last executing test programs: 3m5.308429314s ago: executing program 1 (id=36): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000024c80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000024d40)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x28100}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}}, 0x0) 3m4.880732305s ago: executing program 1 (id=40): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r1) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004891) write$cgroup_devices(r1, &(0x7f00000005c0)=ANY=[], 0xfffffeff) sendmsg$kcm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2400c094) 3m4.68142807s ago: executing program 1 (id=42): r0 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r0, 0x0) r1 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r1, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) accept4$nfc_llcp(r0, 0x0, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000500)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x1}}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000140)="bc", 0x1}], 0x1, 0x0, 0x0, 0x10}, 0x20040001) 3m4.392147248s ago: executing program 1 (id=48): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x20200ccc, &(0x7f0000002c00)=ANY=[], 0xfe, 0x1527, &(0x7f0000002c40)="$eJzs3Au4TtXWOPAx5pyLTdKb5D7HHIs3uUySJJdUckmSJElyS5IkSRISm9ySkITck9xDcgvJ/U5yT5IjSZKQ3JL5f3Q56ul8nb7/6XzOc/b4Pc989hzvWnO+Y+6x3v2utd6991dt+1eqU7l8LWaGfwn+9CUVAFIAoBcAXAYAEQCUyFIiy/ntGTSm/mtPIv5a90662BmIi0nqn7ZJ/dM2qX/aJvVP26T+aZvUP22T+qdtUn8h0rKNk3NeLi3tNrn/n5bJ+/9/kf1FRny2psiV7f4XQ6T+aZvUP22T+qch0e8fkvqnbVL/tE3q/9/vlj/YJvX/L5Xy53aT+guRlv39XvDZEMJ/wP3ov7ql/91nHL/cgr74uf0ntIt8+AkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESCNOhQsMAPzSv9h5CSGEEEIIIYQQ4q8T0l/sDIQQQgghhBBCCPHvh6BAg4EI0kF6SIEMkBEugUxwKWSGyyABl0MWuAKywpWQDbJDDsgJuSA35AELBA4YYsgL+SAJV0F+uBoKQEEoBIXBQxEoCtdAMbgWisN1UAKuh5JwA5SC0lAGysKNUA5ugpvhFigPt0IFqAiVoDLcBlXgdqgKd0A1uBOqw11QA+6GmnAP1IJ7oTbcB3XgfqgLD0A9qA8NoCE0+v8a/yx0hOegE3SGVOgCXeF56AbdoQf0hF7wAvSGF6EPvAR9oR/0h5dhALwCA+FVGASDYQi8BkNhGAyHETASRsFoeB3GwBswFt6EcTAeJsBEmASTYQq8BVNhGkyHt2EGvAMzYRbMhjkwF96FeTAfFsB7sBDeh0WwGJbAUlgGy2EFrIRVsBrWwFpYB+thA3wAG+FD2ASbYQtshW2wHXZAetgJH8Mu+AR2w6f/y/EnYQd89Kvx7RAQUKFCgwbTYTpMwRTMiBkxE2bCzJgZE5jALJgFs2JWzIbZMAfmwFyYC/NgHiQkZGTMi3kxiUnMj/mxABbAQlgIPXosikWxGF6LxbE4lsASWBJLYiksjaWxLJbFclgOb8absTyWxwpYASthJbwNb8PbsSpWxWpYDatjdayBNbAm1sRaWAtrY22sg3WwLtbFelgPG2ADbISNsDE2xibYBJtiU2yGzbA5NscW2AJbYktsha2wNbbGNtgG22JbbIftsT0+i8/ic/gcdsYKqgt2xa7YDbthD+yJPfEF7I0v4ov4EvbFftgfX8aX8RUciCdwEA7GITgEy6lhOBxHIKtROBpH4xgcg2NxLI7D8TgeJ+IknIxTcApOxWk4Dd/GGfgOvoOzcBbOwbk4F+fhfFyAC3AhnsRFuBiX4FJchstxGa7EVbgS1+BaXIPrEc1Pr9APcTNuxq24FbfjdvwIP8KP8WPsi7txN+7BPbgX9+I+3If7cT8ewAN4EA/iITyEh/EwHsGjeAyP4nE8jifwJJ7CU3gGz+BZfDrXF7W3F1zdF9R5RhmVTqVTKSpFZVQZVSaVSWVWmVVCJVQWlUVlVVlVNpVN5VA5VC6VS+VReRQpUqxilVflVUmVVPlVflVAFVCFVCHllVdFVVFVTBVTxVVxVUJdr0qqG1QpVVo97MuqsqpG9NPqyqvyqoKqqCqpyqqyqqKqqKqqqqqmqqnqqrqqoe5WNVUX7IH3qvOVqaP6YV3VH+up+qqBaqhewQdVYzUQm6iHVVP1iBqMg7C5auxbqMdVSzUcW6kn1Qh8SrVRo7Cteka1U+1VB/Ws6qia+E6qsxqHXVRXNRG7qe6qh+qppmJFdb5ildRLqq/qp/qrl9UcfEUNVK+qQWqwGqJeU0PVMDVcjVAj1Sg1Wr2uxqg31Fj1phqnxqsJaqKapCarKeotNVVNU9PV22qGekfNVLPUbDVHzVXvqnlqvlqg3lML1ftqkVqslqilaplarlaolWqVWq3WqLVqnVqvNqgP1Eb1odqkNqstaqvaprarHeojtVN9rHapT9Ru9anao/6m9qrP1D71udqvvlAH1JfqoPpKHVJfq8PqG3VEHVXH1LfquPpOnVAn1Sl1Wp1R36uz6gd1TgUFGrXSWhsd6XQ6vU7RGXRGfYnOpC/VmfVlOqEv11n0FTqrvlJn09l1Dp1T59K5dR5tNWmnWcc6r86nk/oqnV9frQvogrqQLqy9LqKL6mt0MX2tLq6v0yX09bqkvkGX0qV1GV1W36jL6Zv0zfoWXV7fqivoirqSrqxv01X07bqqvkNX03fq6vouXUPfrWvqe3Qtfa+ure/TdfT9uq5+QNfT9XUD3VA30g/qxvoh3eT80aQf0c30o7q5fky30I/rlvoJ3Uo/qVvrp3Qb/bRuq5/R7XR73UH/oM/poDvpzjpVd9Fd9fO6m+6ue+ieupd+QffWL+o++iXdV/fT/fXLeoB+RQ/Ur+pBerAeol/TQ/UwPVyP0CP1KD1av67H6Df0WP2mHqfH6wl6op6kJ+seP880/U+Mf+MfjO/z47N/oDfqD/UmvVlv0Vv1Nr1d79A79E69U+/Su/RuvVvv0Xv0Xr1X79P79H69Xx/QB/RBfVAf0of0YX1YH9FH9Wn9rT6uv9Mn9El9Up/WZ/QZffbn7wEYNMpoY0xk0pn0JsVkMBnNJSaTudRkNpeZhLncZDFXmKzmSpPNZDc5TE6Ty+Q2eYw1ZJxhE5u8Jp9JmqtMfnO1KWAKmkKmsPGmiClqrvmXx/+z/BqZRqaxaWyamCamqWlqmplmprlpblqYFqalaWlamVamtWlt2pg2pq1pa9qZdqaD6WA6mo6mk+lkUk2q6WqeN91Md9PD9DS9zAumt+lt+pg+pq/pa/qb/maAGWAGmoFmkBlkhpghZqgZaoab4WakGWlGm9FmjBljxpqxZpwZZyaYCWaSmWSmmClmqplqppvpZoaZYWaamWa2mW3mmrlmnplnFpgFZqFZaBaZxWaxWWqWmuVmuVlpVprVZrVZa9aa9Wa9WWQ2mo1mk9lktpgtZpvZZnaYHWan2Wl2mV1mt9lt9pg9Zq/Za/aZfWa/2W8OmAPmoDloDplD5rA5bI6YI+aYOWaOm+PmhDlhTplT5ow5Y86as+acOXf+tC9SkYpMZKJ0UbooJUqJMkYZo0xRpihzlDlKRIkoS5QlyhpdGWWLskc5opxRrih3lCeyEUUu4iiO8kb5omR0VZQ/ujoqEBWMCkWFIx8ViYpG10TFomuj4tF1UYno+qhkdENUKiodlYnKRjdG5aKbopujW6Ly0a1RhajiL59DRbdHVaM7omrRnVH16K6oRnR3VDO6J6oV3RvVju6L6kT3R3WjB6J6Uf2oQdQwavRn548qRZWj26Iqfzh/CCeyP+Q72c421XaxXe3ztpvtbnvYnraXfcH2ti/aPvYl29f2s/3ty3aAfcUOtK/aQXawHWJfs0PtMDvcjrAj7Sg72r5ux9g37Fj7ph1nx9sJdqKdZCfbKfYtO9VOs9Pt23aGfcfOtLPsbDvHzrXv2nl2vl1g37ML7ft2kV1sl9ildpldblfYlXaVXW3X2LV2nV1vN9gP7Eb7od1kN9stdqvdZrfbHfYju9N+bHfZT+xu+6ndY/9m99rP7D743O63X9gD9kt70H5lD9mv7WH7jT1ij9pj9lt73H5nT9iT9pQ9bc/Y7+1Z+4M9Z8P5k/vzb+9kyFA6SkcplEIZKSNlokyUmTJTghKUhbJQVspK2Sgb5aAclItyUR7KQ+cxMeWlvJSkJOWn/FSAClAhKkSePBWlolSMilFxKk4lqASVpJJUikpRGSpDN9KNdBPdRLfQLXQr3UoVqSJVpspUhapQVapK1agaVafqVINqUE2qSbWoFtWm2lSH6lBdqkv1qB41oAbUiBpRY2pMTagJNaWm1IyaUXNqTi2oBbWkltSKWlFrak1tqA21pbbUjtpRB+pAHakjdTrdiVIplbpSV+pG3agH9aBe1It6U2/qQ32oL/Wl/tSfBtAAGkgDaRANpiH0Gg2lYTScRtBIGkWjaTSNoTE0lsbSOBpHE2gCTaJJNIWm0FSaStNpOs2gGTSTZtJsmk1zaS7No3m0gBbQQlpIi2gRLaEltIyW0QpaQatoFa2hNbSO1tEG2kAbaSNt0ptoC22hbbSNdtAO2kk7aRftot20m/bQHtpLe2kf7aP9tJ8O0AE6SAfpEB2iw3SYjtAROkbH6DgdpxN0gk7RKTpD39NZ+oHOUaAUpyCju8Rlcpe6zO4yl+IyuF/HOVxOl8vldnmcddlc9t/E5Jwr4Aq6Qq6w866IK+qu+V1cypV2ZVxZd6Mr525yN/8uruJud1XdHa6au9NVdrf9Jq7u7nI13P2upnvA1XL1XW3X0NVx97u67gFXz9V3DVxD18w96pq7x1wL97hr6Z74XTzPzXer3Gq3xq11O93H7pQ77Q66r9wZ973r5Dq7Xu4F19u96Pq4l1zfav1+G7t+boh7zQ11w9xwN8KNdKN+F09wE90kN9lNcW+5qW7a7+K57l03wy1wM90sN9vN+TE+n9MC955b6N53i9xit8QtdcvccrfCrfx7rkvderfBfeB2uI/cJrfZbXFb3Ta3/cf4/Dp2uU/cbvepO+C+dHvdZ26fO+T2uy9+jM+v75D72h1237gj7qg75r51x9137oQ7+eP6z6/9W/eDO+eCA0ZWrNlwxOk4PadwBs7Il3AmvpQz82Wc4Ms5C1/BWflKzsbZOQfn5Fycm/OwZWLHzDHn5Xyc5Ks4P1/NBbggF+LC7LkIF+VruBhfy8X5Oi7B13NJvoFLcWkuw2X5Ri7HN/HNBrg838oVuCJX4sp8G1fh27kq38HV+E6uzndxDb6ba/I9XIvv5dp8H/9yN6Me1+cG3JAb8YPcmB/iJvwwN+VHuBk/ys35MW7Bj3NLfoJb8ZPcmp/iNvw0t+VnuB235w78LHfk57gTd+ZU7sJd+Xnuxt25B/fkXvwC9+YXuQ+/xH25H/fnl3kAv8ID+VUexIN5CL/GQ3kYD+cRPJJH8Wh+ncfwGzyW3+RxPJ4n8ESexJN5Cr/FU3kaT+e3eQa/wzNnZAbgOTyX3+V5PJ8X8Hu8kN/nRbyYl/BSXsbLeQWv5FW8mtfwWl7H63kDf8Ab+UPexJt5C2/lbbydd/BHvJM/5l38Ce/mT3kP/4338me8jz/n/fwFH+Av+SB/xYf4az7M3/ARPsrH+Fs+zt/xCT7Jp/g0n+Hv+Sz/wOc4MMQYq1jHJo7idHH6OCXOEGeML4kzxZfGmePL4kR8eZwlviLOGl8ZZ4uzxzninHGuOHecJ7YxxS7mOI7zxvniZHxVnD++Oi4QF4wLxYVjHxeJi8bXxMXia+Pi8XVxifj6uGR8Q1wqLh3ff2fZ+Ma4XHxTfHN8S1w+vjWuEFeMK8WV49viKvHtcdX4jrhafGdcPL4rrhHfHdeM74lrxffGteP74jrx/XHd+IG4Xlw/bhA3jBvFD8aN44fiJvHDcdP4kbhZ/GjcPH4sbhE/HreMn/in21PjLnHX+Pn4+TiEO/Ts5Jzk3OS7yXnJ+ckFyfeSC5PvJxclFyeXJJcmlyWXJ1ckVyZXJVcn1yTXJtcl1yc3JD9IhlA5PXj0ymtvfOTT+fQ+xWfwGf0lPpO/1Gf2l/mEv9xn8Vf4rP5Kn81n9zl8Tp/L5/Z5vPXknWcf+7w+n0/6q3x+f7Uv4Av6Qr6w976IL+ob+ka+kW/sH/JN/MO+qX/EP+If9Y/6x/xj/nHf0j/hW/knfWv/lG/jn/ZP+2d8O9/ed/DP+o7+Od/Jd/apPtV39V19N9/N9/A90v38IvJ9fB/f1/f1/X1/P8AP8AP9QD/ID/JD/BA/1A/1w/1wP9KP9KP9aD/Gj/Fj/Vg/zo/zE/wEP8lP8lP8FD/VT/XT/XQ/o8AMP9PP9LP9bD/Xz/Xz/Dy/wC/wC/1Cv8gv8kv8Er/ML/Mr/Aq/yq/ya/wav86v8xv8Br/Rb/Sb/Ca/xW/x2/w2v8Pv8Dv9Tr/L7/K7/W6/x+/xe/1ev89/7vf7L/wB/6U/6L/yh/zX/rD/xh/xR/0x/60/7r/zJ/xJf8qf9mf89/6s/8Gf88GPTryeGJN4IzE28WZiXGJ8YkJiYmJSYnJiSuKtxNTEtMT0xNuJGYl3EjMTsxKzEykA8G5iXmJ+YkHivcTCxPuJRYnFiSWJpYllieWJEHJvikPekC8kw1Uhf7g6FAgFQ6FQOPhQJBQN14Ri4dpQPFwXSoTrQ8lwQygVSocy4YFQL9QPDULD0Cg8GBqHh0KT8HBoGh4JzcKjoXl4LLQIj4eW4YnQKjwZWoenQpvwdGgbngntQvvQITwbOobnQqfQOaSGLqFreD50C91Dj9Az9AovhN7hxdAnvBT6hn6hf3g5DAivhIHh1TAoDA5DwmthaBgWhocRYWQYFUaH18OYDG+EseHNMC6MDxPCxDApTA5TwlthapgWpoe3w4zwTpgZZoXZYU6YG94N88L8sCC8FxaG98OisDgsCUvDsrA8rAgrw6qwOqwJa8O6sD5sCB+EjeHDsClsDlvC1rAtbA87wkdhZ/g47AqfhN3h04A/HX2p+8LnYX/4IhwIX4aD4atwKHwdDodvwpFwNBwL34bj4btwIpwMp8LpcCZ8H86GH8I5+Zs1IYQQQog/Zey+P97e5R88pn5u53UFgEs359z/6+0GANZl+6nfXeVqlgCAxzu3vfeXVqFCamrqz/su0hDlmwUAiQvjf7wM+TleDE3hUWgBD0Oxf5hfd9X+DP/B/HgkhOT1ABl/Neb8efwv8YX5r/0f5n/wkSHzSsansvx2/rM/n2+ezz85C6BAvgtjMsCF+ML8xf+H+bM3/qP8F2nI8NlogCa/GpMJLsQX5i8KD8ET0OI3ewohhBBCCCGEED/prsq0/ifXnz9en+f66XeRf3w4Pfw9/qfX50IIIYQQQgghhLj4nmrf4bEHW7R4uLV0pJMWOhkA4D8gjX9HJ+UvnfBi/2QSQgghhBBC/NUunPRf7EyEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQoi06//i/5Nd7DUKIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQF9v/CwAA//+JSyoS") creat(&(0x7f0000000580)='./bus\x00', 0x9e) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000100)='?', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) 3m3.962344989s ago: executing program 1 (id=52): syz_usb_connect(0x1, 0x0, 0x0, &(0x7f0000001100)={0xa, &(0x7f0000000fc0)={0xa, 0x6, 0x200, 0x89, 0x5, 0x9, 0x10, 0x2}, 0x0, 0x0}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0x83, "00000000000000000000ffff00000000000002"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) read$watch_queue(r2, &(0x7f0000000200)=""/148, 0xffffffc0) 3m3.56389835s ago: executing program 1 (id=54): r0 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x23, 0x0, 0xa4ff) bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x10000080}, 0x42) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000e001400400000004000000041"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000006c0)="616f9f", &(0x7f0000000680), 0x1006, r1}, 0x38) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000b80)={r1, &(0x7f00000014c0), &(0x7f0000000100)=""/31}, 0x20) 3m3.436329183s ago: executing program 32 (id=54): r0 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x23, 0x0, 0xa4ff) bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x10000080}, 0x42) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000e001400400000004000000041"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000006c0)="616f9f", &(0x7f0000000680), 0x1006, r1}, 0x38) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000b80)={r1, &(0x7f00000014c0), &(0x7f0000000100)=""/31}, 0x20) 2m49.693347819s ago: executing program 0 (id=109): socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x2c, 0x0, 0x0, 0x2}, 0x50) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 2m49.194723682s ago: executing program 0 (id=112): r0 = socket$inet(0x2, 0x80001, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000280)=0xf5c, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) listen(r0, 0x3) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r1, 0x50) 2m48.480117331s ago: executing program 0 (id=118): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x6, &(0x7f0000000740)=ANY=[@ANYBLOB="18120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000001000000b7040000000001008500000034000000950000000000"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) 2m48.188625419s ago: executing program 0 (id=119): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x20200ccc, &(0x7f0000002c00)=ANY=[], 0xfe, 0x1527, &(0x7f0000002c40)="$eJzs3Au4TtXWOPAx5pyLTdKb5D7HHIs3uUySJJdUckmSJElyS5IkSRISm9ySkITck9xDcgvJ/U5yT5IjSZKQ3JL5f3Q56ul8nb7/6XzOc/b4Pc989hzvWnO+Y+6x3v2utd6991dt+1eqU7l8LWaGfwn+9CUVAFIAoBcAXAYAEQCUyFIiy/ntGTSm/mtPIv5a90662BmIi0nqn7ZJ/dM2qX/aJvVP26T+aZvUP22T+qdtUn8h0rKNk3NeLi3tNrn/n5bJ+/9/kf1FRny2psiV7f4XQ6T+aZvUP22T+qch0e8fkvqnbVL/tE3q/9/vlj/YJvX/L5Xy53aT+guRlv39XvDZEMJ/wP3ov7ql/91nHL/cgr74uf0ntIt8+AkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESCNOhQsMAPzSv9h5CSGEEEIIIYQQ4q8T0l/sDIQQQgghhBBCCPHvh6BAg4EI0kF6SIEMkBEugUxwKWSGyyABl0MWuAKywpWQDbJDDsgJuSA35AELBA4YYsgL+SAJV0F+uBoKQEEoBIXBQxEoCtdAMbgWisN1UAKuh5JwA5SC0lAGysKNUA5ugpvhFigPt0IFqAiVoDLcBlXgdqgKd0A1uBOqw11QA+6GmnAP1IJ7oTbcB3XgfqgLD0A9qA8NoCE0+v8a/yx0hOegE3SGVOgCXeF56AbdoQf0hF7wAvSGF6EPvAR9oR/0h5dhALwCA+FVGASDYQi8BkNhGAyHETASRsFoeB3GwBswFt6EcTAeJsBEmASTYQq8BVNhGkyHt2EGvAMzYRbMhjkwF96FeTAfFsB7sBDeh0WwGJbAUlgGy2EFrIRVsBrWwFpYB+thA3wAG+FD2ASbYQtshW2wHXZAetgJH8Mu+AR2w6f/y/EnYQd89Kvx7RAQUKFCgwbTYTpMwRTMiBkxE2bCzJgZE5jALJgFs2JWzIbZMAfmwFyYC/NgHiQkZGTMi3kxiUnMj/mxABbAQlgIPXosikWxGF6LxbE4lsASWBJLYiksjaWxLJbFclgOb8absTyWxwpYASthJbwNb8PbsSpWxWpYDatjdayBNbAm1sRaWAtrY22sg3WwLtbFelgPG2ADbISNsDE2xibYBJtiU2yGzbA5NscW2AJbYktsha2wNbbGNtgG22JbbIftsT0+i8/ic/gcdsYKqgt2xa7YDbthD+yJPfEF7I0v4ov4EvbFftgfX8aX8RUciCdwEA7GITgEy6lhOBxHIKtROBpH4xgcg2NxLI7D8TgeJ+IknIxTcApOxWk4Dd/GGfgOvoOzcBbOwbk4F+fhfFyAC3AhnsRFuBiX4FJchstxGa7EVbgS1+BaXIPrEc1Pr9APcTNuxq24FbfjdvwIP8KP8WPsi7txN+7BPbgX9+I+3If7cT8ewAN4EA/iITyEh/EwHsGjeAyP4nE8jifwJJ7CU3gGz+BZfDrXF7W3F1zdF9R5RhmVTqVTKSpFZVQZVSaVSWVWmVVCJVQWlUVlVVlVNpVN5VA5VC6VS+VReRQpUqxilVflVUmVVPlVflVAFVCFVCHllVdFVVFVTBVTxVVxVUJdr0qqG1QpVVo97MuqsqpG9NPqyqvyqoKqqCqpyqqyqqKqqKqqqqqmqqnqqrqqoe5WNVUX7IH3qvOVqaP6YV3VH+up+qqBaqhewQdVYzUQm6iHVVP1iBqMg7C5auxbqMdVSzUcW6kn1Qh8SrVRo7Cteka1U+1VB/Ws6qia+E6qsxqHXVRXNRG7qe6qh+qppmJFdb5ildRLqq/qp/qrl9UcfEUNVK+qQWqwGqJeU0PVMDVcjVAj1Sg1Wr2uxqg31Fj1phqnxqsJaqKapCarKeotNVVNU9PV22qGekfNVLPUbDVHzVXvqnlqvlqg3lML1ftqkVqslqilaplarlaolWqVWq3WqLVqnVqvNqgP1Eb1odqkNqstaqvaprarHeojtVN9rHapT9Ru9anao/6m9qrP1D71udqvvlAH1JfqoPpKHVJfq8PqG3VEHVXH1LfquPpOnVAn1Sl1Wp1R36uz6gd1TgUFGrXSWhsd6XQ6vU7RGXRGfYnOpC/VmfVlOqEv11n0FTqrvlJn09l1Dp1T59K5dR5tNWmnWcc6r86nk/oqnV9frQvogrqQLqy9LqKL6mt0MX2tLq6v0yX09bqkvkGX0qV1GV1W36jL6Zv0zfoWXV7fqivoirqSrqxv01X07bqqvkNX03fq6vouXUPfrWvqe3Qtfa+ure/TdfT9uq5+QNfT9XUD3VA30g/qxvoh3eT80aQf0c30o7q5fky30I/rlvoJ3Uo/qVvrp3Qb/bRuq5/R7XR73UH/oM/poDvpzjpVd9Fd9fO6m+6ue+ieupd+QffWL+o++iXdV/fT/fXLeoB+RQ/Ur+pBerAeol/TQ/UwPVyP0CP1KD1av67H6Df0WP2mHqfH6wl6op6kJ+seP880/U+Mf+MfjO/z47N/oDfqD/UmvVlv0Vv1Nr1d79A79E69U+/Su/RuvVvv0Xv0Xr1X79P79H69Xx/QB/RBfVAf0of0YX1YH9FH9Wn9rT6uv9Mn9El9Up/WZ/QZffbn7wEYNMpoY0xk0pn0JsVkMBnNJSaTudRkNpeZhLncZDFXmKzmSpPNZDc5TE6Ty+Q2eYw1ZJxhE5u8Jp9JmqtMfnO1KWAKmkKmsPGmiClqrvmXx/+z/BqZRqaxaWyamCamqWlqmplmprlpblqYFqalaWlamVamtWlt2pg2pq1pa9qZdqaD6WA6mo6mk+lkUk2q6WqeN91Md9PD9DS9zAumt+lt+pg+pq/pa/qb/maAGWAGmoFmkBlkhpghZqgZaoab4WakGWlGm9FmjBljxpqxZpwZZyaYCWaSmWSmmClmqplqppvpZoaZYWaamWa2mW3mmrlmnplnFpgFZqFZaBaZxWaxWWqWmuVmuVlpVprVZrVZa9aa9Wa9WWQ2mo1mk9lktpgtZpvZZnaYHWan2Wl2mV1mt9lt9pg9Zq/Za/aZfWa/2W8OmAPmoDloDplD5rA5bI6YI+aYOWaOm+PmhDlhTplT5ow5Y86as+acOXf+tC9SkYpMZKJ0UbooJUqJMkYZo0xRpihzlDlKRIkoS5QlyhpdGWWLskc5opxRrih3lCeyEUUu4iiO8kb5omR0VZQ/ujoqEBWMCkWFIx8ViYpG10TFomuj4tF1UYno+qhkdENUKiodlYnKRjdG5aKbopujW6Ly0a1RhajiL59DRbdHVaM7omrRnVH16K6oRnR3VDO6J6oV3RvVju6L6kT3R3WjB6J6Uf2oQdQwavRn548qRZWj26Iqfzh/CCeyP+Q72c421XaxXe3ztpvtbnvYnraXfcH2ti/aPvYl29f2s/3ty3aAfcUOtK/aQXawHWJfs0PtMDvcjrAj7Sg72r5ux9g37Fj7ph1nx9sJdqKdZCfbKfYtO9VOs9Pt23aGfcfOtLPsbDvHzrXv2nl2vl1g37ML7ft2kV1sl9ildpldblfYlXaVXW3X2LV2nV1vN9gP7Eb7od1kN9stdqvdZrfbHfYju9N+bHfZT+xu+6ndY/9m99rP7D743O63X9gD9kt70H5lD9mv7WH7jT1ij9pj9lt73H5nT9iT9pQ9bc/Y7+1Z+4M9Z8P5k/vzb+9kyFA6SkcplEIZKSNlokyUmTJTghKUhbJQVspK2Sgb5aAclItyUR7KQ+cxMeWlvJSkJOWn/FSAClAhKkSePBWlolSMilFxKk4lqASVpJJUikpRGSpDN9KNdBPdRLfQLXQr3UoVqSJVpspUhapQVapK1agaVafqVINqUE2qSbWoFtWm2lSH6lBdqkv1qB41oAbUiBpRY2pMTagJNaWm1IyaUXNqTi2oBbWkltSKWlFrak1tqA21pbbUjtpRB+pAHakjdTrdiVIplbpSV+pG3agH9aBe1It6U2/qQ32oL/Wl/tSfBtAAGkgDaRANpiH0Gg2lYTScRtBIGkWjaTSNoTE0lsbSOBpHE2gCTaJJNIWm0FSaStNpOs2gGTSTZtJsmk1zaS7No3m0gBbQQlpIi2gRLaEltIyW0QpaQatoFa2hNbSO1tEG2kAbaSNt0ptoC22hbbSNdtAO2kk7aRftot20m/bQHtpLe2kf7aP9tJ8O0AE6SAfpEB2iw3SYjtAROkbH6DgdpxN0gk7RKTpD39NZ+oHOUaAUpyCju8Rlcpe6zO4yl+IyuF/HOVxOl8vldnmcddlc9t/E5Jwr4Aq6Qq6w866IK+qu+V1cypV2ZVxZd6Mr525yN/8uruJud1XdHa6au9NVdrf9Jq7u7nI13P2upnvA1XL1XW3X0NVx97u67gFXz9V3DVxD18w96pq7x1wL97hr6Z74XTzPzXer3Gq3xq11O93H7pQ77Q66r9wZ973r5Dq7Xu4F19u96Pq4l1zfav1+G7t+boh7zQ11w9xwN8KNdKN+F09wE90kN9lNcW+5qW7a7+K57l03wy1wM90sN9vN+TE+n9MC955b6N53i9xit8QtdcvccrfCrfx7rkvderfBfeB2uI/cJrfZbXFb3Ta3/cf4/Dp2uU/cbvepO+C+dHvdZ26fO+T2uy9+jM+v75D72h1237gj7qg75r51x9137oQ7+eP6z6/9W/eDO+eCA0ZWrNlwxOk4PadwBs7Il3AmvpQz82Wc4Ms5C1/BWflKzsbZOQfn5Fycm/OwZWLHzDHn5Xyc5Ks4P1/NBbggF+LC7LkIF+VruBhfy8X5Oi7B13NJvoFLcWkuw2X5Ri7HN/HNBrg838oVuCJX4sp8G1fh27kq38HV+E6uzndxDb6ba/I9XIvv5dp8H/9yN6Me1+cG3JAb8YPcmB/iJvwwN+VHuBk/ys35MW7Bj3NLfoJb8ZPcmp/iNvw0t+VnuB235w78LHfk57gTd+ZU7sJd+Xnuxt25B/fkXvwC9+YXuQ+/xH25H/fnl3kAv8ID+VUexIN5CL/GQ3kYD+cRPJJH8Wh+ncfwGzyW3+RxPJ4n8ESexJN5Cr/FU3kaT+e3eQa/wzNnZAbgOTyX3+V5PJ8X8Hu8kN/nRbyYl/BSXsbLeQWv5FW8mtfwWl7H63kDf8Ab+UPexJt5C2/lbbydd/BHvJM/5l38Ce/mT3kP/4338me8jz/n/fwFH+Av+SB/xYf4az7M3/ARPsrH+Fs+zt/xCT7Jp/g0n+Hv+Sz/wOc4MMQYq1jHJo7idHH6OCXOEGeML4kzxZfGmePL4kR8eZwlviLOGl8ZZ4uzxzninHGuOHecJ7YxxS7mOI7zxvniZHxVnD++Oi4QF4wLxYVjHxeJi8bXxMXia+Pi8XVxifj6uGR8Q1wqLh3ff2fZ+Ma4XHxTfHN8S1w+vjWuEFeMK8WV49viKvHtcdX4jrhafGdcPL4rrhHfHdeM74lrxffGteP74jrx/XHd+IG4Xlw/bhA3jBvFD8aN44fiJvHDcdP4kbhZ/GjcPH4sbhE/HreMn/in21PjLnHX+Pn4+TiEO/Ts5Jzk3OS7yXnJ+ckFyfeSC5PvJxclFyeXJJcmlyWXJ1ckVyZXJVcn1yTXJtcl1yc3JD9IhlA5PXj0ymtvfOTT+fQ+xWfwGf0lPpO/1Gf2l/mEv9xn8Vf4rP5Kn81n9zl8Tp/L5/Z5vPXknWcf+7w+n0/6q3x+f7Uv4Av6Qr6w976IL+ob+ka+kW/sH/JN/MO+qX/EP+If9Y/6x/xj/nHf0j/hW/knfWv/lG/jn/ZP+2d8O9/ed/DP+o7+Od/Jd/apPtV39V19N9/N9/A90v38IvJ9fB/f1/f1/X1/P8AP8AP9QD/ID/JD/BA/1A/1w/1wP9KP9KP9aD/Gj/Fj/Vg/zo/zE/wEP8lP8lP8FD/VT/XT/XQ/o8AMP9PP9LP9bD/Xz/Xz/Dy/wC/wC/1Cv8gv8kv8Er/ML/Mr/Aq/yq/ya/wav86v8xv8Br/Rb/Sb/Ca/xW/x2/w2v8Pv8Dv9Tr/L7/K7/W6/x+/xe/1ev89/7vf7L/wB/6U/6L/yh/zX/rD/xh/xR/0x/60/7r/zJ/xJf8qf9mf89/6s/8Gf88GPTryeGJN4IzE28WZiXGJ8YkJiYmJSYnJiSuKtxNTEtMT0xNuJGYl3EjMTsxKzEykA8G5iXmJ+YkHivcTCxPuJRYnFiSWJpYllieWJEHJvikPekC8kw1Uhf7g6FAgFQ6FQOPhQJBQN14Ri4dpQPFwXSoTrQ8lwQygVSocy4YFQL9QPDULD0Cg8GBqHh0KT8HBoGh4JzcKjoXl4LLQIj4eW4YnQKjwZWoenQpvwdGgbngntQvvQITwbOobnQqfQOaSGLqFreD50C91Dj9Az9AovhN7hxdAnvBT6hn6hf3g5DAivhIHh1TAoDA5DwmthaBgWhocRYWQYFUaH18OYDG+EseHNMC6MDxPCxDApTA5TwlthapgWpoe3w4zwTpgZZoXZYU6YG94N88L8sCC8FxaG98OisDgsCUvDsrA8rAgrw6qwOqwJa8O6sD5sCB+EjeHDsClsDlvC1rAtbA87wkdhZ/g47AqfhN3h04A/HX2p+8LnYX/4IhwIX4aD4atwKHwdDodvwpFwNBwL34bj4btwIpwMp8LpcCZ8H86GH8I5+Zs1IYQQQog/Zey+P97e5R88pn5u53UFgEs359z/6+0GANZl+6nfXeVqlgCAxzu3vfeXVqFCamrqz/su0hDlmwUAiQvjf7wM+TleDE3hUWgBD0Oxf5hfd9X+DP/B/HgkhOT1ABl/Neb8efwv8YX5r/0f5n/wkSHzSsansvx2/rM/n2+ezz85C6BAvgtjMsCF+ML8xf+H+bM3/qP8F2nI8NlogCa/GpMJLsQX5i8KD8ET0OI3ewohhBBCCCGEED/prsq0/ifXnz9en+f66XeRf3w4Pfw9/qfX50IIIYQQQgghhLj4nmrf4bEHW7R4uLV0pJMWOhkA4D8gjX9HJ+UvnfBi/2QSQgghhBBC/NUunPRf7EyEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQoi06//i/5Nd7DUKIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQF9v/CwAA//+JSyoS") creat(&(0x7f0000000580)='./bus\x00', 0x9e) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000100)='?', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) 2m47.368333041s ago: executing program 0 (id=122): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) io_setup(0x5, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000008c0)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x5, 0x1003, r1, 0x0}]) close(0x3) 2m46.416838466s ago: executing program 0 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./bus\x00', 0x100688d, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file5\x00', 0x1616c3, 0x101) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x105, 0x5000003a, r0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file1\x00', 0x8028c7, 0x0, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 2m46.045226566s ago: executing program 33 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./bus\x00', 0x100688d, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file5\x00', 0x1616c3, 0x101) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x105, 0x5000003a, r0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file1\x00', 0x8028c7, 0x0, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 2m33.49506746s ago: executing program 3 (id=197): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}}, 0x24}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02"], 0xe) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$key(0xf, 0x3, 0x2) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x48) splice(r0, 0x0, r2, 0x0, 0x3000, 0x100000000000000d) 2m33.260494826s ago: executing program 3 (id=199): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000008c0), 0x121202, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0605250c"], 0x9) write$binfmt_elf32(r2, 0x0, 0x0) 2m31.062839384s ago: executing program 3 (id=218): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x0, 0x25dfdbfb, {{@in=@local, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x2, 0x0, 0x2000000000000, 0x40, 0xfffffffffffffdfd, 0x50}, {0x5}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 2m30.894449589s ago: executing program 3 (id=212): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000000)="fc00", 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f00000025c0)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0xb8, @rand_addr=' \x01\x00', 0x7}, 0x1c, &(0x7f0000002440)=[{&(0x7f0000000340)='b', 0x1}], 0x1}}], 0x2, 0x10) shutdown(r3, 0x1) splice(r0, 0x0, r2, 0x0, 0x1100000000f336, 0x0) 2m30.673065385s ago: executing program 3 (id=213): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 2m30.338488963s ago: executing program 3 (id=215): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xe, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8af1d25", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 2m14.997483251s ago: executing program 34 (id=215): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xe, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8af1d25", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 2.208939452s ago: executing program 5 (id=1514): socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$can_bcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000680)=""/112, 0xfffffef2}], 0x2}, 0x10150) 2.121127724s ago: executing program 4 (id=1516): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x20) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.029222796s ago: executing program 5 (id=1517): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000180)=0x80, 0x4) setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f0000000040)=0x6, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 1.981051818s ago: executing program 4 (id=1518): open(&(0x7f0000000040)='./file0\x00', 0x101040, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x790f0000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) syz_clone(0x2a840100, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x4000000) setxattr$security_capability(&(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, 0x0, 0x1) 1.566293719s ago: executing program 5 (id=1521): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x2f64, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0x2, 0x23f}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, &(0x7f0000000680)='syzkaller\x00', 0x1, 0x40, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000000)={0xb, 0x29, 0x2, {0x401}}, 0xb) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000640)="68a55d6df108bed91373cc794c16187a680c0c711ae161400d400e28f7117e17fd75340a58f8d37231d4e7cd61719f501fd0d890485c98ee906e64fad259a1000000fc4d76dadbb0", 0x48}], 0x1}}], 0x1, 0x0) 1.250347827s ago: executing program 4 (id=1522): ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000000)={{0x2, 0x4e20, @rand_addr=0x64010102}, {0x6, @local}, 0x48, {0x2, 0x4ea1, @multicast1}, 'bridge_slave_1\x00'}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a10a0017", 0x1f}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f782db44b904020000", 0x13}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 1.249593217s ago: executing program 5 (id=1523): r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, &(0x7f0000000280)={[0x8001a0ffffffff]}, 0x8) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r2}], 0x1, 0x0, 0x0, 0x0) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x13) 912.590026ms ago: executing program 6 (id=1524): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xe, 0x4, 0x4, 0x8}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x6, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 876.874477ms ago: executing program 6 (id=1526): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x8024, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair(0x11, 0x3, 0x300, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0, 0x10000000000}, 0x20) 801.718729ms ago: executing program 6 (id=1527): r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x59b801, 0x1ce) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x4d) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 696.650112ms ago: executing program 6 (id=1529): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x8, {"a2e3ad214fc752f91b5d36f70b06d038e7ff7fc6e5539b385d098b089b3b08381a090890e0878f0e1ac6e7049b3344959b609a240c872adb988f7e0319520100ffe8d178708c523c921b1b5b31310d095d0636cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08c4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e800ba9abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40d4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889632b3570243f989cce3803f465e41e610c2021d653a5520094ec79553299388b0000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a72eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c2d88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d606495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07840900000000000000f5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b19bb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0545359bafffa452370000000010403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae2d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e709000000000000004fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83000000000000010058b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c000003716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff7544130700000000000000f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc6c71737b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b93903000000000000001c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f9354b9094f22b625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c558069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae0000000000000007eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c73144f8e4a737afae5136651b1b9bd522d6039947329710309d83fdd9d8b4ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c10613d17ca51075f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb401000000608d6f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655bff4801784c416b22f73d32d678e2724f43f1fe687c7e8a605fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d7000bdbfc43c10ec23ea6283994a7dde4dcb61fea6b611fb1d6245939241a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f4820000000000000900a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78cd7d79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2e0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77900b5f07722e47afed367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15f2dbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af500ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000eeffffffffffffff00000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r1, &(0x7f0000000000), 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r2, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r2, &(0x7f00000001c0), 0x10) dup3(r0, r1, 0x0) 641.660953ms ago: executing program 6 (id=1532): timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000000000)='\x00', &(0x7f0000000440)='!', 0x1) 556.336416ms ago: executing program 2 (id=1533): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2c, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0x1, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}, @TCA_CODEL_TARGET={0x8, 0x1, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x55}, 0xc010) shutdown(r0, 0x1) 434.575809ms ago: executing program 2 (id=1534): socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r3, @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 314.211582ms ago: executing program 5 (id=1535): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtaction={0x14, 0x30, 0x0, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x44}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 314.025572ms ago: executing program 2 (id=1536): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x10, &(0x7f0000001280), 0x4) r2 = getpid() sendmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)="e60d", 0x2}], 0x1, &(0x7f0000000680)=[@cred={{0x1c, 0x1, 0x2, {r2, 0x0, 0xee00}}}], 0x20, 0x10}, 0x10044001) write$cgroup_pid(r0, &(0x7f0000000400), 0x12) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x1) recvmsg(r1, &(0x7f00000001c0)={0x0, 0x80000001, 0x0}, 0x2002) 232.608474ms ago: executing program 4 (id=1537): r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/rt6_stats\x00') r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="98"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)="ef"}) dup3(r0, r2, 0x80000) 232.262854ms ago: executing program 2 (id=1538): r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=0x1], 0x48) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00'}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) r3 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r3}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 156.609396ms ago: executing program 6 (id=1539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x1}}]}, 0x20}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x54, r3, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x7530, @local}}, {0x14, 0x2, @in={0x2, 0x7530, @remote}}}}]}]}, 0x54}}, 0x0) 148.316116ms ago: executing program 4 (id=1540): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000040)={0x6, 0x1, 0x0, 0x20000000, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x44}, @multicast2}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f00000003c0)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0xfffe, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) 70.866348ms ago: executing program 2 (id=1541): socket(0x2, 0x80805, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0xfd2, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1b, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000002, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) shutdown(r0, 0x1) 70.226588ms ago: executing program 5 (id=1542): syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x7) sendfile(0xffffffffffffffff, r0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000000101010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa140019800800010004000000080002"], 0x44}}, 0x4000) 1.84396ms ago: executing program 4 (id=1543): mknod(&(0x7f0000000040)='./file0\x00', 0x1000, 0x1) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x185d, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) vmsplice(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="9b", 0xfdef}], 0x1, 0x7) 0s ago: executing program 2 (id=1544): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r1, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) bind$tipc(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): tered blocking state [ 81.796730][ T5943] bridge0: port 3(syz_tun) entered disabled state [ 81.809528][ T5943] syz_tun: entered allmulticast mode [ 81.843871][ T5943] syz_tun: entered promiscuous mode [ 81.853483][ T5773] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 81.874563][ T5943] bridge0: port 3(syz_tun) entered blocking state [ 81.878836][ T5773] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 81.881875][ T5943] bridge0: port 3(syz_tun) entered forwarding state [ 81.920289][ T5773] asix: probe of 1-1:0.34 failed with error -71 [ 81.977280][ T5773] usb 1-1: USB disconnect, device number 3 [ 82.604345][ T5959] 8021q: adding VLAN 0 to HW filter on device bond1 [ 82.660825][ T5964] gretap1: entered promiscuous mode [ 82.712681][ T5964] bond1: (slave gretap1): making interface the new active one [ 82.749244][ T5964] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 83.424448][ T5985] Bluetooth: (null): Too short H5 packet [ 83.465405][ T5989] loop1: detected capacity change from 0 to 256 [ 83.515424][ T5989] exFAT-fs (loop1): failed to load upcase table (idx : 0x00011a39, chksum : 0x14e42e2d, utbl_chksum : 0xe619d30d) [ 84.176448][ T3492] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.265763][ T3492] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.333773][ T3492] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.466906][ T3492] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.958518][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.968151][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.978088][ T5087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.988438][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.996283][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 85.004967][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.979532][ T3492] bond1: (slave gretap1): Releasing active interface [ 86.052501][ T6007] chnl_net:caif_netlink_parms(): no params data found [ 86.674934][ T6007] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.682093][ T6007] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.713775][ T6007] bridge_slave_0: entered allmulticast mode [ 86.721116][ T6007] bridge_slave_0: entered promiscuous mode [ 86.767864][ T6007] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.790274][ T6007] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.819882][ T6007] bridge_slave_1: entered allmulticast mode [ 86.838095][ T6007] bridge_slave_1: entered promiscuous mode [ 86.853502][ T23] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 86.896022][ T173] cfg80211: failed to load regulatory.db [ 87.033316][ T5782] Bluetooth: hci3: command tx timeout [ 87.040305][ T6007] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.060581][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.074095][ T23] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 87.083662][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.095391][ T23] usb 1-1: config 0 descriptor?? [ 87.153250][ T3492] hsr_slave_0: left promiscuous mode [ 87.170275][ T6049] loop2: detected capacity change from 0 to 32768 [ 87.179195][ T3492] hsr_slave_1: left promiscuous mode [ 87.218996][ T6049] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.64 (6049) [ 87.249452][ T3492] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.277683][ T3492] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.295343][ T3492] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.295928][ T6049] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 87.302811][ T3492] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.339431][ T23] usbhid 1-1:0.0: can't add hid device: -71 [ 87.353666][ T6049] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 87.358670][ T23] usbhid: probe of 1-1:0.0 failed with error -71 [ 87.383300][ T6049] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 87.390612][ T23] usb 1-1: USB disconnect, device number 4 [ 87.392710][ T6049] BTRFS info (device loop2): use zstd compression, level 3 [ 87.444804][ T3492] bridge_slave_1: left allmulticast mode [ 87.451999][ T3492] bridge_slave_1: left promiscuous mode [ 87.453172][ T6049] BTRFS info (device loop2): using free space tree [ 87.494749][ T3492] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.556007][ T3492] bridge_slave_0: left allmulticast mode [ 87.569421][ T3492] bridge_slave_0: left promiscuous mode [ 87.582714][ T3492] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.604414][ T6049] BTRFS info (device loop2): enabling ssd optimizations [ 87.622682][ T6049] BTRFS info (device loop2): auto enabling async discard [ 87.676127][ T27] audit: type=1800 audit(1787848879.486:4): pid=6049 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.64" name="bus" dev="loop2" ino=263 res=0 errno=0 [ 87.701599][ T3492] veth1_macvtap: left promiscuous mode [ 87.722237][ T3492] veth0_macvtap: left promiscuous mode [ 87.730063][ T3492] veth1_vlan: left promiscuous mode [ 87.735722][ T3492] veth0_vlan: left promiscuous mode [ 87.739658][ T27] audit: type=1800 audit(1787848879.486:5): pid=6049 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.64" name="bus" dev="loop2" ino=263 res=0 errno=0 [ 87.914413][ T23] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 88.112266][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.137006][ T5778] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 88.157167][ T23] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 88.180423][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.209643][ T23] usb 1-1: config 0 descriptor?? [ 88.331403][ T3492] bond1 (unregistering): Released all slaves [ 88.501205][ T5778] usb 3-1: unable to get BOS descriptor or descriptor too short [ 88.522452][ T5778] usb 3-1: no configurations [ 88.527220][ T5778] usb 3-1: can't read configurations, error -22 [ 88.822231][ T3492] team0 (unregistering): Port device team_slave_1 removed [ 88.858840][ T3492] team0 (unregistering): Port device team_slave_0 removed [ 88.896261][ T3492] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 88.935915][ T3492] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 89.051920][ T5772] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 89.055027][ T23] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 89.090172][ T23] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input5 [ 89.115223][ T5782] Bluetooth: hci3: command tx timeout [ 89.521560][ T5773] usb 1-1: USB disconnect, device number 5 [ 89.521616][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 89.651177][ T3492] bond0 (unregistering): Released all slaves [ 89.727272][ T6007] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.740215][ T6070] FAULT_INJECTION: forcing a failure. [ 89.740215][ T6070] name failslab, interval 1, probability 0, space 0, times 0 [ 89.753382][ T6070] CPU: 1 PID: 6070 Comm: syz.3.67 Not tainted syzkaller #0 [ 89.760608][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.770670][ T6070] Call Trace: [ 89.773942][ T6070] [ 89.776895][ T6070] dump_stack_lvl+0x18c/0x250 [ 89.781579][ T6070] ? show_regs_print_info+0x20/0x20 [ 89.786770][ T6070] ? load_image+0x420/0x420 [ 89.791270][ T6070] should_fail_ex+0x394/0x4c0 [ 89.795950][ T6070] should_failslab+0x9/0x20 [ 89.800453][ T6070] slab_pre_alloc_hook+0x59/0x300 [ 89.805479][ T6070] kmem_cache_alloc_node+0x5e/0x310 [ 89.810675][ T6070] ? __alloc_skb+0x103/0x2c0 [ 89.815271][ T6070] __alloc_skb+0x103/0x2c0 [ 89.819698][ T6070] rtmsg_ifinfo_build_skb+0x83/0x260 [ 89.824992][ T6070] ? lockdep_rtnl_is_held+0x26/0x30 [ 89.830193][ T6070] rtmsg_ifinfo+0x8c/0x1a0 [ 89.834616][ T6070] __dev_notify_flags+0xf3/0x310 [ 89.839563][ T6070] ? __dev_change_flags+0x6a0/0x6a0 [ 89.844762][ T6070] ? __dev_change_flags+0x4d2/0x6a0 [ 89.849963][ T6070] ? dev_get_flags+0x1c0/0x1c0 [ 89.854730][ T6070] ? is_bpf_text_address+0x26/0x2a0 [ 89.859926][ T6070] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 89.865998][ T6070] dev_change_flags+0xde/0x1a0 [ 89.870763][ T6070] do_setlink+0xb69/0x3f40 [ 89.875179][ T6070] ? arch_stack_walk+0x160/0x190 [ 89.880121][ T6070] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 89.886272][ T6070] ? stack_trace_save+0xaa/0x100 [ 89.891206][ T6070] ? stack_trace_snprint+0xf0/0xf0 [ 89.896339][ T6070] ? __nla_validate+0x50/0x50 [ 89.901041][ T6070] ? validate_linkmsg+0x719/0x910 [ 89.906066][ T6070] rtnl_newlink+0x1145/0x2170 [ 89.910746][ T6070] ? rtnl_newlink+0xb21/0x2170 [ 89.915521][ T6070] ? rtnl_setlink+0x4e0/0x4e0 [ 89.920202][ T6070] ? __rwlock_init+0x150/0x150 [ 89.924970][ T6070] ? do_raw_spin_unlock+0x121/0x230 [ 89.930169][ T6070] ? __mutex_lock+0x923/0xc80 [ 89.934848][ T6070] ? __mutex_lock+0x4d2/0xc80 [ 89.939560][ T6070] ? rtnl_setlink+0x4e0/0x4e0 [ 89.944256][ T6070] rtnetlink_rcv_msg+0x843/0xf90 [ 89.949325][ T6070] ? rtnetlink_rcv_msg+0x220/0xf90 [ 89.954464][ T6070] ? rtnetlink_bind+0x80/0x80 [ 89.959193][ T6070] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 89.965191][ T6070] ? lock_chain_count+0x20/0x20 [ 89.970058][ T6070] ? __local_bh_enable_ip+0x13a/0x1c0 [ 89.975426][ T6070] ? lockdep_hardirqs_on+0x98/0x150 [ 89.980629][ T6070] ? __local_bh_enable_ip+0x13a/0x1c0 [ 89.985995][ T6070] ? _local_bh_enable+0xa0/0xa0 [ 89.990846][ T6070] ? __dev_queue_xmit+0x275/0x3640 [ 89.995962][ T6070] ? __dev_queue_xmit+0x1bc2/0x3640 [ 90.001167][ T6070] ? __dev_queue_xmit+0x275/0x3640 [ 90.006296][ T6070] ? ref_tracker_free+0x686/0x830 [ 90.011323][ T6070] netlink_rcv_skb+0x235/0x4c0 [ 90.016089][ T6070] ? rtnetlink_bind+0x80/0x80 [ 90.020768][ T6070] ? netlink_ack+0x1160/0x1160 [ 90.025536][ T6070] ? __lock_acquire+0x7d80/0x7d80 [ 90.030561][ T6070] ? netlink_deliver_tap+0x2e/0x1b0 [ 90.035759][ T6070] netlink_unicast+0x7b1/0x930 [ 90.040535][ T6070] netlink_sendmsg+0x8d0/0xbf0 [ 90.045313][ T6070] ? netlink_getsockopt+0x590/0x590 [ 90.050515][ T6070] ? apparmor_socket_sendmsg+0x8e/0x330 [ 90.056065][ T6070] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 90.061351][ T6070] ? security_socket_sendmsg+0x80/0xa0 [ 90.066808][ T6070] ? netlink_getsockopt+0x590/0x590 [ 90.072003][ T6070] ____sys_sendmsg+0x61b/0x980 [ 90.076774][ T6070] ? __asan_memset+0x22/0x40 [ 90.081363][ T6070] ? __sys_sendmsg_sock+0x30/0x30 [ 90.086381][ T6070] ? __import_iovec+0x5f2/0x850 [ 90.091255][ T6070] ? import_iovec+0x73/0xa0 [ 90.095766][ T6070] ___sys_sendmsg+0x2a6/0x360 [ 90.100449][ T6070] ? __sys_sendmsg+0x2b0/0x2b0 [ 90.105251][ T6070] __se_sys_sendmsg+0x1d0/0x2c0 [ 90.110102][ T6070] ? __x64_sys_sendmsg+0x80/0x80 [ 90.115058][ T6070] ? lockdep_hardirqs_on+0x98/0x150 [ 90.120265][ T6070] do_syscall_64+0x55/0xb0 [ 90.124691][ T6070] ? clear_bhb_loop+0x40/0x90 [ 90.129393][ T6070] ? clear_bhb_loop+0x40/0x90 [ 90.134100][ T6070] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 90.140016][ T6070] RIP: 0033:0x7f7e0f39e0d9 [ 90.144439][ T6070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.164063][ T6070] RSP: 002b:00007f7e101a4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 90.172482][ T6070] RAX: ffffffffffffffda RBX: 00007f7e0f625fa0 RCX: 00007f7e0f39e0d9 [ 90.180451][ T6070] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000005 [ 90.188418][ T6070] RBP: 00007f7e0f435024 R08: 0000000000000000 R09: 0000000000000000 [ 90.196383][ T6070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.204347][ T6070] R13: 00007f7e0f626038 R14: 00007f7e0f625fa0 R15: 00007ffe57fbd6d8 [ 90.212325][ T6070] [ 90.464609][ T6070] bridge0: port 3(syz_tun) entered disabled state [ 90.509695][ T6070] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.517198][ T6070] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.730513][ T5778] IPVS: starting estimator thread 0... [ 90.823257][ T6101] IPVS: using max 19 ests per chain, 45600 per kthread [ 91.140832][ T6070] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.188875][ T6070] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.196456][ T5782] Bluetooth: hci3: command tx timeout [ 91.497615][ T6070] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.507677][ T6070] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.517035][ T6070] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.526255][ T6070] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.681667][ T6007] team0: Port device team_slave_0 added [ 91.760549][ T6007] team0: Port device team_slave_1 added [ 91.812215][ T6007] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.819620][ T6007] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.845841][ T6007] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.858681][ T6007] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.865968][ T6007] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.892192][ T6007] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.988474][ T6007] hsr_slave_0: entered promiscuous mode [ 91.995939][ T6007] hsr_slave_1: entered promiscuous mode [ 92.002021][ T6007] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.010105][ T6007] Cannot create hsr debugfs directory [ 92.023155][ T173] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 92.235660][ T173] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 92.251105][ T173] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 92.286003][ T173] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 92.318409][ T173] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 92.344987][ T173] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 92.362010][ T173] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.388685][ T6107] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 92.406103][ T6107] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 92.436365][ T173] pl2303 4-1:1.0: pl2303 converter detected [ 92.474660][ T173] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 92.484457][ T6007] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.520160][ T6007] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.562227][ T6007] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.597486][ T6007] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.796304][ T5773] usb 4-1: USB disconnect, device number 4 [ 92.796346][ T6107] pl2303 4-1:1.0: pl2303_vendor_write - failed to write [0007]: -71 [ 92.806401][ T6007] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.853939][ T6107] pl2303 ttyUSB0: pl2303_get_line_request - failed: -19 [ 92.862518][ T6107] pl2303 ttyUSB0: pl2303_set_line_request - failed: -19 [ 92.893668][ T6107] pl2303 4-1:1.0: pl2303_vendor_read - failed to read [000a]: -19 [ 92.909003][ T6007] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.916078][ T6107] pl2303 ttyUSB0: failed to submit interrupt urb: -19 [ 92.955057][ T5773] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 92.955229][ T3492] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.970670][ T3492] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.980566][ T5773] pl2303 4-1:1.0: device disconnected [ 93.024506][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.031791][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.065908][ T6128] mmap: syz.0.76 (6128) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 93.273465][ T5782] Bluetooth: hci3: command tx timeout [ 93.631039][ T6007] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.779475][ T6153] warning: `syz.3.80' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 94.030277][ T6163] loop3: detected capacity change from 0 to 512 [ 94.542179][ T6007] veth0_vlan: entered promiscuous mode [ 94.589897][ T6007] veth1_vlan: entered promiscuous mode [ 94.745417][ T6007] veth0_macvtap: entered promiscuous mode [ 94.784958][ T6007] veth1_macvtap: entered promiscuous mode [ 94.846643][ T6007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.872041][ T6007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.906930][ T6007] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.938273][ T6007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 94.963665][ T6007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.994778][ T6007] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.035281][ T6007] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.080908][ T6007] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.103602][ T6007] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.112351][ T6007] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.307381][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.344385][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.421718][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.454928][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.776586][ T6211] ip_tables: iptables: counters copy to user failed while replacing table [ 96.529849][ T6233] netlink: 20 bytes leftover after parsing attributes in process `syz.4.100'. [ 96.563802][ T6233] netlink: 144 bytes leftover after parsing attributes in process `syz.4.100'. [ 96.970180][ T6241] syz.4.101 uses obsolete (PF_INET,SOCK_PACKET) [ 99.369305][ T5807] IPVS: starting estimator thread 0... [ 99.503348][ T6331] IPVS: using max 22 ests per chain, 52800 per kthread [ 99.758615][ T6341] loop0: detected capacity change from 0 to 256 [ 99.842001][ T6341] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011a39, chksum : 0x14e42e2d, utbl_chksum : 0xe619d30d) [ 101.011770][ T64] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.217462][ T64] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.345632][ T64] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.486202][ T64] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.456560][ T5087] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 102.466648][ T5087] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 102.483406][ T5087] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.492077][ T5087] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.500360][ T5087] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 102.513348][ T5087] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.563309][ T5773] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 102.613296][ T6421] netlink: 24 bytes leftover after parsing attributes in process `syz.4.136'. [ 102.813385][ T5773] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 102.844748][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.868521][ T5773] usb 3-1: config 0 descriptor?? [ 103.361056][ T6416] chnl_net:caif_netlink_parms(): no params data found [ 103.913500][ T64] hsr_slave_0: left promiscuous mode [ 103.930740][ T64] hsr_slave_1: left promiscuous mode [ 103.951057][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.968452][ T64] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.997272][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.019993][ T64] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.053947][ T64] bridge_slave_1: left allmulticast mode [ 104.059655][ T64] bridge_slave_1: left promiscuous mode [ 104.086997][ T64] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.138220][ T64] bridge_slave_0: left allmulticast mode [ 104.151000][ T64] bridge_slave_0: left promiscuous mode [ 104.170041][ T64] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.307094][ T64] veth1_macvtap: left promiscuous mode [ 104.323323][ T64] veth0_macvtap: left promiscuous mode [ 104.326886][ T5773] usb 3-1: Cannot set autoneg [ 104.342389][ T64] veth1_vlan: left promiscuous mode [ 104.348221][ T5773] MOSCHIP usb-ethernet driver: probe of 3-1:0.0 failed with error -71 [ 104.358167][ T64] veth0_vlan: left promiscuous mode [ 104.379717][ T5773] usb 3-1: USB disconnect, device number 4 [ 104.553494][ T5782] Bluetooth: hci0: command tx timeout [ 104.614837][ T6477] loop4: detected capacity change from 0 to 512 [ 104.654169][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 104.698760][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 104.725997][ T6477] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 104.736331][ T6477] EXT4-fs error (device loop4): ext4_iget_extra_inode:4740: inode #15: comm syz.4.149: corrupted in-inode xattr: invalid ea_ino [ 104.757753][ T6477] EXT4-fs error (device loop4): ext4_orphan_get:1409: comm syz.4.149: couldn't read orphan inode 15 (err -117) [ 104.771747][ T6477] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.846418][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 104.865498][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 104.939596][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 104.952901][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 104.990734][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 105.008992][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 105.034048][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 105.046958][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 105.062132][ T6477] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.149: Unrecognised inode hash code 255 [ 105.073630][ T6477] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.149: Corrupt directory, running e2fsck is recommended [ 105.089080][ T6477] EXT4-fs error (device loop4): ext4_empty_dir:3145: inode #2: block 4: comm syz.4.149: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=131071, rec_len=65535, size=1024 fake=0 [ 105.140707][ T6007] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.233255][ T5826] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 105.447753][ T5826] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.471379][ T64] team0 (unregistering): Port device team_slave_1 removed [ 105.479540][ T5826] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.493360][ T5826] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 105.515394][ T5826] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 105.532463][ T5826] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.555386][ T5826] usb 3-1: config 0 descriptor?? [ 105.598739][ T64] team0 (unregistering): Port device team_slave_0 removed [ 105.651384][ T64] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 105.739118][ T64] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.015033][ T5826] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 106.076028][ T5826] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 106.276267][ T64] bond0 (unregistering): Released all slaves [ 106.439311][ T6491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.445951][ T6472] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 106.449517][ T6491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.471332][ T6472] batman_adv: batadv0: Adding interface: gretap1 [ 106.495956][ T6472] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.521865][ T6472] batman_adv: batadv0: Interface activated: gretap1 [ 106.633311][ T5782] Bluetooth: hci0: command tx timeout [ 106.688429][ T6416] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.697279][ T6416] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.707117][ T6416] bridge_slave_0: entered allmulticast mode [ 106.728714][ T6416] bridge_slave_0: entered promiscuous mode [ 106.738582][ T6416] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.768024][ T6416] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.785118][ T6416] bridge_slave_1: entered allmulticast mode [ 106.816783][ T6416] bridge_slave_1: entered promiscuous mode [ 106.924610][ T6416] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.947610][ T6416] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.031458][ T6416] team0: Port device team_slave_0 added [ 107.056677][ T6416] team0: Port device team_slave_1 added [ 107.173442][ T6416] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 107.187423][ T6416] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.238885][ T6416] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 107.277772][ T6416] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.303203][ T6416] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.368466][ T6416] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.559490][ T6416] hsr_slave_0: entered promiscuous mode [ 107.571510][ T6416] hsr_slave_1: entered promiscuous mode [ 107.871293][ T6533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.160'. [ 108.195661][ T5778] usb 3-1: USB disconnect, device number 5 [ 108.458115][ T6416] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 108.492453][ T6416] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 108.542899][ T6416] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 108.577252][ T6416] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 108.713249][ T5782] Bluetooth: hci0: command tx timeout [ 108.829832][ T6557] netlink: 'syz.4.165': attribute type 1 has an invalid length. [ 109.088750][ T6416] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.122242][ T6416] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.171710][ T6376] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.178933][ T6376] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.209713][ T6376] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.216940][ T6376] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.321122][ T6416] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 109.683193][ T6416] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.301071][ T6416] veth0_vlan: entered promiscuous mode [ 110.342000][ T6416] veth1_vlan: entered promiscuous mode [ 110.621234][ T6416] veth0_macvtap: entered promiscuous mode [ 110.656789][ T6416] veth1_macvtap: entered promiscuous mode [ 110.719447][ T6416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.744434][ T6416] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.774658][ T6416] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.796278][ T5782] Bluetooth: hci0: command tx timeout [ 110.800162][ T6618] netlink: 4 bytes leftover after parsing attributes in process `syz.4.174'. [ 110.826475][ T6416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.843449][ T6416] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.866163][ T6416] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.927593][ T6416] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.956027][ T6416] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.979296][ T6416] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.994351][ T6416] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.145322][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.161486][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.261851][ T3518] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.272282][ T3518] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.473681][ T6636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.177'. [ 111.593333][ T5826] IPVS: starting estimator thread 0... [ 111.655149][ T6636] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 111.723369][ T6642] IPVS: using max 18 ests per chain, 43200 per kthread [ 111.734637][ T6645] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 112.896015][ T6682] loop5: detected capacity change from 0 to 1024 [ 112.944005][ T6682] EXT4-fs: Ignoring removed nomblk_io_submit option [ 112.957759][ T6682] EXT4-fs: Ignoring removed bh option [ 113.025246][ T6682] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a00ec01c, mo2=0002] [ 113.065646][ T6682] System zones: 0-1, 3-12 [ 113.120027][ T6682] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 113.394197][ T6703] loop3: detected capacity change from 0 to 512 [ 113.426582][ T6703] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 113.462695][ T6703] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 113.484831][ T6703] EXT4-fs (loop3): orphan cleanup on readonly fs [ 113.499511][ T6703] EXT4-fs error (device loop3): ext4_orphan_get:1430: comm syz.3.191: bad orphan inode 3 [ 113.511152][ T6703] EXT4-fs (loop3): Remounting filesystem read-only [ 113.521869][ T6703] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 113.588970][ T6703] EXT4-fs warning (device loop3): dx_probe:893: inode #2: comm syz.3.191: dx entry: limit 0 != root limit 125 [ 113.631655][ T6703] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.191: Corrupt directory, running e2fsck is recommended [ 113.667137][ T6703] EXT4-fs warning (device loop3): dx_probe:893: inode #2: comm syz.3.191: dx entry: limit 0 != root limit 125 [ 113.680237][ T6703] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.191: Corrupt directory, running e2fsck is recommended [ 113.710185][ T6703] EXT4-fs warning (device loop3): dx_probe:893: inode #2: comm syz.3.191: dx entry: limit 0 != root limit 125 [ 113.736381][ T6703] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.191: Corrupt directory, running e2fsck is recommended [ 113.755744][ T6703] EXT4-fs warning (device loop3): dx_probe:893: inode #2: comm syz.3.191: dx entry: limit 0 != root limit 125 [ 113.782338][ T6703] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.191: Corrupt directory, running e2fsck is recommended [ 113.835293][ T6703] EXT4-fs warning (device loop3): dx_probe:893: inode #2: comm syz.3.191: dx entry: limit 0 != root limit 125 [ 113.878710][ T6416] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.887799][ T6703] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.191: Corrupt directory, running e2fsck is recommended [ 114.026456][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 114.919076][ T6748] nvme_fabrics: missing parameter 'transport=%s' [ 114.933268][ T6748] nvme_fabrics: missing parameter 'nqn=%s' [ 115.499972][ T5778] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 115.733358][ T5778] usb 3-1: Using ep0 maxpacket: 16 [ 115.740219][ T5778] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 115.763263][ T5778] usb 3-1: config 0 has no interface number 0 [ 115.783576][ T5778] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 115.823255][ T5778] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 115.846582][ T5778] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 115.861217][ T5778] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 115.883152][ T5778] usb 3-1: Product: syz [ 115.887351][ T5778] usb 3-1: SerialNumber: syz [ 115.932533][ T5778] usb 3-1: config 0 descriptor?? [ 115.965016][ T5778] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 116.011220][ T5778] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input6 [ 116.269191][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 117.099400][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.113218][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.121179][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.128390][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.135568][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.142742][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.149950][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.157176][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.164490][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.171688][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 117.194075][ T28] usb 3-1: USB disconnect, device number 6 [ 117.199979][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 117.233353][ T28] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 117.823992][ T5809] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 118.021669][ T6840] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 118.032769][ T6840] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 118.044280][ T5809] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 118.053479][ T5809] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.073611][ T5809] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 118.095457][ T5809] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.119605][ T5809] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 118.133181][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 118.141540][ T5809] usb 5-1: Product: syz [ 118.149344][ T5809] usb 5-1: Manufacturer: syz [ 118.207961][ T5809] cdc_wdm 5-1:1.0: skipping garbage [ 118.218007][ T5809] cdc_wdm 5-1:1.0: skipping garbage [ 118.262499][ T5809] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 118.269440][ T5809] cdc_wdm 5-1:1.0: Unknown control protocol [ 118.342577][ T6851] 8021q: adding VLAN 0 to HW filter on device bond2 [ 118.399654][ T6851] gretap1: entered promiscuous mode [ 118.421367][ T28] usb 5-1: USB disconnect, device number 2 [ 118.430240][ T6851] bond2: (slave gretap1): making interface the new active one [ 118.448602][ T6851] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 119.003225][ T28] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 119.196337][ T28] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 119.211143][ T28] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.227615][ T28] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 119.239712][ T28] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.254688][ T28] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 119.264945][ T28] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 119.284824][ T28] usb 5-1: Product: syz [ 119.289175][ T28] usb 5-1: Manufacturer: syz [ 119.344202][ T28] cdc_wdm 5-1:1.0: skipping garbage [ 119.349470][ T28] cdc_wdm 5-1:1.0: skipping garbage [ 119.370610][ T28] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 119.389908][ T28] cdc_wdm 5-1:1.0: Unknown control protocol [ 121.324443][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.331369][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.343243][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.349904][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.356555][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.363202][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.369541][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.376180][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.383169][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.389809][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.396239][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.402885][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.409249][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.415906][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.422251][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.428990][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.435973][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.442620][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.448937][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 121.455577][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 121.483461][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 121.492239][ T28] usb 5-1: USB disconnect, device number 3 [ 121.908789][ T6963] netlink: 4 bytes leftover after parsing attributes in process `syz.4.242'. [ 122.411435][ T6975] 8021q: adding VLAN 0 to HW filter on device bond1 [ 122.471260][ T6979] gretap1: entered promiscuous mode [ 122.488509][ T6979] bond1: (slave gretap1): making interface the new active one [ 122.497845][ T6979] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 123.777840][ T7015] netlink: 'syz.5.264': attribute type 5 has an invalid length. [ 123.955894][ T7018] tipc: Failed to remove unknown binding: 66,0,0/0:1450958342/1450958343 [ 124.128708][ T7024] netlink: 24 bytes leftover after parsing attributes in process `syz.2.259'. [ 124.529794][ T7039] loop4: detected capacity change from 0 to 512 [ 124.625346][ T7039] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 124.739957][ T7039] EXT4-fs error (device loop4): ext4_validate_block_bitmap:421: comm syz.4.265: bg 0: bad block bitmap checksum [ 124.769363][ T5760] udevd[5760]: incorrect ext4 checksum on /dev/loop4 [ 124.858125][ T6007] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.123938][ T7052] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.269'. [ 125.133913][ T7052] openvswitch: netlink: Geneve option length err (len 3060, max 255). [ 125.281126][ T7054] loop4: detected capacity change from 0 to 2048 [ 125.352947][ T7054] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 125.594257][ T7054] EXT4-fs error (device loop4): __ext4_get_inode_loc:4497: comm syz.4.278: Invalid inode table block 10568646295092588463 in block_group 0 [ 125.721797][ T6007] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.898926][ T7062] netlink: 'syz.2.273': attribute type 1 has an invalid length. [ 125.959668][ T7062] bond3: entered promiscuous mode [ 125.967253][ T7062] 8021q: adding VLAN 0 to HW filter on device bond3 [ 126.079239][ T7072] Bluetooth: MGMT ver 1.22 [ 126.101026][ T7072] loop5: detected capacity change from 0 to 1024 [ 126.110115][ T7062] 8021q: adding VLAN 0 to HW filter on device bond3 [ 126.119706][ T7062] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 126.134393][ T7062] bond3: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 126.152054][ T7072] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 126.158244][ T7062] bond3: (slave ip6gre1): making interface the new active one [ 126.173299][ T7062] ip6gre1: entered promiscuous mode [ 126.180600][ T7062] bond3: (slave ip6gre1): Enslaving as an active interface with an up link [ 126.187910][ T5087] Bluetooth: hci0: unexpected event for opcode 0x1003 [ 126.271875][ T6416] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 126.675464][ T7085] loop4: detected capacity change from 0 to 1764 [ 127.882547][ T7101] trusted_key: syz.2.285 sent an empty control message without MSG_MORE. [ 128.153610][ T5782] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 128.363287][ T5773] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 128.564236][ T5773] usb 3-1: not running at top speed; connect to a high speed hub [ 128.573201][ T5773] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.583471][ T5773] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 128.592398][ T5773] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 128.601948][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.610100][ T173] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 128.636872][ T5773] gspca_main: spca501-2.14.0 probing 0000:0000 [ 128.833355][ T173] usb 6-1: Using ep0 maxpacket: 16 [ 128.841057][ T173] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 128.849637][ T173] usb 6-1: config 0 has no interface number 0 [ 128.861384][ T5773] gspca_spca501: reg write: error -71 [ 128.867820][ T173] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 128.883245][ T5773] spca501 3-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 128.900481][ T5773] spca501: probe of 3-1:1.0 failed with error -22 [ 128.907290][ T173] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 128.923639][ T5773] usb 3-1: Found UVC 49.30 device (0000:0000) [ 128.930670][ T5773] usb 3-1: No valid video chain found. [ 128.946060][ T173] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 128.951795][ T7130] netlink: 156 bytes leftover after parsing attributes in process `syz.4.295'. [ 128.962760][ T5773] usb 3-1: USB disconnect, device number 7 [ 128.970219][ T173] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 128.983918][ T173] usb 6-1: Product: syz [ 128.988129][ T173] usb 6-1: SerialNumber: syz [ 128.998376][ T173] usb 6-1: config 0 descriptor?? [ 129.008349][ T7130] netlink: 20 bytes leftover after parsing attributes in process `syz.4.295'. [ 129.029494][ T173] cm109 6-1:0.8: invalid payload size 0, expected 4 [ 129.044288][ T173] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input7 [ 129.272798][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 130.052276][ C1] cm109_urb_ctl_callback: 72 callbacks suppressed [ 130.052300][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 130.052560][ T5808] usb 6-1: USB disconnect, device number 2 [ 130.058770][ C1] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 130.111713][ T5808] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 130.235580][ T5782] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 130.244998][ T5782] Bluetooth: hci0: Injecting HCI hardware error event [ 130.253761][ T5087] Bluetooth: hci0: hardware error 0x00 [ 130.283153][ T28] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 130.465640][ T28] usb 5-1: unable to get BOS descriptor or descriptor too short [ 130.476506][ T28] usb 5-1: not running at top speed; connect to a high speed hub [ 130.492820][ T28] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 130.518531][ T28] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 130.534831][ T28] usb 5-1: New USB device found, idVendor=0bda, idProduct=4014, bcdDevice= 0.40 [ 130.544306][ T28] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.546299][ T7156] loop2: detected capacity change from 0 to 1024 [ 130.552310][ T28] usb 5-1: Product: syz [ 130.552335][ T28] usb 5-1: Manufacturer: syz [ 130.552349][ T28] usb 5-1: SerialNumber: syz [ 130.787491][ T28] usb 5-1: 0:2 : does not exist [ 130.792902][ T28] usb 5-1: unit 6 not found! [ 130.820080][ T7156] hfsplus: b-tree write err: -5, ino 8 [ 130.837651][ T7159] hfsplus: b-tree write err: -5, ino 8 [ 130.890251][ T28] usb 5-1: USB disconnect, device number 4 [ 130.917835][ T1145] hfsplus: b-tree write err: -5, ino 8 [ 130.957930][ T5760] udevd[5760]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 131.117768][ T7163] bridge0: port 3(wlan1) entered blocking state [ 131.125142][ T7163] bridge0: port 3(wlan1) entered disabled state [ 131.131622][ T7163] mac80211_hwsim hwsim13 wlan1: entered allmulticast mode [ 131.149666][ T7163] mac80211_hwsim hwsim13 wlan1: entered promiscuous mode [ 131.161687][ T7163] bridge0: port 3(wlan1) entered blocking state [ 131.168151][ T7163] bridge0: port 3(wlan1) entered forwarding state [ 131.652081][ T7187] netlink: 12 bytes leftover after parsing attributes in process `syz.2.319'. [ 131.765664][ T3518] bridge0: port 3(wlan1) entered disabled state [ 132.181426][ T7203] sctp: [Deprecated]: syz.5.326 (pid 7203) Use of struct sctp_assoc_value in delayed_ack socket option. [ 132.181426][ T7203] Use struct sctp_sack_info instead [ 132.313392][ T5087] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 132.960904][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.967525][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.117357][ T5782] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 133.128626][ T5782] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 133.143269][ T5782] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 133.166520][ T5782] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 133.174786][ T5782] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 133.182156][ T5782] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 133.425795][ T5775] syz_tun (unregistering): left allmulticast mode [ 133.432317][ T5775] syz_tun (unregistering): left promiscuous mode [ 133.441259][ T5775] bridge0: port 3(syz_tun) entered disabled state [ 133.639260][ T7230] netlink: 55631 bytes leftover after parsing attributes in process `syz.5.333'. [ 133.951538][ T7212] chnl_net:caif_netlink_parms(): no params data found [ 134.071415][ T7212] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.078933][ T7212] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.086667][ T7212] bridge_slave_0: entered allmulticast mode [ 134.093807][ T7212] bridge_slave_0: entered promiscuous mode [ 134.101657][ T7212] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.109001][ T7212] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.116369][ T7212] bridge_slave_1: entered allmulticast mode [ 134.125182][ T7212] bridge_slave_1: entered promiscuous mode [ 134.225457][ T7212] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 134.238751][ T7212] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 134.341654][ T7212] team0: Port device team_slave_0 added [ 134.368071][ T7212] team0: Port device team_slave_1 added [ 134.486573][ T7212] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 134.494103][ T7212] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.531329][ T7212] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 134.572424][ T7212] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 134.579704][ T7212] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.608043][ T7212] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.703368][ T7212] hsr_slave_0: entered promiscuous mode [ 134.710266][ T7212] hsr_slave_1: entered promiscuous mode [ 134.717067][ T7212] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 134.724865][ T7212] Cannot create hsr debugfs directory [ 134.955194][ T3518] batman_adv: batadv0: Interface deactivated: gretap1 [ 135.004921][ T3518] batman_adv: batadv0: Removing interface: gretap1 [ 135.120594][ T7212] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 135.132102][ T7212] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 135.146532][ T7212] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 135.158354][ T7212] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 135.273255][ T5782] Bluetooth: hci4: command tx timeout [ 135.339721][ T3518] hsr_slave_0: left promiscuous mode [ 135.354694][ T3518] hsr_slave_1: left promiscuous mode [ 135.360965][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.377190][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 135.388376][ T3518] bridge_slave_1: left allmulticast mode [ 135.396369][ T3518] bridge_slave_1: left promiscuous mode [ 135.402725][ T3518] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.420986][ T3518] bridge_slave_0: left allmulticast mode [ 135.428053][ T3518] bridge_slave_0: left promiscuous mode [ 135.439460][ T3518] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.045844][ T3518] team0 (unregistering): Port device team_slave_1 removed [ 136.085666][ T3518] team0 (unregistering): Port device team_slave_0 removed [ 136.129630][ T3518] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 136.178491][ T3518] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 136.447640][ T3518] bond0 (unregistering): Released all slaves [ 136.573172][ T7212] 8021q: adding VLAN 0 to HW filter on device bond0 [ 136.597942][ T7212] 8021q: adding VLAN 0 to HW filter on device team0 [ 136.619131][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 136.626409][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 136.655499][ T6266] bridge0: port 2(bridge_slave_1) entered blocking state [ 136.662652][ T6266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 136.945778][ T3518] IPVS: stop unused estimator thread 0... [ 137.051341][ T7212] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 137.337276][ T7212] veth0_vlan: entered promiscuous mode [ 137.354867][ T5782] Bluetooth: hci4: command tx timeout [ 137.369334][ T7212] veth1_vlan: entered promiscuous mode [ 137.407812][ T7212] veth0_macvtap: entered promiscuous mode [ 137.429837][ T7212] veth1_macvtap: entered promiscuous mode [ 137.459967][ T7212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 137.482147][ T7212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.492534][ T7212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 137.507538][ T7212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.520793][ T7212] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 137.541597][ T7212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.557848][ T7212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.569372][ T7212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.583079][ T7212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.606298][ T7212] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.627229][ T7212] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.639495][ T7212] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.650939][ T7212] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.664869][ T7212] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.773217][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.784358][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.818534][ T6266] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.828164][ T6266] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.433331][ T5782] Bluetooth: hci4: command tx timeout [ 139.603321][ T5807] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 139.795891][ T5807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 139.841025][ T5807] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 139.867176][ T5807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.901226][ T5807] usb 5-1: config 0 descriptor?? [ 140.157607][ T7404] Illegal XDP return value 4291411968 on prog (id 50) dev syz_tun, expect packet loss! [ 140.176763][ T5807] usbhid 5-1:0.0: can't add hid device: -71 [ 140.182801][ T5807] usbhid: probe of 5-1:0.0 failed with error -71 [ 140.227514][ T5807] usb 5-1: USB disconnect, device number 5 [ 140.402037][ T5826] IPVS: starting estimator thread 0... [ 140.513180][ T7417] IPVS: using max 21 ests per chain, 50400 per kthread [ 140.763145][ T5807] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 140.832532][ T7428] netlink: 'syz.6.357': attribute type 1 has an invalid length. [ 140.913724][ T7407] loop2: detected capacity change from 0 to 32768 [ 140.934182][ T7407] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.353 (7407) [ 140.993628][ T7407] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 141.021662][ T5807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 141.035806][ T7407] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 141.045654][ T5807] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 141.063440][ T7407] BTRFS info (device loop2): turning on sync discard [ 141.089019][ T5807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.098123][ T7407] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 141.120458][ T5807] usb 5-1: config 0 descriptor?? [ 141.130240][ T7407] BTRFS info (device loop2): use zstd compression, level 3 [ 141.156990][ T7407] BTRFS info (device loop2): turning on async discard [ 141.175027][ T7407] BTRFS warning (device loop2): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 141.187164][ T7407] BTRFS info (device loop2): trying to use backup root at mount time [ 141.201480][ T7407] BTRFS info (device loop2): enabling auto defrag [ 141.230557][ T7407] BTRFS info (device loop2): turning on flush-on-commit [ 141.258192][ T7407] BTRFS info (device loop2): using free space tree [ 141.401162][ T6266] BTRFS warning (device loop2): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 141.434784][ T7407] BTRFS error (device loop2): failed to load root extent [ 141.439482][ T7453] loop5: detected capacity change from 0 to 128 [ 141.469347][ T7407] BTRFS warning (device loop2): try to load backup roots slot 1 [ 141.494506][ T64] BTRFS warning (device loop2): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 141.519104][ T5782] Bluetooth: hci4: command tx timeout [ 141.559900][ T7407] BTRFS warning (device loop2): couldn't read tree root [ 141.615191][ T7407] BTRFS warning (device loop2): try to load backup roots slot 2 [ 141.645408][ T3441] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 141.675805][ T7407] BTRFS warning (device loop2): couldn't read tree root [ 141.684569][ T7453] syz.5.359: attempt to access beyond end of device [ 141.684569][ T7453] loop5: rw=2049, sector=138, nr_sectors = 16 limit=128 [ 141.693174][ T7407] BTRFS warning (device loop2): try to load backup roots slot 3 [ 141.749549][ T7407] BTRFS info (device loop2): enabling ssd optimizations [ 141.769827][ T7407] BTRFS info (device loop2): rebuilding free space tree [ 141.811301][ T7455] syz.5.359: attempt to access beyond end of device [ 141.811301][ T7455] loop5: rw=2049, sector=170, nr_sectors = 22 limit=128 [ 141.868952][ T7407] BTRFS info (device loop2): checking UUID tree [ 141.973341][ T5807] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 141.982174][ T5807] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input8 [ 142.027160][ T7407] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 142.260745][ T28] usb 5-1: USB disconnect, device number 6 [ 142.260814][ C0] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 142.422561][ T7478] io-wq is not configured for unbound workers [ 143.265329][ T7503] fuse: Bad value for 'fd' [ 143.514826][ T27] audit: type=1326 audit(1787848935.326:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 143.611711][ T27] audit: type=1326 audit(1787848935.366:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 143.683360][ T27] audit: type=1326 audit(1787848935.366:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f42a579cf47 code=0x7ffc0000 [ 143.803230][ T27] audit: type=1326 audit(1787848935.366:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 143.888905][ T27] audit: type=1326 audit(1787848935.366:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 143.939065][ T7518] bridge0: port 3(wlan1) entered blocking state [ 143.967628][ T27] audit: type=1326 audit(1787848935.376:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 143.993630][ T7518] bridge0: port 3(wlan1) entered disabled state [ 144.000149][ T7518] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 144.029996][ T27] audit: type=1326 audit(1787848935.376:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 144.046595][ T7518] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 144.146442][ T27] audit: type=1326 audit(1787848935.376:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=429 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 144.205121][ T27] audit: type=1326 audit(1787848935.376:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 144.280439][ T27] audit: type=1326 audit(1787848935.376:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7508 comm="syz.2.372" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=161 compat=0 ip=0x7f42a579e0d9 code=0x7ffc0000 [ 147.176913][ T7542] netlink: 4 bytes leftover after parsing attributes in process `syz.2.380'. [ 147.210317][ T7542] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.214110][ T5826] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 147.219806][ T7542] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.235926][ T7542] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.244677][ T7542] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.414878][ T5826] usb 5-1: Using ep0 maxpacket: 32 [ 147.429135][ T5826] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 147.437622][ T5826] usb 5-1: config 2 has no interface number 0 [ 147.452115][ T5826] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 147.524348][ T5826] usb 5-1: config 2 interface 88 has no altsetting 0 [ 147.575114][ T5826] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 147.606496][ T5826] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 147.633807][ T5826] usb 5-1: Product: syz [ 147.642735][ T5826] usb 5-1: Manufacturer: syz [ 147.699827][ T5826] usb 5-1: SerialNumber: syz [ 147.770508][ T7534] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 148.035515][ T7534] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 148.614177][ T7587] capability: warning: `syz.5.388' uses 32-bit capabilities (legacy support in use) [ 149.089707][ T5826] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 149.123456][ T5826] asix: probe of 5-1:2.88 failed with error -71 [ 149.143361][ T5826] usb 5-1: USB disconnect, device number 7 [ 150.019131][ T7628] loop6: detected capacity change from 0 to 2048 [ 150.147964][ T7614] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.156928][ T7614] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.323671][ T5809] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 150.524873][ T5809] usb 7-1: config index 0 descriptor too short (expected 17742, got 18) [ 150.534830][ T5809] usb 7-1: config 231 has too many interfaces: 138, using maximum allowed: 32 [ 150.544338][ T5809] usb 7-1: config 231 has an invalid descriptor of length 212, skipping remainder of the config [ 150.556395][ T5809] usb 7-1: config 231 has 0 interfaces, different from the descriptor's value: 138 [ 150.566690][ T5809] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 150.576868][ T5809] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.607062][ T7614] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 150.645859][ T7614] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 150.815142][ T5809] usb 7-1: string descriptor 0 read error: -22 [ 150.970055][ T7614] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.979080][ T7614] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.988237][ T7614] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.997226][ T7614] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.025687][ T5924] usb 7-1: USB disconnect, device number 2 [ 151.395679][ T7649] netlink: 'syz.4.406': attribute type 1 has an invalid length. [ 151.786219][ T7663] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 152.436354][ T7684] loop4: detected capacity change from 0 to 512 [ 152.473022][ T7684] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 152.498672][ T7686] fuse: Bad value for 'fd' [ 152.527594][ T7684] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 152.596429][ T7684] EXT4-fs (loop4): 1 truncate cleaned up [ 152.616281][ T7684] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 152.841241][ T6007] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.244132][ T27] kauditd_printk_skb: 8 callbacks suppressed [ 153.244141][ T27] audit: type=1326 audit(1787848945.066:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.299734][ T27] audit: type=1326 audit(1787848945.096:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.334012][ T5808] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 153.342942][ T27] audit: type=1326 audit(1787848945.096:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=163 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.368324][ T27] audit: type=1326 audit(1787848945.096:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.399903][ T27] audit: type=1326 audit(1787848945.096:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=68 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.427314][ T27] audit: type=1326 audit(1787848945.096:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.498102][ T27] audit: type=1326 audit(1787848945.096:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.549080][ T5808] usb 5-1: Using ep0 maxpacket: 16 [ 153.583603][ T5808] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 153.610923][ T5808] usb 5-1: config 0 has no interface number 0 [ 153.625623][ T27] audit: type=1326 audit(1787848945.106:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=121 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.652677][ T5808] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 153.674701][ T5808] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 153.693576][ T27] audit: type=1326 audit(1787848945.106:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.764815][ T5808] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 153.802624][ T5808] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 153.811226][ T27] audit: type=1326 audit(1787848945.106:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7716 comm="syz.6.420" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 153.853185][ T5808] usb 5-1: Product: syz [ 153.863680][ T5808] usb 5-1: SerialNumber: syz [ 153.870915][ T5808] usb 5-1: config 0 descriptor?? [ 153.886967][ T5808] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 153.903451][ T5808] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input9 [ 154.170253][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 154.936998][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 154.948654][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 154.960935][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 154.968455][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 154.975924][ T5778] usb 5-1: USB disconnect, device number 8 [ 154.981861][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 154.981893][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 155.024062][ T5778] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 156.438196][ T7779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.433'. [ 156.790541][ T7790] overlayfs: failed to clone upperpath [ 156.838278][ T7775] loop6: detected capacity change from 0 to 32768 [ 156.861607][ T7775] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 scanned by syz.6.430 (7775) [ 156.935039][ T7775] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 156.948079][ T7775] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 156.979371][ T7775] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 157.003269][ T7775] BTRFS info (device loop6): use zstd compression, level 3 [ 157.028601][ T7775] BTRFS info (device loop6): using free space tree [ 157.138469][ T7775] BTRFS info (device loop6): enabling ssd optimizations [ 157.170381][ T7775] BTRFS info (device loop6): auto enabling async discard [ 157.763186][ T5924] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 158.115348][ T7833] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 158.342167][ T5924] usb 7-1: unable to get BOS descriptor or descriptor too short [ 158.396197][ T5924] usb 7-1: no configurations [ 158.404574][ T5924] usb 7-1: can't read configurations, error -22 [ 158.588961][ T7843] netlink: 8 bytes leftover after parsing attributes in process `syz.5.450'. [ 158.626898][ T7843] netlink: 4 bytes leftover after parsing attributes in process `syz.5.450'. [ 158.654403][ T7843] netlink: 'syz.5.450': attribute type 15 has an invalid length. [ 158.753979][ T7843] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 158.762761][ T7843] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 158.771459][ T7843] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 158.780276][ T7843] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 158.796010][ T7843] netlink: 8 bytes leftover after parsing attributes in process `syz.5.450'. [ 158.807165][ T7843] netlink: 4 bytes leftover after parsing attributes in process `syz.5.450'. [ 158.824144][ T7843] netlink: 'syz.5.450': attribute type 15 has an invalid length. [ 158.844489][ T7843] netdevsim netdevsim5 netdevsim0: set [0, 1] type 1 family 0 port 60387 - 0 [ 158.854077][ T7843] netdevsim netdevsim5 netdevsim1: set [0, 1] type 1 family 0 port 60387 - 0 [ 158.862902][ T7843] netdevsim netdevsim5 netdevsim2: set [0, 1] type 1 family 0 port 60387 - 0 [ 158.871978][ T7843] netdevsim netdevsim5 netdevsim3: set [0, 1] type 1 family 0 port 60387 - 0 [ 158.915079][ T7212] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 161.840382][ T27] kauditd_printk_skb: 12 callbacks suppressed [ 161.840396][ T27] audit: type=1326 audit(1787848953.656:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f92d8797e57 code=0x50000 [ 161.934320][ T27] audit: type=1326 audit(1787848953.656:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f92d873f459 code=0x50000 [ 162.012408][ T27] audit: type=1326 audit(1787848953.656:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f92d873f51d code=0x50000 [ 162.061209][ T27] audit: type=1326 audit(1787848953.656:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.090603][ T27] audit: type=1326 audit(1787848953.656:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.229827][ T27] audit: type=1326 audit(1787848953.656:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.283295][ T27] audit: type=1326 audit(1787848953.656:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.370329][ T27] audit: type=1326 audit(1787848953.656:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.433700][ T27] audit: type=1326 audit(1787848953.656:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.484059][ T5924] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 162.499946][ T27] audit: type=1326 audit(1787848953.656:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7861 comm="syz.4.457" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x50000 [ 162.713290][ T5924] usb 7-1: Using ep0 maxpacket: 32 [ 162.720437][ T5924] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 162.729113][ T5924] usb 7-1: config 0 has no interface number 0 [ 162.767202][ T5924] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 162.833128][ T5924] usb 7-1: config 0 interface 85 has no altsetting 0 [ 162.849623][ T5924] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 162.868252][ T5924] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.893728][ T5924] usb 7-1: Product: syz [ 162.908208][ T5924] usb 7-1: Manufacturer: syz [ 162.912869][ T5924] usb 7-1: SerialNumber: syz [ 162.955363][ T5924] usb 7-1: config 0 descriptor?? [ 162.998569][ T7902] fuse: Bad value for 'fd' [ 163.366049][ T7912] loop4: detected capacity change from 0 to 256 [ 163.581137][ T5924] appletouch 7-1:0.85: Geyser mode initialized. [ 163.601039][ T5924] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.85/input/input10 [ 164.052430][ T7925] netlink: 4 bytes leftover after parsing attributes in process `syz.5.481'. [ 164.131978][ T7925] hsr_slave_1 (unregistering): left promiscuous mode [ 164.300225][ T5924] usb 7-1: USB disconnect, device number 5 [ 164.366767][ T5924] appletouch 7-1:0.85: input: appletouch disconnected [ 164.624533][ T7941] netlink: 4 bytes leftover after parsing attributes in process `syz.5.485'. [ 164.725095][ T7946] gretap2: entered promiscuous mode [ 165.710372][ T7968] netlink: 12 bytes leftover after parsing attributes in process `syz.5.495'. [ 165.749671][ T7968] netdevsim netdevsim5 netdevsim0: set [0, 2] type 1 family 0 port 8472 - 0 [ 165.759000][ T7968] netdevsim netdevsim5 netdevsim1: set [0, 2] type 1 family 0 port 8472 - 0 [ 165.767789][ T7968] netdevsim netdevsim5 netdevsim2: set [0, 2] type 1 family 0 port 8472 - 0 [ 165.776615][ T7968] netdevsim netdevsim5 netdevsim3: set [0, 2] type 1 family 0 port 8472 - 0 [ 165.802400][ T7968] netlink: 12 bytes leftover after parsing attributes in process `syz.5.495'. [ 166.204588][ T7982] syzkaller1: entered promiscuous mode [ 166.220376][ T7982] syzkaller1: entered allmulticast mode [ 166.441740][ T7990] netlink: 'syz.4.505': attribute type 1 has an invalid length. [ 166.512668][ T7990] 8021q: adding VLAN 0 to HW filter on device bond2 [ 166.528091][ T7993] bond2: (slave gretap2): Enslaving as a backup interface with an up link [ 166.627827][ T6376] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 166.772487][ T7985] loop6: detected capacity change from 0 to 32768 [ 166.791859][ T7985] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz.6.503 (7985) [ 166.853662][ T7985] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 166.893808][ T7985] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 166.902576][ T7985] BTRFS info (device loop6): turning on sync discard [ 166.933464][ T7985] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 166.963166][ T7985] BTRFS info (device loop6): use zstd compression, level 3 [ 166.993277][ T7985] BTRFS info (device loop6): turning on async discard [ 167.000109][ T7985] BTRFS warning (device loop6): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 167.033982][ T7985] BTRFS info (device loop6): trying to use backup root at mount time [ 167.042125][ T7985] BTRFS info (device loop6): enabling auto defrag [ 167.088457][ T7985] BTRFS info (device loop6): turning on flush-on-commit [ 167.101364][ T7985] BTRFS info (device loop6): using free space tree [ 167.153154][ T27] kauditd_printk_skb: 57 callbacks suppressed [ 167.153169][ T27] audit: type=1326 audit(1787848958.956:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8008 comm="syz.2.508" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x0 [ 167.256673][ T6376] BTRFS warning (device loop6): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 167.313428][ T7985] BTRFS error (device loop6): failed to load root extent [ 167.323962][ T7985] BTRFS warning (device loop6): try to load backup roots slot 1 [ 167.371072][ T6376] BTRFS warning (device loop6): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 167.424485][ T7985] BTRFS warning (device loop6): couldn't read tree root [ 167.431490][ T7985] BTRFS warning (device loop6): try to load backup roots slot 2 [ 167.459751][ T7990] bond2 (unregistering): (slave gretap2): Removing an active aggregator [ 167.471223][ T6375] BTRFS error (device loop6): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 167.521403][ T7990] bond2 (unregistering): (slave gretap2): Releasing backup interface [ 167.523219][ T7985] BTRFS warning (device loop6): couldn't read tree root [ 167.557118][ T7985] BTRFS warning (device loop6): try to load backup roots slot 3 [ 167.581050][ T7990] bond2 (unregistering): Released all slaves [ 167.619481][ T7985] BTRFS info (device loop6): enabling ssd optimizations [ 167.650082][ T7985] BTRFS info (device loop6): rebuilding free space tree [ 167.714822][ T8031] IPVS: Scheduler module ip_vs_sip not found [ 167.803882][ T7985] BTRFS info (device loop6): checking UUID tree [ 167.968105][ T7985] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 168.227658][ T8058] netlink: 2028 bytes leftover after parsing attributes in process `syz.2.515'. [ 168.249008][ T8058] netlink: 24 bytes leftover after parsing attributes in process `syz.2.515'. [ 168.777449][ T8080] netlink: 12 bytes leftover after parsing attributes in process `syz.5.521'. [ 168.824935][ T8080] netlink: 12 bytes leftover after parsing attributes in process `syz.5.521'. [ 169.041249][ T8092] loop5: detected capacity change from 0 to 1024 [ 169.163495][ T8092] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 169.212746][ T8092] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 169.293219][ T8092] EXT4-fs error (device loop5): ext4_free_blocks:6694: comm syz.5.524: Freeing blocks not in datazone - block = 0, count = 16 [ 169.370615][ T8092] EXT4-fs (loop5): Remounting filesystem read-only [ 169.388354][ T8111] loop4: detected capacity change from 0 to 256 [ 169.450851][ T8111] FAT-fs (loop4): bogus number of FAT sectors [ 169.489593][ T8111] FAT-fs (loop4): Can't find a valid FAT filesystem [ 169.535993][ T6416] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 171.399137][ T8189] netlink: 7 bytes leftover after parsing attributes in process `syz.4.551'. [ 171.844970][ T8202] netlink: 4 bytes leftover after parsing attributes in process `syz.4.553'. [ 172.100404][ T8206] tipc: Failed to remove unknown binding: 66,0,0/0:1361147982/1361147983 [ 172.674258][ T8224] gretap1: entered promiscuous mode [ 174.020805][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.569'. [ 174.057643][ T8254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.569'. [ 174.069765][ T8254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.569'. [ 177.771169][ T8311] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 178.680307][ T8353] fuse: root generation should be zero [ 178.902604][ T8369] loop4: detected capacity change from 0 to 256 [ 178.935399][ T8369] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 178.997009][ T8369] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 179.090586][ T27] audit: type=1800 audit(1787848970.906:114): pid=8369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.596" name="file0" dev="loop4" ino=1048623 res=0 errno=0 [ 179.128266][ T8376] netlink: 'syz.2.600': attribute type 1 has an invalid length. [ 179.241630][ T8376] 8021q: adding VLAN 0 to HW filter on device bond4 [ 179.370871][ T8378] bond4: (slave gretap3): Enslaving as a backup interface with an up link [ 179.816386][ T8381] bond4 (unregistering): (slave gretap3): Releasing backup interface [ 179.845008][ T8381] bond4 (unregistering): Released all slaves [ 181.117159][ T8425] dummy0: entered promiscuous mode [ 181.137598][ T8425] gretap0: entered promiscuous mode [ 181.146331][ T8425] hsr1: entered allmulticast mode [ 181.151427][ T8425] dummy0: entered allmulticast mode [ 181.160498][ T8425] gretap0: entered allmulticast mode [ 181.761287][ T8431] bridge_slave_0: left allmulticast mode [ 181.798064][ T8431] bridge_slave_0: left promiscuous mode [ 181.805743][ T8431] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.849284][ T8431] bridge_slave_1: left allmulticast mode [ 181.857270][ T8431] bridge_slave_1: left promiscuous mode [ 181.886629][ T8438] raw_sendmsg: syz.4.622 forgot to set AF_INET. Fix it! [ 181.886811][ T8431] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.938911][ T8431] bond0: (slave bond_slave_0): Releasing backup interface [ 182.011458][ T8431] bond0: (slave bond_slave_1): Releasing backup interface [ 182.092742][ T8431] team0: Port device team_slave_0 removed [ 182.172517][ T8431] team0: Port device team_slave_1 removed [ 182.188568][ T8431] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.217128][ T8431] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.257338][ T8431] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.269655][ T8431] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 182.310732][ T8435] netlink: 28 bytes leftover after parsing attributes in process `syz.6.620'. [ 182.379422][ T8452] netlink: 12 bytes leftover after parsing attributes in process `syz.2.628'. [ 182.437556][ T8460] capability: warning: `syz.5.629' uses deprecated v2 capabilities in a way that may be insecure [ 182.456450][ T8452] 8021q: adding VLAN 0 to HW filter on device bond4 [ 182.555695][ T8455] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 182.606723][ T8458] netlink: 'syz.2.628': attribute type 10 has an invalid length. [ 182.622207][ T8458] netlink: 40 bytes leftover after parsing attributes in process `syz.2.628'. [ 182.635915][ T8458] dummy0: entered promiscuous mode [ 182.643568][ T8458] bond4: (slave dummy0): Releasing backup interface [ 185.687069][ T8491] loop5: detected capacity change from 0 to 32768 [ 185.703205][ T8491] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.640 (8491) [ 185.818204][ T8491] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 185.860290][ T8491] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 185.903396][ T8491] BTRFS info (device loop5): turning on sync discard [ 185.910146][ T8491] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 185.954984][ T8491] BTRFS info (device loop5): use zstd compression, level 3 [ 185.962694][ T8491] BTRFS info (device loop5): turning on async discard [ 185.977083][ T8491] BTRFS warning (device loop5): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 185.994719][ T8491] BTRFS info (device loop5): trying to use backup root at mount time [ 186.015061][ T8491] BTRFS info (device loop5): enabling auto defrag [ 186.037100][ T8491] BTRFS info (device loop5): turning on flush-on-commit [ 186.053265][ T8491] BTRFS info (device loop5): using free space tree [ 186.159621][ T1145] BTRFS warning (device loop5): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 186.178581][ T8491] BTRFS error (device loop5): failed to load root extent [ 186.188637][ T8491] BTRFS warning (device loop5): try to load backup roots slot 1 [ 186.208785][ T1145] BTRFS warning (device loop5): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 186.237845][ T27] audit: type=1326 audit(1787848978.046:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.279368][ T8491] BTRFS warning (device loop5): couldn't read tree root [ 186.286926][ T8491] BTRFS warning (device loop5): try to load backup roots slot 2 [ 186.373169][ T6375] BTRFS error (device loop5): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 186.402430][ T8491] BTRFS warning (device loop5): couldn't read tree root [ 186.413871][ T27] audit: type=1326 audit(1787848978.056:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.414024][ T8491] BTRFS warning (device loop5): try to load backup roots slot 3 [ 186.449543][ T27] audit: type=1326 audit(1787848978.056:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.489615][ T27] audit: type=1326 audit(1787848978.086:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.532022][ T27] audit: type=1326 audit(1787848978.086:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.556810][ T27] audit: type=1326 audit(1787848978.086:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.583307][ T27] audit: type=1326 audit(1787848978.096:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.607795][ T27] audit: type=1326 audit(1787848978.096:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.649700][ T8491] BTRFS info (device loop5): enabling ssd optimizations [ 186.665736][ T8491] BTRFS info (device loop5): rebuilding free space tree [ 186.713917][ T8491] BTRFS info (device loop5): checking UUID tree [ 186.752188][ T27] audit: type=1326 audit(1787848978.096:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.822224][ T27] audit: type=1326 audit(1787848978.096:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8526 comm="syz.6.648" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 186.880943][ T8491] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 188.944028][ T8587] loop4: detected capacity change from 0 to 32768 [ 188.953563][ T8587] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.665 (8587) [ 188.973533][ T8587] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 188.990357][ T8587] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 188.999762][ T8587] BTRFS info (device loop4): turning on sync discard [ 189.012405][ T8587] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 189.022416][ T8587] BTRFS info (device loop4): use zstd compression, level 3 [ 189.034973][ T8587] BTRFS info (device loop4): turning on async discard [ 189.041825][ T8587] BTRFS warning (device loop4): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 189.058139][ T8587] BTRFS info (device loop4): trying to use backup root at mount time [ 189.066964][ T8587] BTRFS info (device loop4): enabling auto defrag [ 189.075032][ T8587] BTRFS info (device loop4): turning on flush-on-commit [ 189.082084][ T8587] BTRFS info (device loop4): using free space tree [ 189.105061][ T3441] BTRFS warning (device loop4): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 189.121308][ T8587] BTRFS error (device loop4): failed to load root extent [ 189.128971][ T8587] BTRFS warning (device loop4): try to load backup roots slot 1 [ 189.138094][ T64] BTRFS warning (device loop4): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 189.167641][ T8587] BTRFS warning (device loop4): couldn't read tree root [ 189.175277][ T8587] BTRFS warning (device loop4): try to load backup roots slot 2 [ 189.185202][ T64] BTRFS error (device loop4): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 189.202857][ T8587] BTRFS warning (device loop4): couldn't read tree root [ 189.215382][ T8587] BTRFS warning (device loop4): try to load backup roots slot 3 [ 189.252956][ T8587] BTRFS info (device loop4): enabling ssd optimizations [ 189.265947][ T8587] BTRFS info (device loop4): rebuilding free space tree [ 189.304105][ T8587] BTRFS info (device loop4): checking UUID tree [ 189.494817][ T8587] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 189.716901][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.751025][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.795019][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.858376][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.932581][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.954418][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 189.986415][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 190.022008][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 190.039842][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 190.052124][ T8616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 190.250145][ T8622] netlink: 'syz.4.669': attribute type 1 has an invalid length. [ 190.292232][ T8622] 8021q: adding VLAN 0 to HW filter on device bond2 [ 190.374872][ T8622] bond2: (slave ip6erspan0): making interface the new active one [ 190.401926][ T8622] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 191.507781][ T8653] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 191.516934][ T8653] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 191.525915][ T8653] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 191.534849][ T8653] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 192.670493][ T8696] netlink: 12 bytes leftover after parsing attributes in process `syz.5.697'. [ 192.698198][ T8696] 8021q: adding VLAN 0 to HW filter on device bond1 [ 192.737544][ T8696] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 192.754365][ T8696] netlink: 'syz.5.697': attribute type 10 has an invalid length. [ 192.762106][ T8696] netlink: 40 bytes leftover after parsing attributes in process `syz.5.697'. [ 192.771319][ T8696] dummy0: entered promiscuous mode [ 192.778359][ T8696] bond1: (slave dummy0): Releasing backup interface [ 192.858409][ T8701] bridge_slave_0: left allmulticast mode [ 192.864231][ T8701] bridge_slave_0: left promiscuous mode [ 192.869988][ T8701] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.880905][ T8701] bridge_slave_1: left allmulticast mode [ 192.886840][ T8701] bridge_slave_1: left promiscuous mode [ 192.892662][ T8701] bridge0: port 2(bridge_slave_1) entered disabled state [ 192.906464][ T8701] bond0: (slave bond_slave_0): Releasing backup interface [ 192.917246][ T8701] bond0: (slave bond_slave_1): Releasing backup interface [ 192.932219][ T8701] team0: Port device team_slave_0 removed [ 192.941186][ T8701] team0: Port device team_slave_1 removed [ 192.947780][ T8701] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 192.958835][ T8701] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 192.967826][ T8701] mac80211_hwsim hwsim13 wlan1: left allmulticast mode [ 192.980314][ T8701] mac80211_hwsim hwsim13 wlan1: left promiscuous mode [ 192.989967][ T8701] bridge0: port 3(wlan1) entered disabled state [ 193.007263][ T8703] netlink: 28 bytes leftover after parsing attributes in process `syz.5.698'. [ 194.399625][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.406111][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.905456][ T27] kauditd_printk_skb: 135 callbacks suppressed [ 194.905472][ T27] audit: type=1326 audit(1787848986.726:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 194.993270][ T27] audit: type=1326 audit(1787848986.776:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.041930][ T8766] gretap0: entered promiscuous mode [ 195.052053][ T8766] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 195.060446][ T27] audit: type=1326 audit(1787848986.776:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.073281][ T8766] Cannot create hsr debugfs directory [ 195.097375][ T8766] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 195.109654][ T8766] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 195.120173][ T27] audit: type=1326 audit(1787848986.776:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.124611][ T8766] hsr1: entered allmulticast mode [ 195.173255][ T27] audit: type=1326 audit(1787848986.776:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=232 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.181154][ T8766] dummy0: entered allmulticast mode [ 195.228031][ T8766] gretap0: entered allmulticast mode [ 195.236023][ T27] audit: type=1326 audit(1787848986.776:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.303163][ T27] audit: type=1326 audit(1787848986.776:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.374605][ T27] audit: type=1326 audit(1787848986.776:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.433206][ T27] audit: type=1326 audit(1787848986.776:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.533110][ T27] audit: type=1326 audit(1787848986.776:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8759 comm="syz.5.722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7fbc1799e0d9 code=0x7ffc0000 [ 195.687713][ T8787] fuse: Bad value for 'fd' [ 196.484193][ T5782] Bluetooth: hci1: command 0x0406 tx timeout [ 196.566468][ T8808] bridge_slave_0: left allmulticast mode [ 196.582389][ T8808] bridge_slave_0: left promiscuous mode [ 196.592372][ T8808] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.606270][ T8808] bridge_slave_1: left allmulticast mode [ 196.612031][ T8808] bridge_slave_1: left promiscuous mode [ 196.622352][ T8808] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.645810][ T8808] bond1: (slave veth0_to_bond): Releasing backup interface [ 196.667033][ T8808] bond0: (slave bond_slave_0): Releasing backup interface [ 196.687858][ T8808] bond0: (slave bond_slave_1): Releasing backup interface [ 196.720393][ T8808] team0: Port device team_slave_0 removed [ 196.744050][ T8808] team0: Port device team_slave_1 removed [ 196.750389][ T8808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 196.758946][ T8808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 196.768145][ T8808] bond2: (slave gretap1): Releasing active interface [ 196.777933][ T8808] bond3: (slave ip6gre1): Releasing backup interface [ 196.784838][ T8808] ip6gre1: left promiscuous mode [ 197.648949][ T8810] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.658003][ T8810] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.667965][ T8810] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.676906][ T8810] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.765427][ T8811] netlink: 28 bytes leftover after parsing attributes in process `syz.2.739'. [ 198.950796][ T8845] netlink: 209216 bytes leftover after parsing attributes in process `syz.5.755'. [ 198.971067][ T8845] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 199.272342][ T8860] netlink: 'syz.2.762': attribute type 1 has an invalid length. [ 199.315356][ T8860] 8021q: adding VLAN 0 to HW filter on device bond5 [ 199.472021][ T8860] bond5: (slave veth5): Enslaving as an active interface with a down link [ 199.506465][ T8865] veth0_virt_wifi: entered promiscuous mode [ 199.521052][ T8865] bond5: (slave veth0_virt_wifi): Enslaving as an active interface with a down link [ 199.677757][ T8874] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.761'. [ 199.874817][ T8881] batman_adv: batadv0: Adding interface: dummy0 [ 199.886629][ T8881] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 199.916288][ T8881] batman_adv: batadv0: Interface activated: dummy0 [ 199.944420][ T8883] batadv0: mtu less than device minimum [ 199.965678][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 199.978775][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 199.991268][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.003730][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.016180][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.028619][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.041065][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.053525][ T8883] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 200.978527][ T8918] sctp: [Deprecated]: syz.2.781 (pid 8918) Use of int in max_burst socket option deprecated. [ 200.978527][ T8918] Use struct sctp_assoc_value instead [ 203.019877][ T8954] netlink: 'syz.4.794': attribute type 1 has an invalid length. [ 203.093885][ T8954] 8021q: adding VLAN 0 to HW filter on device bond3 [ 203.157697][ T8957] bond3: (slave dummy0): making interface the new active one [ 203.246024][ T8957] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 204.037736][ T8954] bond3 (unregistering): (slave dummy0): Releasing active interface [ 204.238088][ T8954] bond3 (unregistering): Released all slaves [ 206.184027][ T9016] netlink: 12 bytes leftover after parsing attributes in process `syz.6.818'. [ 207.628818][ T9056] netlink: 188 bytes leftover after parsing attributes in process `syz.5.833'. [ 207.657263][ T9056] netlink: 105 bytes leftover after parsing attributes in process `syz.5.833'. [ 207.666543][ T9056] netlink: 105 bytes leftover after parsing attributes in process `syz.5.833'. [ 211.339925][ T9130] net_ratelimit: 11 callbacks suppressed [ 211.339939][ T9130] ip_tables: iptables: counters copy to user failed while replacing table [ 211.833379][ T5087] Bluetooth: hci3: command 0x0406 tx timeout [ 214.108487][ T9178] netlink: 4 bytes leftover after parsing attributes in process `syz.2.880'. [ 214.163478][ T9178] 8021q: adding VLAN 0 to HW filter on device team1 [ 215.213979][ T9213] fuse: Bad value for 'fd' [ 215.593390][ T9226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.900'. [ 215.695379][ T9226] 8021q: adding VLAN 0 to HW filter on device bond6 [ 216.100682][ T9236] netlink: 8 bytes leftover after parsing attributes in process `syz.2.904'. [ 218.474052][ T9305] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.930'. [ 218.819615][ T27] kauditd_printk_skb: 14 callbacks suppressed [ 218.819630][ T27] audit: type=1326 audit(1787849010.636:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9310 comm="syz.2.932" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f42a579e0d9 code=0x0 [ 219.396260][ T9317] netlink: 'syz.5.934': attribute type 10 has an invalid length. [ 219.439631][ T9317] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 219.477627][ T9321] netlink: 'syz.6.936': attribute type 1 has an invalid length. [ 219.507755][ T9321] bond1: entered promiscuous mode [ 219.533502][ T9321] bond1: entered allmulticast mode [ 219.544180][ T9321] 8021q: adding VLAN 0 to HW filter on device bond1 [ 219.569948][ T9323] erspan1: entered allmulticast mode [ 219.657330][ T9323] bond1: (slave erspan1): making interface the new active one [ 219.679417][ T9323] erspan1: entered promiscuous mode [ 219.708925][ T9323] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 219.810602][ T9323] syz.6.936 (9323) used greatest stack depth: 18984 bytes left [ 220.443545][ T9358] netlink: 24 bytes leftover after parsing attributes in process `syz.2.952'. [ 221.057598][ T9378] netlink: 'syz.4.961': attribute type 4 has an invalid length. [ 221.115452][ T9378] netlink: 'syz.4.961': attribute type 4 has an invalid length. [ 221.911055][ T9416] fuse: Bad value for 'fd' [ 221.982324][ T9420] netlink: 4 bytes leftover after parsing attributes in process `syz.6.976'. [ 222.130563][ T9428] MTDSB: Device #1 doesn't appear to exist [ 222.130563][ T9428] [ 222.253522][ T9434] netlink: 4 bytes leftover after parsing attributes in process `syz.2.989'. [ 222.511495][ T9446] netlink: 84 bytes leftover after parsing attributes in process `syz.4.986'. [ 222.623987][ T9448] netlink: 8 bytes leftover after parsing attributes in process `syz.6.988'. [ 222.657857][ T9452] overlayfs: failed to clone upperpath [ 223.159163][ T9484] bond2: (slave vlan2): Opening slave failed [ 223.282822][ T9492] overlayfs: failed to clone upperpath [ 223.330325][ T9495] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1004'. [ 223.498213][ T9500] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1008'. [ 223.548010][ T9504] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1007'. [ 223.855016][ T9514] netlink: 144 bytes leftover after parsing attributes in process `syz.6.1012'. [ 224.193214][ T9527] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1017'. [ 224.596034][ T9535] 8021q: adding VLAN 0 to HW filter on device bond2 [ 224.618690][ T9541] macvlan2: entered promiscuous mode [ 224.663984][ T9541] macvlan2: entered allmulticast mode [ 224.670867][ T9541] bond2: entered promiscuous mode [ 224.722444][ T9541] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 224.747999][ T9541] bond2: left promiscuous mode [ 224.798516][ T9546] netlink: 'syz.4.1024': attribute type 15 has an invalid length. [ 224.832953][ T9546] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 224.842019][ T9546] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 224.850893][ T9546] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 224.859642][ T9546] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 224.876935][ T9546] vxlan0: entered promiscuous mode [ 224.992850][ T27] audit: type=1326 audit(1787849016.806:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9552 comm="syz.6.1028" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x0 [ 226.451023][ T27] audit: type=1326 audit(1787849018.266:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9606 comm="syz.4.1049" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f92d879e0d9 code=0x0 [ 227.415118][ T9634] __nla_validate_parse: 3 callbacks suppressed [ 227.415137][ T9634] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1057'. [ 227.558150][ T9640] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1062'. [ 227.568708][ T9640] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.576308][ T9640] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.623724][ T9640] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1062'. [ 227.644298][ T9640] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1062'. [ 227.708037][ T27] audit: type=1326 audit(1787849019.526:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9646 comm="syz.6.1064" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x0 [ 227.855124][ T9656] netlink: 'syz.2.1066': attribute type 1 has an invalid length. [ 228.069816][ T9669] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1072'. [ 229.508452][ T9722] netlink: 2028 bytes leftover after parsing attributes in process `syz.6.1089'. [ 229.521769][ T9722] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1089'. [ 231.018586][ T9764] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1108'. [ 232.711352][ T9827] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 232.730074][ T9827] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 235.794833][ T9893] netlink: 11575 bytes leftover after parsing attributes in process `syz.6.1159'. [ 236.239267][ T9910] netlink: 15051 bytes leftover after parsing attributes in process `syz.2.1166'. [ 237.227042][ T9927] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -6351, delta: 1 [ 237.259696][ T9927] ref_ctr increment failed for inode: 0x428 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88807c474c00 [ 238.092622][ T9941] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1178'. [ 238.144187][ T9945] netlink: 'syz.6.1179': attribute type 1 has an invalid length. [ 238.202858][ T9945] 8021q: adding VLAN 0 to HW filter on device bond2 [ 238.247244][ T9950] bond2: (slave veth3): Enslaving as an active interface with a down link [ 238.296226][ T9952] overlayfs: failed to clone upperpath [ 238.382370][ T9945] veth0_virt_wifi: entered promiscuous mode [ 238.406976][ T9945] bond2: (slave veth0_virt_wifi): Enslaving as an active interface with a down link [ 238.481365][ T9945] bond2: (slave veth0_virt_wifi): Releasing active interface [ 238.594589][ T8] kernel write not supported for file bpf-prog (pid: 8 comm: kworker/0:0) [ 238.641496][ T27] audit: type=1326 audit(1787849030.456:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.707495][ T27] audit: type=1326 audit(1787849030.456:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.759158][ T27] audit: type=1326 audit(1787849030.496:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.784313][ T27] audit: type=1326 audit(1787849030.496:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.809228][ T27] audit: type=1326 audit(1787849030.496:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.834089][ T27] audit: type=1326 audit(1787849030.496:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.862779][ T27] audit: type=1326 audit(1787849030.496:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.893838][ T27] audit: type=1326 audit(1787849030.496:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 238.919854][ T27] audit: type=1326 audit(1787849030.496:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff43f75e90e code=0x7ffc0000 [ 238.946530][ T27] audit: type=1326 audit(1787849030.496:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9960 comm="syz.6.1184" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff43f79e0d9 code=0x7ffc0000 [ 240.454519][T10029] netlink: 'syz.4.1212': attribute type 1 has an invalid length. [ 240.488330][T10029] netlink: 63763 bytes leftover after parsing attributes in process `syz.4.1212'. [ 240.551997][T10033] netlink: 'syz.2.1214': attribute type 2 has an invalid length. [ 240.565191][T10033] netlink: 11575 bytes leftover after parsing attributes in process `syz.2.1214'. [ 240.699117][ T8] kernel write not supported for file bpf-prog (pid: 8 comm: kworker/0:0) [ 242.495398][T10082] netlink: 'syz.2.1232': attribute type 10 has an invalid length. [ 242.506717][T10082] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.524888][T10082] bond0: (slave team0): Enslaving as an active interface with an up link [ 242.895348][T10104] overlayfs: failed to clone upperpath [ 243.392399][T10130] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1250'. [ 243.640911][T10140] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1253'. [ 243.654641][T10140] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1253'. [ 243.719677][T10140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.763976][T10140] bond1: (slave bond0): Enslaving as an active interface with an up link [ 243.906467][T10144] dummy0: left promiscuous mode [ 243.932427][T10144] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 256 - 0 [ 243.941510][T10144] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 256 - 0 [ 243.950462][T10144] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 256 - 0 [ 243.959331][T10144] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 256 - 0 [ 244.037566][T10144] netdevsim netdevsim5 netdevsim0: unset [0, 1] type 1 family 0 port 60387 - 0 [ 244.047157][T10144] netdevsim netdevsim5 netdevsim1: unset [0, 1] type 1 family 0 port 60387 - 0 [ 244.056231][T10144] netdevsim netdevsim5 netdevsim2: unset [0, 1] type 1 family 0 port 60387 - 0 [ 244.065274][T10144] netdevsim netdevsim5 netdevsim3: unset [0, 1] type 1 family 0 port 60387 - 0 [ 244.107054][T10144] netdevsim netdevsim5 netdevsim0: unset [0, 2] type 1 family 0 port 8472 - 0 [ 244.116486][T10144] netdevsim netdevsim5 netdevsim1: unset [0, 2] type 1 family 0 port 8472 - 0 [ 244.125810][T10144] netdevsim netdevsim5 netdevsim2: unset [0, 2] type 1 family 0 port 8472 - 0 [ 244.134801][T10144] netdevsim netdevsim5 netdevsim3: unset [0, 2] type 1 family 0 port 8472 - 0 [ 244.170169][T10144] gretap1: left promiscuous mode [ 244.841327][T10178] netlink: 228 bytes leftover after parsing attributes in process `syz.6.1267'. [ 245.392343][T10189] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1271'. [ 245.869509][T10202] netlink: 'syz.2.1276': attribute type 10 has an invalid length. [ 245.916463][T10204] overlayfs: failed to clone upperpath [ 246.324856][T10214] 9pnet: p9_errstr2errno: server reported unknown error @cDB|pan [ 246.841214][T10236] bond3: entered allmulticast mode [ 246.876444][T10236] macvlan3: entered promiscuous mode [ 246.908062][T10236] macvlan3: entered allmulticast mode [ 246.922544][T10236] bond3: (slave macvlan3): Opening slave failed [ 247.599477][T10269] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1305'. [ 249.032073][T10316] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1325'. [ 250.482233][T10350] lo: entered allmulticast mode [ 250.511923][T10350] lo: left allmulticast mode [ 251.090852][T10366] netlink: 'syz.6.1345': attribute type 1 has an invalid length. [ 251.164401][T10366] 8021q: adding VLAN 0 to HW filter on device bond4 [ 251.176019][T10366] bond3: (slave bond4): making interface the new active one [ 251.185266][T10366] bond3: (slave bond4): Enslaving as an active interface with an up link [ 251.203199][T10366] bond3: entered promiscuous mode [ 251.208484][T10366] bond4: entered promiscuous mode [ 251.334243][T10380] fuse: Bad value for 'fd' [ 251.540905][T10384] netlink: 'syz.5.1352': attribute type 11 has an invalid length. [ 252.418243][T10408] ip_tables: iptables: counters copy to user failed while replacing table [ 253.633506][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 253.706997][T10464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1374'. [ 253.943547][ T5944] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 254.244285][T10479] netlink: 'syz.5.1378': attribute type 1 has an invalid length. [ 254.290015][T10479] 8021q: adding VLAN 0 to HW filter on device bond3 [ 254.355479][T10479] bond3: (slave veth5): Enslaving as a backup interface with a down link [ 254.423956][T10479] bond3: (slave dummy0): Enslaving as a backup interface with an up link [ 254.443115][T10479] netlink: 'syz.5.1378': attribute type 10 has an invalid length. [ 254.450990][T10479] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1378'. [ 254.491098][T10479] dummy0: entered promiscuous mode [ 254.505707][ T6373] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 254.544403][T10479] bond3: (slave dummy0): Removing an active aggregator [ 254.572297][T10479] bond3: (slave dummy0): Releasing backup interface [ 254.854807][T10500] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1385'. [ 255.429277][ T8] IPVS: starting estimator thread 0... [ 255.533479][T10510] IPVS: using max 21 ests per chain, 50400 per kthread [ 255.838991][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.845544][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.162678][T10581] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1414'. [ 257.916180][ T5087] Bluetooth: hci4: command 0x0406 tx timeout [ 259.752166][T10648] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 259.785488][T10649] team0: Port device xfrm0 added [ 259.803585][T10649] tipc: Started in network mode [ 259.810913][T10649] tipc: Node identity 42896cf083fc, cluster identity 4711 [ 259.820353][T10649] tipc: Enabled bearer , priority 0 [ 260.826569][ T8] tipc: Node number set to 3245698288 [ 261.327757][ T27] kauditd_printk_skb: 67 callbacks suppressed [ 261.327772][ T27] audit: type=1326 audit(1787849053.146:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10687 comm="syz.5.1455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbc1799e0d9 code=0x0 [ 262.107068][T10720] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1464'. [ 262.329686][T10736] netlink: 136 bytes leftover after parsing attributes in process `syz.5.1469'. [ 262.493803][T10740] overlayfs: failed to clone upperpath [ 262.559892][T10742] netlink: 201392 bytes leftover after parsing attributes in process `syz.6.1472'. [ 262.574939][T10742] netlink: zone id is out of range [ 262.580320][T10742] netlink: zone id is out of range [ 262.603228][T10742] netlink: zone id is out of range [ 262.611871][T10742] netlink: zone id is out of range [ 262.619713][T10742] netlink: zone id is out of range [ 262.627524][T10742] netlink: zone id is out of range [ 262.632952][T10742] netlink: zone id is out of range [ 262.646692][T10742] netlink: zone id is out of range [ 262.652903][T10742] netlink: zone id is out of range [ 262.659961][T10742] netlink: zone id is out of range [ 262.717053][T10748] syz_tun: entered allmulticast mode [ 262.754223][T10748] dvmrp6: entered allmulticast mode [ 262.785707][T10747] syz_tun: left allmulticast mode [ 264.031603][ T27] audit: type=1326 audit(1787849055.846:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10802 comm="syz.2.1496" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f42a579e0d9 code=0x0 [ 265.644922][T10851] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1515'. [ 266.590829][T10871] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1522'. [ 266.939351][T10883] bond3: entered allmulticast mode [ 267.018274][T10885] dvmrp6: entered allmulticast mode [ 267.165165][ T5924] libceph: connect (1)[c::]:6789 error -101 [ 267.172019][ T5924] libceph: mon0 (1)[c::]:6789 connect error [ 267.210461][ T5924] libceph: connect (1)[c::]:6789 error -101 [ 267.213879][T10891] ceph: No mds server is up or the cluster is laggy [ 267.225936][ T5924] libceph: mon0 (1)[c::]:6789 connect error [ 267.528461][T10905] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1535'. [ 267.631214][T10909] dvmrp6: entered allmulticast mode [ 267.687130][T10911] tipc: Started in network mode [ 267.692232][T10911] tipc: Node identity ac1414aa, cluster identity 4711 [ 267.723166][T10911] tipc: New replicast peer: 172.20.20.187 [ 267.730034][T10911] ------------[ cut here ]------------ [ 267.736082][T10911] WARNING: CPU: 0 PID: 10911 at net/core/flow_dissector.c:1107 __skb_flow_dissect+0xb05/0x6e70 [ 267.746517][T10911] Modules linked in: [ 267.750444][T10911] CPU: 0 PID: 10911 Comm: syz.6.1539 Not tainted syzkaller #0 [ 267.757981][T10911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.768098][T10911] RIP: 0010:__skb_flow_dissect+0xb05/0x6e70 [ 267.774077][T10911] Code: c6 e8 7f 41 06 f9 85 db 0f 84 9a 06 00 00 80 3d a4 c1 f5 05 01 0f 85 c0 06 00 00 e8 b5 3d 06 f9 e9 d5 f9 ff ff e8 ab 3d 06 f9 <0f> 0b e8 b4 6b 0e 02 89 c3 31 ff 89 c6 e8 49 41 06 f9 85 db 74 18 [ 267.793755][T10911] RSP: 0018:ffffc9000cbd60a0 EFLAGS: 00010287 [ 267.799852][T10911] RAX: ffffffff888134c5 RBX: 0000000000000000 RCX: 0000000000080000 [ 267.807926][T10911] RDX: ffffc9000d66a000 RSI: 000000000000d3e1 RDI: 000000000000d3e2 [ 267.815951][T10911] RBP: ffffc9000cbd66b8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 267.823979][T10911] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: ffffffff8e8cf8f8 [ 267.831977][T10911] R13: 1ffffffff1d19f20 R14: ffffffff8e8cf902 R15: dffffc0000000000 [ 267.840004][T10911] FS: 00007ff44072b6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 267.848990][T10911] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 267.855627][T10911] CR2: 00007f42a65556c8 CR3: 00000000301e2000 CR4: 00000000003506f0 [ 267.863648][T10911] Call Trace: [ 267.866946][T10911] [ 267.871442][T10911] ? __skb_flow_dissect+0x1eb/0x6e70 [ 267.876832][T10911] ? bpf_flow_dissect+0x3f0/0x3f0 [ 267.881910][T10911] ? verify_lock_unused+0x140/0x140 [ 267.887185][T10911] ? mark_lock+0x94/0x320 [ 267.891553][T10911] ? __lock_acquire+0x1262/0x7d80 [ 267.896673][T10911] ? verify_lock_unused+0x140/0x140 [ 267.901914][T10911] ? nf_conntrack_in+0xc29/0x15b0 [ 267.906997][T10911] ? verify_lock_unused+0x140/0x140 [ 267.912357][T10911] __skb_get_hash+0xf3/0x2e0 [ 267.917004][T10911] ? __skb_get_hash_symmetric+0x1d0/0x1d0 [ 267.922758][T10911] ? ip_vs_conn_hashkey_param+0x34a/0x5c0 [ 267.928553][T10911] ? __ip_vs_conn_in_get+0x9a/0xae0 [ 267.933809][T10911] ? nf_ct_nat_ext_add+0x110/0x110 [ 267.938954][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 267.944389][T10911] nft_trace_init+0x1bb/0x420 [ 267.949094][T10911] ? nf_trace_fill_pkt_info+0x870/0x870 [ 267.954708][T10911] nft_do_chain+0x1523/0x1620 [ 267.959413][T10911] ? udp_conn_schedule+0x352/0x740 [ 267.964588][T10911] ? __udp_exit+0x40/0x40 [ 267.968936][T10911] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 267.974927][T10911] nft_do_chain_ipv4+0x160/0x230 [ 267.979895][T10911] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 267.985523][T10911] ? nf_nat_ipv4_local_fn+0x411/0x560 [ 267.990930][T10911] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 267.996549][T10911] nf_hook_slow+0xbd/0x200 [ 268.001007][T10911] ? nf_hook+0x390/0x390 [ 268.005335][T10911] nf_hook+0x228/0x390 [ 268.009442][T10911] ? nf_hook+0xa2/0x390 [ 268.013655][T10911] ? __ip_local_out+0x5f0/0x5f0 [ 268.018527][T10911] ? nf_hook+0x390/0x390 [ 268.022787][T10911] ? ip_route_output_key_hash+0x13d/0x330 [ 268.028558][T10911] ? ip_fast_csum+0x1ee/0x2b0 [ 268.033303][T10911] __ip_local_out+0x4db/0x5f0 [ 268.038046][T10911] ? nf_hook+0x390/0x390 [ 268.042331][T10911] ip_local_out+0x2a/0x130 [ 268.046885][T10911] iptunnel_xmit+0x4d0/0x910 [ 268.051526][T10911] udp_tunnel_xmit_skb+0x22f/0x380 [ 268.056727][T10911] tipc_udp_xmit+0x861/0xb40 [ 268.061365][T10911] ? tipc_udp_xmit+0xb7/0xb40 [ 268.066129][T10911] ? tipc_udp_msg2addr+0x1d0/0x1d0 [ 268.071287][T10911] ? __asan_memcpy+0x40/0x70 [ 268.075964][T10911] ? __pskb_copy_fclone+0x978/0x1000 [ 268.081296][T10911] ? __asan_memcpy+0x40/0x70 [ 268.085961][T10911] ? __pskb_copy_fclone+0x978/0x1000 [ 268.091303][T10911] tipc_udp_send_msg+0x27e/0x3e0 [ 268.096334][T10911] tipc_bearer_xmit_skb+0x2ad/0x3f0 [ 268.101573][T10911] ? tipc_bearer_xmit_skb+0xaa/0x3f0 [ 268.106949][T10911] ? tipc_bearer_min_mtu+0x1d0/0x1d0 [ 268.112324][T10911] __tipc_nl_bearer_enable+0x10a7/0x13e0 [ 268.118064][T10911] ? tipc_nl_bearer_disable+0x30/0x30 [ 268.123510][T10911] ? trace_contention_end+0x39/0xe0 [ 268.128756][T10911] ? tipc_nl_bearer_enable+0x17/0x30 [ 268.134124][T10911] ? mutex_lock_nested+0x20/0x20 [ 268.139100][T10911] ? __nla_parse+0x40/0x50 [ 268.143603][T10911] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 268.149962][T10911] ? genl_family_rcv_msg_attrs_parse+0x20a/0x290 [ 268.156390][T10911] tipc_nl_bearer_enable+0x22/0x30 [ 268.161545][T10911] genl_family_rcv_msg_doit+0x21a/0x310 [ 268.167190][T10911] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 268.173170][T10911] ? bpf_lsm_capable+0x9/0x10 [ 268.177875][T10911] ? security_capable+0x89/0xb0 [ 268.182747][T10911] genl_rcv_msg+0x611/0x7a0 [ 268.187313][T10911] ? genl_bind+0x360/0x360 [ 268.191755][T10911] ? __tipc_nl_bearer_enable+0x13e0/0x13e0 [ 268.197626][T10911] netlink_rcv_skb+0x235/0x4c0 [ 268.202411][T10911] ? genl_bind+0x360/0x360 [ 268.206918][T10911] ? netlink_ack+0x1160/0x1160 [ 268.211713][T10911] ? __lock_acquire+0x7d80/0x7d80 [ 268.216823][T10911] ? net_generic+0x1e/0x240 [ 268.221378][T10911] ? down_read+0x1ac/0x2e0 [ 268.225872][T10911] genl_rcv+0x28/0x40 [ 268.229897][T10911] netlink_unicast+0x7b1/0x930 [ 268.234749][T10911] netlink_sendmsg+0x8d0/0xbf0 [ 268.239558][T10911] ? netlink_getsockopt+0x590/0x590 [ 268.244836][T10911] ? apparmor_socket_sendmsg+0x8e/0x330 [ 268.250425][T10911] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 268.255791][T10911] ? security_socket_sendmsg+0x80/0xa0 [ 268.261279][T10911] ? netlink_getsockopt+0x590/0x590 [ 268.266572][T10911] ____sys_sendmsg+0x61b/0x980 [ 268.271371][T10911] ? __asan_memset+0x22/0x40 [ 268.276818][T10911] ? __sys_sendmsg_sock+0x30/0x30 [ 268.281868][T10911] ? __import_iovec+0x5f2/0x850 [ 268.286871][T10911] ? import_iovec+0x73/0xa0 [ 268.291405][T10911] ___sys_sendmsg+0x2a6/0x360 [ 268.296154][T10911] ? __sys_sendmsg+0x2b0/0x2b0 [ 268.300970][T10911] __se_sys_sendmsg+0x1d0/0x2c0 [ 268.305871][T10911] ? __x64_sys_sendmsg+0x80/0x80 [ 268.310861][T10911] ? lockdep_hardirqs_on+0x98/0x150 [ 268.316124][T10911] do_syscall_64+0x55/0xb0 [ 268.320561][T10911] ? clear_bhb_loop+0x40/0x90 [ 268.325332][T10911] ? clear_bhb_loop+0x40/0x90 [ 268.330035][T10911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 268.335985][T10911] RIP: 0033:0x7ff43f79e0d9 [ 268.340454][T10911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.360116][T10911] RSP: 002b:00007ff44072b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 268.368591][T10911] RAX: ffffffffffffffda RBX: 00007ff43fa25fa0 RCX: 00007ff43f79e0d9 [ 268.376651][T10911] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005 [ 268.384662][T10911] RBP: 00007ff43f835024 R08: 0000000000000000 R09: 0000000000000000 [ 268.392631][T10911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 268.400647][T10911] R13: 00007ff43fa26038 R14: 00007ff43fa25fa0 R15: 00007ffedc258a68 [ 268.408764][T10911] [ 268.411780][T10911] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 268.419059][T10911] CPU: 0 PID: 10911 Comm: syz.6.1539 Not tainted syzkaller #0 [ 268.426504][T10911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.436564][T10911] Call Trace: [ 268.439834][T10911] [ 268.442758][T10911] dump_stack_lvl+0x18c/0x250 [ 268.447444][T10911] ? show_regs_print_info+0x20/0x20 [ 268.452667][T10911] ? load_image+0x420/0x420 [ 268.457172][T10911] panic+0x2ca/0x720 [ 268.461082][T10911] ? bpf_jit_dump+0xd0/0xd0 [ 268.465636][T10911] __warn+0x2e0/0x470 [ 268.469638][T10911] ? __skb_flow_dissect+0xb05/0x6e70 [ 268.474930][T10911] ? __skb_flow_dissect+0xb05/0x6e70 [ 268.480225][T10911] report_bug+0x2be/0x4f0 [ 268.484548][T10911] ? __skb_flow_dissect+0xb05/0x6e70 [ 268.489827][T10911] ? __skb_flow_dissect+0xb05/0x6e70 [ 268.495124][T10911] ? __skb_flow_dissect+0xb07/0x6e70 [ 268.500416][T10911] handle_bug+0xcf/0x120 [ 268.504655][T10911] exc_invalid_op+0x1a/0x50 [ 268.509151][T10911] asm_exc_invalid_op+0x1a/0x20 [ 268.514000][T10911] RIP: 0010:__skb_flow_dissect+0xb05/0x6e70 [ 268.519931][T10911] Code: c6 e8 7f 41 06 f9 85 db 0f 84 9a 06 00 00 80 3d a4 c1 f5 05 01 0f 85 c0 06 00 00 e8 b5 3d 06 f9 e9 d5 f9 ff ff e8 ab 3d 06 f9 <0f> 0b e8 b4 6b 0e 02 89 c3 31 ff 89 c6 e8 49 41 06 f9 85 db 74 18 [ 268.539568][T10911] RSP: 0018:ffffc9000cbd60a0 EFLAGS: 00010287 [ 268.545634][T10911] RAX: ffffffff888134c5 RBX: 0000000000000000 RCX: 0000000000080000 [ 268.553625][T10911] RDX: ffffc9000d66a000 RSI: 000000000000d3e1 RDI: 000000000000d3e2 [ 268.561610][T10911] RBP: ffffc9000cbd66b8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 268.569575][T10911] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: ffffffff8e8cf8f8 [ 268.577559][T10911] R13: 1ffffffff1d19f20 R14: ffffffff8e8cf902 R15: dffffc0000000000 [ 268.585560][T10911] ? __skb_flow_dissect+0xb05/0x6e70 [ 268.590862][T10911] ? __skb_flow_dissect+0x1eb/0x6e70 [ 268.596183][T10911] ? bpf_flow_dissect+0x3f0/0x3f0 [ 268.601225][T10911] ? verify_lock_unused+0x140/0x140 [ 268.606428][T10911] ? mark_lock+0x94/0x320 [ 268.610770][T10911] ? __lock_acquire+0x1262/0x7d80 [ 268.615826][T10911] ? verify_lock_unused+0x140/0x140 [ 268.621043][T10911] ? nf_conntrack_in+0xc29/0x15b0 [ 268.626069][T10911] ? verify_lock_unused+0x140/0x140 [ 268.631277][T10911] __skb_get_hash+0xf3/0x2e0 [ 268.635879][T10911] ? __skb_get_hash_symmetric+0x1d0/0x1d0 [ 268.641629][T10911] ? ip_vs_conn_hashkey_param+0x34a/0x5c0 [ 268.647357][T10911] ? __ip_vs_conn_in_get+0x9a/0xae0 [ 268.652546][T10911] ? nf_ct_nat_ext_add+0x110/0x110 [ 268.657653][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 268.663028][T10911] nft_trace_init+0x1bb/0x420 [ 268.667725][T10911] ? nf_trace_fill_pkt_info+0x870/0x870 [ 268.673285][T10911] nft_do_chain+0x1523/0x1620 [ 268.677976][T10911] ? udp_conn_schedule+0x352/0x740 [ 268.683094][T10911] ? __udp_exit+0x40/0x40 [ 268.687435][T10911] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 268.693396][T10911] nft_do_chain_ipv4+0x160/0x230 [ 268.698347][T10911] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 268.703904][T10911] ? nf_nat_ipv4_local_fn+0x411/0x560 [ 268.709290][T10911] ? nf_tables_netdev_event+0x9d0/0x9d0 [ 268.714839][T10911] nf_hook_slow+0xbd/0x200 [ 268.719273][T10911] ? nf_hook+0x390/0x390 [ 268.723520][T10911] nf_hook+0x228/0x390 [ 268.727616][T10911] ? nf_hook+0xa2/0x390 [ 268.731766][T10911] ? __ip_local_out+0x5f0/0x5f0 [ 268.736611][T10911] ? nf_hook+0x390/0x390 [ 268.740841][T10911] ? ip_route_output_key_hash+0x13d/0x330 [ 268.746556][T10911] ? ip_fast_csum+0x1ee/0x2b0 [ 268.751226][T10911] __ip_local_out+0x4db/0x5f0 [ 268.755903][T10911] ? nf_hook+0x390/0x390 [ 268.760154][T10911] ip_local_out+0x2a/0x130 [ 268.764564][T10911] iptunnel_xmit+0x4d0/0x910 [ 268.769157][T10911] udp_tunnel_xmit_skb+0x22f/0x380 [ 268.774282][T10911] tipc_udp_xmit+0x861/0xb40 [ 268.778891][T10911] ? tipc_udp_xmit+0xb7/0xb40 [ 268.783763][T10911] ? tipc_udp_msg2addr+0x1d0/0x1d0 [ 268.788890][T10911] ? __asan_memcpy+0x40/0x70 [ 268.793485][T10911] ? __pskb_copy_fclone+0x978/0x1000 [ 268.798789][T10911] ? __asan_memcpy+0x40/0x70 [ 268.803383][T10911] ? __pskb_copy_fclone+0x978/0x1000 [ 268.808684][T10911] tipc_udp_send_msg+0x27e/0x3e0 [ 268.813634][T10911] tipc_bearer_xmit_skb+0x2ad/0x3f0 [ 268.818845][T10911] ? tipc_bearer_xmit_skb+0xaa/0x3f0 [ 268.824132][T10911] ? tipc_bearer_min_mtu+0x1d0/0x1d0 [ 268.829435][T10911] __tipc_nl_bearer_enable+0x10a7/0x13e0 [ 268.835080][T10911] ? tipc_nl_bearer_disable+0x30/0x30 [ 268.840472][T10911] ? trace_contention_end+0x39/0xe0 [ 268.845694][T10911] ? tipc_nl_bearer_enable+0x17/0x30 [ 268.850969][T10911] ? mutex_lock_nested+0x20/0x20 [ 268.855914][T10911] ? __nla_parse+0x40/0x50 [ 268.860343][T10911] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 268.866662][T10911] ? genl_family_rcv_msg_attrs_parse+0x20a/0x290 [ 268.872994][T10911] tipc_nl_bearer_enable+0x22/0x30 [ 268.878114][T10911] genl_family_rcv_msg_doit+0x21a/0x310 [ 268.883666][T10911] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 268.889575][T10911] ? bpf_lsm_capable+0x9/0x10 [ 268.894252][T10911] ? security_capable+0x89/0xb0 [ 268.899119][T10911] genl_rcv_msg+0x611/0x7a0 [ 268.903634][T10911] ? genl_bind+0x360/0x360 [ 268.908060][T10911] ? __tipc_nl_bearer_enable+0x13e0/0x13e0 [ 268.913884][T10911] netlink_rcv_skb+0x235/0x4c0 [ 268.918654][T10911] ? genl_bind+0x360/0x360 [ 268.923071][T10911] ? netlink_ack+0x1160/0x1160 [ 268.927875][T10911] ? __lock_acquire+0x7d80/0x7d80 [ 268.932890][T10911] ? net_generic+0x1e/0x240 [ 268.937405][T10911] ? down_read+0x1ac/0x2e0 [ 268.941813][T10911] genl_rcv+0x28/0x40 [ 268.945784][T10911] netlink_unicast+0x7b1/0x930 [ 268.950563][T10911] netlink_sendmsg+0x8d0/0xbf0 [ 268.955364][T10911] ? netlink_getsockopt+0x590/0x590 [ 268.960572][T10911] ? apparmor_socket_sendmsg+0x8e/0x330 [ 268.966108][T10911] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 268.971386][T10911] ? security_socket_sendmsg+0x80/0xa0 [ 268.976836][T10911] ? netlink_getsockopt+0x590/0x590 [ 268.982033][T10911] ____sys_sendmsg+0x61b/0x980 [ 268.986810][T10911] ? __asan_memset+0x22/0x40 [ 268.991390][T10911] ? __sys_sendmsg_sock+0x30/0x30 [ 268.996411][T10911] ? __import_iovec+0x5f2/0x850 [ 269.001281][T10911] ? import_iovec+0x73/0xa0 [ 269.005777][T10911] ___sys_sendmsg+0x2a6/0x360 [ 269.010465][T10911] ? __sys_sendmsg+0x2b0/0x2b0 [ 269.015290][T10911] __se_sys_sendmsg+0x1d0/0x2c0 [ 269.020149][T10911] ? __x64_sys_sendmsg+0x80/0x80 [ 269.025088][T10911] ? lockdep_hardirqs_on+0x98/0x150 [ 269.030281][T10911] do_syscall_64+0x55/0xb0 [ 269.034697][T10911] ? clear_bhb_loop+0x40/0x90 [ 269.039384][T10911] ? clear_bhb_loop+0x40/0x90 [ 269.044060][T10911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 269.049968][T10911] RIP: 0033:0x7ff43f79e0d9 [ 269.054404][T10911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.074043][T10911] RSP: 002b:00007ff44072b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 269.082488][T10911] RAX: ffffffffffffffda RBX: 00007ff43fa25fa0 RCX: 00007ff43f79e0d9 [ 269.090476][T10911] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005 [ 269.098461][T10911] RBP: 00007ff43f835024 R08: 0000000000000000 R09: 0000000000000000 [ 269.106429][T10911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 269.114420][T10911] R13: 00007ff43fa26038 R14: 00007ff43fa25fa0 R15: 00007ffedc258a68 [ 269.122427][T10911] [ 269.125603][T10911] Kernel Offset: disabled [ 269.130024][T10911] Rebooting in 86400 seconds..