTEa8SvvJ/BY64sifhEpFlIrzXR7v71defpbtdebFxd6arvblY/9/sFusm3CPjYQRZxvb/G30sf/sAsAAAAAAAAAAAAA2B1F/DRS3Jx/IS1G7zmljeal2rn6+bnOUcHdY/9ream1tbW1aupkLedQzrGcZ3NO51zMeS3n9Zw3ct7MeSvnas7bOVs5o5KfP2ct51DOsZxnc07nXMx5Lef1nDdy3sx5K+dqzts5WznDeU8AAAAAAAAAAAAAAAAAAAA8ZINRxESkuPHuH7WvKx3t69J/+sTomfHneq8Z/7ltHqesfTkifho7uyZvf77WeKqUfx7+egHbG4givpOv//cnez0YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgX6hEEd+NFD/6TStFioixiOno5O1ir0cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJQGUhGnIsV/fWOgfXs1Ir4YER+ulX8i/ndtq70eMQAAAAAAAAAAAAAAAAAAAHwCpSIuR4ofv9dK1Yi4Wr1z4OlD1ROjh0feKqKIVJb01r8xee5k7dTC/OLS7PLy7Extqtm4sDAzu9OnGzjdaF65OjU+8UhWZluDj3j8gwOnFhbfWWpc+sOVu95/cODk+eWVpfqFu98dg9EXMdQ750h7wFPjE+1BzzXqzfaiqXKPAfZF1Ha6MgAAAAAAAAAAAAAAAAAAAOwbB1MR45Hi+Z8dS93zxvs65/x/qnOrWK/9yR9vfBfA3Jbs6v3+gJ1Mp50O9Ej7xPva1PjExGTP7L7+j5aWY0qpiM9GisN///n2+fApDt713Piy7s8ixej/Hct11cNl3dimqoEjU+MTtTMLzZdOzs0tXKiv1M/PzdYmF+sXdvzFAQAAAAAAAAAAAAAAAAAAAHAfB1MRfx4pjr2+mrrXnc/n//d1bvWc//9aRPey8wNpc65rn9v/u+1z+zvTnz4x+vrR5+81/1Gc/1+OKaUiPowUz/zV59vX0++e/z+0pbas+3Gk+MX3vpTrKk+VdcPd1ek84sXG3OxQWftipPj+2W5ttGtfzbWf2agdLmv/IVI8+weba4/n2uc2ao+WtXcixcSZu9d+dqN2pKwdjBRf/dNat/ZgWfv1XHtoo/blCwtzMzt9eXkylf3/b5Hiy8PfTN2f+Xv2f8/3f1zbkus+0vP3n35Y/V/tmXct9/Va7v/hbfr/cqT4i+tfynWd3jua73+m/e9G/38/UvzepzbXvpJrn92oHd7pasFeKvv/nyLF6u1/Wf+Zz/2fO2ujQ3v7/4t9m7O7XbBX/f9Mz7xqHtfIb/lawJNm+Z1vv12fm5tdMmHChIn1ib3+zQQ8auX2/39Hiq9dLlJ3PzZv//9O59bG/v//fGdj+//Elly3R9v/z/bMO5H3Wvr7IgZW5hf7PxcxsPzOt19qzNcvzV6abY6MjB7//WPDR48P9z/V3bnfmNrxawePu7L/344UP/mbf17/HHvz/v/dP/87uCXX7VH/f6Z3nTbt1+z4pYAnTtn/fx0p/vXGB+v/v+l+n/91P+d74fnNOdgt2qP+f65nXi3/M9oz74Ui4uROnwsAAAAAAAAAAB4TB1MRP4sUf9v6x/Vr3m8+/ie+3K3tPf7vXvbD9f8BgPsr3/8nI8XPD341db9DZifH/89syXV7dPzvoZ55M7t0XvOOX2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiYUhRxIFK8+4NWul2UtzsGTjeaV65OjU/cfbHBFCkqUbTry78Dw0dHjr3y6vHRbt5/+YftC/HG5LmTtVML84tLs8vLszO1qWbjwsLM7I4f4UGX3+pI+wWozb99ZebixeXa0ZdHNt19tXrnwNOHqidGD4+81a2dGp+YmOyp6ev/2M/+EenhPRSfIE9FET+PFO+99EH69yKiEg/eC9v87njUBqOv7L/2SkyNT7RXZK5Rb66Ud6ZKruqLqPYsNNbtkV3oxQcyFnEtIirlgI+Uqze5WF+qn5+brZ2tL600VhoLzVTpjLZcn2pUYjRFLEZEq9jrwbPf9EcRfxcp7vy6lf6jiCi6ffDimck3h0a2f4C+XRjkPZ62WkSsxmPQs7BPHYginosUP5weiv8sOn3Vbpv3I75S5msRl8u8leJ6vp3KXxCjEb/yfgKPtb4o4mykWEit9H6Re7+9XXn6W7XXmxcXemq725WP/f7BbrJtwj42EEX8sr3F30q/9H4OAAAAAAAAAAAAAPtcEV+LFDfnX0jt80PXzyltNC/VztXPz3UO6+8e+1/LS62tra1VUydrOYdyjuU8m3M652LOazmv57yR82bOWzlXc97O2coZlfz8OWs5h3KO5TybczrnYs5rOa/nvJHzZs5bOVdz3s7ZyhmOkwYAAAAAAAAAAAAAAAAA4BGpRBHfixQ/+k0rrRWd68tORydvO88VPtH+PwAA//9mFkcG") lchown(&(0x7f0000000000)='./file1\x00', 0x0, 0xffffffffffffffff) 1.333208543s ago: executing program 1 (id=714): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x2800715, &(0x7f0000000280)={[{@commit={'commit', 0x3d, 0xf2a}}, {@user_xattr}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x22}}, {@errors_remount}, {@quota}, {@barrier_val={'barrier', 0x3d, 0xff}}, {@discard}, {@orlov}, {@grpjquota}]}, 0xee, 0x43e, &(0x7f00000008c0)="$eJzs281vFOUfAPDvzLb09wOhFRGlglbR2PjS0oLKwYtGEw+amOgBj7UtpLJQQ2sipNFqDB4NiXfj0cS/wJNejHoy8ap3Q0K0MQE91czsTNku3dKXXRbZzyeZ9Hl2nunzfHfm2XnmeXYD6FpDEdEbEXdFxK8R0R8RSWOBodqfa0sLk38vLUwmsbz8xh9JXu7q0sJkWbQ8bleRGU4j0k+S2sEN5s5fOD1RrU6fK/Kj82feHZ07f+HpmTMTp6ZPTZ8dP3782NGx554df6YlcWZxXR38YPbggVfeuvTa5IlLb//4dV9E7D9U218fR6sMZYH/uZxr3PdYqyvrsN116aSngw1hUyoRkZ2uNO///VGJ6yevP17+uKONA9oquzf1Nd+9uAzcwZLodAuAzihv9Nnzb7ndoqHHbeHKC7UHoCzua8VW29OTPxNFMT/SLkMRcWLxny+yLdo0DwEAUO/bbPzz1FrjvzT215XbU6yhDETE3RGxNyLuiYh9EXFvRF72voi4f5P1Ny4N3Tj+SS9vKbANysZ/zxdrW6vHf+XoLwYqRW53Hn9vcnKmOn2keE+Go7cvy4+tU8d3L/3yWbN99eO/bMvqL8eCRTsu9zRM0E1NzE+0alB65aOIwZ614k9WVgKSiDgQEYOb+9d7ysTME18dbFbo5vGvowXrTMtfRjxeO/+L0RB/KVl/fXL0f1GdPjJaXhU3+unni683q39b8bdAdv53rr7+G0r0/5XUr9fObb6Oi7992vSZZqvX/47kzXzNekfx2vsT8/PnxiJ2JK/m+VWvj18/tsyX5bP4hw+v3f/3Fsdk8T8QEdlFfCgiHoyIh4q2PxwRj0TE4XXi/+HFR9/ZevztlcU/tebn38r1P7D6/G8+UTn9/TfN6t/Y+T+Wp4aLV/LPv5vYaAO3894BAADAf0Waf/c/SUdW0mk6MlL7Dv++2JlWZ+fmnzw5+97ZqdpvBAaiNy1nuvrr5kPHksXiP9by48Vccbn/aDFv/Hnl/3l+ZHK2OtXh2KHb7WrS/zO/VzrdOqDt/F4Luldj/0871A7g1nP/h+6l/0P30v+he63V/z9syFsLgDuT+z90L/0fupf+D91L/4eutJ3f9Ut0cyLS26IZEm1KdPqTCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDX+DQAA//8RV+6j") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x100bf28, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3e}}, 0xfffff805}, 0x1c) sendto$inet6(r0, 0x0, 0x3d, 0x4088010, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xbd}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.259880446s ago: executing program 2 (id=715): mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) rt_sigqueueinfo(0x0, 0x20, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1200) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x3) close(0x3) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000000)={r3, 0x1, 0x0, 0x2000}) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESOCT=r0]) 1.226616973s ago: executing program 0 (id=716): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r2, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r3, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) 1.11675615s ago: executing program 5 (id=717): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x1000, 0x0, 0x7d, 0x200001ff, 0x1, 0x1}, 0x1c) close(0x3) socket$nl_route(0x10, 0x3, 0x0) 740.608164ms ago: executing program 0 (id=718): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 159.550726ms ago: executing program 4 (id=719): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cd00000000000004000000850000000500000095"], &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001780)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYBLOB], 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) 157.240025ms ago: executing program 1 (id=720): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x3}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f0000002300), &(0x7f0000000640)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r3, r4, r4}, &(0x7f0000000540)=""/194, 0xc2, &(0x7f00000000c0)={&(0x7f0000000340)={'wp256-generic\x00'}}) 75.223777ms ago: executing program 2 (id=721): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r1, 0x4068aea3, &(0x7f0000000180)={0xa4, 0x0, 0x1}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0x8000000, 0xf000, 0x0, 0x2, 0x8, 0x0, 0x40, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0xfb, 0x9, 0x0, 0x2, 0x1, 0x7, 0x3, 0xff}, {0x6000, 0x3000, 0xc, 0x0, 0x7, 0x9, 0x40, 0x0, 0x3, 0x9, 0x0, 0xfc}, {0xeeef0000, 0xd000, 0xf, 0xff, 0x7c, 0xfe, 0xa, 0x0, 0xfe, 0x3, 0x4}, {0xdddd0000, 0xf000, 0x4, 0x0, 0xff, 0x4, 0x6, 0xb, 0x0, 0x3c}, {0xeeee8000, 0x4000, 0x0, 0x3, 0x5, 0x2, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0xdddd1000, 0x0, 0x2, 0xff, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x3000, 0xe, 0x0, 0xc8, 0x1, 0x83, 0xa, 0x26, 0x96}, {0x1, 0x4}, {0x80a0000, 0xff}, 0x0, 0x0, 0xeeee8000, 0x600, 0x1, 0x5800, 0x0, [0x4000000000013, 0x0, 0x1]}) r6 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r5, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f0000000240)="fb4149dd053be3ac2cc4a22332a77b23b8898600087bb16c94a6ab80313804d92f00000000010000045a96383369d226270080ff000000000000000000a000", 0x0, 0xffa4) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@arm64={0xa, 0x3, 0x0, '\x00', 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 0 (id=722): setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', 0x8c00, &(0x7f00000006c0)=ANY=[@ANYBLOB="666c7573682c757466383d312c6e6f6e756d7461696c3d302c726f6469722c757466383d312c6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c3d302c646f733178666c6f7070792c726f6469722c73686f72746e616d653d77696e6e742c71756965742c0094f8a04f0973c43c7bcea227ba87b349831c01bc3220ec43c16881ca5a7eb4c441b475069a19ed5992542160cfb3116e6b98cb32f0c11a1425599a6e9e6112e8ccec10c22c03ee6158bae8a13f6c3b4c6a28b970ccddefe85485144c95ae43328f492ad74f0d68df2d1fb7eed626acbfd66c627c439a6358168da375c739b94ec5550af56d20754c3be005251ae53ba42f"], 0x4, 0x31b, &(0x7f0000000100)="$eJzs3U1rG0cYwPFn9WJJdl37UEopLQwulJbixRb0VkpNsaFU0GJbhbpQWNfrVmgtGa0wqITYgUCuOefgQ44hl5CQSy4h5OpLPoET5+aLb/HBZMJqX/SKLDtISsj/d1g91syzM7szsvFI2j3+4eZWcTMtIoZIuFXeJiZx8e3Jt0/3n3+58uQj/2ellhZW57NKxUTkryt3Zx5XJ/548PGjlBxM/318kn158MWqyOvV/ySmCq4qaa0stV4uV72dq42CWzSV+t2xLddWhZJrV6pBubXu2GrTKW9v15RV2pgc367YrqusUk0V7ZqqllW1UlPWv1ahpEzTVJPjAhGZjqJYR5nRKzF/51RrOdFa69SeaK271N4Lg2TwmHq7zuJd0jb+Pet2TI74IHuGYTjVib7Hv+FwwL3CsPiv/xe3+ht/vTukbmFIVv5c+3Uhl1tcViotsnVjJ7+T9x/98sMJKYgjtuwvf7d2Jt4cCYjhbZd+yS3Oqbpp+XprN8jf3cn7fxwWNuv5R2FSU76E+fN+vmrNT8p4I9+WrEzJJ9I1PxvmS6wpf0y++aop35QpefaPlMWRDW8mN+VfnVfq599ybe1n6vWaXBvB8AAAAAAAAAAAcCmmijTW743ord6Maabqn/iIyjPe0149v0K0vj4nU3LWfX1+ruv6fkI+T4zwwAEAAAAA+IC4tf+LluPYlcEE8duZHk0kTREvELk+43Wm5w4/DXrcX+tjItJZFO/dREuQ+d5vL/yQe00GeaLCIH2BHnYJwi9rFK2ze2FRRrpVjl1oAsyOdT3z6YohA50/LYH0U1nSl5vYqbYDTPadHo/a+sytGYmOOto4fz/acpL+MxKNYO+sny70cgiCH/fDtTkRf+DS7Sdq9sjfr9Pjl8Yr3bQbAAAAAO+Lpn+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiETf/zeCO/33czmx8Lr9rUUS3CK+85JsjfvE3384ouMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPO8CQAA///5tbNU") syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x802, &(0x7f0000000500)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=', @ANYRESDEC=0x0]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r1, 0x0, 0x0, 0x8ffff) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2000, 0x1e9) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r2, 0x0) kernel console output (not intermixed with test programs): te [ 70.944436][ T5602] bridge_slave_0: entered allmulticast mode [ 70.945440][ T5602] bridge_slave_0: entered promiscuous mode [ 71.005815][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.005874][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.005950][ T5602] bridge_slave_1: entered allmulticast mode [ 71.006983][ T5602] bridge_slave_1: entered promiscuous mode [ 71.039700][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.039769][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.039859][ T5603] bridge_slave_0: entered allmulticast mode [ 71.040750][ T5603] bridge_slave_0: entered promiscuous mode [ 71.043551][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.044388][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.044801][ T5603] bridge_slave_1: entered allmulticast mode [ 71.046398][ T5603] bridge_slave_1: entered promiscuous mode [ 71.121630][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.121914][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.122083][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.122205][ T5601] bridge_slave_0: entered allmulticast mode [ 71.123748][ T5601] bridge_slave_0: entered promiscuous mode [ 71.167288][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.167499][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.167607][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.167688][ T5601] bridge_slave_1: entered allmulticast mode [ 71.168602][ T5601] bridge_slave_1: entered promiscuous mode [ 71.170528][ T5612] Bluetooth: hci3: command tx timeout [ 71.170699][ T54] Bluetooth: hci4: command tx timeout [ 71.190828][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.194393][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.194567][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.194664][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.195044][ T5609] bridge_slave_0: entered allmulticast mode [ 71.196844][ T5609] bridge_slave_0: entered promiscuous mode [ 71.200735][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.200854][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.201229][ T5609] bridge_slave_1: entered allmulticast mode [ 71.202710][ T5609] bridge_slave_1: entered promiscuous mode [ 71.249894][ T5612] Bluetooth: hci1: command tx timeout [ 71.250078][ T5612] Bluetooth: hci0: command tx timeout [ 71.251183][ T54] Bluetooth: hci2: command tx timeout [ 71.278497][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.278640][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.278808][ T5604] bridge_slave_0: entered allmulticast mode [ 71.281685][ T5604] bridge_slave_0: entered promiscuous mode [ 71.335966][ T5602] team0: Port device team_slave_0 added [ 71.338867][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.338986][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.339080][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.339304][ T5604] bridge_slave_1: entered allmulticast mode [ 71.342455][ T5604] bridge_slave_1: entered promiscuous mode [ 71.362558][ T5603] team0: Port device team_slave_0 added [ 71.370613][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.376769][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.380929][ T5602] team0: Port device team_slave_1 added [ 71.386668][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.415917][ T5603] team0: Port device team_slave_1 added [ 71.454303][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.466919][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.466936][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.466958][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.499946][ T5601] team0: Port device team_slave_0 added [ 71.503206][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.513967][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.514031][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.535658][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.535674][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.535697][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.541856][ T5609] team0: Port device team_slave_0 added [ 71.544879][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.544892][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.544913][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.551494][ T5601] team0: Port device team_slave_1 added [ 71.659004][ T5609] team0: Port device team_slave_1 added [ 71.660075][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.660088][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.660109][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.676080][ T5604] team0: Port device team_slave_0 added [ 71.681737][ T5604] team0: Port device team_slave_1 added [ 71.746510][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.746523][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.746536][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.764499][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.764517][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.764538][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.827620][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.827636][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.827659][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.856889][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.856906][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.856929][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.867722][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.867739][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.867760][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.878251][ T5603] hsr_slave_0: entered promiscuous mode [ 71.882203][ T5603] hsr_slave_1: entered promiscuous mode [ 71.899433][ T5602] hsr_slave_0: entered promiscuous mode [ 71.901413][ T5602] hsr_slave_1: entered promiscuous mode [ 71.902469][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 71.902544][ T5602] Cannot create hsr debugfs directory [ 71.906825][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.906840][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.906862][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.037069][ T5601] hsr_slave_0: entered promiscuous mode [ 72.038021][ T5601] hsr_slave_1: entered promiscuous mode [ 72.038803][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 72.038822][ T5601] Cannot create hsr debugfs directory [ 72.046469][ T5609] hsr_slave_0: entered promiscuous mode [ 72.047427][ T5609] hsr_slave_1: entered promiscuous mode [ 72.048116][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 72.048133][ T5609] Cannot create hsr debugfs directory [ 72.148096][ T5604] hsr_slave_0: entered promiscuous mode [ 72.148794][ T5604] hsr_slave_1: entered promiscuous mode [ 72.149182][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 72.149199][ T5604] Cannot create hsr debugfs directory [ 72.528523][ T5603] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.542290][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.543476][ T5603] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.549658][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.551594][ T5603] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.561509][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.564300][ T5603] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.575333][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.652170][ T5602] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 72.656514][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.657580][ T5602] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 72.660140][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.674871][ T5602] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 72.683679][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.684503][ T5602] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 72.694118][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.791098][ T5601] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.794284][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.797284][ T5601] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.814089][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.822362][ T5601] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.834994][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.850258][ T5601] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.853872][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.896427][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.939086][ T5609] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.951664][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.967885][ T5609] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.971638][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.972579][ T5609] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.980688][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.990249][ T5609] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 73.010661][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 73.041044][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.079561][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.079687][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.138162][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.138325][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.154893][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.156345][ T5604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.167254][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 73.168126][ T5604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.173097][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 73.195573][ T5604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.198018][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 73.215989][ T5604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.227188][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 73.239812][ T54] Bluetooth: hci4: command tx timeout [ 73.239847][ T4922] Bluetooth: hci3: command tx timeout [ 73.275733][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.289048][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.289106][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.302217][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.302314][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.320571][ T54] Bluetooth: hci2: command tx timeout [ 73.320600][ T54] Bluetooth: hci0: command tx timeout [ 73.320627][ T4922] Bluetooth: hci1: command tx timeout [ 73.401302][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.485970][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.513362][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.549958][ T88] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.550078][ T88] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.567177][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.567267][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.628201][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.678074][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.678175][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.712693][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.718071][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.718172][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.857824][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.903689][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.903789][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.941453][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.941555][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.184286][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.653244][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.863378][ T5602] veth0_vlan: entered promiscuous mode [ 74.894042][ T5602] veth1_vlan: entered promiscuous mode [ 75.028743][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.036354][ T5603] veth0_vlan: entered promiscuous mode [ 75.088081][ T5603] veth1_vlan: entered promiscuous mode [ 75.098222][ T5602] veth0_macvtap: entered promiscuous mode [ 75.116962][ T5602] veth1_macvtap: entered promiscuous mode [ 75.234910][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.236765][ T5601] veth0_vlan: entered promiscuous mode [ 75.247632][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.275110][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.277540][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.287384][ T5603] veth0_macvtap: entered promiscuous mode [ 75.310427][ T5603] veth1_macvtap: entered promiscuous mode [ 75.321249][ T5612] Bluetooth: hci3: command tx timeout [ 75.321538][ T5612] Bluetooth: hci4: command tx timeout [ 75.335516][ T5601] veth1_vlan: entered promiscuous mode [ 75.369122][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.400223][ T54] Bluetooth: hci0: command tx timeout [ 75.400254][ T54] Bluetooth: hci1: command tx timeout [ 75.400275][ T54] Bluetooth: hci2: command tx timeout [ 75.423544][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.435252][ T5604] veth0_vlan: entered promiscuous mode [ 75.502672][ T5609] veth0_vlan: entered promiscuous mode [ 75.519841][ T151] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.541457][ T5604] veth1_vlan: entered promiscuous mode [ 75.547950][ T5609] veth1_vlan: entered promiscuous mode [ 75.549147][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.549164][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.593920][ T51] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.593985][ T51] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.594033][ T51] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.594064][ T51] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.594092][ T51] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.594124][ T51] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.614163][ T5601] veth0_macvtap: entered promiscuous mode [ 75.630155][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.672554][ T5601] veth1_macvtap: entered promiscuous mode [ 75.702142][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.702161][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.754252][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.788561][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.791683][ T5604] veth0_macvtap: entered promiscuous mode [ 75.810246][ T151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.810286][ T151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.848915][ T5604] veth1_macvtap: entered promiscuous mode [ 75.860887][ T5609] veth0_macvtap: entered promiscuous mode [ 75.928822][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.928841][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.934997][ T5609] veth1_macvtap: entered promiscuous mode [ 75.949694][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.950294][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.950444][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.950474][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.001240][ T5602] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 76.026391][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.098109][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.157955][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.196284][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.237820][ T5804] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 76.238049][ T151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.238066][ T151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.312370][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.312413][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.312446][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.348129][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.348177][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.348209][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.348240][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.382649][ T5805] FAULT_INJECTION: forcing a failure. [ 76.382649][ T5805] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 76.382705][ T5805] CPU: 0 UID: 0 PID: 5805 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 76.382727][ T5805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.382745][ T5805] Call Trace: [ 76.382752][ T5805] [ 76.382763][ T5805] dump_stack_lvl+0xe8/0x150 [ 76.382794][ T5805] should_fail_ex+0x3eb/0x540 [ 76.382819][ T5805] copy_fpstate_to_sigframe+0xa83/0xd20 [ 76.382840][ T5805] ? copy_fpstate_to_sigframe+0x188/0xd20 [ 76.382864][ T5805] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 76.382897][ T5805] ? timerqueue_linked_add+0x287/0x2e0 [ 76.382925][ T5805] ? fpu__alloc_mathframe+0xac/0x130 [ 76.382946][ T5805] get_sigframe+0x603/0x830 [ 76.382975][ T5805] ? __pfx_get_sigframe+0x10/0x10 [ 76.383007][ T5805] x64_setup_rt_frame+0x163/0xc50 [ 76.383033][ T5805] ? _raw_spin_unlock_irq+0x2e/0x50 [ 76.383051][ T5805] ? get_signal+0x10d8/0x12c0 [ 76.383075][ T5805] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 76.383103][ T5805] arch_do_signal_or_restart+0x456/0x860 [ 76.383125][ T5805] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 76.383143][ T5805] ? __x64_sys_sendmsg+0x25d/0x290 [ 76.383177][ T5805] exit_to_user_mode_loop+0x10e/0x770 [ 76.383196][ T5805] ? rcu_is_watching+0x16/0xb0 [ 76.383219][ T5805] do_syscall_64+0x328/0x520 [ 76.383237][ T5805] ? trace_irq_disable+0x3b/0x140 [ 76.383254][ T5805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.383272][ T5805] ? clear_bhb_loop+0x70/0xc0 [ 76.383292][ T5805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.383311][ T5805] RIP: 0033:0x7f0fe6b9e157 [ 76.383334][ T5805] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 76.383348][ T5805] RSP: 002b:00007f0fe79a0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 76.383373][ T5805] RAX: 000000000000002e RBX: 00007f0fe6e25fa0 RCX: 00007f0fe6b9e159 [ 76.383386][ T5805] RDX: 0000000000000010 RSI: 0000200000000540 RDI: 0000000000000005 [ 76.383398][ T5805] RBP: 00007f0fe6c3506b R08: 0000000000000000 R09: 0000000000000000 [ 76.383411][ T5805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.383422][ T5805] R13: 00007f0fe6e26038 R14: 00007f0fe6e25fa0 R15: 00007fff996d5ff8 [ 76.383448][ T5805] [ 76.422224][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.454380][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.454399][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.611973][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.611993][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.753565][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.753586][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.813277][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.813298][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.838955][ T5812] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6'. [ 76.838995][ T5812] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6'. [ 76.985759][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.985774][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.403665][ T54] Bluetooth: hci4: command tx timeout [ 77.403701][ T54] Bluetooth: hci3: command tx timeout [ 77.479774][ T5612] Bluetooth: hci2: command tx timeout [ 77.479806][ T5612] Bluetooth: hci1: command tx timeout [ 77.480165][ T5612] Bluetooth: hci0: command tx timeout [ 80.988820][ T5833] bridge0: port 3(syz_tun) entered blocking state [ 80.988879][ T5833] bridge0: port 3(syz_tun) entered disabled state [ 81.036591][ T5833] syz_tun: entered allmulticast mode [ 81.054112][ T5833] syz_tun: entered promiscuous mode [ 81.057055][ T5833] bridge0: port 3(syz_tun) entered blocking state [ 81.057181][ T5833] bridge0: port 3(syz_tun) entered forwarding state [ 81.067640][ T5837] netlink: 'syz.3.10': attribute type 49 has an invalid length. [ 81.082044][ C0] bridge0: port 3(syz_tun) neighbor 0000.00:00:00:00:00:00 lost [ 81.082652][ C0] bridge0: topology change detected, propagating [ 81.180277][ T5836] loop2: detected capacity change from 0 to 1024 [ 81.242937][ T5836] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 81.242968][ T5836] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 81.249265][ T5836] jbd2_journal_init_inode: Cannot locate journal superblock [ 81.249283][ T5836] EXT4-fs (loop2): Could not load journal inode [ 81.346708][ T5845] loop3: detected capacity change from 0 to 512 [ 81.516238][ T5845] EXT4-fs error (device loop3): ext4_orphan_get:1403: inode #15: comm syz.3.13: iget: bad extended attribute block 134217728 [ 81.516423][ T5845] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 81.519431][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 81.519454][ C0] EXT4-fs (loop3): initial error at time 1790833208: ext4_orphan_get:1403: inode 15 [ 81.519484][ C0] EXT4-fs (loop3): last error at time 1790833208: ext4_orphan_get:1403: inode 15 [ 82.169938][ T1221] cfg80211: failed to load regulatory.db [ 82.189132][ T5845] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.13: couldn't read orphan inode 15 (err -117) [ 82.189243][ T5845] loop3: lost filesystem error report for type 5 error -117 [ 82.243564][ T5845] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 82.310871][ T5845] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.349830][ T5875] netlink: 'syz.1.20': attribute type 11 has an invalid length. [ 83.818824][ T5885] Zero length message leads to an empty skb [ 84.834803][ T5897] netlink: 4 bytes leftover after parsing attributes in process `syz.4.25'. [ 87.012594][ T5916] netlink: 36 bytes leftover after parsing attributes in process `syz.4.30'. [ 87.722597][ T5717] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 88.435017][ T5924] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 88.452072][ T5717] usb 2-1: New USB device found: idVendor=17cc, idProduct=1969, bcdDevice=34.15 [ 88.458622][ T5717] usb 2-1: config 9 interface 0 has no altsetting 0 [ 88.582637][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.582665][ T5717] usb 2-1: Product: syz [ 88.582678][ T5717] usb 2-1: Manufacturer: syz [ 88.582691][ T5717] usb 2-1: SerialNumber: syz [ 88.834947][ T5908] netlink: 'syz.1.28': attribute type 1 has an invalid length. [ 88.948532][ T5930] netlink: 'syz.1.28': attribute type 10 has an invalid length. [ 88.948553][ T5930] netlink: 40 bytes leftover after parsing attributes in process `syz.1.28'. [ 89.064404][ T5930] dummy0: entered promiscuous mode [ 89.142435][ T5717] snd-usb-caiaq 2-1:9.0: can't set alt interface. [ 89.142458][ T5717] usb 2-1: unable to init card! (ret=-5) [ 89.143703][ T5717] snd-usb-caiaq 2-1:9.0: probe with driver snd-usb-caiaq failed with error -5 [ 89.178772][ T5717] usb 2-1: USB disconnect, device number 2 [ 90.527801][ T5950] loop4: detected capacity change from 0 to 512 [ 90.538415][ T5950] EXT4-fs: Ignoring removed mblk_io_submit option [ 90.612505][ T5950] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.39: corrupted in-inode xattr: e_value size too large [ 90.612537][ T5950] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 90.626872][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 90.626896][ C1] EXT4-fs (loop4): initial error at time 1790833217: ext4_iget_extra_inode:5210: inode 15 [ 90.626925][ C1] EXT4-fs (loop4): last error at time 1790833217: ext4_iget_extra_inode:5210: inode 15 [ 90.673399][ T5950] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.39: couldn't read orphan inode 15 (err -117) [ 90.673435][ T5950] loop4: lost filesystem error report for type 5 error -117 [ 90.864429][ T5950] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 91.746674][ T5603] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 92.383964][ T5987] netlink: 28 bytes leftover after parsing attributes in process `syz.4.46'. [ 92.385663][ T5987] netlink: 24 bytes leftover after parsing attributes in process `syz.4.46'. [ 96.438130][ T151] rpcbind: server 127.0.0.1 not responding, timed out [ 96.666394][ T6025] netlink: 12 bytes leftover after parsing attributes in process `syz.4.58'. [ 96.793357][ T6025] bond1 (unregistering): Released all slaves [ 96.794018][ T6030] loop3: detected capacity change from 0 to 512 [ 96.817031][ T6030] EXT4-fs: Ignoring removed mblk_io_submit option [ 96.887052][ T6030] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.57: corrupted in-inode xattr: e_value size too large [ 96.887088][ T6030] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 96.889379][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 96.889401][ C1] EXT4-fs (loop3): initial error at time 1790833224: ext4_iget_extra_inode:5210: inode 15 [ 96.889925][ C1] EXT4-fs (loop3): last error at time 1790833224: ext4_iget_extra_inode:5210: inode 15 [ 96.891058][ T6030] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.57: couldn't read orphan inode 15 (err -117) [ 96.891085][ T6030] loop3: lost filesystem error report for type 5 error -117 [ 96.911747][ T6030] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 97.228586][ T5602] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.364236][ T6039] v: renamed from veth0_vlan [ 102.502622][ T6079] netlink: 12 bytes leftover after parsing attributes in process `syz.3.72'. [ 102.703640][ T6079] bond1 (unregistering): Released all slaves [ 102.855703][ T6094] loop2: detected capacity change from 0 to 256 [ 102.946072][ T6096] netlink: 36 bytes leftover after parsing attributes in process `syz.0.74'. [ 103.475796][ T6094] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xb9756464, utbl_chksum : 0xe619d30d) [ 103.693585][ T6102] netlink: 'syz.1.76': attribute type 1 has an invalid length. [ 103.814988][ T6109] netlink: 12 bytes leftover after parsing attributes in process `syz.1.76'. [ 103.963572][ T6109] hsr_slave_0: entered allmulticast mode [ 104.019778][ T6117] syz.2.79 uses obsolete (PF_INET,SOCK_PACKET) [ 104.127773][ T6118] loop0: detected capacity change from 0 to 512 [ 104.141331][ T6118] ======================================================= [ 104.141331][ T6118] WARNING: The mand mount option has been deprecated and [ 104.141331][ T6118] and is ignored by this kernel. Remove the mand [ 104.141331][ T6118] option from the mount to silence this warning. [ 104.141331][ T6118] ======================================================= [ 104.141457][ T6118] EXT4-fs: Ignoring removed mblk_io_submit option [ 104.190546][ T6118] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 104.327625][ T5268] v: left promiscuous mode [ 104.408049][ T990] v: entered promiscuous mode [ 104.464359][ T6132] loop0: detected capacity change from 0 to 164 [ 105.250719][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.86'. [ 108.111513][ T6182] syzkaller0: entered promiscuous mode [ 108.111536][ T6182] syzkaller0: entered allmulticast mode [ 108.458059][ T6193] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 109.332873][ T6215] netlink: 12 bytes leftover after parsing attributes in process `syz.2.100'. [ 114.199585][ T5702] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 114.444013][ T6251] netlink: 36 bytes leftover after parsing attributes in process `syz.2.109'. [ 115.111921][ T5702] usb 5-1: New USB device found: idVendor=0cf2, idProduct=6250, bcdDevice=87.bd [ 115.116210][ T5702] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 115.116300][ T5702] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 115.124191][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.124216][ T5702] usb 5-1: Product: syz [ 115.124228][ T5702] usb 5-1: Manufacturer: syz [ 115.124241][ T5702] usb 5-1: SerialNumber: syz [ 115.260607][ T5702] usb 5-1: config 0 descriptor?? [ 115.352159][ T6256] netlink: 'syz.3.111': attribute type 4 has an invalid length. [ 115.368254][ T6256] netlink: 'syz.3.111': attribute type 4 has an invalid length. [ 115.579235][ T5702] usb 5-1: USB disconnect, device number 2 [ 115.641036][ T5808] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 115.811632][ T5808] usb 3-1: New USB device found: idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 115.816576][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.816626][ T5808] usb 3-1: Product: syz [ 115.816641][ T5808] usb 3-1: Manufacturer: syz [ 115.816654][ T5808] usb 3-1: SerialNumber: syz [ 115.890638][ T5808] usb 3-1: config 0 descriptor?? [ 115.908373][ T5808] ch341 3-1:0.0: ch341-uart converter detected [ 115.981061][ T6267] loop3: detected capacity change from 0 to 32768 [ 116.972560][ T5808] usb 3-1: failed to receive control message: -32 [ 116.972619][ T5808] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -32 [ 117.296930][ T6267] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 117.486749][ T6267] XFS (loop3): Ending clean mount [ 117.866542][ T6276] bridge_slave_0: left allmulticast mode [ 117.866571][ T6276] bridge_slave_0: left promiscuous mode [ 117.868099][ T6276] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.930064][ T6276] bridge_slave_1: left allmulticast mode [ 117.930092][ T6276] bridge_slave_1: left promiscuous mode [ 117.930293][ T6276] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.965826][ T6276] bond0: (slave bond_slave_0): Releasing backup interface [ 117.973589][ T5602] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 118.008652][ T6276] bond0: (slave bond_slave_1): Releasing backup interface [ 118.049157][ T6276] team0: Port device team_slave_0 removed [ 118.085758][ T6276] team0: Port device team_slave_1 removed [ 118.086654][ T6276] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.086675][ T6276] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 118.117082][ T6276] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.117105][ T6276] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 118.134356][ T6276] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 118.267248][ T5702] usb 3-1: USB disconnect, device number 2 [ 118.287213][ T5702] ch341 3-1:0.0: device disconnected [ 118.434693][ T6292] loop0: detected capacity change from 0 to 512 [ 118.464384][ T6292] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 118.464524][ T6292] System zones: 1-12 [ 118.493030][ T6292] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.118: missing EA_INODE flag [ 118.493062][ T6292] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 118.499385][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 118.499409][ C1] EXT4-fs (loop0): initial error at time 1790833501: ext4_xattr_inode_iget:437: inode 12 [ 118.499438][ C1] EXT4-fs (loop0): last error at time 1790833501: ext4_xattr_inode_iget:437: inode 12 [ 118.551452][ T6292] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.118: error while reading EA inode 12 err=-117 [ 118.551493][ T6292] loop0: lost filesystem error report for type 5 error -117 [ 118.553300][ T6292] EXT4-fs (loop0): 1 orphan inode deleted [ 118.554996][ T6292] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.663618][ T6306] loop4: detected capacity change from 0 to 164 [ 118.692231][ T5604] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.043804][ T6321] __vm_enough_memory: pid: 6321, comm: syz.0.126, bytes: 4503599627366400 not enough memory for the allocation [ 119.579458][ T5724] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 119.997329][ T6310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.004363][ T6310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.115734][ T5724] usb 5-1: unable to get BOS descriptor or descriptor too short [ 120.120752][ T5724] usb 5-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=0.00 [ 120.120790][ T5724] usb 5-1: no configurations [ 120.120802][ T5724] usb 5-1: can't read configurations, error -22 [ 120.697182][ T6343] syzkaller0: entered promiscuous mode [ 120.697206][ T6343] syzkaller0: entered allmulticast mode [ 122.359570][ T5808] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 122.515334][ T5808] usb 3-1: New USB device found: idVendor=17cc, idProduct=1969, bcdDevice=34.15 [ 122.518482][ T5808] usb 3-1: config 9 interface 0 has no altsetting 0 [ 122.547353][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.547380][ T5808] usb 3-1: Product: syz [ 122.547394][ T5808] usb 3-1: Manufacturer: syz [ 122.547407][ T5808] usb 3-1: SerialNumber: syz [ 122.795037][ T6372] netlink: 'syz.2.139': attribute type 1 has an invalid length. [ 122.807382][ T6388] capability: warning: `syz.0.141' uses deprecated v2 capabilities in a way that may be insecure [ 122.876743][ T6372] 8021q: adding VLAN 0 to HW filter on device bond1 [ 122.938565][ T6389] bond1: (slave gretap1): making interface the new active one [ 122.949179][ T6389] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 123.058715][ T6396] netlink: 4 bytes leftover after parsing attributes in process `syz.0.142'. [ 123.058755][ T6396] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 123.084787][ T6372] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 123.086749][ T6389] netlink: 'syz.2.139': attribute type 10 has an invalid length. [ 123.086770][ T6389] netlink: 40 bytes leftover after parsing attributes in process `syz.2.139'. [ 123.086852][ T6389] dummy0: entered promiscuous mode [ 123.126863][ T6389] bond1: (slave dummy0): Releasing active interface [ 123.126928][ T6389] gretap1: entered promiscuous mode [ 123.245106][ T5808] snd-usb-caiaq 3-1:9.0: can't set alt interface. [ 123.245131][ T5808] usb 3-1: unable to init card! (ret=-5) [ 123.247629][ T5808] snd-usb-caiaq 3-1:9.0: probe with driver snd-usb-caiaq failed with error -5 [ 123.272447][ T5808] usb 3-1: USB disconnect, device number 3 [ 125.364832][ T6416] loop2: detected capacity change from 0 to 4096 [ 125.401848][ T6416] ntfs3(loop2): ino=0, mi_enum_attr [ 125.443708][ T6416] ntfs3(loop2): ino=0, mi_enum_attr [ 125.443969][ T6416] ntfs3(loop2): Mark volume as dirty due to NTFS errors [ 125.481854][ T6416] ntfs3(loop2): ino=0, mi_enum_attr [ 127.196328][ T6431] syzkaller0: entered promiscuous mode [ 127.196354][ T6431] syzkaller0: entered allmulticast mode [ 127.930369][ T6444] lo: entered promiscuous mode [ 128.031099][ T6444] tunl0: entered promiscuous mode [ 128.174754][ T6444] gre0: entered promiscuous mode [ 128.358183][ T6444] gretap0: entered promiscuous mode [ 128.385590][ T6444] erspan0: entered promiscuous mode [ 128.398670][ T6444] ip_vti0: entered promiscuous mode [ 128.409688][ T6444] ip6_vti0: entered promiscuous mode [ 128.416990][ T6444] sit0: entered promiscuous mode [ 128.422787][ T6444] ip6tnl0: entered promiscuous mode [ 128.432481][ T6444] ip6gre0: entered promiscuous mode [ 128.457049][ T6444] syz_tun: entered promiscuous mode [ 128.470294][ T6444] ip6gretap0: entered promiscuous mode [ 128.483754][ T6444] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.484126][ T6444] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.487407][ T6444] bridge0: entered promiscuous mode [ 128.497418][ T6444] vcan0: entered promiscuous mode [ 128.504043][ T6444] bond0: entered promiscuous mode [ 128.504063][ T6444] bond_slave_0: entered promiscuous mode [ 128.504268][ T6444] bond_slave_1: entered promiscuous mode [ 128.531823][ T6444] team0: entered promiscuous mode [ 128.531843][ T6444] team_slave_0: entered promiscuous mode [ 128.532118][ T6444] team_slave_1: entered promiscuous mode [ 128.569867][ T990] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 128.574702][ T6444] nlmon0: entered promiscuous mode [ 128.578090][ T6444] batadv0: entered promiscuous mode [ 128.588035][ T6444] vxcan0: entered promiscuous mode [ 128.589829][ T6444] vxcan1: entered promiscuous mode [ 128.591776][ T6444] veth0: entered promiscuous mode [ 128.599167][ T6444] veth1: entered promiscuous mode [ 128.614118][ T6444] wg0: entered promiscuous mode [ 128.619197][ T6444] wg1: entered promiscuous mode [ 128.628806][ T6444] wg2: entered promiscuous mode [ 128.640023][ T6444] veth0_to_bridge: entered promiscuous mode [ 128.651557][ T6444] veth1_to_bridge: entered promiscuous mode [ 128.665837][ T6444] veth0_to_bond: entered promiscuous mode [ 128.677988][ T6444] veth1_to_bond: entered promiscuous mode [ 128.687792][ T6444] veth0_to_team: entered promiscuous mode [ 128.701445][ T6444] veth1_to_team: entered promiscuous mode [ 128.711906][ T6444] veth0_to_batadv: entered promiscuous mode [ 128.719488][ T6444] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.719538][ T6444] batadv_slave_0: entered promiscuous mode [ 128.725924][ T6444] veth1_to_batadv: entered promiscuous mode [ 128.736669][ T6444] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.736737][ T6444] batadv_slave_1: entered promiscuous mode [ 128.741024][ T990] usb 4-1: New USB device found: idVendor=046d, idProduct=0920, bcdDevice=78.55 [ 128.745924][ T6444] xfrm0: entered promiscuous mode [ 128.768083][ T6444] veth0_to_hsr: entered promiscuous mode [ 128.779802][ T990] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.779826][ T990] usb 4-1: Product: syz [ 128.779841][ T990] usb 4-1: Manufacturer: syz [ 128.779854][ T990] usb 4-1: SerialNumber: syz [ 128.786282][ T990] usb 4-1: config 0 descriptor?? [ 128.791362][ T6444] veth1_to_hsr: entered promiscuous mode [ 128.808441][ T6444] hsr0: entered promiscuous mode [ 128.819003][ T6444] veth1_virt_wifi: entered promiscuous mode [ 128.820582][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 128.828430][ T6444] veth0_virt_wifi: entered promiscuous mode [ 128.854611][ T6444] virt_wifi0: entered promiscuous mode [ 128.876232][ T6444] vlan0: entered promiscuous mode [ 128.883976][ T6444] vlan1: entered promiscuous mode [ 128.896381][ T6444] macvlan0: entered promiscuous mode [ 128.905920][ T6444] macvlan1: entered promiscuous mode [ 128.913904][ T6444] ipvlan0: entered promiscuous mode [ 128.920294][ T6444] ipvlan1: entered promiscuous mode [ 128.947852][ T6444] macvtap0: entered promiscuous mode [ 128.963408][ T6444] macsec0: entered promiscuous mode [ 128.973394][ T6444] geneve0: entered promiscuous mode [ 128.985314][ T6444] geneve1: entered promiscuous mode [ 128.994346][ T10] usb 1-1: New USB device found: idVendor=17cc, idProduct=1969, bcdDevice=34.15 [ 128.995589][ T10] usb 1-1: config 9 interface 0 has no altsetting 0 [ 128.997751][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.997772][ T10] usb 1-1: Product: syz [ 128.997785][ T10] usb 1-1: Manufacturer: syz [ 128.997798][ T10] usb 1-1: SerialNumber: syz [ 129.046267][ T6444] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 129.071402][ T990] gspca_main: tv8532-2.14.0 probing 046d:0920 [ 129.090575][ T6444] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 129.109779][ T6444] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 129.138164][ T6444] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 129.150295][ T990] usb 4-1: USB disconnect, device number 2 [ 129.182207][ T5848] udevd[5848]: setting owner of /dev/bus/usb/004/002 to uid=0, gid=0 failed: No such file or directory [ 129.186158][ T6444] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 129.250354][ T6444] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 129.263480][ T5889] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.264500][ T5889] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.264562][ T5889] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.264597][ T5889] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.265931][ T6453] netlink: 'syz.0.159': attribute type 1 has an invalid length. [ 129.416505][ T6453] 8021q: adding VLAN 0 to HW filter on device bond1 [ 129.464904][ T6468] bond1: (slave gretap1): making interface the new active one [ 129.466550][ T6468] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 129.877916][ T6473] netlink: 'syz.4.163': attribute type 1 has an invalid length. [ 130.290462][ T6468] netlink: 'syz.0.159': attribute type 10 has an invalid length. [ 130.290488][ T6468] netlink: 40 bytes leftover after parsing attributes in process `syz.0.159'. [ 130.293747][ T6453] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 130.295894][ T6468] dummy0: entered promiscuous mode [ 130.344512][ T6468] bond1: (slave dummy0): Releasing active interface [ 130.344542][ T6468] gretap1: entered promiscuous mode [ 130.529957][ T10] snd-usb-caiaq 1-1:9.0: can't set alt interface. [ 130.529982][ T10] usb 1-1: unable to init card! (ret=-5) [ 130.530335][ T10] snd-usb-caiaq 1-1:9.0: probe with driver snd-usb-caiaq failed with error -5 [ 130.542655][ T10] usb 1-1: USB disconnect, device number 2 [ 131.061258][ T6495] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 131.067265][ T6495] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 132.570502][ T6512] wusb3801 0-0004: supply vbus not found, using dummy regulator [ 132.939564][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.939621][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.871207][ T6512] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x04 [ 135.863067][ T6542] loop2: detected capacity change from 0 to 256 [ 135.878169][ T6542] FAT-fs (loop2): bogus logical sector size 0 [ 135.878196][ T6542] FAT-fs (loop2): Can't find a valid FAT filesystem [ 136.071307][ T5889] gretap1: left promiscuous mode [ 136.989743][ T990] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 137.139973][ T990] usb 1-1: Using ep0 maxpacket: 32 [ 137.145655][ T990] usb 1-1: New USB device found: idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 137.197882][ T990] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.198014][ T990] usb 1-1: Product: syz [ 137.198102][ T990] usb 1-1: Manufacturer: syz [ 137.198145][ T990] usb 1-1: SerialNumber: syz [ 137.314942][ T990] usb 1-1: config 0 descriptor?? [ 137.450765][ T990] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 139.101288][ T5702] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 139.773389][ T5702] usb 2-1: unable to get BOS descriptor or descriptor too short [ 139.774208][ T5702] usb 2-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 139.775051][ T5702] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 139.775083][ T5702] usb 2-1: can't read configurations, error -71 [ 139.833351][ T6572] loop0: detected capacity change from 0 to 4096 [ 139.878734][ T6572] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 139.878761][ T6572] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 139.878772][ T6572] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 139.878825][ T6572] loop0: [ 139.973199][ T990] gspca_ov534_9: sccb_write failed [ 140.038965][ T6579] syzkaller0: entered promiscuous mode [ 140.038988][ T6579] syzkaller0: entered allmulticast mode [ 140.175533][ T990] gspca_ov534_9: reg_w failed -71 [ 140.409404][ T990] gspca_ov534_9: Unknown sensor 0000 [ 140.409493][ T990] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 140.413557][ T990] usb 1-1: USB disconnect, device number 3 [ 140.438332][ T6592] loop4: detected capacity change from 0 to 8 [ 140.502296][ T6592] SQUASHFS error: Unable to read inode 0x11f [ 140.556044][ T33] audit: type=1800 audit(1790833523.741:2): pid=6590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.203" name="/" dev="fuse" ino=1 res=0 errno=-5 [ 142.349519][ T33] audit: type=1800 audit(1790833525.511:3): pid=6607 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.207" name=08 dev="sda1" ino=2049 res=0 errno=-22 [ 143.280010][ T6621] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 143.787725][ T6633] FAULT_INJECTION: forcing a failure. [ 143.787725][ T6633] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 143.787757][ T6633] CPU: 0 UID: 0 PID: 6633 Comm: syz.1.216 Not tainted syzkaller #0 PREEMPT(full) [ 143.787779][ T6633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.787791][ T6633] Call Trace: [ 143.787798][ T6633] [ 143.787807][ T6633] dump_stack_lvl+0xe8/0x150 [ 143.787859][ T6633] should_fail_ex+0x3eb/0x540 [ 143.787882][ T6633] _copy_from_user+0x2d/0xb0 [ 143.787903][ T6633] do_ip6t_set_ctl+0x74c/0xe30 [ 143.787929][ T6633] ? rcu_is_watching+0x16/0xb0 [ 143.787951][ T6633] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 143.787986][ T6633] ? __mutex_unlock_slowpath+0x731/0x900 [ 143.788014][ T6633] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 143.788048][ T6633] nf_setsockopt+0x26f/0x290 [ 143.788070][ T6633] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 143.788091][ T6633] do_sock_setsockopt+0x17c/0x1b0 [ 143.788116][ T6633] __x64_sys_setsockopt+0x13d/0x1b0 [ 143.788140][ T6633] do_syscall_64+0x166/0x520 [ 143.788161][ T6633] ? trace_irq_disable+0x3b/0x140 [ 143.788178][ T6633] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.788198][ T6633] ? clear_bhb_loop+0x70/0xc0 [ 143.788219][ T6633] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.788238][ T6633] RIP: 0033:0x7f60a739e159 [ 143.788262][ T6633] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.788276][ T6633] RSP: 002b:00007f60a822a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 143.788298][ T6633] RAX: ffffffffffffffda RBX: 00007f60a7625fa0 RCX: 00007f60a739e159 [ 143.788312][ T6633] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 [ 143.788324][ T6633] RBP: 00007f60a743506b R08: 0000000000000310 R09: 0000000000000000 [ 143.788336][ T6633] R10: 0000200000000980 R11: 0000000000000246 R12: 0000000000000000 [ 143.788348][ T6633] R13: 00007f60a7626038 R14: 00007f60a7625fa0 R15: 00007ffdf88880d8 [ 143.788378][ T6633] [ 144.880122][ T5889] gretap1: left promiscuous mode [ 145.836142][ T6663] bridge_slave_0: left allmulticast mode [ 145.836390][ T6663] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.905661][ T6663] bridge_slave_1: left allmulticast mode [ 145.905956][ T6663] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.936987][ T6663] bond0: (slave bond_slave_0): Releasing backup interface [ 147.006485][ T6663] bond0: (slave bond_slave_1): Releasing backup interface [ 147.718529][ T6663] team0: Port device team_slave_0 removed [ 147.740091][ T6663] team0: Port device team_slave_1 removed [ 147.740452][ T6663] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 147.749245][ T6663] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 147.777211][ T6663] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 147.847311][ T6667] team0: Mode changed to "loadbalance" [ 148.149801][ T32] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 148.305276][ T32] usb 4-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 148.309955][ T32] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.317025][ T32] usb 4-1: config 0 descriptor?? [ 148.537070][ T32] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 148.665835][ T6700] netlink: 4 bytes leftover after parsing attributes in process `syz.0.229'. [ 148.985064][ T32] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 1 [ 148.985091][ T32] [drm] Initialized udl on minor 1 [ 150.096780][ T32] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 150.111749][ T32] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 150.129111][ T32] usb 4-1: USB disconnect, device number 3 [ 150.265618][ T6719] netlink: 12 bytes leftover after parsing attributes in process `syz.1.233'. [ 150.395108][ T6719] netlink: 'syz.1.233': attribute type 5 has an invalid length. [ 150.395130][ T6719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.233'. [ 150.461487][ T5808] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 150.610879][ T5808] usb 3-1: New USB device found: idVendor=046d, idProduct=0920, bcdDevice=78.55 [ 150.627360][ T5808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.627386][ T5808] usb 3-1: Product: syz [ 150.627400][ T5808] usb 3-1: Manufacturer: syz [ 150.627413][ T5808] usb 3-1: SerialNumber: syz [ 150.663513][ T5808] usb 3-1: config 0 descriptor?? [ 150.664496][ T6731] netlink: 'syz.1.236': attribute type 8 has an invalid length. [ 150.904068][ T6741] FAULT_INJECTION: forcing a failure. [ 150.904068][ T6741] name failslab, interval 1, probability 0, space 0, times 1 [ 150.904102][ T6741] CPU: 1 UID: 0 PID: 6741 Comm: syz.3.239 Not tainted syzkaller #0 PREEMPT(full) [ 150.904149][ T6741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.904164][ T6741] Call Trace: [ 150.904171][ T6741] [ 150.904180][ T6741] dump_stack_lvl+0xe8/0x150 [ 150.904208][ T6741] should_fail_ex+0x3eb/0x540 [ 150.904234][ T6741] should_failslab+0xa8/0x100 [ 150.904254][ T6741] ? __kernfs_new_node+0xe6/0x980 [ 150.904273][ T6741] kmem_cache_alloc_noprof+0x9c/0x600 [ 150.904293][ T6741] ? kstrdup+0x81/0x100 [ 150.904311][ T6741] ? __kernfs_new_node+0xe6/0x980 [ 150.904336][ T6741] __kernfs_new_node+0xe6/0x980 [ 150.904354][ T6741] ? check_path+0x21/0x40 [ 150.904379][ T6741] ? __pfx___kernfs_new_node+0x10/0x10 [ 150.904397][ T6741] ? kernfs_root+0x1c/0x230 [ 150.904422][ T6741] ? kernfs_root+0x1c/0x230 [ 150.904440][ T6741] ? kernfs_root+0x1c/0x230 [ 150.904455][ T6741] ? kernfs_root+0x1c/0x230 [ 150.904479][ T6741] kernfs_create_dir_ns+0xf7/0x220 [ 150.904504][ T6741] sysfs_create_dir_ns+0x12f/0x2a0 [ 150.904529][ T6741] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 150.904552][ T6741] ? do_raw_spin_unlock+0xf5/0x200 [ 150.904576][ T6741] kobject_add_internal+0x622/0xcd0 [ 150.904602][ T6741] kobject_init_and_add+0x12b/0x1a0 [ 150.904628][ T6741] ? __pfx_kobject_init_and_add+0x10/0x10 [ 150.904648][ T6741] ? __kmalloc_cache_noprof+0x148/0x600 [ 150.904666][ T6741] ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0 [ 150.904685][ T6741] ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0 [ 150.904719][ T6741] rpc_sysfs_xprt_switch_setup+0x169/0x2b0 [ 150.904744][ T6741] xprt_switch_alloc+0x238/0x590 [ 150.904770][ T6741] rpc_create_xprt+0x1c7/0xa90 [ 150.904793][ T6741] ? __pfx_rpc_create_xprt+0x10/0x10 [ 150.904821][ T6741] ? rcu_is_watching+0x16/0xb0 [ 150.904841][ T6741] ? trace_kmalloc+0x2a/0xf0 [ 150.904863][ T6741] ? __kmalloc_node_track_caller_noprof+0x4cd/0x720 [ 150.904883][ T6741] ? __kmalloc_node_track_caller_noprof+0x2e6/0x720 [ 150.904902][ T6741] ? xprt_create_transport+0x39b/0x5f0 [ 150.904919][ T6741] ? xprt_create_transport+0x39b/0x5f0 [ 150.904937][ T6741] ? kstrdup+0x81/0x100 [ 150.904955][ T6741] ? __asan_memcpy+0x40/0x70 [ 150.904979][ T6741] ? xprt_create_transport+0x438/0x5f0 [ 150.905001][ T6741] rpc_create+0x649/0x900 [ 150.905017][ T6741] ? rcu_is_watching+0x16/0xb0 [ 150.905037][ T6741] ? __pfx_rpc_create+0x10/0x10 [ 150.905063][ T6741] ? __bfs+0x153/0x290 [ 150.905078][ T6741] ? __pfx_hlock_conflict+0x10/0x10 [ 150.905128][ T6741] ? nfs_init_timeout_values+0x186/0x430 [ 150.905152][ T6741] nfs_mount+0x445/0x740 [ 150.905176][ T6741] ? __pfx_nfs_mount+0x10/0x10 [ 150.905207][ T6741] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 150.905251][ T6741] ? nfs_try_get_tree+0x57f/0x11e0 [ 150.905274][ T6741] nfs_try_get_tree+0x76d/0x11e0 [ 150.905292][ T6741] ? irqentry_exit+0x218/0x920 [ 150.905308][ T6741] ? trace_irq_disable+0x3b/0x140 [ 150.905334][ T6741] ? __pfx_nfs_try_get_tree+0x10/0x10 [ 150.905372][ T6741] ? find_nfs_version+0x9d/0x170 [ 150.905393][ T6741] ? nfs_get_tree+0x11a9/0x1650 [ 150.905421][ T6741] vfs_get_tree+0x92/0x2a0 [ 150.905442][ T6741] vfs_cmd_create+0xa2/0x200 [ 150.905464][ T6741] __se_sys_fsconfig+0x6b9/0x810 [ 150.905489][ T6741] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 150.905510][ T6741] ? rcu_is_watching+0x16/0xb0 [ 150.905534][ T6741] ? __x64_sys_fsconfig+0x20/0xc0 [ 150.905553][ T6741] do_syscall_64+0x166/0x520 [ 150.905568][ T6741] ? trace_irq_disable+0x3b/0x140 [ 150.905582][ T6741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.905599][ T6741] ? clear_bhb_loop+0x70/0xc0 [ 150.905619][ T6741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.905638][ T6741] RIP: 0033:0x7f0fe6b9e159 [ 150.905656][ T6741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.905672][ T6741] RSP: 002b:00007f0fe79a0028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 150.905693][ T6741] RAX: ffffffffffffffda RBX: 00007f0fe6e25fa0 RCX: 00007f0fe6b9e159 [ 150.905715][ T6741] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 150.905726][ T6741] RBP: 00007f0fe6c3506b R08: 0000000000000000 R09: 0000000000000000 [ 150.905738][ T6741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 150.905748][ T6741] R13: 00007f0fe6e26038 R14: 00007f0fe6e25fa0 R15: 00007fff996d5ff8 [ 150.905779][ T6741] [ 150.908744][ T6741] kobject: kobject_add_internal failed for switch-0 (error: -12 parent: xprt-switches) [ 151.121034][ T5808] gspca_main: tv8532-2.14.0 probing 046d:0920 [ 151.445200][ T5808] usb 3-1: USB disconnect, device number 4 [ 152.715042][ T6780] loop3: detected capacity change from 0 to 512 [ 152.721907][ T6780] EXT4-fs: Ignoring removed mblk_io_submit option [ 152.884246][ T6780] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.248: corrupted in-inode xattr: e_value size too large [ 152.884282][ T6780] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 152.898645][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 152.898669][ C0] EXT4-fs (loop3): initial error at time 1790833536: ext4_iget_extra_inode:5210: inode 15 [ 152.898698][ C0] EXT4-fs (loop3): last error at time 1790833536: ext4_iget_extra_inode:5210: inode 15 [ 152.938826][ T6780] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.248: couldn't read orphan inode 15 (err -117) [ 152.938857][ T6780] loop3: lost filesystem error report for type 5 error -117 [ 152.958628][ T6780] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 153.008861][ T6788] FAULT_INJECTION: forcing a failure. [ 153.008861][ T6788] name failslab, interval 1, probability 0, space 0, times 0 [ 153.008893][ T6788] CPU: 1 UID: 0 PID: 6788 Comm: syz.1.251 Not tainted syzkaller #0 PREEMPT(full) [ 153.008917][ T6788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 153.008930][ T6788] Call Trace: [ 153.008938][ T6788] [ 153.008946][ T6788] dump_stack_lvl+0xe8/0x150 [ 153.008974][ T6788] should_fail_ex+0x3eb/0x540 [ 153.009008][ T6788] ? __pfx_proc_alloc_inode+0x10/0x10 [ 153.009030][ T6788] should_failslab+0xa8/0x100 [ 153.009052][ T6788] ? __pfx_proc_alloc_inode+0x10/0x10 [ 153.009071][ T6788] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 153.009095][ T6788] ? proc_alloc_inode+0x2a/0xc0 [ 153.009112][ T6788] ? proc_alloc_inode+0x2a/0xc0 [ 153.009137][ T6788] ? __pfx_proc_alloc_inode+0x10/0x10 [ 153.009156][ T6788] proc_alloc_inode+0x2a/0xc0 [ 153.009176][ T6788] alloc_inode+0x6a/0x1b0 [ 153.009197][ T6788] new_inode+0x1f/0x170 [ 153.009214][ T6788] ? proc_pid_make_inode+0x19/0x130 [ 153.009236][ T6788] proc_pid_make_inode+0x21/0x130 [ 153.009259][ T6788] proc_pident_instantiate+0x6d/0x2a0 [ 153.009283][ T6788] proc_fill_cache+0x2a8/0x390 [ 153.009306][ T6788] ? __pfx_proc_pident_instantiate+0x10/0x10 [ 153.009323][ T6788] ? __pfx_proc_fill_cache+0x10/0x10 [ 153.009344][ T6788] ? __pfx_filldir64+0x10/0x10 [ 153.009368][ T6788] proc_pident_readdir+0x151/0x1f0 [ 153.009395][ T6788] iterate_dir+0x2e2/0x4d0 [ 153.009419][ T6788] __se_sys_getdents64+0xf1/0x280 [ 153.009443][ T6788] ? __pfx___se_sys_getdents64+0x10/0x10 [ 153.009461][ T6788] ? __pfx_filldir64+0x10/0x10 [ 153.009481][ T6788] ? rcu_is_watching+0x16/0xb0 [ 153.009514][ T6788] do_syscall_64+0x166/0x520 [ 153.009532][ T6788] ? trace_irq_disable+0x3b/0x140 [ 153.009550][ T6788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.009570][ T6788] ? clear_bhb_loop+0x70/0xc0 [ 153.009592][ T6788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.009612][ T6788] RIP: 0033:0x7f60a739e159 [ 153.009632][ T6788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.009647][ T6788] RSP: 002b:00007f60a822a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 153.009668][ T6788] RAX: ffffffffffffffda RBX: 00007f60a7625fa0 RCX: 00007f60a739e159 [ 153.009683][ T6788] RDX: 000000000000006f RSI: 0000200000000340 RDI: 0000000000000005 [ 153.009696][ T6788] RBP: 00007f60a743506b R08: 0000000000000000 R09: 0000000000000000 [ 153.009709][ T6788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 153.009722][ T6788] R13: 00007f60a7626038 R14: 00007f60a7625fa0 R15: 00007ffdf88880d8 [ 153.009754][ T6788] [ 153.355053][ T5602] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 154.117055][ T33] audit: type=1326 audit(1790833537.301:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.118190][ T33] audit: type=1326 audit(1790833537.301:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.118236][ T33] audit: type=1326 audit(1790833537.301:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169514][ T33] audit: type=1326 audit(1790833537.301:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169589][ T33] audit: type=1326 audit(1790833537.301:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169626][ T33] audit: type=1326 audit(1790833537.301:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169662][ T33] audit: type=1326 audit(1790833537.301:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169699][ T33] audit: type=1326 audit(1790833537.301:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169735][ T33] audit: type=1326 audit(1790833537.301:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.169771][ T33] audit: type=1326 audit(1790833537.301:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6824 comm="syz.0.260" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa70d19e159 code=0x7ffc0000 [ 154.200737][ T32] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 154.432942][ T32] usb 2-1: New USB device found: idVendor=046d, idProduct=0920, bcdDevice=78.55 [ 154.655339][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.655388][ T32] usb 2-1: Product: syz [ 154.655442][ T32] usb 2-1: Manufacturer: syz [ 154.655920][ T32] usb 2-1: SerialNumber: syz [ 155.124657][ T32] usb 2-1: config 0 descriptor?? [ 155.511862][ T32] gspca_main: tv8532-2.14.0 probing 046d:0920 [ 155.632447][ T32] usb 2-1: USB disconnect, device number 5 [ 156.348521][ T6841] netlink: 'syz.2.265': attribute type 1 has an invalid length. [ 156.349074][ T6841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.265'. [ 156.349270][ T6841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.265'. [ 157.089550][ T6845] loop2: detected capacity change from 0 to 256 [ 157.622814][ T6865] sg_write: data in/out 768/2 bytes for SCSI command 0x0-- guessing data in; [ 157.622814][ T6865] program syz.2.271 not setting count and/or reply_len properly [ 158.808179][ T6868] loop4: detected capacity change from 0 to 1024 [ 158.881389][ T6870] loop1: detected capacity change from 0 to 256 [ 159.142773][ T6878] netlink: 12 bytes leftover after parsing attributes in process `syz.3.277'. [ 159.181428][ T6878] bond1: entered promiscuous mode [ 159.181451][ T6878] bond1: entered allmulticast mode [ 159.320543][ T990] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 159.459506][ T5808] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 159.486717][ T6888] xt_limit: Overflow, try lower: 1207959552/384 [ 159.929405][ T990] usb 1-1: Using ep0 maxpacket: 8 [ 159.933311][ T990] usb 1-1: New USB device found: idVendor=0225, idProduct=0000, bcdDevice=0.00 [ 159.935766][ T990] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 159.935791][ T990] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 159.935831][ T990] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 159.935855][ T990] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 159.935890][ T990] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.935932][ T5808] usb 2-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 159.957993][ T990] hub 1-1:1.0: bad descriptor, ignoring hub [ 159.958019][ T990] hub 1-1:1.0: probe with driver hub failed with error -5 [ 159.958542][ T990] cdc_wdm 1-1:1.0: skipping garbage [ 159.958555][ T990] cdc_wdm 1-1:1.0: skipping garbage [ 160.037231][ T5808] usb 2-1: config 1 has an invalid interface number: 128 but max is 1 [ 160.037262][ T5808] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.037280][ T5808] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 160.037297][ T5808] usb 2-1: config 1 has no interface number 0 [ 160.037337][ T5808] usb 2-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 160.137774][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.137809][ T5808] usb 2-1: Product: syz [ 160.137822][ T5808] usb 2-1: Manufacturer: syz [ 160.137835][ T5808] usb 2-1: SerialNumber: syz [ 160.186575][ T5808] cdc_wdm 2-1:1.128: skipping garbage [ 160.186637][ T5808] cdc_wdm 2-1:1.128: skipping garbage [ 160.186661][ T5808] cdc_wdm 2-1:1.128: probe with driver cdc_wdm failed with error -22 [ 160.202013][ T990] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 160.202050][ T990] cdc_wdm 1-1:1.0: Unknown control protocol [ 160.245996][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.246091][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.246616][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.246638][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.246847][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.246868][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.247067][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.247086][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.247292][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.247311][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.247511][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.247531][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.247729][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.247748][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.247947][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.247967][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.248169][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.248188][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.248388][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 160.248407][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 160.290496][ T990] usb 1-1: USB disconnect, device number 4 [ 160.291797][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 160.439064][ T5709] usb 2-1: USB disconnect, device number 6 [ 160.859496][ T990] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 160.879457][ T5709] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 161.012396][ T990] usb 1-1: Using ep0 maxpacket: 8 [ 161.013935][ T990] usb 1-1: New USB device found: idVendor=0225, idProduct=0000, bcdDevice=0.00 [ 161.015394][ T990] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.015414][ T990] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 161.015455][ T990] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 161.015479][ T990] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 161.015517][ T990] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.035157][ T5709] usb 5-1: New USB device found: idVendor=17ef, idProduct=60b5, bcdDevice=0.00 [ 161.042304][ T5709] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 161.042334][ T5709] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 161.042357][ T5709] usb 5-1: config 0 interface 0 has no altsetting 0 [ 161.042387][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.059749][ T990] hub 1-1:1.0: bad descriptor, ignoring hub [ 161.059775][ T990] hub 1-1:1.0: probe with driver hub failed with error -5 [ 161.060342][ T990] cdc_wdm 1-1:1.0: skipping garbage [ 161.060355][ T990] cdc_wdm 1-1:1.0: skipping garbage [ 161.080032][ T990] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 161.080053][ T990] cdc_wdm 1-1:1.0: Unknown control protocol [ 161.080559][ T5709] usb 5-1: config 0 descriptor?? [ 161.081812][ T6901] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 161.919855][ T32] usb 1-1: USB disconnect, device number 5 [ 162.464524][ T6926] kvm: requested 6704 ns i8254 timer period limited to 200000 ns [ 162.481124][ T6926] kvm: requested 95542 ns i8254 timer period limited to 200000 ns [ 162.483616][ T6926] kvm: requested 192762 ns i8254 timer period limited to 200000 ns [ 162.484503][ T6926] kvm: requested 160914 ns i8254 timer period limited to 200000 ns [ 162.519514][ T6926] kvm: requested 127390 ns i8254 timer period limited to 200000 ns [ 162.520666][ T6926] kvm: requested 145828 ns i8254 timer period limited to 200000 ns [ 162.527584][ T6926] kvm: requested 57828 ns i8254 timer period limited to 200000 ns [ 162.557995][ T6926] kvm: requested 92190 ns i8254 timer period limited to 200000 ns [ 162.572519][ T6926] kvm: requested 170971 ns i8254 timer period limited to 200000 ns [ 162.574748][ T6926] kvm: requested 98895 ns i8254 timer period limited to 200000 ns [ 164.619486][ T5709] usbhid 5-1:0.0: can't add hid device: -71 [ 164.619600][ T5709] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 164.635177][ T5709] usb 5-1: USB disconnect, device number 5 [ 165.101046][ T5709] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 165.250198][ T5709] usb 5-1: New USB device found: idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 165.250816][ T5709] usb 5-1: config 0 has no interfaces? [ 165.250847][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.254611][ T5709] usb 5-1: config 0 descriptor?? [ 165.382991][ T6973] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 165.535817][ T5808] usb 5-1: USB disconnect, device number 6 [ 165.955072][ T6983] netlink: 'syz.1.307': attribute type 1 has an invalid length. [ 165.990182][ T6983] 8021q: adding VLAN 0 to HW filter on device bond1 [ 166.012752][ T6983] veth0_to_bond: left promiscuous mode [ 166.036244][ T6983] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 166.062398][ T6983] bond1: entered promiscuous mode [ 166.062425][ T6983] bond1: entered allmulticast mode [ 166.085488][ T6983] macvlan2: entered promiscuous mode [ 166.085511][ T6983] macvlan2: entered allmulticast mode [ 166.101918][ T6983] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 166.124368][ T6989] netlink: 'syz.3.308': attribute type 1 has an invalid length. [ 166.247249][ T6987] bond2: (slave veth0_to_bond): making interface the new active one [ 166.259958][ T6987] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 166.324538][ T6996] loop0: detected capacity change from 0 to 1024 [ 166.473526][ T6996] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 166.473703][ T6996] ext4 filesystem being mounted at /65/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.734262][ T7012] tipc: Started in network mode [ 167.734285][ T7012] tipc: Node identity 4, cluster identity 4711 [ 167.734297][ T7012] tipc: Node number set to 4 [ 167.989735][ T5717] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 168.083263][ T7024] FAULT_INJECTION: forcing a failure. [ 168.083263][ T7024] name failslab, interval 1, probability 0, space 0, times 0 [ 168.083293][ T7024] CPU: 0 UID: 0 PID: 7024 Comm: syz.2.319 Not tainted syzkaller #0 PREEMPT(full) [ 168.083315][ T7024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.083327][ T7024] Call Trace: [ 168.083335][ T7024] [ 168.083343][ T7024] dump_stack_lvl+0xe8/0x150 [ 168.083370][ T7024] should_fail_ex+0x3eb/0x540 [ 168.083397][ T7024] should_failslab+0xa8/0x100 [ 168.083420][ T7024] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 168.083444][ T7024] ? __d_alloc+0x37/0x7f0 [ 168.083460][ T7024] ? __d_alloc+0x37/0x7f0 [ 168.083484][ T7024] __d_alloc+0x37/0x7f0 [ 168.083507][ T7024] d_alloc+0x4b/0x190 [ 168.083524][ T7024] ? lookup_one_qstr_excl+0xc4/0x360 [ 168.083546][ T7024] lookup_one_qstr_excl+0xd8/0x360 [ 168.083566][ T7024] ? lookup_noperm_common+0x245/0x430 [ 168.083588][ T7024] start_dirop+0x5c/0x90 [ 168.083608][ T7024] simple_start_creating+0xcc/0x110 [ 168.083628][ T7024] ? __pfx_simple_start_creating+0x10/0x10 [ 168.083649][ T7024] ? mntput+0x65/0xc0 [ 168.083673][ T7024] debugfs_start_creating+0xca/0x1b0 [ 168.083696][ T7024] debugfs_create_dir+0x24/0x350 [ 168.083718][ T7024] kvm_create_vm_debugfs+0x1f0/0x8f0 [ 168.083740][ T7024] ? policy_nodemask+0x2cc/0x8e0 [ 168.083765][ T7024] ? __pfx_kvm_create_vm_debugfs+0x10/0x10 [ 168.083799][ T7024] kvm_dev_ioctl+0x12f2/0x16e0 [ 168.083827][ T7024] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 168.083851][ T7024] ? bpf_lsm_file_ioctl+0x9/0x20 [ 168.083869][ T7024] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 168.083887][ T7024] __se_sys_ioctl+0xfc/0x170 [ 168.083909][ T7024] do_syscall_64+0x166/0x520 [ 168.083928][ T7024] ? trace_irq_disable+0x3b/0x140 [ 168.083945][ T7024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.083969][ T7024] ? clear_bhb_loop+0x70/0xc0 [ 168.083991][ T7024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.084011][ T7024] RIP: 0033:0x7f9572b9e159 [ 168.084030][ T7024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.084047][ T7024] RSP: 002b:00007f9573b2e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 168.084069][ T7024] RAX: ffffffffffffffda RBX: 00007f9572e25fa0 RCX: 00007f9572b9e159 [ 168.084084][ T7024] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000005 [ 168.084096][ T7024] RBP: 00007f9572c3506b R08: 0000000000000000 R09: 0000000000000000 [ 168.084108][ T7024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 168.084120][ T7024] R13: 00007f9572e26038 R14: 00007f9572e25fa0 R15: 00007fffa117cd68 [ 168.084153][ T7024] [ 168.145960][ T5717] usb 1-1: New USB device found: idVendor=067b, idProduct=2303, bcdDevice=1.00 [ 168.147528][ T5717] usb 1-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 168.147554][ T5717] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 11776, setting to 1024 [ 168.147578][ T5717] usb 1-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 168.147613][ T5717] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.179062][ T5717] pl2303 1-1:1.0: required endpoints missing [ 168.195098][ T5717] pl2303 1-1:1.1: pl2303 converter detected [ 168.302790][ T5717] usb 1-1: pl2303 converter now attached to ttyUSB0 [ 168.450146][ T6996] EXT4-fs error (device loop0): ext4_map_blocks:832: inode #15: comm syz.0.312: lblock 0 mapped to illegal pblock 0 (length 6) [ 168.569586][ T6996] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.312: bg 0: block 112: padding at end of block bitmap is not set [ 168.604070][ T6996] EXT4-fs error (device loop0): ext4_map_blocks:832: inode #15: block 4: comm syz.0.312: lblock 4 mapped to illegal pblock 4 (length 2) [ 168.606981][ T6996] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 168.607007][ T6996] EXT4-fs (loop0): This should not happen!! Data will be lost [ 168.607007][ T6996] [ 168.618924][ T10] usb 1-1: USB disconnect, device number 6 [ 168.674337][ T10] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 168.684289][ T10] pl2303 1-1:1.1: device disconnected [ 169.791723][ T88] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 28 [ 169.791756][ T88] EXT4-fs (loop0): This should not happen!! Data will be lost [ 169.791756][ T88] [ 169.791770][ T88] EXT4-fs (loop0): Total free blocks count 0 [ 169.791783][ T88] EXT4-fs (loop0): Free/Dirty block details [ 169.791802][ T88] EXT4-fs (loop0): free_blocks=0 [ 169.791834][ T88] EXT4-fs (loop0): dirty_blocks=64 [ 169.791846][ T88] EXT4-fs (loop0): Block reservation details [ 173.375209][ T7081] ceph: No mds server is up or the cluster is laggy [ 173.839394][ T7107] netlink: 'syz.4.341': attribute type 11 has an invalid length. [ 175.438620][ T7142] netlink: 14 bytes leftover after parsing attributes in process `syz.2.355'. [ 175.468775][ T7142] bond0 (unregistering): Released all slaves [ 175.607284][ T7148] netlink: 'syz.1.367': attribute type 13 has an invalid length. [ 175.703672][ T7156] netlink: 'syz.3.357': attribute type 11 has an invalid length. [ 175.999648][ T7156] 8021q: adding VLAN 0 to HW filter on device bond1 [ 176.018274][ T7156] 8021q: adding VLAN 0 to HW filter on device bond2 [ 176.539592][ T5808] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 176.545987][ T7146] loop0: detected capacity change from 0 to 40427 [ 176.639061][ T7146] F2FS-fs (loop0): invalid crc value [ 176.684835][ T7146] F2FS-fs (loop0): invalid crc value [ 176.684876][ T7146] F2FS-fs (loop0): Failed to get valid F2FS checkpoint [ 176.690525][ T5808] usb 5-1: Using ep0 maxpacket: 16 [ 176.695419][ T5808] usb 5-1: New USB device found: idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 176.699820][ T5808] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 176.710444][ T5808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.710471][ T5808] usb 5-1: Product: syz [ 176.710484][ T5808] usb 5-1: Manufacturer: syz [ 176.710498][ T5808] usb 5-1: SerialNumber: syz [ 176.741755][ T5808] usb 5-1: config 0 descriptor?? [ 176.786678][ T5808] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 176.786716][ T5808] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 177.481853][ T5808] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 178.657307][ T5808] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 178.657384][ T5808] em28xx 5-1:0.0: board has no eeprom [ 178.729853][ T5808] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 178.729894][ T5808] em28xx 5-1:0.0: dvb set to bulk mode. [ 178.730234][ T5716] em28xx 5-1:0.0: Binding DVB extension [ 178.754540][ T5808] usb 5-1: USB disconnect, device number 7 [ 178.768839][ T5808] em28xx 5-1:0.0: Disconnecting em28xx [ 178.944404][ T7194] syzkaller0: entered promiscuous mode [ 178.944420][ T7194] syzkaller0: entered allmulticast mode [ 178.953133][ T5716] em28xx 5-1:0.0: Registering input extension [ 178.959227][ T5808] em28xx 5-1:0.0: Closing input extension [ 179.116739][ T5808] em28xx: Freeing device [ 183.617788][ T7254] FAULT_INJECTION: forcing a failure. [ 183.617788][ T7254] name failslab, interval 1, probability 0, space 0, times 0 [ 183.617818][ T7254] CPU: 0 UID: 0 PID: 7254 Comm: syz.3.389 Not tainted syzkaller #0 PREEMPT(full) [ 183.617839][ T7254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 183.617850][ T7254] Call Trace: [ 183.617858][ T7254] [ 183.617866][ T7254] dump_stack_lvl+0xe8/0x150 [ 183.617893][ T7254] should_fail_ex+0x3eb/0x540 [ 183.617918][ T7254] should_failslab+0xa8/0x100 [ 183.617940][ T7254] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 183.617961][ T7254] ? __pfx_inode_set_ctime_current+0x10/0x10 [ 183.617978][ T7254] ? __d_alloc+0x37/0x7f0 [ 183.617991][ T7254] ? __d_alloc+0x37/0x7f0 [ 183.618012][ T7254] __d_alloc+0x37/0x7f0 [ 183.618032][ T7254] d_make_root+0x41/0x80 [ 183.618048][ T7254] devpts_fill_super+0x1e8/0x4f0 [ 183.618066][ T7254] ? __pfx_devpts_fill_super+0x10/0x10 [ 183.618086][ T7254] get_tree_nodev+0xbb/0x150 [ 183.618107][ T7254] vfs_get_tree+0x92/0x2a0 [ 183.618128][ T7254] vfs_cmd_create+0xa2/0x200 [ 183.618153][ T7254] __se_sys_fsconfig+0x6b9/0x810 [ 183.618176][ T7254] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 183.618196][ T7254] ? rcu_is_watching+0x16/0xb0 [ 183.618222][ T7254] ? __x64_sys_fsconfig+0x20/0xc0 [ 183.618242][ T7254] do_syscall_64+0x166/0x520 [ 183.618268][ T7254] ? trace_irq_disable+0x3b/0x140 [ 183.618286][ T7254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.618305][ T7254] ? clear_bhb_loop+0x70/0xc0 [ 183.618326][ T7254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.618343][ T7254] RIP: 0033:0x7f0fe6b9e159 [ 183.618362][ T7254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.618378][ T7254] RSP: 002b:00007f0fe79a0028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 183.618400][ T7254] RAX: ffffffffffffffda RBX: 00007f0fe6e25fa0 RCX: 00007f0fe6b9e159 [ 183.618415][ T7254] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 183.618427][ T7254] RBP: 00007f0fe6c3506b R08: 0000000000000000 R09: 0000000000000000 [ 183.618438][ T7254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 183.618449][ T7254] R13: 00007f0fe6e26038 R14: 00007f0fe6e25fa0 R15: 00007fff996d5ff8 [ 183.618481][ T7254] [ 183.619623][ T7254] devpts: get root dentry failed [ 183.691450][ T7256] loop2: detected capacity change from 0 to 1024 [ 183.703286][ T7256] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 183.703569][ T7256] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (52061!=20869) [ 183.703657][ T7256] EXT4-fs (loop2): external journal device major/minor numbers have changed [ 183.703670][ T7256] EXT4-fs (loop2): filesystem has both journal inode and journal device! [ 184.583913][ T7271] loop4: detected capacity change from 0 to 164 [ 184.585860][ T7271] iso9660: Unknown parameter 'ÿÿÿÿÿÿÿÿÿÿÿÿ .ÃNÛBþO' [ 184.716702][ T7273] netlink: 2 bytes leftover after parsing attributes in process `syz.0.395'. [ 184.835311][ T5888] IPVS: starting estimator thread 0... [ 184.886152][ T7276] IPVS: fo: FWM 3 0x00000003 - no destination available [ 184.889085][ C1] IPVS: fo: FWM 3 0x00000003 - no destination available [ 184.929412][ T7278] IPVS: using max 52 ests per chain, 124800 per kthread [ 186.688717][ T7296] mmap: syz.2.400 (7296) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 187.564619][ T7307] 0: reclassify loop, rule prio 0, protocol 03 [ 187.661444][ T33] kauditd_printk_skb: 48 callbacks suppressed [ 187.661465][ T33] audit: type=1800 audit(1790833570.851:62): pid=7310 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.409" name=08 dev="sda1" ino=2049 res=0 errno=-22 [ 187.802487][ T7312] loop2: detected capacity change from 0 to 256 [ 187.858367][ T7312] exFAT-fs (loop2): error, no upcase table entry. Please run fsck [ 187.858388][ T7312] exFAT-fs (loop2): Filesystem has been set read-only [ 187.858631][ T7312] exFAT-fs (loop2): failed to test first cluster bit of root dir(5) [ 188.230038][ T7329] create_pit_timer: 10 callbacks suppressed [ 188.230060][ T7329] kvm: requested 187733 ns i8254 timer period limited to 200000 ns [ 191.194022][ T7389] netlink: 4 bytes leftover after parsing attributes in process `syz.3.432'. [ 191.322320][ T4922] Bluetooth: hci2: command 0x0406 tx timeout [ 191.323086][ T4922] Bluetooth: hci0: command 0x0406 tx timeout [ 191.323129][ T4922] Bluetooth: hci1: command 0x0406 tx timeout [ 191.323181][ T4922] Bluetooth: hci4: command 0x0406 tx timeout [ 191.323204][ T4922] Bluetooth: hci3: command 0x0406 tx timeout [ 191.442882][ T7395] loop2: detected capacity change from 0 to 16 [ 191.651188][ T7395] erofs (device loop2): mounted with root inode @ nid 36. [ 191.667293][ T7395] erofs (device loop2): compressed inode (nid 89) is invalid in a plain filesystem [ 193.387456][ T7427] netlink: 24 bytes leftover after parsing attributes in process `syz.2.441'. [ 194.441980][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.442057][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.044714][ T7450] syzkaller0: entered promiscuous mode [ 195.044737][ T7450] syzkaller0: entered allmulticast mode [ 195.379388][ T5717] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 195.619869][ T5717] usb 3-1: Using ep0 maxpacket: 8 [ 195.647201][ T5717] usb 3-1: New USB device found: idVendor=0413, idProduct=6a04, bcdDevice=27.2b [ 195.901216][ T5717] usb 3-1: config 135 interface 0 has no altsetting 0 [ 195.955012][ T5717] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.955041][ T5717] usb 3-1: Product: syz [ 195.955054][ T5717] usb 3-1: Manufacturer: syz [ 195.955069][ T5717] usb 3-1: SerialNumber: syz [ 198.091422][ T5890] IPVS: starting estimator thread 0... [ 198.118468][ T7472] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 198.941568][ T7475] IPVS: using max 37 ests per chain, 88800 per kthread [ 199.611568][ T7495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.462'. [ 199.820527][ T5717] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 199.822716][ T5717] dvb_usb_af9015 3-1:135.0: probe with driver dvb_usb_af9015 failed with error -22 [ 199.885114][ T5717] usb 3-1: USB disconnect, device number 5 [ 200.012666][ T7497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.463'. [ 200.232890][ T7506] 9pnet: p9_errstr2errno: server reported unknown error ./file0/../f [ 201.068601][ T33] audit: type=1804 audit(1790833584.251:63): pid=7525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.472" name="/newroot/93/file0" dev="tmpfs" ino=509 res=1 errno=0 [ 201.088851][ T7525] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: 1 [ 201.088878][ T7525] ref_ctr increment failed for inode: 0x1fd offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888023301880 [ 201.103979][ T7525] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: -1 [ 201.104020][ T7525] ref_ctr decrement failed for inode: 0x1fd offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888023301880 [ 201.104078][ T7525] uprobe: syz.4.472:7525 failed to unregister, leaking uprobe [ 203.024584][ T7581] loop2: detected capacity change from 0 to 256 [ 204.388522][ T7614] veth0_to_team: left promiscuous mode [ 204.678777][ T7620] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 205.869559][ T7633] loop0: detected capacity change from 0 to 512 [ 205.893293][ T7633] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 205.895178][ T7633] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.501: corrupted in-inode xattr: e_value size too large [ 205.895209][ T7633] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 205.900149][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 205.900171][ C1] EXT4-fs (loop0): initial error at time 1790833589: ext4_iget_extra_inode:5210: inode 15 [ 205.900200][ C1] EXT4-fs (loop0): last error at time 1790833589: ext4_iget_extra_inode:5210: inode 15 [ 205.930473][ T7633] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.501: couldn't read orphan inode 15 (err -117) [ 205.930505][ T7633] loop0: lost filesystem error report for type 5 error -117 [ 205.933169][ T7633] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 206.136892][ T7631] Bluetooth: MGMT ver 1.23 [ 206.136934][ T7631] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 207.314164][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc1) = 0x6000000be68 [ 207.314287][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc1) = 0x6000000fa12 [ 207.314379][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc1) = 0x6000000fa6f [ 207.314468][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc1) = 0x6000000faea [ 207.314559][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc1) = 0x6000000fa2c [ 207.359416][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc2) = 0x6000000fab1 [ 207.359536][ T7645] kvm [7640]: vcpu0, guest rIP: 0x79 Unhandled WRMSR(0xc2) = 0x6000000fbed [ 207.534524][ T5604] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.859223][ T33] audit: type=1326 audit(1790833591.041:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9572b9e159 code=0x7ffc0000 [ 207.888793][ T33] audit: type=1326 audit(1790833591.081:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9572b9e159 code=0x7ffc0000 [ 207.915281][ T33] audit: type=1326 audit(1790833591.101:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9572b9e159 code=0x7ffc0000 [ 207.915527][ T33] audit: type=1326 audit(1790833591.111:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f9572b9e159 code=0x7ffc0000 [ 207.945251][ T33] audit: type=1326 audit(1790833591.111:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9572b9e159 code=0x7ffc0000 [ 207.999109][ T33] audit: type=1326 audit(1790833591.171:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f9572b5e98e code=0x7ffc0000 [ 207.999159][ T33] audit: type=1326 audit(1790833591.171:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f9572b5e98e code=0x7ffc0000 [ 207.999199][ T33] audit: type=1326 audit(1790833591.171:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f9572b5e98e code=0x7ffc0000 [ 208.076518][ T33] audit: type=1326 audit(1790833591.251:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f9572b5e98e code=0x7ffc0000 [ 208.076553][ T33] audit: type=1326 audit(1790833591.251:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7652 comm="syz.2.507" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f9572b5e98e code=0x7ffc0000 [ 209.842487][ T7695] FAULT_INJECTION: forcing a failure. [ 209.842487][ T7695] name failslab, interval 1, probability 0, space 0, times 0 [ 209.842519][ T7695] CPU: 0 UID: 0 PID: 7695 Comm: syz.0.514 Not tainted syzkaller #0 PREEMPT(full) [ 209.842542][ T7695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.842555][ T7695] Call Trace: [ 209.842563][ T7695] [ 209.842572][ T7695] dump_stack_lvl+0xe8/0x150 [ 209.842599][ T7695] should_fail_ex+0x3eb/0x540 [ 209.842626][ T7695] should_failslab+0xa8/0x100 [ 209.842649][ T7695] __kmalloc_noprof+0xf9/0x710 [ 209.842666][ T7695] ? pcpu_alloc_noprof+0x100f/0x1900 [ 209.842688][ T7695] ? trace_probe_init+0x66/0x400 [ 209.842706][ T7695] ? trace_probe_init+0x66/0x400 [ 209.842730][ T7695] trace_probe_init+0x66/0x400 [ 209.842758][ T7695] alloc_trace_uprobe+0xb0/0x2a0 [ 209.842781][ T7695] __trace_uprobe_create+0x9cb/0xe50 [ 209.842806][ T7695] ? trace_kmalloc+0x2a/0xf0 [ 209.842823][ T7695] ? __pfx___trace_uprobe_create+0x10/0x10 [ 209.842842][ T7695] ? __kmalloc_noprof+0x387/0x710 [ 209.842858][ T7695] ? __kmalloc_noprof+0x1a6/0x710 [ 209.842872][ T7695] ? argv_split+0x18d/0x400 [ 209.842887][ T7695] ? argv_split+0x18d/0x400 [ 209.842910][ T7695] ? argv_split+0x378/0x400 [ 209.842934][ T7695] trace_probe_create+0xce/0x130 [ 209.842952][ T7695] ? __pfx___trace_uprobe_create+0x10/0x10 [ 209.842971][ T7695] ? __pfx_trace_probe_create+0x10/0x10 [ 209.842994][ T7695] ? __might_fault+0xaf/0x130 [ 209.843025][ T7695] dyn_event_create+0x59/0x80 [ 209.843045][ T7695] create_or_delete_trace_uprobe+0x65/0xa0 [ 209.843066][ T7695] trace_parse_run_command+0x1f3/0x380 [ 209.843087][ T7695] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 209.843109][ T7695] ? __pfx_probes_write+0x10/0x10 [ 209.843125][ T7695] vfs_write+0x296/0xba0 [ 209.843151][ T7695] ? __pfx_vfs_write+0x10/0x10 [ 209.843172][ T7695] ? __fget_files+0x2a/0x420 [ 209.843189][ T7695] ? __fget_files+0x3a2/0x420 [ 209.843205][ T7695] ? __fget_files+0x2a/0x420 [ 209.843228][ T7695] ? fdget+0x1ac/0x250 [ 209.843254][ T7695] ksys_write+0x150/0x270 [ 209.843275][ T7695] ? __pfx_ksys_write+0x10/0x10 [ 209.843309][ T7695] do_syscall_64+0x166/0x520 [ 209.843327][ T7695] ? trace_irq_disable+0x3b/0x140 [ 209.843344][ T7695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.843365][ T7695] ? clear_bhb_loop+0x70/0xc0 [ 209.843385][ T7695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.843405][ T7695] RIP: 0033:0x7fa70d19e159 [ 209.843424][ T7695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.843441][ T7695] RSP: 002b:00007fa70e046028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 209.843462][ T7695] RAX: ffffffffffffffda RBX: 00007fa70d425fa0 RCX: 00007fa70d19e159 [ 209.843478][ T7695] RDX: 000000000000000f RSI: 0000200000000500 RDI: 0000000000000004 [ 209.843490][ T7695] RBP: 00007fa70d23506b R08: 0000000000000000 R09: 0000000000000000 [ 209.843502][ T7695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.843513][ T7695] R13: 00007fa70d426038 R14: 00007fa70d425fa0 R15: 00007ffdd9f550b8 [ 209.843543][ T7695] [ 210.037529][ T7698] loop2: detected capacity change from 0 to 164 [ 210.454782][ T7705] netlink: 'syz.0.516': attribute type 1 has an invalid length. [ 211.233967][ T7724] 8021q: adding VLAN 0 to HW filter on device bond1 [ 212.081040][ T7731] bond1: (slave geneve2): making interface the new active one [ 212.084320][ T7731] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 212.297316][ T7747] netlink: 4 bytes leftover after parsing attributes in process `syz.4.525'. [ 213.146598][ T7755] raw_sendmsg: syz.1.528 forgot to set AF_INET. Fix it! [ 213.296462][ T7741] loop0: detected capacity change from 0 to 32768 [ 213.335503][ T7741] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 213.379078][ T7741] XFS (loop0): Ending clean mount [ 213.427285][ T33] kauditd_printk_skb: 134 callbacks suppressed [ 213.427305][ T33] audit: type=1800 audit(1790833596.611:208): pid=7741 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.524" name="file1" dev="loop0" ino=4422 res=0 errno=-22 [ 214.086654][ T7782] loop4: detected capacity change from 0 to 256 [ 214.112533][ T7782] exFAT-fs (loop4): error, The cluster chain has a loop [ 214.112555][ T7782] exFAT-fs (loop4): Filesystem has been set read-only [ 214.112563][ T7782] exFAT-fs (loop4): failed to count the number of clusters in root [ 214.112572][ T7782] exFAT-fs (loop4): failed to recognize exfat type [ 214.270841][ T7787] xt_cgroup: invalid path, errno=-2 [ 214.305318][ T6211] bridge0: port 3(syz_tun) entered disabled state [ 214.366550][ T6211] syz_tun (unregistering): left allmulticast mode [ 214.366577][ T6211] syz_tun (unregistering): left promiscuous mode [ 214.366675][ T6211] bridge0: port 3(syz_tun) entered disabled state [ 214.694577][ T5604] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 215.124949][ T5889] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.988798][ T5889] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.132575][ T5618] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 216.153589][ T5618] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 216.155554][ T5618] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 216.182295][ T5618] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 216.202534][ T5618] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 216.359708][ T7821] netlink: 12 bytes leftover after parsing attributes in process `syz.2.546'. [ 216.508733][ T5889] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.831239][ T5889] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.557449][ T7846] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 217.708287][ T7851] Cannot find set identified by id 1 to match [ 217.828433][ T33] audit: type=1326 audit(1790833600.981:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7842 comm="syz.1.552" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f60a739e159 code=0x0 [ 218.362973][ T5621] Bluetooth: hci2: command tx timeout [ 218.602573][ T5889] bridge_slave_1: left allmulticast mode [ 218.602614][ T5889] bridge_slave_1: left promiscuous mode [ 218.604711][ T5889] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.640134][ T7862] loop4: detected capacity change from 0 to 512 [ 218.648838][ T7862] EXT4-fs (loop4): blocks per group (35) and clusters per group (32768) inconsistent [ 218.648919][ T5889] bridge_slave_0: left allmulticast mode [ 218.648938][ T5889] bridge_slave_0: left promiscuous mode [ 218.673623][ T5889] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.786986][ T7864] loop4: detected capacity change from 0 to 7 [ 218.852373][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.874445][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.874814][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.875085][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.875498][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.941215][ T7864] x_tables: duplicate underflow at hook 1 [ 218.967103][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.967580][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 218.967949][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 219.003895][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 219.006350][ T7409] Buffer I/O error on dev loop4, logical block 0, async page read [ 219.180221][ T5889] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 219.188687][ T5889] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 219.208869][ T5889] bond0 (unregistering): Released all slaves [ 219.227657][ T5889] bond1 (unregistering): Released all slaves [ 219.261989][ T5889] bond2 (unregistering): (slave veth0_to_bond): Releasing active interface [ 219.266164][ T5889] bond2 (unregistering): Released all slaves [ 219.348363][ T7862] bridge1: entered promiscuous mode [ 220.010679][ T7889] NILFS (nullb0): couldn't find nilfs on the device [ 220.469423][ T5621] Bluetooth: hci2: command tx timeout [ 220.515277][ T7891] misc userio: Can't change port extra on an already running userio instance [ 220.979783][ T5889] hsr_slave_0: left promiscuous mode [ 220.986183][ T5889] hsr_slave_1: left promiscuous mode [ 220.987152][ T5889] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 220.987190][ T5889] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 221.010769][ T5889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 221.010791][ T5889] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 221.184872][ T7912] netlink: 64 bytes leftover after parsing attributes in process `syz.2.567'. [ 222.188398][ T5889] veth1_macvtap: left promiscuous mode [ 222.188486][ T5889] veth0_macvtap: left promiscuous mode [ 222.188957][ T5889] veth1_vlan: left promiscuous mode [ 222.189222][ T5889] veth0_vlan: left promiscuous mode [ 222.491960][ T7917] fuse: Bad value for 'fd' [ 222.519638][ T5621] Bluetooth: hci2: command tx timeout [ 223.010948][ T5889] team0 (unregistering): Port device team_slave_1 removed [ 223.045642][ T5889] team0 (unregistering): Port device team_slave_0 removed [ 223.233338][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 223.354206][ T7811] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.354454][ T7811] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.354568][ T7811] bridge_slave_0: entered allmulticast mode [ 223.357049][ T7811] bridge_slave_0: entered promiscuous mode [ 223.386951][ T7811] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.387092][ T7811] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.387214][ T7811] bridge_slave_1: entered allmulticast mode [ 223.419667][ T7811] bridge_slave_1: entered promiscuous mode [ 223.485652][ T7811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 223.490290][ T7811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 223.534012][ T7811] team0: Port device team_slave_0 added [ 223.536767][ T7811] team0: Port device team_slave_1 added [ 223.566884][ T7811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 223.566902][ T7811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 223.566925][ T7811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 223.569107][ T7811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 223.569120][ T7811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 223.569143][ T7811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 223.688800][ T7811] hsr_slave_0: entered promiscuous mode [ 223.692922][ T7811] hsr_slave_1: entered promiscuous mode [ 223.693724][ T7811] debugfs: 'hsr0' already exists in 'hsr' [ 223.693742][ T7811] Cannot create hsr debugfs directory [ 223.989953][ T7811] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 223.997111][ T7811] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 223.998337][ T7811] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 224.002109][ T7811] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 224.002976][ T7811] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 224.047767][ T7811] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 224.050460][ T7811] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 224.064708][ T7811] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 224.088191][ T5268] 8021q: adding VLAN 0 to HW filter on device eth2 [ 224.098909][ T7811] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.098980][ T7811] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.099178][ T7811] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.099239][ T7811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.177850][ T7811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.197522][ T88] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.199035][ T88] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.226201][ T7811] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.246478][ T5890] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.246583][ T5890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.269001][ T5890] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.269112][ T5890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.602781][ T5621] Bluetooth: hci2: command tx timeout [ 224.705588][ T5268] 8021q: adding VLAN 0 to HW filter on device eth3 [ 224.794209][ T7811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 225.103295][ T7811] veth0_vlan: entered promiscuous mode [ 225.125548][ T7811] veth1_vlan: entered promiscuous mode [ 225.164315][ T7811] veth0_macvtap: entered promiscuous mode [ 225.175798][ T7811] veth1_macvtap: entered promiscuous mode [ 225.201242][ T7811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 225.217219][ T7811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 225.303388][ T5890] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.304736][ T5890] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.304769][ T5890] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.304797][ T5890] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.382159][ T5889] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 225.382182][ T5889] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 225.427453][ T5268] 8021q: adding VLAN 0 to HW filter on device eth4 [ 225.442651][ T88] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 225.442672][ T88] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 225.765586][ T7999] syz_tun: entered allmulticast mode [ 226.814268][ T8000] syzkaller0: entered promiscuous mode [ 226.814295][ T8000] syzkaller0: entered allmulticast mode [ 227.155909][ T7999] loop2: detected capacity change from 0 to 512 [ 227.157829][ T7999] EXT4-fs: Ignoring removed nobh option [ 227.212936][ T7999] EXT4-fs error (device loop2): ext4_xattr_inode_iget:473: comm syz.2.582: EA inode 11 has unexpected i_nlink=0 ref_count=1 [ 227.212961][ T7999] loop2: lost filesystem error report for type 5 error -117 [ 227.226234][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 227.226252][ C1] EXT4-fs (loop2): initial error at time 1790833610: ext4_xattr_inode_iget:473 [ 227.226265][ C1] EXT4-fs (loop2): last error at time 1790833610: ext4_xattr_inode_iget:473 [ 227.269235][ T7999] EXT4-fs (loop2): 1 orphan inode deleted [ 227.381605][ T7999] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 227.434730][ T7995] syz_tun: left allmulticast mode [ 227.520490][ T5609] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 227.755971][ T8014] xt_LOG: level 240 >= 8 [ 227.789118][ T8026] syzkaller0: entered promiscuous mode [ 227.789133][ T8026] syzkaller0: entered allmulticast mode [ 228.367034][ T8026] tipc: Started in network mode [ 228.367589][ T8026] tipc: Node identity b239d991b9dc, cluster identity 4711 [ 228.394502][ T8026] tipc: Enabled bearer , priority 0 [ 228.821805][ T8022] tipc: Resetting bearer [ 228.987570][ T8022] tipc: Disabling bearer [ 230.272233][ T8056] netlink: 'syz.4.587': attribute type 1 has an invalid length. [ 230.307605][ T8056] 8021q: adding VLAN 0 to HW filter on device bond2 [ 230.345358][ T8056] vlan2: entered allmulticast mode [ 230.345381][ T8056] bond2: entered allmulticast mode [ 230.413580][ T8059] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 230.486793][ T8056] bond2: (slave dummy0): making interface the new active one [ 230.486818][ T8056] dummy0: entered allmulticast mode [ 230.488706][ T8056] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 230.495890][ T8067] team0: Mode changed to "roundrobin" [ 230.581015][ T8066] netlink: 16390 bytes leftover after parsing attributes in process `syz.1.589'. [ 230.601559][ T8059] tipc: Started in network mode [ 230.601589][ T8059] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 230.601797][ T8059] tipc: Enabled bearer , priority 0 [ 230.712800][ T8072] syzkaller0: entered promiscuous mode [ 230.712823][ T8072] syzkaller0: entered allmulticast mode [ 230.765374][ T8072] tipc: Enabled bearer , priority 0 [ 230.778583][ T8071] tipc: Resetting bearer [ 231.008592][ T8071] tipc: Disabling bearer [ 232.029925][ T5717] tipc: Node number set to 11578026 [ 232.092201][ T8084] netlink: 8 bytes leftover after parsing attributes in process `syz.5.594'. [ 232.092227][ T8084] netlink: 8 bytes leftover after parsing attributes in process `syz.5.594'. [ 232.326278][ T8090] syzkaller0: entered promiscuous mode [ 232.326301][ T8090] syzkaller0: entered allmulticast mode [ 232.341795][ T8092] loop5: detected capacity change from 0 to 128 [ 233.322527][ T8092] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 233.352030][ T8092] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 233.565937][ T7811] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 233.691481][ T8121] bridge2: entered promiscuous mode [ 234.448458][ T8135] syzkaller0: entered promiscuous mode [ 234.448484][ T8135] syzkaller0: entered allmulticast mode [ 234.731147][ T8139] loop4: detected capacity change from 0 to 164 [ 234.902184][ T8148] Bluetooth: ISO socket layer initialized [ 235.709386][ T5824] IPVS: starting estimator thread 0... [ 235.713305][ T8172] netlink: 164 bytes leftover after parsing attributes in process `syz.5.623'. [ 235.714038][ T8172] netlink: 36 bytes leftover after parsing attributes in process `syz.5.623'. [ 235.799480][ T8173] IPVS: using max 31 ests per chain, 74400 per kthread [ 237.085919][ T5618] Bluetooth: hci2: command 0x2062 tx timeout [ 237.101643][ T5621] Bluetooth: hci2: Opcode 0x2062 failed: -110 [ 238.512351][ T8224] loop4: detected capacity change from 0 to 8 [ 238.515509][ T8224] squashfs: Bad value for 'errors' [ 239.513874][ T5621] Bluetooth: hci2: Opcode 0x2065 failed: -110 [ 239.513936][ T5621] Bluetooth: hci2: command 0x2062 tx timeout [ 239.526600][ T8229] syz.1.634 (8229) used greatest stack depth: 16848 bytes left [ 239.703450][ T8231] netlink: 64 bytes leftover after parsing attributes in process `syz.5.636'. [ 239.989597][ T5716] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 240.158008][ T5716] usb 6-1: New USB device found: idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 240.226978][ T5716] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 240.227349][ T5716] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.227548][ T5716] usb 6-1: config 0 has no interface number 0 [ 240.251248][ T5716] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 240.251320][ T5716] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 240.251393][ T5716] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 240.454420][ T5716] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.454447][ T5716] usb 6-1: Product: syz [ 240.454461][ T5716] usb 6-1: Manufacturer: syz [ 240.454475][ T5716] usb 6-1: SerialNumber: syz [ 240.491661][ T5716] usb 6-1: config 0 descriptor?? [ 241.537063][ T5716] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.117/input/input8 [ 241.985103][ T5716] usb 6-1: USB disconnect, device number 2 [ 245.523817][ T8315] loop4: detected capacity change from 0 to 128 [ 245.601990][ T8315] netlink: 8 bytes leftover after parsing attributes in process `syz.4.654'. [ 250.378817][ T8360] fuse: Bad value for 'fd' [ 250.490925][ T8356] loop2: detected capacity change from 0 to 512 [ 250.884697][ T8356] EXT4-fs (loop2): unsupported inode size: 1 [ 250.885392][ T8356] EXT4-fs (loop2): blocksize: 1024 [ 250.896680][ T8378] loop0: detected capacity change from 0 to 256 [ 250.904511][ T8378] exfat: Deprecated parameter 'utf8' [ 250.904533][ T8378] exfat: Deprecated parameter 'utf8' [ 250.904589][ T8378] exfat: Deprecated parameter 'namecase' [ 250.904643][ T8378] exfat: Deprecated parameter 'namecase' [ 251.311020][ T8378] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf6e788d, utbl_chksum : 0xe619d30d) [ 251.751429][ T8391] loop0: detected capacity change from 0 to 1764 [ 253.437802][ T8402] FAULT_INJECTION: forcing a failure. [ 253.437802][ T8402] name fail_futex, interval 1, probability 0, space 0, times 1 [ 253.437899][ T8402] CPU: 1 UID: 0 PID: 8402 Comm: syz.4.667 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.437925][ T8402] Tainted: [L]=SOFTLOCKUP [ 253.437932][ T8402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.437944][ T8402] Call Trace: [ 253.437952][ T8402] [ 253.437960][ T8402] dump_stack_lvl+0xe8/0x150 [ 253.437984][ T8402] should_fail_ex+0x3eb/0x540 [ 253.438008][ T8402] get_futex_key+0x1b4/0x1580 [ 253.438032][ T8402] ? preempt_schedule_thunk+0x16/0x40 [ 253.438059][ T8402] ? __pfx_get_futex_key+0x10/0x10 [ 253.438076][ T8402] ? futex_wake_op+0xda1/0xdc0 [ 253.438107][ T8402] futex_wake+0x119/0x5f0 [ 253.438126][ T8402] ? __pfx_futex_wake_op+0x10/0x10 [ 253.438148][ T8402] ? __pfx_futex_wake+0x10/0x10 [ 253.438180][ T8402] do_futex+0x458/0x4e0 [ 253.438204][ T8402] ? __pfx_do_futex+0x10/0x10 [ 253.438220][ T8402] ? __fget_files+0x3a2/0x420 [ 253.438239][ T8402] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 253.438265][ T8402] __se_sys_futex+0x3a8/0x450 [ 253.438290][ T8402] ? __pfx___se_sys_futex+0x10/0x10 [ 253.438308][ T8402] ? rcu_is_watching+0x16/0xb0 [ 253.438333][ T8402] ? __x64_sys_futex+0x21/0xf0 [ 253.438355][ T8402] do_syscall_64+0x166/0x520 [ 253.438374][ T8402] ? trace_irq_disable+0x3b/0x140 [ 253.438391][ T8402] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.438410][ T8402] ? clear_bhb_loop+0x70/0xc0 [ 253.438431][ T8402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.438449][ T8402] RIP: 0033:0x7f7267f9e159 [ 253.438469][ T8402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.438486][ T8402] RSP: 002b:00007f7268eef0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 253.438512][ T8402] RAX: ffffffffffffffda RBX: 00007f7268226188 RCX: 00007f7267f9e159 [ 253.438527][ T8402] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f726822618c [ 253.438541][ T8402] RBP: 00007f7268226180 R08: 3fffffffffffffff R09: 0000000000000000 [ 253.438555][ T8402] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 253.438569][ T8402] R13: 00007f7268226218 R14: 00007ffd06ba8ee0 R15: 00007ffd06ba8fc8 [ 253.438596][ T8402] [ 253.849386][ T5808] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 254.142443][ T8392] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 254.143015][ T8392] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 254.200096][ T5808] usb 1-1: New USB device found: idVendor=09fb, idProduct=602d, bcdDevice=4b.5f [ 254.202478][ T5808] usb 1-1: config 127 has an invalid interface number: 2 but max is 0 [ 254.202503][ T5808] usb 1-1: config 127 has no interface number 0 [ 254.204422][ T5808] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.204446][ T5808] usb 1-1: Product: syz [ 254.204460][ T5808] usb 1-1: Manufacturer: syz [ 254.204474][ T5808] usb 1-1: SerialNumber: syz [ 254.348976][ T8392] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 254.355519][ T8392] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 254.610210][ T8392] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 254.610701][ T8392] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 254.634307][ T8392] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 254.640757][ T8392] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 254.644423][ T8392] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 255.420617][ T8392] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 255.467125][ T8392] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 255.481741][ T8391] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 255.485726][ T5808] ftdi_sio 1-1:127.2: FTDI USB Serial Device converter detected [ 255.493822][ T5808] ftdi_sio ttyUSB0: unknown device type: 0x4b5f [ 255.511870][ T5808] usb 1-1: USB disconnect, device number 7 [ 255.526484][ T5808] ftdi_sio 1-1:127.2: device disconnected [ 255.803537][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.205727][ T5618] Bluetooth: hci1: command 0x0406 tx timeout [ 256.359602][ T5618] Bluetooth: hci0: command 0x0406 tx timeout [ 256.753781][ T5618] Bluetooth: hci2: command 0x2062 tx timeout [ 256.753910][ T5618] Bluetooth: hci4: command 0x0406 tx timeout [ 256.758969][ T5618] Bluetooth: hci3: command 0x0406 tx timeout [ 258.133454][ T8446] loop5: detected capacity change from 0 to 256 [ 258.144412][ T8446] exFAT-fs (loop5): error, no upcase table entry. Please run fsck [ 258.144433][ T8446] exFAT-fs (loop5): Filesystem has been set read-only [ 258.144673][ T8446] exFAT-fs (loop5): failed to test first cluster bit of root dir(5) [ 258.270915][ T8450] capability: warning: `syz.4.685' uses 32-bit capabilities (legacy support in use) [ 258.291866][ T5621] Bluetooth: hci1: command 0x0406 tx timeout [ 258.439396][ T5621] Bluetooth: hci0: command 0x0406 tx timeout [ 258.839411][ T5621] Bluetooth: hci3: command 0x0406 tx timeout [ 258.839472][ T5621] Bluetooth: hci4: command 0x0406 tx timeout [ 258.841664][ T5621] Bluetooth: hci2: command 0x2062 tx timeout [ 260.919637][ T5618] Bluetooth: hci2: command 0x2062 tx timeout [ 265.568633][ T8505] bond2: (slave dummy0): Releasing active interface [ 265.568661][ T8505] dummy0: left allmulticast mode [ 265.647075][ T8505] bridge_slave_0: left allmulticast mode [ 265.647095][ T8505] bridge_slave_0: left promiscuous mode [ 265.647227][ T8505] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.673553][ T8505] bridge_slave_1: left allmulticast mode [ 265.673573][ T8505] bridge_slave_1: left promiscuous mode [ 265.676311][ T8505] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.737649][ T8505] bond0: (slave bond_slave_0): Releasing backup interface [ 265.804254][ T8505] bond0: (slave bond_slave_1): Releasing backup interface [ 265.842647][ T8505] team0: Port device team_slave_0 removed [ 265.873282][ T8505] team0: Port device team_slave_1 removed [ 265.873876][ T8505] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 265.873890][ T8505] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 265.884094][ T8505] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 265.884116][ T8505] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 265.923798][ T8505] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 265.923878][ T8502] tipc: Started in network mode [ 265.923894][ T8502] tipc: Node identity 4, cluster identity 4711 [ 265.923906][ T8502] tipc: Node number set to 4 [ 266.012177][ T8507] team0: Port device xfrm0 added [ 266.013178][ T8510] tipc: Enabled bearer , priority 0 [ 267.659468][ T8525] netlink: 'syz.4.705': attribute type 1 has an invalid length. [ 267.694304][ T8530] netlink: 'syz.2.704': attribute type 1 has an invalid length. [ 268.238588][ T8530] bond0: entered promiscuous mode [ 268.239033][ T8530] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.380283][ T8531] veth3: entered allmulticast mode [ 268.387663][ T8531] bond3: (slave veth3): Enslaving as an active interface with a down link [ 268.456277][ T8534] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 268.959814][ T8552] loop4: detected capacity change from 0 to 1024 [ 270.126377][ T8545] bond0: (slave bridge2): making interface the new active one [ 270.126403][ T8545] bridge2: entered promiscuous mode [ 270.154704][ T8545] bond0: (slave bridge2): Enslaving as an active interface with an up link [ 271.700478][ T8563] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 271.783143][ T8563] kvm: pic: single mode not supported [ 274.100349][ T8590] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI [ 274.117660][ T8590] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 274.126093][ T8590] CPU: 1 UID: 0 PID: 8590 Comm: syz.4.719 Tainted: G L syzkaller #0 PREEMPT(full) [ 274.136958][ T8590] Tainted: [L]=SOFTLOCKUP [ 274.141292][ T8590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.151445][ T8590] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 274.158116][ T8590] Code: df e8 ae 89 00 00 89 c5 31 ff 89 c6 e8 53 72 4a ff 85 ed 74 0a e8 3a 6d 4a ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 ee 3a bc ff 4c 8b 6b 60 48 89 df e8 72 89 [ 274.177715][ T8590] RSP: 0018:ffffc90005b3fad8 EFLAGS: 00010206 [ 274.183783][ T8590] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000002 [ 274.191774][ T8590] RDX: ffff88807f283e80 RSI: 0000000000000000 RDI: 0000000000000060 [ 274.199772][ T8590] RBP: 0000000000000000 R08: ffffffff907a66bf R09: 1ffffffff20f4cd7 [ 274.207746][ T8590] R10: dffffc0000000000 R11: fffffbfff20f4cd8 R12: ffffffff8f942e40 [ 274.215714][ T8590] R13: 1ffff92000b67f6c R14: dffffc0000000000 R15: ffff88805768ac00 [ 274.223682][ T8590] FS: 00007f7268f316c0(0000) GS:ffff888124dac000(0000) knlGS:0000000000000000 [ 274.232606][ T8590] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 274.239181][ T8590] CR2: 0000001b33215ff8 CR3: 000000007796c000 CR4: 00000000003526f0 [ 274.247145][ T8590] DR0: 0000000000000008 DR1: 0000000000000007 DR2: 0000000000000004 [ 274.255105][ T8590] DR3: 0000000000000008 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 274.263068][ T8590] Call Trace: [ 274.266338][ T8590] [ 274.269266][ T8590] usbg_make_tpg+0x1e0/0x550 [ 274.273857][ T8590] ? configfs_mkdir+0x4b0/0x9e0 [ 274.278702][ T8590] ? __pfx___mutex_lock+0x10/0x10 [ 274.283721][ T8590] ? __pfx_usbg_make_tpg+0x10/0x10 [ 274.288819][ T8590] ? do_raw_spin_lock+0x12b/0x2f0 [ 274.293850][ T8590] target_fabric_make_tpg+0xa8/0x6d0 [ 274.299136][ T8590] configfs_mkdir+0x4f6/0x9e0 [ 274.303805][ T8590] ? d_splice_alias+0x12/0x30 [ 274.308475][ T8590] ? __pfx_configfs_mkdir+0x10/0x10 [ 274.313668][ T8590] ? generic_permission+0x2ba/0x660 [ 274.318859][ T8590] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 274.323871][ T8590] ? security_inode_mkdir+0xc3/0x340 [ 274.329146][ T8590] vfs_mkdir+0x40e/0x630 [ 274.333388][ T8590] filename_mkdirat+0x285/0x510 [ 274.338226][ T8590] ? __might_fault+0xaf/0x130 [ 274.342910][ T8590] ? __pfx_filename_mkdirat+0x10/0x10 [ 274.348271][ T8590] ? do_getname+0x151/0x250 [ 274.352765][ T8590] __se_sys_mkdirat+0x35/0x150 [ 274.357518][ T8590] do_syscall_64+0x166/0x520 [ 274.362104][ T8590] ? trace_irq_disable+0x3b/0x140 [ 274.367124][ T8590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.373183][ T8590] ? clear_bhb_loop+0x70/0xc0 [ 274.377848][ T8590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.383731][ T8590] RIP: 0033:0x7f7267f9e159 [ 274.388136][ T8590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.407732][ T8590] RSP: 002b:00007f7268f31028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 274.416149][ T8590] RAX: ffffffffffffffda RBX: 00007f7268225fa0 RCX: 00007f7267f9e159 [ 274.424110][ T8590] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 274.432072][ T8590] RBP: 00007f726803506b R08: 0000000000000000 R09: 0000000000000000 [ 274.440036][ T8590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 274.447998][ T8590] R13: 00007f7268226038 R14: 00007f7268225fa0 R15: 00007ffd06ba8fc8 [ 274.455970][ T8590] [ 274.458981][ T8590] Modules linked in: [ 274.463689][ T8590] ---[ end trace 0000000000000000 ]--- [ 274.514630][ T8590] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 274.514668][ T8590] Code: df e8 ae 89 00 00 89 c5 31 ff 89 c6 e8 53 72 4a ff 85 ed 74 0a e8 3a 6d 4a ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 ee 3a bc ff 4c 8b 6b 60 48 89 df e8 72 89 [ 274.514685][ T8590] RSP: 0018:ffffc90005b3fad8 EFLAGS: 00010206 [ 274.514704][ T8590] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000002 [ 274.514717][ T8590] RDX: ffff88807f283e80 RSI: 0000000000000000 RDI: 0000000000000060 [ 274.514731][ T8590] RBP: 0000000000000000 R08: ffffffff907a66bf R09: 1ffffffff20f4cd7 [ 274.514745][ T8590] R10: dffffc0000000000 R11: fffffbfff20f4cd8 R12: ffffffff8f942e40 [ 274.514761][ T8590] R13: 1ffff92000b67f6c R14: dffffc0000000000 R15: ffff88805768ac00 [ 274.514776][ T8590] FS: 00007f7268f316c0(0000) GS:ffff888124dac000(0000) knlGS:0000000000000000 [ 274.514793][ T8590] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 274.514807][ T8590] CR2: 00007f7267feb840 CR3: 000000007796c000 CR4: 00000000003526f0 [ 274.514826][ T8590] DR0: 0000000000000008 DR1: 0000000000000007 DR2: 0000000000000004 [ 274.514839][ T8590] DR3: 0000000000000008 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 274.514854][ T8590] Kernel panic - not syncing: Fatal exception [ 274.632838][ T8590] Kernel Offset: disabled [ 274.637213][ T8590] Rebooting in 86400 seconds..