last executing test programs: 6m44.258460174s ago: executing program 4 (id=13): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xf1}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2000477d, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x1194}, 0x1, 0x0, 0x0, 0x4048000}, 0x4000880) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) sendmsg$NL80211_CMD_PROBE_CLIENT(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)={0x38, r2, 0x300, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xc2, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) 6m43.95472967s ago: executing program 4 (id=15): syz_open_procfs(0x0, &(0x7f0000019080)='net/ip6_tables_names\x00') socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x2, 0x80805, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000a80)={0x0, 0xabba, 0x400, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f00000006c0)=0x0, &(0x7f0000000580)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x2, 0x822, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x111}}}, &(0x7f0000000480)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x8225, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x21}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x4, 0x1, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 6m42.516586848s ago: executing program 4 (id=26): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) syz_mount_image$iso9660(&(0x7f0000000140), &(0x7f0000000800)='./file0\x00', 0x800, &(0x7f0000000340)=ANY=[@ANYBLOB="757466382c6869646500757466382c6f76657272696465722f636b7065726d2c6d61703d6f66662c6d61703d6e6f2372726d616c4173657373696f6e3d3078303030303030303030303030303032372c756e686964652c756e686964652c6f76657272696465726f636b7065726d2c6d61703d6f66662c6d61703d6e6f726d616c2c6e6f726f636bc0c78078b9e407981a29180ae1c7377daf60ae087dba62d3d317588d8d353e22d18103fcada0d6618a759eb14447843e1feeb081fa9ab76b68f577952e73d47d9bc79a218a42312dfce6e54da86a0567d40b0ee7a2f988d00948cef254c9ea7a96101831de9aec92d0baef305dae97c8cd1585afde0d52a4e1c9e5320cfc94dac0ef2ed0f9334dbba90c9d9e2020"], 0x2, 0x6b1, &(0x7f0000001100)="$eJzs3V1vG1kdx/HfOI7jZqFaAaqqqg+nLSulorhjZ5sqKhJrxuNkwPZYMw5qJKRV2Sarqk4X2iLR3Cy54UFa3gDihgu44EUgcb3vghsE0grukJYLr+bJseOnuuu2u9vvJ9r1eM5/zvnPjOu/JvEcCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyHJqtl221PBaO3fMZE4t8Jvp8v97o+1Jb8u6lixcmzmuZEX/qVjU2WTV2W8dN5+J/ndF55Nn51WMHoo6fOPMm7e/mc9l209J+Hlo3g4fPz18cLfb3Xv0DLFLmrv7V0m5bOlUek7GBG25LS/0vWZ1yzVe6JvNjQ37xnY9NHWv4Ya7YcdtGidwcx0/MGvONVPe3Fw3bmnX32lt1aoNN1t567sV294wP1xJTrSkUuhse42G19qKY6LmKOaW+egnSYBbbRqzf7+7tz5rT6Kg8rMEVWYFVexKpVyuVMobNzdv3rLt/OCKnKS8HbHsPo1ssvAXLb5kFvPGDSxALqr//7CkhopqaUd3ZMb+OKopkK/mhPZUVv/fuuFOHXew/mdV/qz0/bT5nOL6fzF5dnFS/Z+Qi5GJNxjXYk1YP9/PcpyR0WM91aEe6K666mpPjxbQt5G5tJBeXsLPlly15CmUL09NVbWlP39d6RqjTW1oQ7be1bbqCmVUl6eGXIXaVaiO3PgV5SiQq6o68hXIaE2OrsmorE1tal1Grkrala8dtbSlmqr6X6/X29f9+LivT8lRWVB5QsDKYFBlSk/DxfyPyur/Tz9MXqd23j6B+v96SV4HK8nDx9NigC+AXnr9Pyg3e7NLLy4jAAAAAACwaFb823cr/tv9BUk91b2Ga7/qtAAAAAAAwAJZ6q3ovKzo+l/SBVlc/wMAAAAA8FVjxffYWZJW4w/1W8d3Qj3LLwGWXkKKAAAAAADgc4rv/L9YkHrxpBWXZM11/Q8AAAAAAL4Efjswx34+m2O3l/1ZPycpbK9Yf/vPioJl66h959vWQTVqqR6kMZ+e7LFTP2edTifqjR8KkuJnjnveOp9MjplOgtmfd/CT/Vlz/VvBiQQKS4MdTEjAikbeyKfP9JEuJ5tcTueZv3eYU9ySjLJa9xpuyfEbt8uqVk/nOu6dzi8e3v+lFPQ/6bB/v7tXeu+D7r04l6No1dFB1OmHQ+nkxh+M41yexPMtxPdcjNvjU6pnQ/6u1Vy14nHtbP+XVD3IDQ407QQcj/lrXVH8qY0rq0ns6mF/xv1o/4vR/pdL8Skb2vtg2TrOonxyz8ediAlZFOMsriYxV9euqvLPZLl/FnJW8TtLUqU0eg6GsqgMZjH7WFj/HTkWA1nED1nLwLFYj7L4e9TRhCzW58ti5IwAwKuyrwuK34UuKJ7EvF+FimndzcpD9qb2XHVndnV/Z7i6P/lDrxdvsCTl079NTB2lqOgdfc2K61Ah2aX8uTHv6HZaV4qa8I5uf47qFo311+PvQErTHsni016vd7scj/v7E1X1T0PDjYwbNipL0SG88eTgZ/EE+JH3997fe1iprG/Yb9v2zYqW491IH5ZE7QEAjJj9HTszI6y3dTmJuHzv328lS0MV7xv9jxSU9J4+UFf3dD37CoFL43tdHfgYwvXkqlUDV63mzJu34++lG44t6/rEq7q4lg7EVvqxy8o2Ga7Ux7HrL/gsAADwcl2ZUYfH1//iUP2/rrUkYu3c2Ovu4VqeXh33L+knxZZnJ//Ooo8GAACvBzf4xFrt/MYKAq/9bnlzs1ztbLsm8J0fmcCrbbnGa3XcwNmutrZc0w78ju/4DdMOtOLV3NCEO+22H3RM3Q9M2w+9O/E3v5v0q99Dt1ltdTwnbDfcaugax291qk7H1LzQMe2dHzS8cNsN4o3Dtut4dc+pdjy/ZUJ/J3DckjGh6w4EejW31fHqXrTYMu3Aa1aDXfNjv7HTdE3NDZ3Aa3f8pMNsLK9V94Nm3G0p3xv3eQEAAF47j58ePrjb7e49OrlwKro0T9YcaULM6EJBj59GV+XRmnzaxBxBAAB8wRwX8Dk2Kr7AhAAAAAAAAAAAAAAAAAAAAAAAwIjZt/TNubA87mZBqb/m56fTNfqVjm8xHOnH0qITm2chN+9W2S0Rhw8+nhRT0N1T/TXZ4R+MOXppO/ivr0lvxGuUrMkvfqxTU07ui1j43n5yRCfGRI1jm1b65yL/HP8cCpoZ8/AvE5p6vV5v+hArw8ewMLSDuWmD5iU9Ksx9CgojL1EAX1WfBQAA//843TOC") ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x5) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) 6m41.469108895s ago: executing program 4 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 6m41.011097403s ago: executing program 4 (id=34): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r1, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x80000, 0x1000000, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0x0, 0xfffffffd, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 6m40.583947399s ago: executing program 4 (id=37): openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x12000, 0xea) socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000219000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f00002d7000/0x1000)=nil, &(0x7f000002b000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002bb}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 6m39.649434992s ago: executing program 32 (id=37): openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x12000, 0xea) socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000219000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f00002d7000/0x1000)=nil, &(0x7f000002b000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002bb}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 5m43.89845476s ago: executing program 2 (id=253): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) 5m42.558339298s ago: executing program 2 (id=259): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x180}], 0x1, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0100000800000002", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x2, 0x1, "fa"}, 0x9) 5m42.182378923s ago: executing program 2 (id=263): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) sendto$inet6(r0, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x4d) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup3(r0, r1, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001f00)=""/4106, 0xfffffffffffffccb, 0x0, 0x0}, &(0x7f0000000080)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000880)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000740)=0x40) 5m41.176078032s ago: executing program 2 (id=265): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0x8, 0x70, 0x80000}, 0x20) 5m40.866484667s ago: executing program 2 (id=271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001f80)=ANY=[@ANYBLOB="2c000000210a010300000000000000000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x8000) close(0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200"], 0x7c}}, 0x0) recvmsg(r1, &(0x7f0000001ec0)={0x0, 0x0, 0x0}, 0x40000102) 5m36.815595589s ago: executing program 2 (id=289): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 5m36.311662345s ago: executing program 33 (id=289): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 4m51.28102564s ago: executing program 1 (id=477): socket$nl_route(0x10, 0x3, 0x0) getpgrp(0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000340)='./file0\x00', 0x180200c, &(0x7f0000000280)={[{@nodelalloc}, {@journal_checksum}, {@dioread_nolock}, {@discard}, {@user_xattr}, {}, {@errors_remount}, {@dioread_lock}, {@bh}, {@auto_da_alloc}]}, 0x1, 0x578, &(0x7f0000000500)="$eJzs3V1rFFcfAPD/bF58fR4jiDxPL0rAi1qsG5P0xUKh9rK0UqG9t0uyBsnGlexGTCpUL+pNb4oUSqlQ+gF630vpF+inEFpBioT2ohS2zGY2rsm+JHHtru7vB6Pn7Mx45r9n/uM5M7tsAENrMv0jF/H/iPgqiTjStG40spWTG9utP7oxly5J1Gof/55Ekr3W2D7J/j6UVf4XET9/EXEqt73dyuraYqFUKi5n9anq0tWpyura6ctLhYXiQvHKzOzs2TdmZ95+682exfrqhT+//eje+2e/PLH+zY8Pjt5J4lwcztY1x/EUbjZXJgt/Z6WxOLdlw+keNDZIkn4fAHsykuX5WKTXgCMxkmU98OL7PCJqwJBK5D8MqcY4oDG379E8+Lnx8L2NCVA99vHm+Ec37o3E/vrc6OB68sTMKJ3vTvSg/bSNn367eyddovN9iANd6gC7cvNWRJwZHd1+/U+y61/ne3ud7hadqd887mxyS33Y/v+BfrqXjn9eazX+y22Of6LF+OdQi9zdi+75n3vQg2baSsd/77Qc/25euiZGstp/6mO+seTS5VLxTET8NyJORq3ro4+z6/dr7dY1j//SJW2/MRbMjuPB6L4n95kvVAsRMb7HkJ/w8FbES6Ot4k82+z9p0f/p+3Fhh20cL959ud267vE/W7UfIl5p2f+PuzXp/Hxyqn4+TDXOiu3+uH38l3bt9zv+tP8Pdo5/Iml+XlvZfRvf7/+r2G7dXs//8eSTermRBNcL1erydMR48uH212ce79uoN7ZP4z95ovP1r9X5n06+Pt1h/LeP3W676SD0//yu+n/3hfsffPZdu/Z31v+v10sns1ey619r2bmy0wN82vcPAAAAAAAABkkuIg5HkstvlnO5fH7j8x3H4mCuVK5UT10qr1yZj/p3ZSdiLNd40n2k6fMQ09nnYRv1mS312Yg4GhFfjxyo1/Nz5dJ8v4MHAAAAAAAAAAAAAAAAAACAAXGozff/U7+O9PvogGeu/sMG+/p9FEA/dP3J/1780hMwkLrmP/DCkv8wvOQ/DC/5D8NL/sPwkv8wvOQ/DC/5DwAAAAAAAAAAAAAAAAAAAAAAAAAAAD114fz5dKmtP7oxl9bnr62uLJavnZ4vVhbzSytz+bny8tX8Qrm8UCrm58pL3f69Url8dXomVq5PVYuV6lRlde3iUnnlSvXi5aXCQvFicexfiQoAAAAAAAAAAAAAAAAAAACeL5XVtcVCqVRcVmhbeDcG4jCeZYAb9rT76KBEodCmcCvr3t3t1ceLEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs8U8AAAD//wu/MZ8=") r0 = openat(0xffffffffffffff9c, 0x0, 0xc41, 0x20) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) fallocate(r0, 0x20, 0x4000, 0x3000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r1, 0x0, 0x0) 4m50.416898556s ago: executing program 1 (id=481): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8001, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) close(r1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 4m48.940226705s ago: executing program 1 (id=483): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x20008005}, 0x10888) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) unshare(0x20000000) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, &(0x7f0000000040)=[r0], 0x1}, 0x58) wait4(0x0, 0x0, 0x40000000, 0x0) io_getevents(0x0, 0xe, 0x0, 0x0, 0x0) 4m47.165702873s ago: executing program 1 (id=489): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f00000001c0), 0x1, 0x516, &(0x7f0000000ac0)="$eJzs3ctvY1cZAPDPnjhxMmmTli54tqUtDGg0TuJpo6oLKCuEUCVElyBNg+OJothxFDulCbNIJXZskajECnbwB7Duij0bBDs2ZYHEIwIlIBa3utc3qZOxJ1HzcBT/fpJ1z7nnxt858dxzxl8SnwBG1osRsRsR4xHxTkTM5OcL+SPe7D7S6/b3HtUO9h7VCpEkb/+zkLWn56Lna1K38+csR8T3vx3xo8LjcdvbO2tLjUZ9M6/PdZobc+3tnXurzaWV+kp9vVpdXFicf/3+a9ULG+sLzfG89KWP/rD79Z+k3ZrOz/SO4yJ1h146ipMai4jvXkawIbiVj2d82B3hUylGxLMR8VJ2/8/ErezVBABusiSZiWSmtw4A3HTFLAdWKFbyXMB0FIuVSjeH91xMFRutdufuw9bW+nI3VzYbpeLD1UZ9Ps8VzkapkNYXsvIn9eqJ+v2IeCYifj4xmdUrtVZjeZj/8QGAEXb7xPr/n4nu+g8A3HDlYXcAALhy1n8AGD3WfwAYPdZ/ABg93fV/ctjdAACukPf/ADB6rP8AMFK+99Zb6SM5yD//evnd7a211rv3luvttUpzq1aptTY3Kiut1kr2mT3N056v0WptLLwaW+/NfmOj3Zlrb+88aLa21jsPss/1flAvZVftXsHIAIBBnnnhwz8X0hX5jcnsET17OZSG2jPgshWH3QFgaG4NuwPA0NjtC0bXOd7jSw/ADdFni95jyv3+QChJkuTyugRcsjufk/+HUdWT//dbwDBi5P9hdMn/w+hKksJZ9/yPs14IAFxvcvzAgJ//P5sff5v/cOCHyyev+OAyewUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADX2+H+v5V8L/DpKBYrlYinImI2SoWHq436fEQ8HRF/mihNpPWFIfcZADiv4t8K+f5fd2ZemT7W9Pzto+J4RPz4l2//4r2lTmfzjxHjhX9NHJ7vfJCfr1597wGA0x2u09mx5438/t6j2v7e/2rp8Sr78/dvRUS5G/9gbzwOjuKPxVh2LEcpIqb+XcjrXYWe3MV57L4fEZ/txp/OvgeH8QsxneVAujufnoyfxn7qguPvPzF+8Vj8YtbWPabfi89cQF9g1HyYzj9v9rv/ivFidux//5ezGer88vkvfaraQTYHfhL/cP671RN/Jv+69J7/6VljvPr773RLk4+3vR/x+bGIw9gHPfPPYfzCgPn3lTPG/8sXn39pUFvyq4g70T9+b6y5TnNjrr29c2+1ubRSX6mvV6uLC4vzr99/rTqX5ajnBq8G/3jj7tOD2tLxTw2IXz5l/F854/h//f93fvDlJ8T/2sv94hfjuSfET9fEr54lePqST/2uPKg5jb88YPynvf53zxI/Ij76685j24YDAMPT3t5ZW2o06psKCte/kP6TvQbd6Fv45lXFGo/+TT97uXtPn2hKkk8V69g08ZsvJJkLyroB18HRTR8R/x12ZwAAAAAAAAAAAAAAgL6u4i+Whj1GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbq6PAwAA///KddWP") syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rpc_pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./rpc_pipefs\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./rpc_pipefs/gssd/clntXX/gssd\x00', 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) unshare(0x20000400) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pselect6(0x40, &(0x7f0000000100)={0x9, 0x8000000000000, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, 0x0, 0x0, 0x0, 0x0) 4m45.23421502s ago: executing program 1 (id=498): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_set$pid(0x3, 0x0, 0x6000) setpgid(r3, r3) setpgid(0x0, r3) fchdir(r2) chdir(&(0x7f00000001c0)='./file0\x00') 4m41.974331412s ago: executing program 1 (id=510): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xeffffff9) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) write$eventfd(r3, &(0x7f00000000c0)=0xffffffffffff5eb8, 0x8) read(r3, &(0x7f0000000340)=""/131, 0x83) 4m41.163016172s ago: executing program 34 (id=510): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xeffffff9) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) write$eventfd(r3, &(0x7f00000000c0)=0xffffffffffff5eb8, 0x8) read(r3, &(0x7f0000000340)=""/131, 0x83) 2m44.792164869s ago: executing program 8 (id=894): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x64}, @exit], &(0x7f00000000c0)='GPL\x00'}, 0x90) 2m37.220670743s ago: executing program 8 (id=917): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt_trace\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./mnt_trace\x00', &(0x7f0000001080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./mnt_trace/buffer_size_kb\x00', 0x1, 0x0) write(r0, &(0x7f0000001100)='102', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001140)='./mnt_trace/trace_pipe\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./mnt_trace/trace_marker\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000011c0)='./mnt_trace/trace\x00', 0x0, 0x0) r4 = syz_io_uring_setup(0xf, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001280)=0x0, &(0x7f00000012c0)=0x0, &(0x7f0000001300)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000001340)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x0, &(0x7f00000013c0)=""/4096, 0x1000, 0x0, 0x12345, {0x0, 0x0, 0x0, '\x00', 0x0}}) syz_io_uring_submit(r5, r6, r7, &(0x7f00000023c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r2, 0x0, &(0x7f0000002440)=[{&(0x7f0000002480)='hello\n', 0x6}], 0x1, 0x0, 0x12345, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r4, 0x2, 0x0, 0x0, 0x0, 0x0) close(r3) 2m27.485689012s ago: executing program 8 (id=944): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4cc5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, 0x0, 0x4000000) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 2m26.339025247s ago: executing program 8 (id=947): syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x40, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file7\x00', 0x105042, 0x1ff) linkat(0xffffffffffffff9c, &(0x7f0000000000)='./file4\x00', 0xffffffffffffff9c, &(0x7f00000006c0)='./file5\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000640)='.log\x00', 0xa5d, 0x1) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) 2m23.604026362s ago: executing program 8 (id=953): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x31) socket$inet_mptcp(0x2, 0x1, 0x106) syz_usb_connect$hid(0x4, 0x36, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008040}, 0x40048100) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001", @ANYRESHEX=0x0, @ANYRESHEX], 0xc4}}, 0x20050092) 2m23.161146419s ago: executing program 8 (id=957): syz_emit_ethernet(0x14, &(0x7f0000000040)={@local, @dev, @void, {@generic={0x8863, "d0a70ca9c1aa"}}}, 0x0) r0 = syz_io_uring_setup(0x2, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0x0, 0x304}, &(0x7f0000000240), &(0x7f0000001880), &(0x7f0000000000)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000085000000070000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000200)=r2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000440), 0x0}, 0x20) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000140)={0x0, 0x7, 0x37, "f958ef608b3274b11ce60c549ce3fa80fabf3d12b89cc63d015688866f23ee79770103757a42e05e5f12c94df8f002c1bff9d402281643"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xe0}, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="a6ca047d544ae7ec42b4997c94250a3fcc261d15276014a0837fb9feccd75738a12c4b8a0ee8029580de6f"], &(0x7f00000002c0)={0x20, 0x83, 0x2, "b171"}, &(0x7f0000000300)={0x20, 0x84, 0x3, 'AB\f'}, &(0x7f0000000380)={0x20, 0x85, 0x3, "fad4c0"}}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x21, &(0x7f0000000440), 0x1) 2m22.755808184s ago: executing program 35 (id=957): syz_emit_ethernet(0x14, &(0x7f0000000040)={@local, @dev, @void, {@generic={0x8863, "d0a70ca9c1aa"}}}, 0x0) r0 = syz_io_uring_setup(0x2, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0x0, 0x304}, &(0x7f0000000240), &(0x7f0000001880), &(0x7f0000000000)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000085000000070000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000200)=r2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000440), 0x0}, 0x20) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000140)={0x0, 0x7, 0x37, "f958ef608b3274b11ce60c549ce3fa80fabf3d12b89cc63d015688866f23ee79770103757a42e05e5f12c94df8f002c1bff9d402281643"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xe0}, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="a6ca047d544ae7ec42b4997c94250a3fcc261d15276014a0837fb9feccd75738a12c4b8a0ee8029580de6f"], &(0x7f00000002c0)={0x20, 0x83, 0x2, "b171"}, &(0x7f0000000300)={0x20, 0x84, 0x3, 'AB\f'}, &(0x7f0000000380)={0x20, 0x85, 0x3, "fad4c0"}}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x21, &(0x7f0000000440), 0x1) 1m10.415307787s ago: executing program 9 (id=1166): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000040)={'bridge0\x00', @ifru_ivalue=0x8}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @ifru_ivalue=0x9}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f00000000c0)={'bridge0\x00', @ifru_ivalue=0xa}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000100)={'bridge0\x00', @ifru_ivalue=0xb}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000140)={'bridge0\x00', @ifru_ivalue=0xc}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000180)={'bridge0\x00', @ifru_ivalue=0xd}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f00000001c0)={'bridge0\x00', @ifru_ivalue=0xe}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000200)={'bridge0\x00', @ifru_ivalue=0xf}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000240)={'bridge0\x00', @ifru_ivalue=0x10}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000280)={'bridge0\x00', @ifru_ivalue=0x11}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f00000002c0)={'bridge0\x00', @ifru_ivalue=0x12}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000300)={'bridge0\x00', @ifru_ivalue=0x13}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000340)={'bridge0\x00', @ifru_ivalue=0x14}) 1m0.505729888s ago: executing program 9 (id=1193): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_io_uring_setup(0xeff, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x83, 0x3ac}, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2000c16, &(0x7f0000000240)={[{@orlov}, {@test_dummy_encryption}]}, 0xff, 0x25e, &(0x7f0000000e80)="$eJzs3U1IHGcYB/BnZndr1aXY9lIo/YBSSiuIvRV6sZcWhCJSSqEtWErppUULVulNe8olh+QYkuApFwm5xeQYvEguCYGcTOLBXAKJ5BDJIQnZsDsr+JVo3HUnZH4/WOfDd97nHWb+74g4GEBh9UXEUESUIqI/IioRkWxu8HH26WtuznUvjUXUaj/cTxrtsu3MxnG9ETEbEV9FxGKaxF/liOmFX1YfLn/32dGpyqdnFn7u7uhJNq2trny/fnrkyPnhL6evXr87ksRQVLecV/slu+wrJxHvHEaxV0RSznsE7Mfof+du1HP/bkR80sh/JdLILt6xyTcWK/HFqecde/zetfc7OVag/Wq1Sv0ZOFsDCieNiGok6UBEZOtpOjCQ/Qx/s9ST/j0x+W//nxNT43/kPVMB7VKNWPn2YteF3m35v1PK8g+8prJfSq38ODp/q76yXsp7QEBHfJAt6s///t9mPg/5h8KRfygu+Yfikn8oLvmH4pJ/KC75h4J42vxjv0275B+KS/6huA6c/xNPDm9QQEdszj8AUCy1rgO9Ndzel5CBXOQ9/wAAAAAAAAAAAAAAAAAAADvNdS+NbXza02N5zxaXT0asfZM13Vm/1Ph/xBFvNr72PEi29Jjsq8KL/fpRix206GzOb1+/dTvf+lc+zLf+zHjE7P8RMVgu77z/kub9d3Bv7/H9yu8tFnhJybbtr3/qbP3tHs/nW394OeJSff4Z3G3+SeO9xnL3+adav34t1v/nUYsdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0DHPAgAA///B2nXP") r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x101041, 0x66) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, 0x0) munmap$IORING_OFF_CQ_RING(0x0, 0x9) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 59.432583475s ago: executing program 5 (id=1195): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0x8}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x9, 0x2}}]}}]}, 0x44}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000b00000000000500000014000500200100000000000000000100000000001c00090008"], 0x4c}}, 0x40000) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 58.398175631s ago: executing program 7 (id=1197): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x6}, 0x28) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x4e, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/51, 0x0, &(0x7f0000000500)=""/4092}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000440)=0x8101) 57.786566257s ago: executing program 9 (id=1198): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xfffffffe, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r3, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) 57.670219992s ago: executing program 5 (id=1199): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r2, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r3}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r2, r3) fcntl$setown(r3, 0x8, r1) tkill(r1, 0x13) 54.816846712s ago: executing program 9 (id=1202): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 54.76060709s ago: executing program 5 (id=1204): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 54.679402603s ago: executing program 7 (id=1205): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f0000000100)={0x2}, 0x0) landlock_restrict_self(r1, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x3) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x4907, 0x2, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x0, @local}, 0x1c) 53.522812335s ago: executing program 7 (id=1207): r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000140)=0x1d, 0x4) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000380)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe22, 0x2, @empty}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) 53.318310165s ago: executing program 9 (id=1209): bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) sendto(r3, &(0x7f00000005c0)="a1bfc48ba931fb1ceb70ba6de68925f84d607ce82b9339dda7f5adf00381be33ea1558c858be9d3a5b2aff8f4f59bd095d7034b500b19e0d0524e7bf37b4cec2aad04aacfac1eeca892aa86fe2f21df0a4619b459cb53e0cadf8e3486c5506c18326e1a39911052c19fee16f57ff67c91e3576d08cbca1dbfbdf03bc42498ba5fe9316ab4a80fdaab89a6461775b8f4f23b0f528e97eadd7ca6308c637", 0xfeca, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) 53.20013227s ago: executing program 7 (id=1211): unshare(0x22020600) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = fanotify_init(0x200, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42792000) fanotify_mark(r1, 0x1, 0x1015, r0, 0x0) read(r1, &(0x7f0000000580)=""/190, 0xbe) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000380)="87", 0x1}], 0x1) r3 = fsopen(0x0, 0x1) flistxattr(r3, 0x0, 0xffde) bpf$PROG_LOAD(0x5, 0x0, 0x0) 53.199500207s ago: executing program 5 (id=1212): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() socket$inet6(0xa, 0x80001, 0x0) mremap(&(0x7f000040b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00004b3000/0x4000)=nil) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20000023896) syz_create_resource$binfmt(0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 52.067076442s ago: executing program 9 (id=1214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000c40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xc, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x48000, 0x9, 0x6, 0x4, 0xffff}, 0x8d23}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r3, 0x3c}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)='\'', 0x1}], 0x1}, 0x4011) 52.043104738s ago: executing program 7 (id=1215): socket$kcm(0xa, 0x3, 0x3a) socket$igmp(0x2, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r0, &(0x7f0000000440)="85150e", &(0x7f0000000080)=@udp6=r1, 0x1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000880)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) 50.913673106s ago: executing program 7 (id=1218): r0 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x44004) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1d, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 48.389085162s ago: executing program 5 (id=1220): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000080)=0x80000049, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x101c80) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x0, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) close(r1) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder0\x00', 0x1800, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) 48.048740235s ago: executing program 5 (id=1223): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) gettid() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x11, 0x100a42) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000100)={0x599a}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "2ffc721bedcf4bf0786d492afeb1d73d8cc3698bdf353cf7ab8e19a994f1a8577bdfd0b0cdc22981e5a757496da21cda509c162b7fa8b63bc4046fcd5662210b49478ff1a4588f3ec2941a5c8cbdbb98bfa733512cb0b8c2e49d68d90b7d9431f6e3e046810dc37a686b3aff563ef79a8feadea09407ecfb126830d25f4f7c5fd2113c21b735d14e9dbba547471f48886a0edafe97162e2ef560e24ab9f1032a05c7b2454c01f3c23951d73c10b7088c2cd74644a2b9d5cb9e8b1166e3bcc8bbeca99e73a0be0b9dd8b42dd6fb2fe523331cd313e116b40fa310e055644faaf856172f42ad46fef4838bba4cbf8a3ce142184a0ab21970dd9629aeec5706a52b"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0xfff, 0x3ff, 0x3, 0x19, 0x6, 0x1f, 0x2}}]}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x803}, 0x20004004) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 36.474971603s ago: executing program 36 (id=1214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000c40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xc, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x48000, 0x9, 0x6, 0x4, 0xffff}, 0x8d23}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r3, 0x3c}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)='\'', 0x1}], 0x1}, 0x4011) 35.319365896s ago: executing program 37 (id=1218): r0 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x44004) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1d, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 32.668419502s ago: executing program 38 (id=1223): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) gettid() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x11, 0x100a42) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000100)={0x599a}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "2ffc721bedcf4bf0786d492afeb1d73d8cc3698bdf353cf7ab8e19a994f1a8577bdfd0b0cdc22981e5a757496da21cda509c162b7fa8b63bc4046fcd5662210b49478ff1a4588f3ec2941a5c8cbdbb98bfa733512cb0b8c2e49d68d90b7d9431f6e3e046810dc37a686b3aff563ef79a8feadea09407ecfb126830d25f4f7c5fd2113c21b735d14e9dbba547471f48886a0edafe97162e2ef560e24ab9f1032a05c7b2454c01f3c23951d73c10b7088c2cd74644a2b9d5cb9e8b1166e3bcc8bbeca99e73a0be0b9dd8b42dd6fb2fe523331cd313e116b40fa310e055644faaf856172f42ad46fef4838bba4cbf8a3ce142184a0ab21970dd9629aeec5706a52b"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0xfff, 0x3ff, 0x3, 0x19, 0x6, 0x1f, 0x2}}]}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x803}, 0x20004004) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 10.064542123s ago: executing program 3 (id=1284): r0 = socket$inet(0x2, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)=ANY=[], 0x57) socket$netlink(0x10, 0x3, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0x9fd, 0x85, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000180), 0x800, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000680), &(0x7f0000000540), 0x6c, r2}, 0x38) 9.998453687s ago: executing program 0 (id=1285): io_uring_register$IORING_REGISTER_RESIZE_RINGS(0xffffffffffffffff, 0x21, 0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r2, &(0x7f00000003c0)=""/71, 0xfffffffffffffe83, 0x122, 0x0, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x9) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) 9.11725371s ago: executing program 0 (id=1286): userfaultfd(0x80001) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) inotify_init1(0x0) pipe(&(0x7f00000001c0)) pipe(&(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, 0x0, &(0x7f0000000700)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x2000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x80005c83, 0x40, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x1200, 0x4, 0xffffffff}}], 0x1, 0x0, 0x0) 8.726361682s ago: executing program 3 (id=1288): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, 0x0, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x4, &(0x7f0000000180)=0xffffbfff, 0x4) 7.562595434s ago: executing program 3 (id=1289): syz_usb_connect(0x0, 0x3f, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x442, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x39, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000b40)={r1, 0xffffffffffffffff, 0x39, 0x0, @val=@uprobe_multi={&(0x7f00000008c0)='./file2\x00', &(0x7f0000000900)=[0x2], 0x0, 0x1, 0x1}}, 0x40) 7.30897001s ago: executing program 0 (id=1291): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b"], 0x48) getpeername$netlink(0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB="0000000000000000b702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 6.268690736s ago: executing program 0 (id=1292): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kexec_load(0x0, 0x1, &(0x7f0000000180)=[{0x0, 0x48, 0x0, 0x41000000}], 0x0) socket$kcm(0x29, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) 5.222544755s ago: executing program 0 (id=1293): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000000c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 5.01980944s ago: executing program 6 (id=1294): io_uring_setup(0x667, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x200000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000080)={r5, 0x871f, 0x70}, 0x8) 3.527807063s ago: executing program 0 (id=1295): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5, 0x7, 0xa, 0x40000003, 0xfffffffc}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 3.013905642s ago: executing program 3 (id=1296): setuid(0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000480)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x20}, 0x5000) 3.013040748s ago: executing program 6 (id=1297): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) shutdown(r0, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00006e3000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.741270096s ago: executing program 6 (id=1298): r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e20}, 0xffffffffffffffc1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000680)="6f47aa478b6e40d7a0d54238d5b7f49bbc47602404bf6280f3ab2533c0d8c2747e82b1fd11c2190e73aecaee84d536660efe4c30082b35a08ed2a36921d7786f497326dc21dc6bdc1dd75a0000000000"}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) 1.987033082s ago: executing program 6 (id=1299): gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) close(r2) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r5 = fcntl$dupfd(r2, 0x406, r1) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x2}, 0x8) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000880) close_range(r0, 0xffffffffffffffff, 0x0) 1.884224s ago: executing program 6 (id=1300): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x7, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r3, 0x0, 0x0) write$FUSE_INIT(r3, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/snmp\x00') read$FUSE(r4, &(0x7f0000000440)={0x2020}, 0x2020) 1.85628406s ago: executing program 3 (id=1301): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r3, 0x1) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x41dc, 0x4) recvmmsg(r3, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) 91.962143ms ago: executing program 6 (id=1302): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000010900010073797a300000000008000340000000011400000011000100"], 0x64}}, 0x4000000) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)={0x14, 0x15, 0xa, 0x201}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x24040808) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x40800) 0s ago: executing program 3 (id=1303): syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182395"], 0x0}, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xfffffe40, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x24000800}, 0x10) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000500)={0x28, 0x0, 0x2710, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000001540)=""/4092}) r2 = eventfd(0xf7b2) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000040)={0x0, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) kernel console output (not intermixed with test programs): e=1326 audit(1785268681.082:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7382 comm="syz.3.373" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff2cc75e6ce code=0x7ffc0000 [ 189.706737][ T7022] veth0_vlan: entered promiscuous mode [ 189.804308][ T7022] veth1_vlan: entered promiscuous mode [ 189.829141][ T31] audit: type=1326 audit(1785268681.092:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7382 comm="syz.3.373" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff2cc75e6ce code=0x7ffc0000 [ 190.022100][ T7022] veth0_macvtap: entered promiscuous mode [ 190.118296][ T7022] veth1_macvtap: entered promiscuous mode [ 190.253078][ T7022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 190.329696][ T7022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 190.410942][ T3368] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.463587][ T3368] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.511716][ T3368] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.556840][ T3368] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.020340][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 191.060094][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 191.079001][ T7440] loop6: detected capacity change from 0 to 512 [ 191.144729][ T7440] EXT4-fs (loop6): Test dummy encryption mode enabled [ 191.187958][ T7440] EXT4-fs (loop6): warning: mounting unchecked fs, running e2fsck is recommended [ 191.227009][ T7440] EXT4-fs (loop6): Errors on filesystem, clearing orphan list. [ 191.341071][ T7440] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 191.345880][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 191.397045][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 191.629228][ T5985] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.946402][ T7456] netlink: 12 bytes leftover after parsing attributes in process `syz.7.290'. [ 191.991099][ T7456] netlink: 'syz.7.290': attribute type 5 has an invalid length. [ 192.017825][ T7456] netlink: 4 bytes leftover after parsing attributes in process `syz.7.290'. [ 193.556037][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.568444][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.881269][ T7500] loop6: detected capacity change from 0 to 256 [ 193.941777][ T7500] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xdbae3f17, utbl_chksum : 0xe619d30d) [ 194.045659][ T7500] xt_hashlimit: size too large, truncated to 1048576 [ 194.121122][ T7504] –: renamed from vxcan1 (while UP) [ 194.134230][ T6792] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 194.325265][ T6792] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 194.371487][ T6792] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 194.417488][ T6792] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 194.468935][ T6792] usb 4-1: New USB device found, idVendor=28bd, idProduct=0075, bcdDevice= 0.00 [ 194.513250][ T6792] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.576333][ T6792] usb 4-1: config 0 descriptor?? [ 194.601452][ T7501] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 195.159828][ T6792] hid (null): global environment stack underflow [ 195.564320][ T6792] uclogic 0003:28BD:0075.0001: interface is invalid, ignoring [ 195.754993][ T7525] mtrr: base(0x20000000) is not aligned on a size(0x40000000) boundary [ 195.878536][ T7529] io-wq is not configured for unbound workers [ 197.033137][ T6810] usb 4-1: USB disconnect, device number 2 [ 197.461633][ T7551] loop3: detected capacity change from 0 to 512 [ 197.509141][ T7551] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 197.560551][ T7551] EXT4-fs (loop3): orphan cleanup on readonly fs [ 197.624420][ T7551] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:517: comm syz.3.419: Block bitmap for bg 0 marked uninitialized [ 197.662769][ T7551] loop3: lost filesystem error report for type 5 error -117 [ 197.668015][ T7551] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6679: Corrupt filesystem [ 197.675431][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 197.675455][ C1] EXT4-fs (loop3): initial error at time 1785268690: ext4_read_block_bitmap_nowait:517 [ 197.675485][ C1] EXT4-fs (loop3): last error at time 1785268690: ext4_read_block_bitmap_nowait:517 [ 197.710570][ T7551] loop3: lost filesystem error report for type 5 error -117 [ 197.714864][ T7551] EXT4-fs (loop3): 1 orphan inode deleted [ 197.730363][ T7551] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 197.780419][ T31] kauditd_printk_skb: 19 callbacks suppressed [ 197.780438][ T31] audit: type=1326 audit(1785268690.732:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7559 comm="syz.0.422" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f53f7b9de99 code=0x0 [ 198.005139][ T7564] binder: 7563:7564 ioctl c0306201 0 returned -14 [ 198.049339][ T5626] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.746980][ T7579] netlink: 14 bytes leftover after parsing attributes in process `syz.3.427'. [ 198.816998][ T7583] loop5: detected capacity change from 0 to 512 [ 198.823589][ T6792] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 198.881326][ T7583] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -2 [ 198.907415][ T7583] EXT4-fs error (device loop5): ext4_iget_extra_inode:5180: inode #15: comm syz.5.430: corrupted in-inode xattr: e_value size too large [ 198.983195][ T6792] usb 7-1: Using ep0 maxpacket: 32 [ 198.991461][ T7583] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 198.991940][ T7583] EXT4-fs error (device loop5): ext4_orphan_get:1404: comm syz.5.430: couldn't read orphan inode 15 (err -117) [ 199.001259][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 199.001279][ C0] EXT4-fs (loop5): initial error at time 1785268691: ext4_iget_extra_inode:5180: inode 15 [ 199.001318][ C0] EXT4-fs (loop5): last error at time 1785268691: ext4_iget_extra_inode:5180: inode 15 [ 199.001965][ T6792] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 199.095573][ T6792] usb 7-1: config 0 has no interface number 0 [ 199.113090][ T6792] usb 7-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 199.132801][ T6792] usb 7-1: config 0 interface 1 has no altsetting 0 [ 199.166881][ T6792] usb 7-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 199.172257][ T7583] loop5: lost filesystem error report for type 5 error -117 [ 199.176704][ T6792] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.185761][ T7583] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 199.194082][ T6792] usb 7-1: Product: syz [ 199.210663][ T6792] usb 7-1: Manufacturer: syz [ 199.216977][ T6792] usb 7-1: SerialNumber: syz [ 199.225847][ T6792] usb 7-1: config 0 descriptor?? [ 199.535273][ T5634] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.919964][ T6792] cx231xx 7-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 199.935135][ T6792] cx231xx 7-1:0.1: Failed to read PCB config [ 199.941246][ T6792] cx231xx 7-1:0.1: probe with driver cx231xx failed with error -71 [ 199.959074][ T6792] usb 7-1: USB disconnect, device number 3 [ 200.116204][ T7592] overlayfs: failed to clone upperpath [ 200.472693][ T6792] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 201.173453][ T6792] usb 7-1: Using ep0 maxpacket: 32 [ 201.234826][ T6792] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 201.306716][ T6792] usb 7-1: config 0 has no interface number 0 [ 201.372192][ T6792] usb 7-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 201.464995][ T6792] usb 7-1: config 0 interface 1 has no altsetting 0 [ 201.555609][ T6792] usb 7-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 201.604255][ T6792] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.653296][ T6792] usb 7-1: Product: syz [ 201.678659][ T6792] usb 7-1: Manufacturer: syz [ 201.716255][ T7612] warning: `syz.7.437' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 201.732023][ T6792] usb 7-1: SerialNumber: syz [ 201.789470][ T6792] usb 7-1: config 0 descriptor?? [ 201.835122][ T6792] usb 7-1: can't set config #0, error -71 [ 201.912039][ T6792] usb 7-1: USB disconnect, device number 4 [ 201.992297][ T7614] loop6: detected capacity change from 0 to 128 [ 202.102241][ T7614] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 202.196598][ T7614] ext4 filesystem being mounted at /55/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 202.515782][ T7614] fscrypt: loop6: 2 inode(s) still busy after removing key with identifier 69b2f6edeee720cce0577937eb8a6751, including ino 13 [ 202.744000][ T5985] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 202.823343][ T7623] loop7: detected capacity change from 0 to 512 [ 203.050625][ T7627] loop3: detected capacity change from 0 to 512 [ 203.075469][ T7634] netlink: 24 bytes leftover after parsing attributes in process `syz.5.445'. [ 203.107896][ T7627] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 203.171538][ T7627] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 203.301711][ T7627] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 203.345394][ T7627] EXT4-fs (loop3): 1 truncate cleaned up [ 203.413144][ T7627] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 203.651541][ T7656] Driver unsupported XDP return value 0 on prog (id 37) dev N/A, expect packet loss! [ 204.234604][ T6796] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 204.263198][ T7676] syz_tun: entered allmulticast mode [ 204.285089][ T5626] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.360259][ T7675] syz_tun: left allmulticast mode [ 204.416232][ T6796] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 204.472831][ T6796] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 204.518399][ T6796] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 204.580918][ T6796] usb 2-1: New USB device found, idVendor=18d1, idProduct=502b, bcdDevice= 0.00 [ 204.642137][ T6796] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.679657][ T6796] usb 2-1: config 0 descriptor?? [ 204.732379][ T7664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 205.248575][ T6796] usbhid 2-1:0.0: can't add hid device: -71 [ 205.258744][ T6796] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 205.269948][ T6796] usb 2-1: USB disconnect, device number 4 [ 206.434532][ T7704] netlink: 'syz.6.466': attribute type 27 has an invalid length. [ 207.559863][ T7718] netlink: 'syz.3.471': attribute type 10 has an invalid length. [ 207.618716][ T7704] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.626448][ T7704] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.751003][ T7724] ffs_data_put(): freeing [ 209.193376][ T7704] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.247795][ T7704] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.337468][ T7739] loop1: detected capacity change from 0 to 1024 [ 209.881120][ T7704] ip6erspan0: left allmulticast mode [ 210.297354][ T7752] loop7: detected capacity change from 0 to 32768 [ 210.347001][ T7752] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 210.356888][ T7752] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 210.460226][ T7752] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 1ms [ 210.474596][ T5790] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 210.484022][ T5790] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 210.487337][ T7712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 210.560300][ T7712] 8021q: adding VLAN 0 to HW filter on device team0 [ 210.621840][ T7712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.682496][ T5790] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 198ms [ 210.720142][ T5790] gfs2: fsid=syz:syz.0: jid=0: Done [ 210.746643][ T7752] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 210.828018][ T7712] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.835243][ T7712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 210.952063][ T7712] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.959282][ T7712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 210.992955][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 211.072562][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 211.072724][ T4939] Bluetooth: hci5: command 0x0406 tx timeout [ 211.196668][ T7712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 211.288485][ T7712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 211.406169][ T7712] veth1_vlan: left promiscuous mode [ 211.470260][ T7712] veth0_vlan: left promiscuous mode [ 211.529917][ T7712] veth0_vlan: entered promiscuous mode [ 211.573799][ T7712] veth1_vlan: entered promiscuous mode [ 211.824312][ T7712] veth1_macvtap: left promiscuous mode [ 211.873960][ T7712] veth0_macvtap: left promiscuous mode [ 211.907846][ T7712] veth0_macvtap: entered promiscuous mode [ 211.934630][ T7712] veth1_macvtap: entered promiscuous mode [ 212.036975][ T7712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 212.069520][ T7712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 212.130091][ T7712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 212.145583][ T7712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 212.193709][ T7712] 8021q: adding VLAN 0 to HW filter on device bond1 [ 212.253762][ T7718] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 212.285297][ T7718] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 213.304176][ T7781] syz.0.490 uses obsolete (PF_INET,SOCK_PACKET) [ 213.392392][ T7783] loop6: detected capacity change from 0 to 128 [ 213.459314][ T7788] loop1: detected capacity change from 0 to 512 [ 213.504458][ T7783] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 213.650776][ T7783] ext4 filesystem being mounted at /65/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 213.701360][ T7788] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 213.732022][ T7788] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 213.771584][ T7783] syz.6.491 (pid 7783) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 215.088090][ T5625] EXT4-fs error (device loop1): ext4_lookup:1785: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 215.127303][ T5625] EXT4-fs error (device loop1): ext4_lookup:1785: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 215.158549][ T7797] fscrypt: Adiantum using implementation "adiantum(xchacha12-lib,aes-lib)" [ 215.343455][ T5985] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 215.962458][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 216.288852][ T7749] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.890174][ T7811] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 216.937211][ T7838] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 217.299362][ T3368] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.326944][ T3368] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.453769][ T7850] loop6: detected capacity change from 0 to 128 [ 218.528847][ T7850] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 218.574737][ T7852] loop3: detected capacity change from 0 to 256 [ 218.590264][ T3368] team0: Port device netdevsim1 removed [ 218.615928][ T7852] exfat: Deprecated parameter 'utf8' [ 218.630522][ T3368] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.640940][ T7850] ext4 filesystem being mounted at /69/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 218.660944][ T7852] exfat: Deprecated parameter 'namecase' [ 218.790739][ T7852] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0x01ce8137, utbl_chksum : 0xe619d30d) [ 218.807991][ T3368] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.829171][ T7850] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 218.958223][ T5985] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 219.497843][ T7864] netlink: 596 bytes leftover after parsing attributes in process `syz.0.514'. [ 220.032143][ T7874] loop7: detected capacity change from 0 to 40427 [ 220.076800][ T7874] F2FS-fs (loop7): invalid crc value [ 220.163542][ T7874] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 220.175885][ T7874] F2FS-fs (loop7): f2fs_disable_checkpoint starts, unusable: 0 [ 220.177203][ T5650] Bluetooth: hci2: Unable to find connection for big 0x00 [ 220.184086][ T7874] F2FS-fs (loop7): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 220.184323][ T7874] F2FS-fs (loop7): Start checkpoint disabled! [ 220.439501][ T5645] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 220.456337][ T5645] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 220.466691][ T5645] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 220.479603][ T5645] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 220.495826][ T5645] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 221.178628][ T7874] F2FS-fs (loop7): f2fs_disable_checkpoint finishes, err:0 [ 221.187538][ T7874] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 221.843980][ T7906] syz.7.519: attempt to access beyond end of device [ 221.843980][ T7906] loop7: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 222.600522][ T5650] Bluetooth: hci0: command tx timeout [ 222.680433][ T3368] bond1 (unregistering): (slave ip6erspan0): Releasing active interface [ 222.732233][ T3347] kworker/u8:11: attempt to access beyond end of device [ 222.732233][ T3347] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 222.854095][ T3347] CPU: 1 UID: 0 PID: 3347 Comm: kworker/u8:11 Tainted: G L syzkaller #0 PREEMPT(full) [ 222.854134][ T3347] Tainted: [L]=SOFTLOCKUP [ 222.854143][ T3347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 222.854159][ T3347] Workqueue: writeback wb_workfn (flush-7:7) [ 222.854199][ T3347] Call Trace: [ 222.854208][ T3347] [ 222.854218][ T3347] dump_stack_lvl+0xe8/0x150 [ 222.854259][ T3347] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 222.854301][ T3347] f2fs_write_end_io+0x124b/0x1710 [ 222.854376][ T3347] __submit_merged_bio+0x258/0x6a0 [ 222.854407][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.854436][ T3347] ? rcu_is_watching+0x15/0xb0 [ 222.854471][ T3347] __submit_merged_write_cond+0x3c9/0x4e0 [ 222.854520][ T3347] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 222.854572][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.854614][ T3347] f2fs_write_data_pages+0x2a27/0x36f0 [ 222.854703][ T3347] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 222.854761][ T3347] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 222.854824][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.854863][ T3347] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 222.854924][ T3347] ? __lock_acquire+0x683/0x2cf0 [ 222.854981][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855011][ T3347] ? set_raw_inline+0x28b/0x390 [ 222.855043][ T3347] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 222.855069][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855100][ T3347] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 222.855138][ T3347] do_writepages+0x338/0x560 [ 222.855186][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855213][ T3347] ? reacquire_held_locks+0x104/0x190 [ 222.855237][ T3347] ? writeback_sb_inodes+0x450/0x1b00 [ 222.855280][ T3347] __writeback_single_inode+0x12e/0xf90 [ 222.855334][ T3347] writeback_sb_inodes+0x9de/0x1b00 [ 222.855365][ T3347] ? __lock_acquire+0x683/0x2cf0 [ 222.855421][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855462][ T3347] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 222.855554][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855581][ T3347] ? rcu_is_watching+0x15/0xb0 [ 222.855606][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855633][ T3347] ? queue_io+0x2d3/0x470 [ 222.855672][ T3347] wb_writeback+0x41c/0xad0 [ 222.855711][ T3347] ? queue_io+0x261/0x470 [ 222.855754][ T3347] ? __pfx_wb_writeback+0x10/0x10 [ 222.855785][ T3347] ? do_raw_spin_lock+0x12b/0x2f0 [ 222.855837][ T3347] wb_workfn+0x431/0x10f0 [ 222.855891][ T3347] ? __pfx_wb_workfn+0x10/0x10 [ 222.855918][ T3347] ? rcu_is_watching+0x15/0xb0 [ 222.855942][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.855969][ T3347] ? trace_hrtimer_start+0x82/0x200 [ 222.856011][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856040][ T3347] ? do_raw_spin_lock+0x12b/0x2f0 [ 222.856073][ T3347] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 222.856106][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856138][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856178][ T3347] ? rcu_is_watching+0x15/0xb0 [ 222.856201][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856232][ T3347] ? process_scheduled_works+0xa20/0x14e0 [ 222.856262][ T3347] process_scheduled_works+0xa8e/0x14e0 [ 222.856337][ T3347] ? __pfx_process_scheduled_works+0x10/0x10 [ 222.856376][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856403][ T3347] ? assign_work+0x3cf/0x5d0 [ 222.856440][ T3347] worker_thread+0xa47/0xfb0 [ 222.856510][ T3347] kthread+0x388/0x470 [ 222.856547][ T3347] ? __pfx_worker_thread+0x10/0x10 [ 222.856575][ T3347] ? __pfx_kthread+0x10/0x10 [ 222.856615][ T3347] ret_from_fork+0x514/0xb70 [ 222.856657][ T3347] ? __pfx_ret_from_fork+0x10/0x10 [ 222.856693][ T3347] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.856721][ T3347] ? __switch_to+0xc89/0x1420 [ 222.856760][ T3347] ? __pfx_kthread+0x10/0x10 [ 222.856800][ T3347] ret_from_fork_asm+0x1a/0x30 [ 222.856850][ T3347] [ 223.251463][ T3347] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 223.456932][ T3368] bond0 (unregistering): Released all slaves [ 223.476947][ T3368] bond1 (unregistering): Released all slaves [ 223.505053][ T5284] 8021q: adding VLAN 0 to HW filter on device eth5 [ 223.570808][ T7911] macsec1: entered promiscuous mode [ 223.599514][ T7911] vlan1: entered promiscuous mode [ 223.606767][ T7911] macsec1: entered allmulticast mode [ 223.622159][ T7911] vlan1: entered allmulticast mode [ 223.654988][ T7911] veth0_vlan: entered allmulticast mode [ 223.712756][ T7911] vlan1: left allmulticast mode [ 223.730076][ T7911] veth0_vlan: left allmulticast mode [ 223.770268][ T7911] vlan1: left promiscuous mode [ 224.301407][ T7926] loop5: detected capacity change from 0 to 32768 [ 224.327136][ T7926] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.531 (7926) [ 224.347886][ T7935] bond0: entered promiscuous mode [ 224.380206][ T7935] bond_slave_0: entered promiscuous mode [ 224.415552][ T7935] bond_slave_1: entered promiscuous mode [ 224.432787][ T7935] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 224.451497][ T7926] BTRFS info (device loop5): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 224.523491][ T7926] BTRFS info (device loop5): using blake2b checksum algorithm [ 224.654468][ T3368] hsr_slave_0: left promiscuous mode [ 224.664378][ T7926] BTRFS info (device loop5): enabling ssd optimizations [ 224.671525][ T3368] hsr_slave_1: left promiscuous mode [ 224.677600][ T5645] Bluetooth: hci0: command tx timeout [ 224.686625][ T7926] BTRFS info (device loop5): turning on async discard [ 224.698345][ T7926] BTRFS info (device loop5): enabling free space tree [ 224.706565][ T7926] BTRFS info (device loop5): use zstd compression, level 3 [ 224.730717][ T3368] veth1_macvtap: left promiscuous mode [ 224.777938][ T3368] veth0_macvtap: left promiscuous mode [ 224.827226][ T3368] veth1_vlan: left promiscuous mode [ 224.835567][ T7962] netlink: 8 bytes leftover after parsing attributes in process `syz.7.528'. [ 224.867082][ T3368] veth0_vlan: left promiscuous mode [ 224.903446][ T7962] netlink: 'syz.7.528': attribute type 10 has an invalid length. [ 224.964683][ T7962] netlink: 12 bytes leftover after parsing attributes in process `syz.7.528'. [ 225.220339][ T31] audit: type=1800 audit(1785268718.172:71): pid=7968 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.531" name="bus" dev="loop5" ino=263 res=0 errno=0 [ 225.398576][ T31] audit: type=1800 audit(1785268718.252:72): pid=7926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.531" name="bus" dev="loop5" ino=263 res=0 errno=0 [ 225.959792][ T5634] BTRFS info (device loop5): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 226.366531][ T5645] Bluetooth: hci4: command 0x0406 tx timeout [ 226.762543][ T5650] Bluetooth: hci0: command tx timeout [ 227.073150][ T8000] 9pnet: p9_errstr2errno: server reported unknown error VÔ÷£ä ½Xe) [ 227.482459][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 227.562456][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 227.592455][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 228.822786][ T7962] geneve2: entered promiscuous mode [ 228.828093][ T7962] geneve2: entered allmulticast mode [ 228.842535][ T5650] Bluetooth: hci0: command tx timeout [ 228.851370][ T5284] 8021q: adding VLAN 0 to HW filter on device eth6 [ 228.874600][ T8029] loop3: detected capacity change from 0 to 4096 [ 229.212121][ T8032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.552'. [ 229.338882][ T8029] ntfs3(loop3): failed to convert "0080" to cp869 [ 229.552885][ T6792] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 229.721239][ T6792] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 229.816607][ T6792] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 229.913249][ T6792] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 229.973577][ T6792] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 230.040881][ T6792] usb 8-1: SerialNumber: syz [ 230.457789][ T6792] usb 8-1: 0:2 : does not exist [ 230.501445][ T6792] usb 8-1: unit 48 not found! [ 231.022377][ T6792] usb 8-1: USB disconnect, device number 2 [ 231.420329][ T6247] udevd[6247]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 231.619795][ T7883] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.681961][ T7883] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.745931][ T7883] bridge_slave_0: entered allmulticast mode [ 231.787011][ T7883] bridge_slave_0: entered promiscuous mode [ 231.837853][ T7883] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.865524][ T7883] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.890293][ T7883] bridge_slave_1: entered allmulticast mode [ 231.920369][ T7883] bridge_slave_1: entered promiscuous mode [ 232.148533][ T7883] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 232.202127][ T7883] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 233.442705][ T5284] 8021q: adding VLAN 0 to HW filter on device eth7 [ 233.495400][ T7883] team0: Port device team_slave_0 added [ 233.524447][ T7883] team0: Port device team_slave_1 added [ 233.738615][ T7883] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 233.766093][ T7883] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.862908][ T7883] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 233.936048][ T7883] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 233.972710][ T7883] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 234.083950][ T7883] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 234.496245][ T7883] hsr_slave_0: entered promiscuous mode [ 234.540696][ T7883] hsr_slave_1: entered promiscuous mode [ 234.580091][ T7883] debugfs: 'hsr0' already exists in 'hsr' [ 234.591812][ T7883] Cannot create hsr debugfs directory [ 235.147360][ T8120] loop7: detected capacity change from 0 to 40427 [ 235.229095][ T8120] F2FS-fs (loop7): invalid crc value [ 235.361107][ T8120] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 235.378397][ T8120] F2FS-fs (loop7): f2fs_disable_checkpoint starts, unusable: 0 [ 235.387669][ T8120] F2FS-fs (loop7): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 235.400452][ T8120] F2FS-fs (loop7): Start checkpoint disabled! [ 235.472045][ T8120] F2FS-fs (loop7): f2fs_disable_checkpoint finishes, err:0 [ 235.580837][ T8120] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 236.539102][ T8139] syz.7.574: attempt to access beyond end of device [ 236.539102][ T8139] loop7: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 238.047701][ T3368] kworker/u8:12: attempt to access beyond end of device [ 238.047701][ T3368] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 238.112045][ T3368] CPU: 0 UID: 0 PID: 3368 Comm: kworker/u8:12 Tainted: G L syzkaller #0 PREEMPT(full) [ 238.112082][ T3368] Tainted: [L]=SOFTLOCKUP [ 238.112091][ T3368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 238.112106][ T3368] Workqueue: writeback wb_workfn (flush-7:7) [ 238.112144][ T3368] Call Trace: [ 238.112157][ T3368] [ 238.112166][ T3368] dump_stack_lvl+0xe8/0x150 [ 238.112206][ T3368] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 238.112244][ T3368] f2fs_write_end_io+0x124b/0x1710 [ 238.112305][ T3368] __submit_merged_bio+0x258/0x6a0 [ 238.112335][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.112364][ T3368] ? rcu_is_watching+0x15/0xb0 [ 238.112394][ T3368] __submit_merged_write_cond+0x3c9/0x4e0 [ 238.112438][ T3368] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 238.112486][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.112524][ T3368] f2fs_write_data_pages+0x2a27/0x36f0 [ 238.112602][ T3368] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 238.112653][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.112680][ T3368] ? cfg80211_inform_single_bss_data+0x1499/0x1be0 [ 238.112756][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.112784][ T3368] ? __lock_acquire+0x683/0x2cf0 [ 238.112866][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.112898][ T3368] ? unwind_next_frame+0x8f/0x2550 [ 238.112927][ T3368] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 238.112967][ T3368] do_writepages+0x338/0x560 [ 238.113010][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113038][ T3368] ? reacquire_held_locks+0x104/0x190 [ 238.113062][ T3368] ? writeback_sb_inodes+0x450/0x1b00 [ 238.113103][ T3368] __writeback_single_inode+0x12e/0xf90 [ 238.113147][ T3368] writeback_sb_inodes+0x9de/0x1b00 [ 238.113178][ T3368] ? __lock_acquire+0x683/0x2cf0 [ 238.113231][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113269][ T3368] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 238.113350][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113376][ T3368] ? rcu_is_watching+0x15/0xb0 [ 238.113400][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113427][ T3368] ? queue_io+0x2d3/0x470 [ 238.113464][ T3368] wb_writeback+0x41c/0xad0 [ 238.113500][ T3368] ? queue_io+0x261/0x470 [ 238.113540][ T3368] ? __pfx_wb_writeback+0x10/0x10 [ 238.113570][ T3368] ? do_raw_spin_lock+0x12b/0x2f0 [ 238.113618][ T3368] wb_workfn+0x431/0x10f0 [ 238.113667][ T3368] ? __pfx_wb_workfn+0x10/0x10 [ 238.113693][ T3368] ? rcu_is_watching+0x15/0xb0 [ 238.113716][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113744][ T3368] ? trace_hrtimer_start+0x82/0x200 [ 238.113783][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113811][ T3368] ? do_raw_spin_lock+0x12b/0x2f0 [ 238.113849][ T3368] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 238.113878][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113906][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113938][ T3368] ? rcu_is_watching+0x15/0xb0 [ 238.113959][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.113985][ T3368] ? process_scheduled_works+0xa20/0x14e0 [ 238.114012][ T3368] process_scheduled_works+0xa8e/0x14e0 [ 238.114067][ T3368] ? __pfx_process_scheduled_works+0x10/0x10 [ 238.114099][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.114123][ T3368] ? assign_work+0x3cf/0x5d0 [ 238.114154][ T3368] worker_thread+0xa47/0xfb0 [ 238.114184][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.114219][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.114243][ T3368] ? __kthread_parkme+0x71/0x1f0 [ 238.114282][ T3368] kthread+0x388/0x470 [ 238.114315][ T3368] ? __pfx_worker_thread+0x10/0x10 [ 238.114342][ T3368] ? __pfx_kthread+0x10/0x10 [ 238.114377][ T3368] ret_from_fork+0x514/0xb70 [ 238.114413][ T3368] ? __pfx_ret_from_fork+0x10/0x10 [ 238.114445][ T3368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 238.114469][ T3368] ? __switch_to+0xc89/0x1420 [ 238.114500][ T3368] ? __pfx_kthread+0x10/0x10 [ 238.114534][ T3368] ret_from_fork_asm+0x1a/0x30 [ 238.114572][ T3368] [ 238.502402][ T3368] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 238.549722][ T7883] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 238.568373][ T7883] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 238.576572][ T7883] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 238.584564][ T6820] loop7: lost filesystem error report for type 5 error -108 [ 238.605254][ T7883] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 238.621755][ T7883] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 238.636596][ T7883] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 238.644717][ T7883] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 238.657119][ T7883] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 238.950732][ T5284] 8021q: adding VLAN 0 to HW filter on device eth8 [ 239.036347][ T7883] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.138261][ T7883] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.186244][ T6746] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.193447][ T6746] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.309732][ T3368] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.317000][ T3368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.044862][ T8229] loop3: detected capacity change from 0 to 164 [ 244.292129][ T7883] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 245.159348][ T8284] netlink: 'syz.5.613': attribute type 27 has an invalid length. [ 245.384251][ T8284] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.391666][ T8284] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.765402][ T8284] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.840788][ T8284] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 246.691688][ T8284] vlan2: left allmulticast mode [ 246.721197][ T8284] bond2: left allmulticast mode [ 246.739969][ T8284] geneve2: left allmulticast mode [ 246.749452][ T3368] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.961642][ T8286] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.978608][ T8286] 8021q: adding VLAN 0 to HW filter on device team0 [ 246.999665][ T8286] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 249.167476][ T8286] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.174690][ T8286] bridge0: port 1(bridge_slave_0) entered listening state [ 249.191561][ T8286] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.198736][ T8286] bridge0: port 2(bridge_slave_1) entered listening state [ 249.352295][ T8286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 249.418905][ T8286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 249.460260][ T8324] fuse: fd is not a fuse device [ 249.476859][ T8325] netlink: 4 bytes leftover after parsing attributes in process `syz.3.625'. [ 249.531052][ T8286] veth1_vlan: left promiscuous mode [ 249.559528][ T8286] veth0_vlan: left promiscuous mode [ 249.592226][ T8286] veth0_vlan: entered promiscuous mode [ 249.645713][ T8286] veth1_vlan: entered promiscuous mode [ 249.720370][ T8286] veth1_macvtap: left promiscuous mode [ 249.746341][ T8286] veth1_macvtap: entered promiscuous mode [ 249.765889][ T8286] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 249.775657][ T8286] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 249.785701][ T8286] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 249.796173][ T8286] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 249.811071][ T8286] 8021q: adding VLAN 0 to HW filter on device bond1 [ 249.821139][ T8286] 8021q: adding VLAN 0 to HW filter on device bond2 [ 249.837715][ T8286] veth0_to_team: entered promiscuous mode [ 249.934158][ T8336] CUSE: zero length info key specified [ 250.168380][ T6745] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.385962][ T8346] bridge_slave_0: left allmulticast mode [ 250.401788][ T8346] bridge_slave_0: left promiscuous mode [ 250.411606][ T8346] bridge0: port 1(bridge_slave_0) entered disabled state [ 250.447395][ T8346] bridge_slave_1: left allmulticast mode [ 250.477285][ T8346] bridge_slave_1: left promiscuous mode [ 250.489679][ T8346] bridge0: port 2(bridge_slave_1) entered disabled state [ 250.511165][ T8346] bond0: (slave bond_slave_0): Releasing backup interface [ 250.541073][ T8346] bond0: (slave bond_slave_1): Releasing backup interface [ 250.575412][ T8346] team0: Port device team_slave_0 removed [ 250.610692][ T8346] team0: Port device team_slave_1 removed [ 250.626494][ T8346] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 250.634614][ T8346] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 250.647943][ T8346] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 250.656909][ T8346] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 250.671480][ T8346] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 250.780310][ T8349] team0: Mode changed to "loadbalance" [ 250.856348][ T7883] veth0_vlan: entered promiscuous mode [ 250.946353][ T7883] veth1_vlan: entered promiscuous mode [ 251.096967][ T7883] veth0_macvtap: entered promiscuous mode [ 251.113750][ T8360] loop7: detected capacity change from 0 to 256 [ 251.138102][ T7883] veth1_macvtap: entered promiscuous mode [ 252.321408][ T8360] exFAT-fs (loop7): failed to load upcase table (idx : 0x00011f1c, chksum : 0x850fc7e5, utbl_chksum : 0xe619d30d) [ 252.530632][ T7883] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 252.637549][ T7883] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 252.717591][ T6746] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.737181][ T6746] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.812051][ T6746] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.847983][ T6746] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.004630][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.011526][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.171454][ T3368] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.179688][ T3368] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 255.245984][ T3299] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.255039][ T3299] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 256.124153][ T0] NOHZ tick-stop error: local softirq work is pending, handler #20a!!! [ 257.506679][ T6820] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 258.470004][ T6820] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 258.513766][ T6820] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.556989][ T6820] usb 9-1: Product: syz [ 258.579107][ T6820] usb 9-1: Manufacturer: syz [ 258.615503][ T6820] usb 9-1: SerialNumber: syz [ 259.043274][ T8426] syzkaller0: entered promiscuous mode [ 259.056300][ T8434] netlink: 4 bytes leftover after parsing attributes in process `syz.5.654'. [ 259.117699][ T8426] syzkaller0: entered allmulticast mode [ 259.230647][ T6820] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 259.288079][ T8444] loop7: detected capacity change from 0 to 256 [ 259.459731][ T8447] FAT-fs (loop7): error, clusters badly computed (2 != 1) [ 259.467318][ T8447] FAT-fs (loop7): Filesystem has been set read-only [ 260.384974][ T6820] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 260.525862][ T6820] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 260.652435][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 260.676366][ T6820] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 260.767099][ T6820] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 261.061518][ T6820] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -71 [ 261.152038][ T6820] usb 9-1: USB disconnect, device number 2 [ 261.571776][ T8447] FAT-fs (loop7): error, fat_get_cluster: detected the cluster chain loop (i_pos 198) [ 261.584860][ T6820] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 261.601030][ T8447] FAT-fs (loop7): error, fat_free: invalid cluster chain (i_pos 198) [ 261.977310][ T8462] loop5: detected capacity change from 0 to 40427 [ 261.984767][ T8462] F2FS-fs: heap/no_heap options were deprecated [ 262.008453][ T6820] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 262.020941][ T6820] usb 9-1: config 0 has no interface number 0 [ 262.028496][ T8462] F2FS-fs (loop5): build fault injection rate: 19 [ 262.035209][ T8462] F2FS-fs (loop5): build fault injection type: 0x3bfe8c [ 262.043911][ T8462] F2FS-fs (loop5): invalid crc value [ 262.052932][ T6820] usb 9-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 262.080904][ T8462] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of f2fs_build_free_nids+0xa00/0x18c0 [ 262.102496][ T6820] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 262.156071][ T8462] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of read_node_folio+0x21d/0x3d0 [ 262.182541][ T8462] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 262.195253][ T8462] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 262.204320][ T6820] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.212379][ T6820] usb 9-1: Product: syz [ 262.240136][ T6820] usb 9-1: Manufacturer: syz [ 262.249039][ T6820] usb 9-1: SerialNumber: syz [ 262.277653][ T6820] usb 9-1: config 0 descriptor?? [ 262.354724][ T8462] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of f2fs_get_dnode_of_data+0xa60/0x1ee0 [ 262.374870][ T6820] yurex 9-1:0.50: Could not find endpoints [ 262.405516][ T8462] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x3a1/0xdc0 [ 262.421146][ T8462] F2FS-fs (loop5): inject no more block in inc_valid_node_count of f2fs_new_node_folio+0x355/0xdc0 [ 262.449504][ T8462] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of f2fs_find_data_folio+0x3a3/0x6d0 [ 262.469520][ T8462] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x3a1/0xdc0 [ 262.569533][ T8462] F2FS-fs (loop5): inject inconsistent footer in f2fs_sanity_check_node_footer of __get_node_folio+0x8c1/0xdf0 [ 262.583069][ T8462] F2FS-fs (loop5): inconsistent node block, node_type:1, nid:20, node_footer[nid:20,ino:20,ofs:0,cpver:0,blkaddr:0] [ 262.794869][ T8462] syz.5.660: attempt to access beyond end of device [ 262.794869][ T8462] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 262.811302][ T8462] CPU: 0 UID: 0 PID: 8462 Comm: syz.5.660 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.811342][ T8462] Tainted: [L]=SOFTLOCKUP [ 262.811351][ T8462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 262.811366][ T8462] Call Trace: [ 262.811375][ T8462] [ 262.811386][ T8462] dump_stack_lvl+0xe8/0x150 [ 262.811433][ T8462] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 262.811474][ T8462] f2fs_write_end_io+0x124b/0x1710 [ 262.811537][ T8462] __submit_merged_bio+0x258/0x6a0 [ 262.811569][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.811599][ T8462] ? rcu_is_watching+0x15/0xb0 [ 262.811631][ T8462] __submit_merged_write_cond+0x3c9/0x4e0 [ 262.811675][ T8462] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 262.811725][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.811765][ T8462] f2fs_write_data_pages+0x2a27/0x36f0 [ 262.811802][ T8462] ? unwind_get_return_address+0x4d/0x90 [ 262.811879][ T8462] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 262.811969][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.811996][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812026][ T8462] ? __bfs+0x153/0x290 [ 262.812062][ T8462] ? __pfx_hlock_conflict+0x10/0x10 [ 262.812094][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812137][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812165][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812194][ T8462] ? __lock_acquire+0x13e8/0x2cf0 [ 262.812262][ T8462] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 262.812302][ T8462] do_writepages+0x338/0x560 [ 262.812341][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812373][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812406][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812435][ T8462] ? do_raw_spin_unlock+0xf5/0x210 [ 262.812471][ T8462] filemap_fdatawrite+0x1e9/0x2f0 [ 262.812513][ T8462] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 262.812593][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812626][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.812660][ T8462] ? do_raw_spin_unlock+0xf5/0x210 [ 262.812695][ T8462] f2fs_sync_dirty_inodes+0x30e/0x830 [ 262.812753][ T8462] f2fs_write_checkpoint+0xa3d/0x2710 [ 262.812838][ T8462] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 262.812920][ T8462] ? __pfx_down_write+0x10/0x10 [ 262.812961][ T8462] ? rcu_is_watching+0x15/0xb0 [ 262.812987][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813021][ T8462] f2fs_issue_checkpoint+0x424/0x6f0 [ 262.813049][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813077][ T8462] ? check_path+0x21/0x40 [ 262.813107][ T8462] ? __pfx_f2fs_issue_checkpoint+0x10/0x10 [ 262.813134][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813162][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813191][ T8462] ? __lock_acquire+0x13e8/0x2cf0 [ 262.813233][ T8462] ? irqentry_exit+0x218/0x8f0 [ 262.813289][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813316][ T8462] ? __up_read+0x29c/0x930 [ 262.813368][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813397][ T8462] ? f2fs_sync_fs+0x1f2/0x3c0 [ 262.813432][ T8462] f2fs_do_sync_file+0xcd3/0x1960 [ 262.813478][ T8462] ? __pfx_f2fs_do_sync_file+0x10/0x10 [ 262.813557][ T8462] ? __fget_files+0x2a/0x420 [ 262.813591][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813619][ T8462] ? __fget_files+0x3a2/0x420 [ 262.813653][ T8462] ? __fget_files+0x2a/0x420 [ 262.813690][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.813715][ T8462] ? srso_alias_return_thunk+0x5/0xfbef5 [ 262.813742][ T8462] ? f2fs_sync_file+0xe9/0x160 [ 262.813776][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.813801][ T8462] ? __pfx_f2fs_sync_file+0x10/0x10 [ 262.813840][ T8462] __x64_sys_fdatasync+0xb9/0x110 [ 262.813870][ T8462] do_syscall_64+0x174/0x580 [ 262.813898][ T8462] ? trace_irq_disable+0x3b/0x140 [ 262.813940][ T8462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.813966][ T8462] RIP: 0033:0x7fea8b79de99 [ 262.813988][ T8462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.814010][ T8462] RSP: 002b:00007fea8c5ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000004b [ 262.814036][ T8462] RAX: ffffffffffffffda RBX: 00007fea8ba25fa0 RCX: 00007fea8b79de99 [ 262.814055][ T8462] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 262.814070][ T8462] RBP: 00007fea8b833eaf R08: 0000000000000000 R09: 0000000000000000 [ 262.814086][ T8462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 262.814101][ T8462] R13: 00007fea8ba26038 R14: 00007fea8ba25fa0 R15: 00007ffeddb61ac8 [ 262.814140][ T8462] [ 263.259903][ T8462] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 263.327140][ T8479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.378739][ T8479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.576984][ T6820] usb 9-1: USB disconnect, device number 3 [ 264.830025][ T8510] loop5: detected capacity change from 0 to 512 [ 265.832959][ T8510] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 266.779926][ T8535] evm: overlay not supported [ 266.791809][ T8536] loop5: detected capacity change from 0 to 1024 [ 266.820201][ T8536] EXT4-fs: Mount option(s) incompatible with ext3 [ 268.505470][ T8548] input: syz1 as /devices/virtual/input/input5 [ 268.591307][ T6247] udevd[6247]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 269.181114][ T8556] netlink: 'syz.5.682': attribute type 1 has an invalid length. [ 269.317111][ T8558] netlink: 28 bytes leftover after parsing attributes in process `syz.5.682'. [ 269.591408][ T8520] netlink: 8 bytes leftover after parsing attributes in process `syz.0.670'. [ 270.080218][ T8557] bond3: (slave geneve3): making interface the new active one [ 270.104858][ T8557] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 270.138409][ T8558] 8021q: adding VLAN 0 to HW filter on device bond3 [ 270.202861][ T7491] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 270.234817][ T7491] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 270.282086][ T3347] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 270.335956][ T3347] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 271.152432][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 271.182441][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 271.651931][ T8595] netlink: 8 bytes leftover after parsing attributes in process `syz.5.692'. [ 271.883621][ T8595] netlink: 8 bytes leftover after parsing attributes in process `syz.5.692'. [ 274.222799][ T8640] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 274.235012][ T6820] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 274.702137][ T8643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.738560][ T8643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.980642][ T8656] netlink: 12 bytes leftover after parsing attributes in process `syz.3.707'. [ 277.482172][ T6820] usb 6-1: unable to get BOS descriptor or descriptor too short [ 277.509464][ T8676] netlink: 8 bytes leftover after parsing attributes in process `syz.6.711'. [ 277.517371][ T6820] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 277.557953][ T6820] usb 6-1: can't read configurations, error -71 [ 277.622532][ T31] audit: type=1804 audit(1785268770.572:73): pid=8684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.712" name="bus" dev="ramfs" ino=19659 res=1 errno=0 [ 277.716573][ T31] audit: type=1804 audit(1785268770.602:74): pid=8686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.712" name="bus" dev="ramfs" ino=19659 res=1 errno=0 [ 279.275092][ T8718] netlink: 4 bytes leftover after parsing attributes in process `syz.7.720'. [ 279.314469][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 279.324357][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 280.814953][ T8738] loop8: detected capacity change from 0 to 128 [ 282.334566][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 282.456533][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 282.582302][ T8754] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 282.691851][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 282.781996][ T8758] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 283.052640][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 283.187367][ T8754] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 284.079503][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 284.170209][ T8754] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 284.201715][ T31] audit: type=1326 audit(1785268777.142:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 284.347084][ T8748] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 284.992361][ T31] audit: type=1326 audit(1785268777.152:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.018470][ T31] audit: type=1326 audit(1785268777.182:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.200730][ T31] audit: type=1326 audit(1785268777.182:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.319737][ T31] audit: type=1326 audit(1785268777.182:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.387383][ T8775] netlink: 64 bytes leftover after parsing attributes in process `syz.8.739'. [ 285.440110][ T31] audit: type=1326 audit(1785268777.182:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.520896][ T31] audit: type=1326 audit(1785268777.192:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 285.826955][ T31] audit: type=1326 audit(1785268777.192:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 286.196271][ T31] audit: type=1326 audit(1785268777.192:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 286.482569][ T31] audit: type=1326 audit(1785268777.192:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8769 comm="syz.6.737" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7099de99 code=0x7ffc0000 [ 286.490744][ T8785] netlink: 'syz.7.743': attribute type 11 has an invalid length. [ 286.568256][ T8780] loop6: detected capacity change from 0 to 4096 [ 286.586654][ T8780] EXT4-fs: inline encryption not supported [ 286.626478][ T8780] EXT4-fs: Ignoring removed bh option [ 286.887574][ T8780] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 287.876821][ T5645] Bluetooth: hci3: command 0x0406 tx timeout [ 287.885189][ T8780] EXT4-fs (loop6): can't mount with data=, fs mounted w/o journal [ 290.012918][ T8817] Process accounting resumed [ 295.427189][ T8857] netlink: 8 bytes leftover after parsing attributes in process `syz.5.762'. [ 295.475037][ T8857] netlink: 8 bytes leftover after parsing attributes in process `syz.5.762'. [ 295.683301][ T8859] netlink: 24 bytes leftover after parsing attributes in process `syz.3.763'. [ 297.468466][ T8898] loop6: detected capacity change from 0 to 1024 [ 299.071208][ T8922] loop3: detected capacity change from 0 to 512 [ 299.245872][ T8922] EXT4-fs error (device loop3): ext4_orphan_get:1399: inode #15: comm syz.3.781: iget: bad i_size value: 38620345925642 [ 299.358244][ T8927] netlink: 20 bytes leftover after parsing attributes in process `syz.6.783'. [ 299.407879][ T8922] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 299.411978][ T8922] EXT4-fs error (device loop3): ext4_orphan_get:1404: comm syz.3.781: couldn't read orphan inode 15 (err -117) [ 299.421304][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 299.421337][ C0] EXT4-fs (loop3): initial error at time 1785268792: ext4_orphan_get:1399: inode 15 [ 299.421378][ C0] EXT4-fs (loop3): last error at time 1785268792: ext4_orphan_get:1399: inode 15 [ 299.498282][ T8922] loop3: lost filesystem error report for type 5 error -117 [ 299.519778][ T8922] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 299.674327][ T31] kauditd_printk_skb: 42 callbacks suppressed [ 299.674349][ T31] audit: type=1800 audit(1785268792.632:127): pid=8912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.778" name="bus" dev="ramfs" ino=20018 res=0 errno=0 [ 299.739801][ T8927] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 299.943872][ T8922] EXT4-fs error (device loop3): ext4_validate_block_bitmap:432: comm syz.3.781: bg 0: block 5: invalid block bitmap [ 300.053646][ T8933] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.061031][ T8933] bridge0: port 1(bridge_slave_0) entered disabled state [ 300.136504][ T8922] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 12 with error 28 [ 300.232594][ T8922] EXT4-fs (loop3): This should not happen!! Data will be lost [ 300.232594][ T8922] [ 300.421398][ T8922] EXT4-fs (loop3): Total free blocks count 0 [ 300.692569][ T8922] EXT4-fs (loop3): Free/Dirty block details [ 300.837941][ T8922] EXT4-fs (loop3): free_blocks=0 [ 301.420863][ T8922] EXT4-fs (loop3): dirty_blocks=16 [ 301.473981][ T8922] EXT4-fs (loop3): Block reservation details [ 301.512533][ T8922] EXT4-fs (loop3): i_reserved_data_blocks=16 [ 301.900403][ T8933] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 302.823207][ T8922] EXT4-fs (loop3): shut down requested (0) [ 302.872332][ T8933] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 304.664379][ T5626] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 305.710209][ T7493] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.890166][ T7493] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 305.988135][ T7493] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.004453][ T7493] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 306.014083][ T7493] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.043044][ T7493] netdevsim netdevsim5 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 306.070518][ T8979] binder: BINDER_SET_CONTEXT_MGR already set [ 306.094947][ T8979] binder: 8978:8979 ioctl 4018620d 200000004a80 returned -16 [ 306.124269][ T7491] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.409011][ T7491] netdevsim netdevsim5 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 306.524407][ T8988] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 306.686489][ T8992] netlink: 14 bytes leftover after parsing attributes in process `syz.0.801'. [ 306.782698][ T8992] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 307.067744][ T8992] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 308.138968][ T8992] bond0 (unregistering): Released all slaves [ 310.159144][ T9035] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 310.469438][ T31] audit: type=1326 audit(1785268803.422:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9033 comm="syz.7.810" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f42bcf9de99 code=0x0 [ 316.375933][ T9074] binder: 9072:9074 unknown command 0 [ 316.438371][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.446248][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.477260][ T9074] binder: 9072:9074 ioctl c0306201 2000000001c0 returned -22 [ 317.516767][ T9084] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 317.614425][ T31] audit: type=1326 audit(1785268810.492:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53f7b9de99 code=0x7ffc0000 [ 317.803599][ T31] audit: type=1326 audit(1785268810.502:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53f7b9de99 code=0x7ffc0000 [ 317.830915][ T31] audit: type=1326 audit(1785268810.502:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f53f7b9de99 code=0x7ffc0000 [ 317.855669][ T31] audit: type=1326 audit(1785268810.502:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53f7b9de99 code=0x7ffc0000 [ 317.881412][ T31] audit: type=1326 audit(1785268810.502:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53f7b9de99 code=0x7ffc0000 [ 317.884989][ T5771] IPVS: starting estimator thread 0... [ 317.906403][ T31] audit: type=1326 audit(1785268810.592:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f53f7b5e6ce code=0x7ffc0000 [ 317.936212][ T31] audit: type=1326 audit(1785268810.602:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f53f7b5e6ce code=0x7ffc0000 [ 317.961021][ T31] audit: type=1326 audit(1785268810.612:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f53f7b5e6ce code=0x7ffc0000 [ 318.062034][ T31] audit: type=1326 audit(1785268810.632:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f53f7b5e6ce code=0x7ffc0000 [ 318.195428][ T9091] IPVS: using max 27 ests per chain, 64800 per kthread [ 318.670290][ T31] audit: type=1326 audit(1785268810.652:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9077 comm="syz.0.825" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f53f7b5e6ce code=0x7ffc0000 [ 318.932883][ T5650] Bluetooth: hci3: unexpected cc 0x203e length: 2 > 1 [ 318.943139][ T5650] Bluetooth: hci3: unexpected event for opcode 0x203e [ 319.139460][ T9112] netlink: 'syz.6.834': attribute type 1 has an invalid length. [ 319.341190][ T9115] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 319.410245][ T9112] netlink: 28 bytes leftover after parsing attributes in process `syz.6.834'. [ 319.468724][ T9112] 8021q: adding VLAN 0 to HW filter on device bond2 [ 319.872824][ T9129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.839'. [ 320.014254][ T9133] netlink: 8 bytes leftover after parsing attributes in process `syz.0.839'. [ 320.065164][ T9132] netlink: 8 bytes leftover after parsing attributes in process `syz.5.840'. [ 320.385958][ T9136] loop8: detected capacity change from 0 to 2048 [ 320.854371][ T9142] fuse: Bad value for 'fd' [ 320.888422][ T9136] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=4096, location=4096 [ 320.922594][ T9136] UDF-fs: error (device loop8): udf_process_sequence: Primary Volume Descriptor not found! [ 320.986405][ T9136] UDF-fs: error (device loop8): udf_process_sequence: Primary Volume Descriptor not found! [ 321.008757][ T9136] UDF-fs: Scanning with blocksize 512 failed [ 321.488929][ T9136] UDF-fs: warning (device loop8): udf_load_vrs: No anchor found [ 321.496944][ T9136] UDF-fs: Scanning with blocksize 1024 failed [ 321.540741][ T9136] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=512, location=512 [ 321.574266][ T9136] UDF-fs: warning (device loop8): udf_load_vrs: No anchor found [ 321.606353][ T9136] UDF-fs: Scanning with blocksize 2048 failed [ 321.631317][ T9136] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=256, location=256 [ 321.720257][ T9136] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=512, location=512 [ 321.742968][ T9136] UDF-fs: warning (device loop8): udf_load_vrs: No anchor found [ 321.779179][ T9136] UDF-fs: Scanning with blocksize 4096 failed [ 321.798354][ T9136] UDF-fs: warning (device loop8): udf_fill_super: No partition found (1) [ 322.054191][ T9136] loop8: detected capacity change from 0 to 4096 [ 322.068872][ T9136] ntfs3(loop8): Different NTFS sector size (2048) and media sector size (512). [ 323.132815][ T5650] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 323.143228][ T5650] Bluetooth: hci3: Injecting HCI hardware error event [ 323.151780][ T5650] Bluetooth: hci3: hardware error 0x00 [ 323.234007][ T9136] ntfs3(loop8): Failed to read $AttrDef (-4). [ 323.614829][ T9165] netlink: 16 bytes leftover after parsing attributes in process `syz.0.852'. [ 323.790196][ T9167] tipc: Started in network mode [ 323.807116][ T9167] tipc: Node identity , cluster identity 4711 [ 323.838547][ T9167] tipc: Failed to obtain node identity [ 323.870735][ T9167] tipc: Enabling of bearer rejected, failed to enable media [ 325.313527][ T5650] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 325.952052][ T9192] geneve1: entered promiscuous mode [ 325.961111][ T9192] macsec1: entered allmulticast mode [ 326.029851][ T9192] geneve1: entered allmulticast mode [ 326.146145][ T9192] geneve1: left allmulticast mode [ 326.375809][ T9192] geneve1: left promiscuous mode [ 329.543382][ T9222] loop8: detected capacity change from 0 to 128 [ 329.685838][ T9222] ext4: Unknown parameter 'fsmagic' [ 330.354414][ T9233] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 330.393645][ T9234] netlink: 16 bytes leftover after parsing attributes in process `syz.6.873'. [ 331.937810][ T9262] syzkaller0: entered promiscuous mode [ 332.093551][ T9262] syzkaller0: entered allmulticast mode [ 332.187218][ T9265] tipc: Failed to remove unknown binding: 66,0,0/0:2943037320/2943037322 [ 332.223943][ T9259] tipc: Failed to remove unknown binding: 66,0,0/0:45462368/45462369 [ 332.283721][ T9259] tipc: Failed to remove unknown binding: 66,0,0/0:45462368/45462369 [ 334.052160][ T5650] Bluetooth: hci0: Unknown advertising packet type: 0x18 [ 334.052214][ T5650] Bluetooth: hci0: Unknown advertising packet type: 0x1e [ 334.065044][ T5650] Bluetooth: hci0: Unknown advertising packet type: 0x30 [ 334.078223][ T5650] Bluetooth: hci0: Malformed LE Event: 0x0d [ 337.342248][ T9338] netlink: 68 bytes leftover after parsing attributes in process `syz.0.903'. [ 342.238713][ T9379] 0x000000000006-0x000000020000 : "" [ 342.370970][ T9379] ftl_cs: FTL header corrupt! [ 346.054984][ T9407] bridge0: port 3(syz_tun) entered blocking state [ 346.064392][ T9407] bridge0: port 3(syz_tun) entered disabled state [ 346.071504][ T9407] syz_tun: entered allmulticast mode [ 346.091746][ T9407] bridge0: port 3(syz_tun) entered blocking state [ 346.100792][ T9407] bridge0: port 3(syz_tun) entered forwarding state [ 347.139808][ T9407] bridge0: port 4(batadv0) entered blocking state [ 347.245305][ T9407] bridge0: port 4(batadv0) entered disabled state [ 347.337465][ T9407] batadv0: entered allmulticast mode [ 347.415702][ T9407] batadv0: entered promiscuous mode [ 347.445997][ T9407] bridge0: port 4(batadv0) entered blocking state [ 347.452648][ T9407] bridge0: port 4(batadv0) entered forwarding state [ 347.708156][ T7487] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 347.718114][ T7487] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 351.837902][ T9457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 352.567582][ T9470] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 352.591093][ T9470] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 354.187762][ T9492] loop8: detected capacity change from 0 to 64 [ 354.362456][ T9491] loop7: detected capacity change from 0 to 4096 [ 354.428608][ T9491] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 354.473230][ T9491] UDF-fs: Scanning with blocksize 512 failed [ 354.572898][ T9491] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 356.247865][ T5357] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 356.270823][ T7883] BFS-fs: bfs_iget(): Bad inode number loop8:0000fe02 [ 356.346983][ T7883] BFS-fs: bfs_iget(): Bad inode number loop8:0000fe02 [ 356.455299][ T5357] usb 8-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 356.495367][ T5357] usb 8-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 356.545049][ T5357] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.659389][ T5357] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 357.288347][ T7491] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.497620][ T7491] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.663806][ T9527] binder: 9524:9527 ioctl 4018620d 0 returned -22 [ 357.695715][ T9527] binder: 9524:9527 ioctl c0306201 0 returned -14 [ 357.714683][ T5357] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 357.738972][ T5357] stv0680 8-1:4.0: STV(e): camera ping failed!! [ 357.760902][ T7491] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.783388][ T5357] stv0680 8-1:4.0: last error: 39, command = 0xd5 [ 358.046433][ T5357] usb 8-1: USB disconnect, device number 3 [ 358.127229][ T5645] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 358.142601][ T5645] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 358.156773][ T5645] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 358.165067][ T7491] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.184803][ T5645] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 358.198513][ T5645] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 358.710567][ T9552] loop6: detected capacity change from 0 to 32768 [ 358.718391][ T9552] btrfs: Deprecated parameter 'usebackuproot' [ 358.724740][ T9552] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 358.737184][ T9552] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.968 (9552) [ 358.777173][ T9552] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 358.787347][ T9552] BTRFS info (device loop6): using crc32c checksum algorithm [ 358.888418][ T49] BTRFS warning (device loop6): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 358.966033][ T9552] BTRFS error (device loop6): failed to load root extent [ 358.973277][ T9552] BTRFS warning (device loop6): try to load backup roots slot 1 [ 358.996073][ T7489] BTRFS warning (device loop6): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 359.042718][ T9552] BTRFS warning (device loop6): couldn't read tree root [ 359.049765][ T9552] BTRFS warning (device loop6): try to load backup roots slot 2 [ 359.064136][ T49] BTRFS error (device loop6): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 359.120765][ T9552] BTRFS warning (device loop6): couldn't read tree root [ 359.127894][ T9552] BTRFS warning (device loop6): try to load backup roots slot 3 [ 359.200672][ T9552] BTRFS info (device loop6): rebuilding free space tree [ 359.258549][ T9552] BTRFS info (device loop6): checking UUID tree [ 359.267353][ T9552] BTRFS info (device loop6): enabling ssd optimizations [ 359.274892][ T9552] BTRFS info (device loop6): turning on async discard [ 359.281714][ T9552] BTRFS info (device loop6): enabling free space tree [ 359.288579][ T9552] BTRFS info (device loop6): force clearing of disk cache [ 359.295915][ T9552] BTRFS info (device loop6): enabling auto defrag [ 359.302443][ T9552] BTRFS info (device loop6): trying to use backup root at mount time [ 359.310778][ T9552] BTRFS info (device loop6): use zstd compression, level 3 [ 360.724561][ T5650] Bluetooth: hci0: command tx timeout [ 360.948730][ T5985] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 361.332196][ T9604] Cannot find del_set index 0 as target [ 362.057972][ T9607] tipc: Failed to remove unknown binding: 66,0,0/0:3489390141/3489390143 [ 362.072731][ T9607] tipc: Failed to remove unknown binding: 66,0,0/0:3489390141/3489390142 [ 362.107457][ T9607] tipc: Failed to remove unknown binding: 66,0,0/0:3489390141/3489390143 [ 362.132134][ T9607] tipc: Failed to remove unknown binding: 66,0,0/0:3489390141/3489390142 [ 362.912595][ T5650] Bluetooth: hci0: command tx timeout [ 364.527900][ T5650] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 364.551326][ T5650] CPU: 1 UID: 0 PID: 5650 Comm: kworker/u9:9 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.551367][ T5650] Tainted: [L]=SOFTLOCKUP [ 364.551376][ T5650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 364.551393][ T5650] Workqueue: hci2 hci_rx_work [ 364.551427][ T5650] Call Trace: [ 364.551437][ T5650] [ 364.551447][ T5650] dump_stack_lvl+0xe8/0x150 [ 364.551490][ T5650] sysfs_create_dir_ns+0x271/0x2a0 [ 364.551532][ T5650] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 364.551572][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.551603][ T5650] ? do_raw_spin_unlock+0xf5/0x210 [ 364.551640][ T5650] kobject_add_internal+0x622/0xcd0 [ 364.551686][ T5650] kobject_add+0x163/0x240 [ 364.551718][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.551756][ T5650] ? __pfx_kobject_add+0x10/0x10 [ 364.551788][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.551821][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.551854][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.551887][ T5650] ? get_device_parent+0x366/0x3a0 [ 364.551923][ T5650] device_add+0x3fa/0xb80 [ 364.551955][ T5650] hci_conn_add_sysfs+0xd5/0x210 [ 364.551988][ T5650] le_conn_complete_evt+0xfef/0x1580 [ 364.552037][ T5650] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 364.552077][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552106][ T5650] ? __mutex_unlock_slowpath+0x731/0x900 [ 364.552142][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552171][ T5650] ? skb_pull_data+0xf0/0x200 [ 364.552212][ T5650] hci_le_conn_complete_evt+0x187/0x470 [ 364.552258][ T5650] hci_event_packet+0x67a/0xf10 [ 364.552297][ T5650] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 364.552331][ T5650] ? __pfx_hci_event_packet+0x10/0x10 [ 364.552371][ T5650] ? audit_tree_freeing_mark+0x760/0xb20 [ 364.552407][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552435][ T5650] ? hci_send_to_monitor+0xe2/0x590 [ 364.552479][ T5650] hci_rx_work+0x3ee/0x1020 [ 364.552520][ T5650] ? process_scheduled_works+0xa20/0x14e0 [ 364.552552][ T5650] process_scheduled_works+0xa8e/0x14e0 [ 364.552615][ T5650] ? __pfx_process_scheduled_works+0x10/0x10 [ 364.552653][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552682][ T5650] ? assign_work+0x3cf/0x5d0 [ 364.552717][ T5650] worker_thread+0xa47/0xfb0 [ 364.552751][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552792][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.552821][ T5650] ? __kthread_parkme+0x71/0x1f0 [ 364.552867][ T5650] kthread+0x388/0x470 [ 364.552912][ T5650] ? __pfx_worker_thread+0x10/0x10 [ 364.552941][ T5650] ? __pfx_kthread+0x10/0x10 [ 364.552981][ T5650] ret_from_fork+0x514/0xb70 [ 364.553023][ T5650] ? __pfx_ret_from_fork+0x10/0x10 [ 364.553062][ T5650] ? srso_alias_return_thunk+0x5/0xfbef5 [ 364.553092][ T5650] ? __switch_to+0xc89/0x1420 [ 364.553124][ T5650] ? __pfx_kthread+0x10/0x10 [ 364.553160][ T5650] ret_from_fork_asm+0x1a/0x30 [ 364.553199][ T5650] [ 364.848171][ T5650] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 364.868896][ T5650] Bluetooth: hci2: failed to register connection device [ 365.004949][ T5650] Bluetooth: hci0: command tx timeout [ 365.475171][ T9636] netlink: 'syz.0.987': attribute type 4 has an invalid length. [ 366.179897][ T9619] syz_tun: entered allmulticast mode [ 366.190850][ T9619] syz_tun: left allmulticast mode [ 366.734517][ T9653] fuse: fd is not a fuse device [ 367.145023][ T5650] Bluetooth: hci0: command tx timeout [ 367.547509][ T7491] bridge_slave_1: left allmulticast mode [ 367.573557][ T7491] bridge_slave_1: left promiscuous mode [ 367.589808][ T7491] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.623634][ T7491] bridge_slave_0: left allmulticast mode [ 367.629313][ T7491] bridge_slave_0: left promiscuous mode [ 367.664884][ T7491] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.879056][ T7491] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.881680][ T9680] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1000'. [ 370.899931][ T7491] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.910529][ T7491] bond0 (unregistering): Released all slaves [ 370.991490][ T9680] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.437417][ T9693] tipc: Failed to remove unknown binding: 66,0,0/0:3585541217/3585541219 [ 372.445990][ T9693] tipc: Failed to remove unknown binding: 66,0,0/0:3585541217/3585541218 [ 372.459023][ T9693] tipc: Failed to remove unknown binding: 66,0,0/0:3585541217/3585541219 [ 372.467670][ T9693] tipc: Failed to remove unknown binding: 66,0,0/0:3585541217/3585541218 [ 372.598292][ T9701] loop3: detected capacity change from 0 to 16 [ 373.107416][ T7491] hsr_slave_0: left promiscuous mode [ 373.145511][ T7491] hsr_slave_1: left promiscuous mode [ 373.171101][ T7491] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 373.201260][ T7491] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 373.229993][ T7491] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 373.255345][ T7491] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 373.325319][ T7491] veth1_macvtap: left promiscuous mode [ 373.353602][ T7491] veth0_macvtap: left promiscuous mode [ 373.372049][ T7491] veth1_vlan: left promiscuous mode [ 373.395489][ T7491] veth0_vlan: left promiscuous mode [ 373.984848][ T9711] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 374.855860][ T9744] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1014'. [ 375.093111][ T7491] team0 (unregistering): Port device team_slave_1 removed [ 375.134070][ T7491] team0 (unregistering): Port device team_slave_0 removed [ 375.468758][ T9713] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode [ 375.618283][ T5284] 8021q: adding VLAN 0 to HW filter on device eth9 [ 377.875641][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.882084][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.243842][ T7491] IPVS: stop unused estimator thread 0... [ 381.848605][ T9816] syzkaller0: entered promiscuous mode [ 381.899433][ T9816] syzkaller0: entered allmulticast mode [ 381.914541][ T9537] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.941440][ T9537] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.997548][ T9537] bridge_slave_0: entered allmulticast mode [ 382.022939][ T9537] bridge_slave_0: entered promiscuous mode [ 382.119033][ T9831] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1034'. [ 382.154429][ T9831] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1034'. [ 382.280782][ T9537] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.326928][ T9537] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.366171][ T9537] bridge_slave_1: entered allmulticast mode [ 382.401384][ T9537] bridge_slave_1: entered promiscuous mode [ 382.487318][ T9837] fuse: fd is not a fuse device [ 383.567799][ T9537] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.809384][ T5284] 8021q: adding VLAN 0 to HW filter on device eth11 [ 384.129552][ T9537] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 385.227229][ T9537] team0: Port device team_slave_0 added [ 385.321447][ T9866] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1042'. [ 386.056246][ T9537] team0: Port device team_slave_1 added [ 386.215630][ T5650] Bluetooth: hci2: unexpected event for opcode 0x2039 [ 386.313682][ T9537] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.327784][ T9537] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 386.389441][ T9537] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 386.428505][ T9537] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 386.463805][ T9537] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 386.561535][ T9537] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.757124][ T9537] hsr_slave_0: entered promiscuous mode [ 387.769314][ T9537] hsr_slave_1: entered promiscuous mode [ 387.775931][ T9537] debugfs: 'hsr0' already exists in 'hsr' [ 387.781729][ T9537] Cannot create hsr debugfs directory [ 389.317969][ T9924] loop7: detected capacity change from 0 to 512 [ 389.576685][ T9924] EXT4-fs error (device loop7): ext4_xattr_inode_iget:441: inode #12: comm syz.7.1056: missing EA_INODE flag [ 389.657927][ T9924] loop7: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 389.672401][ C1] EXT4-fs (loop7): error count since last fsck: 1 [ 389.690927][ C1] EXT4-fs (loop7): initial error at time 1785268882: ext4_xattr_inode_iget:441: inode 12 [ 389.700821][ C1] EXT4-fs (loop7): last error at time 1785268882: ext4_xattr_inode_iget:441: inode 12 [ 390.155675][ T9924] EXT4-fs error (device loop7): ext4_xattr_inode_iget:446: comm syz.7.1056: error while reading EA inode 12 err=-117 [ 390.375360][ T9924] loop7: lost filesystem error report for type 5 error -117 [ 390.396423][ T9924] EXT4-fs (loop7): 1 orphan inode deleted [ 390.513330][ T9924] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 390.977528][ T5284] 8021q: adding VLAN 0 to HW filter on device eth10 [ 391.347168][ T9537] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 391.445278][ T9537] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 391.470726][ T9537] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 391.502645][ T9947] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 391.561623][ T9537] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 391.599127][ T9537] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 391.679544][ T9537] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 391.718714][ T9537] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 391.809383][ T9537] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 392.298326][ T9537] 8021q: adding VLAN 0 to HW filter on device bond0 [ 392.340369][ T9962] uprobe: syz.6.1064:9962 failed to unregister, leaking uprobe [ 393.189427][ T9537] 8021q: adding VLAN 0 to HW filter on device team0 [ 393.208633][ T9972] loop3: detected capacity change from 0 to 512 [ 393.247307][ T9972] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 4294967295: comm syz.3.1066: invalid block [ 393.259571][ T9972] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 393.262387][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 393.277964][ C0] EXT4-fs (loop3): initial error at time 1785268886: ext4_get_branch:178: inode 11: block 4294967295 [ 393.288911][ C0] EXT4-fs (loop3): last error at time 1785268886: ext4_get_branch:178: inode 11: block 4294967295 [ 393.324978][ T7486] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.332182][ T7486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 393.441904][ T9972] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1066: invalid indirect mapped block 4294967295 (level 1) [ 393.473176][ T9972] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 393.485155][ T9972] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1066: invalid indirect mapped block 4294967295 (level 1) [ 393.528944][ T7486] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.536149][ T7486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.632845][ T9972] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 393.651839][ T9972] EXT4-fs (loop3): 2 truncates cleaned up [ 393.787651][ T9972] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 396.611780][ T5626] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 396.751404][ T5284] 8021q: adding VLAN 0 to HW filter on device eth12 [ 396.877400][ T7022] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 398.884871][T10032] SQUASHFS error: Failed to read block 0x0: -5 [ 399.853534][ T9537] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.202908][T10088] loop3: detected capacity change from 0 to 2048 [ 404.275837][T10088] EXT4-fs: Ignoring removed i_version option [ 404.524126][T10088] EXT4-fs (loop3): couldn't mount as ext2 due to feature incompatibilities [ 404.734143][T10105] syz_tun: entered allmulticast mode [ 405.348925][ T9537] veth0_vlan: entered promiscuous mode [ 405.361765][ T9537] veth1_vlan: entered promiscuous mode [ 406.002016][ T9537] veth0_macvtap: entered promiscuous mode [ 406.331965][ T9537] veth1_macvtap: entered promiscuous mode [ 406.374616][ T9537] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 406.390481][ T9537] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 406.631406][T10121] xt_connbytes: Forcing CT accounting to be enabled [ 406.638333][T10121] Cannot find set identified by id 0 to match [ 407.891741][ T7486] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.173986][ T49] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.295462][T10135] zonefs (nullb0) ERROR: Not a zoned block device [ 409.020957][ T49] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.100230][ T49] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.477314][T10150] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 412.031112][T10157] bridge_slave_0: left allmulticast mode [ 412.054033][T10157] bridge_slave_0: left promiscuous mode [ 412.122698][ T24] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 412.139358][T10157] bridge0: port 1(bridge_slave_0) entered disabled state [ 413.137261][T10176] netlink: 'syz.3.1113': attribute type 4 has an invalid length. [ 413.156262][ T24] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 413.175641][ T24] usb 7-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 413.210639][ T24] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 413.245051][ T24] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 413.256715][ T24] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 413.272609][ T24] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 413.286715][ T24] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 413.480433][ T24] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 413.489631][ T24] usb 7-1: Product: syz [ 413.494089][ T24] usb 7-1: Manufacturer: syz [ 413.529614][T10163] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 413.561344][ T24] cdc_wdm 7-1:1.0: skipping garbage [ 414.133954][ T24] cdc_wdm 7-1:1.0: skipping garbage [ 414.153738][ T24] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 414.159706][ T24] cdc_wdm 7-1:1.0: Unknown control protocol [ 414.275219][ T24] usb 7-1: USB disconnect, device number 5 [ 414.660489][T10157] bridge_slave_1: left allmulticast mode [ 414.678471][T10157] bridge_slave_1: left promiscuous mode [ 414.809410][T10157] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.384708][T10157] bond0: (slave bond_slave_0): Releasing backup interface [ 415.434558][T10157] bond0: (slave bond_slave_1): Releasing backup interface [ 415.491030][T10157] team0: Port device team_slave_0 removed [ 415.546863][T10157] team0: Port device team_slave_1 removed [ 415.591894][T10157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 415.648307][T10157] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 415.746618][T10173] netlink: 'syz.3.1113': attribute type 12 has an invalid length. [ 415.801791][ T7486] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.832298][ T7486] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.920642][ T7486] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.938925][ T7486] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.497262][T10236] bond0: (slave vxlan0): Enslaving as an active interface with an up link [ 417.529096][ T12] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.580177][ T12] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.737329][ T6796] IPVS: starting estimator thread 0... [ 417.737822][ T12] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.787353][ T12] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.853531][T10249] IPVS: using max 25 ests per chain, 60000 per kthread [ 420.228817][T10266] trusted_key: encrypted_key: insufficient parameters specified [ 420.347776][T10270] loop6: detected capacity change from 0 to 512 [ 420.409661][T10272] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1136'. [ 420.423205][T10270] FAT-fs (loop6): data area starts beyond volume (199892 > 45184) [ 420.706749][T10276] netlink: 'syz.5.1138': attribute type 1 has an invalid length. [ 421.097485][T10270] FAT-fs (loop6): Can't find a valid FAT filesystem [ 421.748192][T10276] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1138'. [ 423.536731][T10309] loop6: detected capacity change from 0 to 1024 [ 423.573441][T10309] EXT4-fs: Ignoring removed i_version option [ 423.634455][T10309] EXT4-fs: Ignoring removed oldalloc option [ 423.688711][T10309] EXT4-fs (loop6): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 424.008274][T10309] EXT4-fs (loop6): group descriptors corrupted! [ 424.918730][T10321] loop9: detected capacity change from 0 to 40427 [ 424.927279][T10323] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1148'. [ 424.931414][T10321] F2FS-fs: heap/no_heap options were deprecated [ 424.947004][T10321] F2FS-fs (loop9): build fault injection rate: 19 [ 424.953502][T10321] F2FS-fs (loop9): build fault injection type: 0x3bfe8c [ 424.964413][T10321] F2FS-fs (loop9): invalid crc value [ 424.994967][T10324] loop6: detected capacity change from 0 to 16 [ 425.018084][T10321] F2FS-fs (loop9): inject page alloc in f2fs_grab_cache_folio of f2fs_build_free_nids+0xa00/0x18c0 [ 425.061969][T10323] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1148'. [ 425.089309][T10321] F2FS-fs (loop9): inject slab alloc in f2fs_kmem_cache_alloc of read_node_folio+0x21d/0x3d0 [ 425.110154][T10321] F2FS-fs (loop9): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 425.124821][T10321] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 425.128858][T10324] erofs (device loop6): invalid ishare xattr prefix id 0 [ 425.311019][T10321] F2FS-fs (loop9): inject page alloc in f2fs_grab_cache_folio of f2fs_get_dnode_of_data+0xa60/0x1ee0 [ 426.639413][T10346] netlink: 'syz.5.1153': attribute type 12 has an invalid length. [ 426.699699][ T7495] kworker/u8:24: attempt to access beyond end of device [ 426.699699][ T7495] loop9: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 426.705233][T10346] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1153'. [ 426.769273][ T7495] CPU: 0 UID: 0 PID: 7495 Comm: kworker/u8:24 Tainted: G L syzkaller #0 PREEMPT(full) [ 426.769316][ T7495] Tainted: [L]=SOFTLOCKUP [ 426.769325][ T7495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 426.769341][ T7495] Workqueue: writeback wb_workfn (flush-7:9) [ 426.769380][ T7495] Call Trace: [ 426.769390][ T7495] [ 426.769400][ T7495] dump_stack_lvl+0xe8/0x150 [ 426.769450][ T7495] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 426.769491][ T7495] f2fs_write_end_io+0x124b/0x1710 [ 426.769559][ T7495] __submit_merged_bio+0x258/0x6a0 [ 426.769591][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.769620][ T7495] ? rcu_is_watching+0x15/0xb0 [ 426.769653][ T7495] f2fs_submit_merged_write+0x27d/0x380 [ 426.769695][ T7495] ? __pfx_f2fs_submit_merged_write+0x10/0x10 [ 426.769738][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.769779][ T7495] f2fs_sync_node_pages+0x1055/0x1210 [ 426.769839][ T7495] ? __pfx_f2fs_sync_node_pages+0x10/0x10 [ 426.769872][ T7495] ? __percpu_counter_sum+0x1c6/0x1f0 [ 426.769937][ T7495] ? has_not_enough_free_secs+0xc9a/0x16b0 [ 426.769981][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770012][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770041][ T7495] ? blk_start_plug+0x51/0x1b0 [ 426.770084][ T7495] f2fs_write_node_pages+0x311/0x700 [ 426.770115][ T7495] ? __lock_acquire+0x683/0x2cf0 [ 426.770160][ T7495] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 426.770200][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770229][ T7495] ? set_raw_inline+0x28b/0x390 [ 426.770260][ T7495] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 426.770286][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770314][ T7495] ? f2fs_update_inode+0x1394/0x25c0 [ 426.770341][ T7495] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 426.770375][ T7495] do_writepages+0x338/0x560 [ 426.770433][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770461][ T7495] ? reacquire_held_locks+0x104/0x190 [ 426.770486][ T7495] ? writeback_sb_inodes+0x450/0x1b00 [ 426.770530][ T7495] __writeback_single_inode+0x12e/0xf90 [ 426.770576][ T7495] writeback_sb_inodes+0x9de/0x1b00 [ 426.770646][ T7495] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 426.770739][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770767][ T7495] ? rcu_is_watching+0x15/0xb0 [ 426.770791][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.770819][ T7495] ? queue_io+0x2d3/0x470 [ 426.770858][ T7495] wb_writeback+0x41c/0xad0 [ 426.770897][ T7495] ? queue_io+0x261/0x470 [ 426.770938][ T7495] ? __pfx_wb_writeback+0x10/0x10 [ 426.770969][ T7495] ? do_raw_spin_lock+0x12b/0x2f0 [ 426.771023][ T7495] wb_workfn+0x431/0x10f0 [ 426.771077][ T7495] ? __pfx_wb_workfn+0x10/0x10 [ 426.771124][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771152][ T7495] ? do_raw_spin_lock+0x12b/0x2f0 [ 426.771186][ T7495] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 426.771221][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771254][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771294][ T7495] ? rcu_is_watching+0x15/0xb0 [ 426.771319][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771351][ T7495] ? process_scheduled_works+0xa20/0x14e0 [ 426.771383][ T7495] process_scheduled_works+0xa8e/0x14e0 [ 426.771461][ T7495] ? __pfx_process_scheduled_works+0x10/0x10 [ 426.771501][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771530][ T7495] ? assign_work+0x3cf/0x5d0 [ 426.771568][ T7495] worker_thread+0xa47/0xfb0 [ 426.771604][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771648][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771676][ T7495] ? __kthread_parkme+0x71/0x1f0 [ 426.771725][ T7495] kthread+0x388/0x470 [ 426.771764][ T7495] ? __pfx_worker_thread+0x10/0x10 [ 426.771793][ T7495] ? __pfx_kthread+0x10/0x10 [ 426.771833][ T7495] ret_from_fork+0x514/0xb70 [ 426.771877][ T7495] ? __pfx_ret_from_fork+0x10/0x10 [ 426.771914][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 426.771943][ T7495] ? __switch_to+0xc89/0x1420 [ 426.771981][ T7495] ? __pfx_kthread+0x10/0x10 [ 426.772019][ T7495] ret_from_fork_asm+0x1a/0x30 [ 426.772069][ T7495] [ 427.218268][ T7495] F2FS-fs (loop9): Stopped filesystem due to reason: 3 [ 427.269728][T10358] loop7: detected capacity change from 0 to 512 [ 427.280075][ T7495] CPU: 1 UID: 0 PID: 7495 Comm: kworker/u8:24 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.280112][ T7495] Tainted: [L]=SOFTLOCKUP [ 427.280120][ T7495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 427.280135][ T7495] Workqueue: writeback wb_workfn (flush-7:9) [ 427.280173][ T7495] Call Trace: [ 427.280183][ T7495] [ 427.280193][ T7495] dump_stack_lvl+0xe8/0x150 [ 427.280232][ T7495] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 427.280270][ T7495] f2fs_write_end_io+0x124b/0x1710 [ 427.280316][ T7495] __submit_merged_bio+0x258/0x6a0 [ 427.280346][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280375][ T7495] ? rcu_is_watching+0x15/0xb0 [ 427.280405][ T7495] f2fs_submit_merged_write+0x27d/0x380 [ 427.280437][ T7495] ? __pfx_f2fs_submit_merged_write+0x10/0x10 [ 427.280468][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280506][ T7495] f2fs_sync_node_pages+0x1055/0x1210 [ 427.280559][ T7495] ? __pfx_f2fs_sync_node_pages+0x10/0x10 [ 427.280585][ T7495] ? __percpu_counter_sum+0x1c6/0x1f0 [ 427.280633][ T7495] ? has_not_enough_free_secs+0xc9a/0x16b0 [ 427.280675][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280706][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280738][ T7495] ? blk_start_plug+0x51/0x1b0 [ 427.280777][ T7495] f2fs_write_node_pages+0x311/0x700 [ 427.280806][ T7495] ? __lock_acquire+0x683/0x2cf0 [ 427.280849][ T7495] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 427.280885][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280910][ T7495] ? set_raw_inline+0x28b/0x390 [ 427.280932][ T7495] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 427.280958][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.280986][ T7495] ? f2fs_update_inode+0x1394/0x25c0 [ 427.281013][ T7495] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 427.281042][ T7495] do_writepages+0x338/0x560 [ 427.281076][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281101][ T7495] ? reacquire_held_locks+0x104/0x190 [ 427.281126][ T7495] ? writeback_sb_inodes+0x450/0x1b00 [ 427.281167][ T7495] __writeback_single_inode+0x12e/0xf90 [ 427.281204][ T7495] writeback_sb_inodes+0x9de/0x1b00 [ 427.281257][ T7495] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 427.281337][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281359][ T7495] ? rcu_is_watching+0x15/0xb0 [ 427.281377][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281402][ T7495] ? queue_io+0x2d3/0x470 [ 427.281440][ T7495] wb_writeback+0x41c/0xad0 [ 427.281476][ T7495] ? queue_io+0x261/0x470 [ 427.281508][ T7495] ? __pfx_wb_writeback+0x10/0x10 [ 427.281531][ T7495] ? do_raw_spin_lock+0x12b/0x2f0 [ 427.281577][ T7495] wb_workfn+0x431/0x10f0 [ 427.281627][ T7495] ? __pfx_wb_workfn+0x10/0x10 [ 427.281670][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281695][ T7495] ? do_raw_spin_lock+0x12b/0x2f0 [ 427.281726][ T7495] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 427.281759][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281788][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281819][ T7495] ? rcu_is_watching+0x15/0xb0 [ 427.281837][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.281862][ T7495] ? process_scheduled_works+0xa20/0x14e0 [ 427.281893][ T7495] process_scheduled_works+0xa8e/0x14e0 [ 427.281957][ T7495] ? __pfx_process_scheduled_works+0x10/0x10 [ 427.281985][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.282008][ T7495] ? assign_work+0x3cf/0x5d0 [ 427.282044][ T7495] worker_thread+0xa47/0xfb0 [ 427.282076][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.282111][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.282132][ T7495] ? __kthread_parkme+0x71/0x1f0 [ 427.282170][ T7495] kthread+0x388/0x470 [ 427.282207][ T7495] ? __pfx_worker_thread+0x10/0x10 [ 427.282233][ T7495] ? __pfx_kthread+0x10/0x10 [ 427.282266][ T7495] ret_from_fork+0x514/0xb70 [ 427.282297][ T7495] ? __pfx_ret_from_fork+0x10/0x10 [ 427.282332][ T7495] ? srso_alias_return_thunk+0x5/0xfbef5 [ 427.282361][ T7495] ? __switch_to+0xc89/0x1420 [ 427.282397][ T7495] ? __pfx_kthread+0x10/0x10 [ 427.282435][ T7495] ret_from_fork_asm+0x1a/0x30 [ 427.282480][ T7495] [ 427.737551][ T7495] F2FS-fs (loop9): Stopped filesystem due to reason: 3 [ 427.947369][T10358] EXT4-fs: inline encryption not supported [ 428.164671][T10358] EXT4-fs (loop7): mounting ext3 file system using the ext4 subsystem [ 428.845967][T10358] EXT4-fs error (device loop7): ext4_iget_extra_inode:5180: inode #15: comm syz.7.1157: corrupted in-inode xattr: e_value size too large [ 428.874069][T10358] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 428.879412][T10358] EXT4-fs error (device loop7): ext4_orphan_get:1404: comm syz.7.1157: couldn't read orphan inode 15 (err -117) [ 428.888627][ C1] EXT4-fs (loop7): error count since last fsck: 1 [ 428.888651][ C1] EXT4-fs (loop7): initial error at time 1785268921: ext4_iget_extra_inode:5180: inode 15 [ 428.888689][ C1] EXT4-fs (loop7): last error at time 1785268921: ext4_iget_extra_inode:5180: inode 15 [ 429.136743][T10358] loop7: lost filesystem error report for type 5 error -117 [ 429.521928][T10358] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 431.428302][ T7022] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 434.454720][T10441] bridge0: port 3(syz_tun) entered blocking state [ 434.472535][T10441] bridge0: port 3(syz_tun) entered disabled state [ 434.484505][T10441] syz_tun: entered allmulticast mode [ 434.502180][T10441] syz_tun: entered promiscuous mode [ 434.548111][T10441] bridge0: port 3(syz_tun) entered blocking state [ 434.554785][T10441] bridge0: port 3(syz_tun) entered listening state [ 434.586094][T10444] bridge0: port 4(ip6gretap0) entered blocking state [ 434.626049][T10444] bridge0: port 4(ip6gretap0) entered disabled state [ 434.648353][T10444] ip6gretap0: entered allmulticast mode [ 435.740007][T10444] ip6gretap0: entered promiscuous mode [ 435.876406][T10444] bridge0: port 4(ip6gretap0) entered blocking state [ 435.883298][T10444] bridge0: port 4(ip6gretap0) entered listening state [ 436.000972][T10450] gretap1: entered promiscuous mode [ 436.055855][T10457] bridge0: port 5(bond0) entered blocking state [ 436.137930][T10457] bridge0: port 5(bond0) entered disabled state [ 436.280387][T10457] bond0: entered allmulticast mode [ 436.445876][T10457] bond_slave_0: entered allmulticast mode [ 436.597693][T10457] bond_slave_1: entered allmulticast mode [ 437.360411][T10457] bond0: entered promiscuous mode [ 437.381749][T10457] bond_slave_0: entered promiscuous mode [ 437.916696][T10457] bond_slave_1: entered promiscuous mode [ 438.042686][T10457] bridge0: port 5(bond0) entered blocking state [ 438.049098][T10457] bridge0: port 5(bond0) entered listening state [ 438.123310][T10444] bridge0: port 6(team0) entered blocking state [ 438.135186][T10444] bridge0: port 6(team0) entered disabled state [ 438.151589][T10444] team0: entered allmulticast mode [ 438.159882][T10475] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.180828][T10444] team_slave_0: entered allmulticast mode [ 438.191442][T10444] team_slave_1: entered allmulticast mode [ 438.271957][T10474] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.309895][T10444] team0: entered promiscuous mode [ 438.338317][T10444] team_slave_0: entered promiscuous mode [ 438.371586][T10444] team_slave_1: entered promiscuous mode [ 438.443144][T10444] bridge0: port 6(team0) entered blocking state [ 438.449645][T10444] bridge0: port 6(team0) entered listening state [ 438.514523][ T5650] Bluetooth: hci1: unexpected event for opcode 0x0c24 [ 438.521754][T10474] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 438.576371][T10462] bridge0: port 7(dummy0) entered blocking state [ 438.600529][T10462] bridge0: port 7(dummy0) entered disabled state [ 438.654934][T10462] dummy0: entered allmulticast mode [ 438.709989][T10462] dummy0: entered promiscuous mode [ 438.726941][T10462] bridge0: port 7(dummy0) entered blocking state [ 438.733421][T10462] bridge0: port 7(dummy0) entered listening state [ 438.766154][T10452] bridge0: port 8(batadv0) entered blocking state [ 438.792206][T10452] bridge0: port 8(batadv0) entered disabled state [ 438.813965][T10452] batadv0: entered allmulticast mode [ 438.830289][T10452] batadv0: entered promiscuous mode [ 438.842002][T10452] bridge0: port 8(batadv0) entered blocking state [ 438.848569][T10452] bridge0: port 8(batadv0) entered listening state [ 438.862141][T10488] netlink: 'syz.3.1188': attribute type 1 has an invalid length. [ 438.975097][ T7495] batman_adv: batadv0: IGMP Querier appeared [ 438.981628][ T7495] batman_adv: batadv0: MLD Querier appeared [ 438.995499][T10488] 8021q: adding VLAN 0 to HW filter on device bond3 [ 439.067778][T10490] gretap1: entered promiscuous mode [ 439.082007][T10490] bond3: (slave gretap1): making interface the new active one [ 439.108495][T10490] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 439.278927][T10491] macvlan2: entered promiscuous mode [ 439.320253][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.328218][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.347024][T10491] macvlan2: entered allmulticast mode [ 439.379646][T10498] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 439.544920][T10491] bond3: entered promiscuous mode [ 439.848181][T10491] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 440.160694][T10491] bond3: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 440.238560][T10491] bond3: left promiscuous mode [ 441.056405][T10512] loop9: detected capacity change from 0 to 128 [ 441.065108][T10512] EXT4-fs: Ignoring removed orlov option [ 441.550715][T10512] EXT4-fs (loop9): Test dummy encryption mode enabled [ 441.881643][T10512] EXT4-fs (loop9): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 441.895081][T10512] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 442.671525][ T9537] EXT4-fs (loop9): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 442.801679][T10528] bridge0: port 3(syz_tun) entered disabled state [ 443.029328][T10528] syz_tun (unregistering): left allmulticast mode [ 444.119419][T10539] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1201'. [ 445.478139][T10528] bridge0: port 3(syz_tun) entered disabled state [ 445.842737][T10548] capability: warning: `syz.6.1200' uses 32-bit capabilities (legacy support in use) [ 448.083613][T10566] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 450.020635][T10592] 9pnet_fd: p9_fd_create_tcp (10592): problem connecting socket to 127.0.0.1 [ 450.202449][ C1] bridge0: port 3(syz_tun) entered learning state [ 451.472798][ C0] bridge0: port 4(ip6gretap0) entered learning state [ 451.569713][T10588] syzkaller0: entered promiscuous mode [ 451.602150][T10588] syzkaller0: entered allmulticast mode [ 451.782544][ T5918] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 451.977070][ T5918] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 451.992546][ T5918] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.013876][ T5918] usb 8-1: Product: syz [ 452.024679][ T5918] usb 8-1: Manufacturer: syz [ 452.032757][ T5918] usb 8-1: SerialNumber: syz [ 452.283784][ T5918] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 452.520935][T10611] loop3: detected capacity change from 0 to 32768 [ 452.563229][T10611] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.1203 (10611) [ 452.582481][T10611] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 452.592568][ T5918] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 452.592626][ T5918] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 452.611948][T10611] BTRFS info (device loop3): using sha256 checksum algorithm [ 452.919400][ T5918] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -32 [ 453.251003][T10611] BTRFS info (device loop3): enabling ssd optimizations [ 453.258104][T10611] BTRFS info (device loop3): turning on sync discard [ 453.264956][T10611] BTRFS info (device loop3): enabling free space tree [ 453.271745][T10611] BTRFS info (device loop3): use zlib compression, level 3 [ 453.394786][ C1] bridge0: port 5(bond0) entered learning state [ 453.674073][T10634] ptrace attach of "ci-upstream-kasan-gce-root/syz-executor exec"[5626] was attempted by "ci-upstream-kasan-gce-root/syz-executor exec"[10634] [ 454.032418][ C1] bridge0: port 8(batadv0) entered learning state [ 454.039030][ C1] bridge0: port 7(dummy0) entered learning state [ 454.045597][ C0] bridge0: port 6(team0) entered learning state [ 454.224129][ T5626] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 457.175916][T10645] syz.3.1226 (10645): drop_caches: 2 [ 465.425465][T10706] dummy_hcd dummy_hcd.0: remove, state 1 [ 465.435428][T10706] usb usb1: USB disconnect, device number 1 [ 465.444674][T10706] usb 1-1: USB disconnect, device number 2 [ 465.552501][ C1] bridge0: port 3(syz_tun) entered forwarding state [ 465.559176][ C1] bridge0: topology change detected, propagating [ 465.873175][T10706] cdc_ncm 1-1:1.1 usb1: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 465.937001][ T5645] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 465.960646][ T5645] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 465.969231][ T5645] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 465.987658][ T5645] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 466.001360][ T5645] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 466.228263][ T5645] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 466.253234][ T5645] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 466.303784][ T5645] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 466.339983][ T5645] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 466.370518][ T5645] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 466.832490][ C0] bridge0: port 4(ip6gretap0) entered forwarding state [ 466.839406][ C0] bridge0: topology change detected, propagating [ 467.967848][ T5645] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 467.987458][ T5645] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 468.021179][ T5645] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 468.752478][ C1] bridge0: port 5(bond0) entered forwarding state [ 468.758961][ C1] bridge0: topology change detected, propagating [ 469.392522][ C0] bridge0: port 6(team0) entered forwarding state [ 469.399042][ C0] bridge0: topology change detected, propagating [ 469.405650][ C1] bridge0: port 7(dummy0) entered forwarding state [ 469.412184][ C1] bridge0: topology change detected, propagating [ 469.418752][ C1] bridge0: port 8(batadv0) entered forwarding state [ 469.425418][ C1] bridge0: topology change detected, propagating [ 469.508615][ T5645] Bluetooth: hci6: command tx timeout [ 469.518130][ T5645] Bluetooth: hci7: command tx timeout [ 469.528560][ T5645] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 469.560256][ T5645] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 471.552572][ T5650] Bluetooth: hci7: command tx timeout [ 471.558065][ T5645] Bluetooth: hci6: command tx timeout [ 471.638373][ T5650] Bluetooth: hci0: command tx timeout [ 472.720594][T10706] dummy_hcd dummy_hcd.0: stopped [ 472.725929][T10706] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 472.828974][ T9537] bridge0: port 3(syz_tun) entered disabled state [ 472.968410][ T9537] syz_tun (unregistering): left allmulticast mode [ 472.993586][ T9537] syz_tun (unregistering): left promiscuous mode [ 473.023401][ T9537] bridge0: port 3(syz_tun) entered disabled state [ 473.682493][ T5650] Bluetooth: hci7: command tx timeout [ 473.689773][ T5645] Bluetooth: hci6: command tx timeout [ 473.712530][ T5645] Bluetooth: hci0: command tx timeout [ 474.145622][T10617] syz_tun (unregistering): left allmulticast mode [ 474.485613][ T6817] usb 8-1: USB disconnect, device number 4 [ 475.680429][ T49] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.712423][ T5645] Bluetooth: hci6: command tx timeout [ 475.717868][ T5650] Bluetooth: hci7: command tx timeout [ 475.794566][ T5650] Bluetooth: hci0: command tx timeout [ 476.164426][T10800] gfs2: gfs2 mount does not exist [ 476.375846][T10804] loop3: detected capacity change from 0 to 512 [ 476.536884][T10804] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1260: invalid indirect mapped block 4294967295 (level 1) [ 476.538451][ T49] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.574686][T10804] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 476.584288][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 476.599860][ C0] EXT4-fs (loop3): initial error at time 1785268969: ext4_free_branches:1023: inode 11 [ 476.609545][ C0] EXT4-fs (loop3): last error at time 1785268969: ext4_free_branches:1023: inode 11 [ 476.646017][T10804] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1260: invalid indirect mapped block 4294967295 (level 1) [ 476.700821][T10804] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 476.712270][T10804] EXT4-fs (loop3): 2 truncates cleaned up [ 476.811178][T10804] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 477.872664][ T5650] Bluetooth: hci0: command tx timeout [ 478.963134][ T49] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.011292][T10827] netlink: 'syz.0.1263': attribute type 1 has an invalid length. [ 479.238009][T10831] bond0 (unregistering): Released all slaves [ 480.632466][T10810] EXT4-fs error (device loop3): ext4_validate_block_bitmap:432: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 480.658638][ T5626] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 481.208357][T10827] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 482.734027][ T49] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.459663][T10730] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.480939][T10730] bridge0: port 1(bridge_slave_0) entered disabled state [ 486.499696][T10730] bridge_slave_0: entered allmulticast mode [ 486.534770][T10730] bridge_slave_0: entered promiscuous mode [ 486.641320][T10730] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.666476][T10730] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.675315][ T5791] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 486.697365][T10730] bridge_slave_1: entered allmulticast mode [ 486.726545][T10730] bridge_slave_1: entered promiscuous mode [ 486.855282][ T5791] usb 7-1: Using ep0 maxpacket: 8 [ 486.885930][ T5791] usb 7-1: config index 0 descriptor too short (expected 255, got 27) [ 486.911249][ T5791] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.944429][ T5791] usb 7-1: config 0 has no interfaces? [ 486.950290][ T5791] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 486.960351][ T5791] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.005631][ T5791] usb 7-1: config 0 descriptor?? [ 487.135886][T10730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 487.152045][ T49] batadv0: left allmulticast mode [ 487.169552][ T49] batadv0: left promiscuous mode [ 487.183487][ T49] bridge0: port 8(batadv0) entered disabled state [ 487.206170][ T49] dummy0: left allmulticast mode [ 487.228867][ T49] dummy0: left promiscuous mode [ 487.261668][ T49] bridge0: port 7(dummy0) entered disabled state [ 487.295853][ T5918] usb 7-1: USB disconnect, device number 6 [ 487.342414][ T49] team0: left allmulticast mode [ 487.356726][ T49] team_slave_0: left allmulticast mode [ 487.370968][ T49] team_slave_1: left allmulticast mode [ 487.390242][ T49] team0: left promiscuous mode [ 487.409403][ T49] team_slave_0: left promiscuous mode [ 487.425870][ T49] team_slave_1: left promiscuous mode [ 487.441037][ T49] bridge0: port 6(team0) entered disabled state [ 487.707082][ T49] bond0: left allmulticast mode [ 487.732865][ T49] bond_slave_0: left allmulticast mode [ 487.869914][T10934] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1278'. [ 488.336472][ T49] bond_slave_1: left allmulticast mode [ 488.346900][ T49] bond0: left promiscuous mode [ 488.351678][ T49] bond_slave_0: left promiscuous mode [ 488.358688][ T49] bond_slave_1: left promiscuous mode [ 488.364641][ T49] bridge0: port 5(bond0) entered disabled state [ 488.490770][ T49] ip6gretap0: left allmulticast mode [ 488.533356][ T49] ip6gretap0: left promiscuous mode [ 488.538908][ T49] bridge0: port 4(ip6gretap0) entered disabled state [ 489.802010][ T49] bridge_slave_1: left allmulticast mode [ 489.840654][ T49] bridge_slave_1: left promiscuous mode [ 489.869560][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.061220][ T49] bridge_slave_0: left allmulticast mode [ 490.092721][ T49] bridge_slave_0: left promiscuous mode [ 490.129501][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.201011][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 491.220193][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 491.231037][ T49] bond0 (unregistering): Released all slaves [ 491.278324][T10730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 491.671057][T10730] team0: Port device team_slave_0 added [ 491.702023][T10730] team0: Port device team_slave_1 added [ 491.861687][T10972] loop6: detected capacity change from 0 to 1024 [ 492.840438][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 492.840460][ T31] audit: type=1800 audit(1785268985.792:143): pid=10981 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1287" name="file1" dev="loop6" ino=20 res=0 errno=0 [ 492.884185][ T31] audit: type=1800 audit(1785268985.802:144): pid=10972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1287" name="file1" dev="loop6" ino=20 res=0 errno=0 [ 493.173954][T10730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 493.216967][T10730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 493.244263][T10730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 493.998297][T10730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 494.017580][T10730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 494.075818][T10730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 495.068612][ T49] hsr_slave_0: left promiscuous mode [ 495.096788][ T49] hsr_slave_1: left promiscuous mode [ 495.123213][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 495.142872][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 495.166670][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 495.185594][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 495.253704][ T49] veth1_macvtap: left promiscuous mode [ 495.268849][ T49] veth0_macvtap: left promiscuous mode [ 495.280877][ T49] veth1_vlan: left promiscuous mode [ 495.300165][ T49] veth0_vlan: left promiscuous mode [ 500.566565][T11074] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1302'. [ 500.758050][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.776456][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 500.812168][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 500.824244][ C0] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 500.832651][ C0] CPU: 0 UID: 0 PID: 11065 Comm: syz.6.1302 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.843586][ C0] Tainted: [L]=SOFTLOCKUP [ 500.847895][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 500.857944][ C0] RIP: 0010:dummy_queue+0x1ae/0x900 [ 500.863148][ C0] Code: fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 0b 5c 7d fa 4d 8b 24 24 49 83 c4 60 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 f0 05 00 00 45 8b 24 24 44 89 e6 83 e6 02 [ 500.882750][ C0] RSP: 0018:ffffc90000007ca0 EFLAGS: 00010216 [ 500.888851][ C0] RAX: 000000000000000c RBX: ffff888028cb6510 RCX: dffffc0000000000 [ 500.896819][ C0] RDX: ffff888031fd0000 RSI: 0000000000000003 RDI: 0000000000000005 [ 500.904783][ C0] RBP: ffff888028cb6500 R08: ffffffff90579137 R09: 1ffffffff20af226 SYZFAIL: failed to recv rpc [ 500.912749][ C0] R10: dffffc0000000000 R11: ffffffff87b73db0 R12: 0000000000000060 [ 500.920716][ C0] R13: 1ffff11005196ca0 R14: ffff888027690248 R15: ffff888027690c00 [ 500.928685][ C0] FS: 00007f6b718ce6c0(0000) GS:ffff888124f4e000(0000) knlGS:0000000000000000 [ 500.937615][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 500.944197][ C0] CR2: 000055647b1a9008 CR3: 0000000035aeb000 CR4: 0000000000350ef0 [ 500.952171][ C0] Call Trace: [ 500.955447][ C0] [ 500.958280][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 500.963918][ C0] usb_ep_queue+0xf1/0x3c0 [ 500.968337][ C0] eth_start_xmit+0x9a7/0x1080 [ 500.973106][ C0] ? __pfx_ncm_tx_timeout+0x10/0x10 [ 500.978295][ C0] ncm_tx_timeout+0x87/0xa0 [ 500.982793][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 500.987993][ C0] hrtimer_run_softirq+0x17a/0x240 [ 500.993098][ C0] handle_softirqs+0x225/0x840 [ 500.997883][ C0] ? __irq_exit_rcu+0xca/0x220 [ 501.002644][ C0] __irq_exit_rcu+0xca/0x220 [ 501.007227][ C0] irq_exit_rcu+0x9/0x30 [ 501.011461][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 501.017086][ C0] [ 501.020001][ C0] [ 501.022915][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 501.028897][ C0] RIP: 0010:finish_task_switch+0x417/0xc60 [ 501.034742][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 f3 1b 3e 0a e8 0e ac 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 f8 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 501.054344][ C0] RSP: 0018:ffffc90003e17260 EFLAGS: 00000206 [ 501.060407][ C0] RAX: 000000000000c68d RBX: ffff8880b863bf20 RCX: 0000000080000001 [ 501.068370][ C0] RDX: 0000000000000000 RSI: ffffffff8e22d546 RDI: ffffffff8c4bdc80 [ 501.076336][ C0] RBP: ffffc90003e172b0 R08: ffffffff90579137 R09: 1ffffffff20af226 [ 501.084333][ C0] R10: dffffc0000000000 R11: fffffbfff20af227 R12: ffff888031fd0000 [ 501.092297][ C0] R13: ffff888031fd0000 R14: dffffc0000000000 R15: 1ffff110170c77e4 [ 501.100278][ C0] __schedule+0x17e1/0x56c0 [ 501.104776][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.110425][ C0] ? __lock_acquire+0x683/0x2cf0 [ 501.115411][ C0] ? __pfx___schedule+0x10/0x10 [ 501.120283][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.125931][ C0] ? schedule+0x90/0x2b0 [ 501.130184][ C0] schedule+0x164/0x2b0 [ 501.134348][ C0] schedule_timeout+0xc0/0x2c0 [ 501.139128][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 501.144515][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.150154][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.155789][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.161424][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 501.166564][ C0] unix_wait_for_peer+0x1f5/0x2f0 [ 501.171608][ C0] ? __pfx_unix_wait_for_peer+0x10/0x10 [ 501.177181][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 501.183272][ C0] ? apparmor_unix_may_send+0x2f5/0x340 [ 501.188841][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.194485][ C0] unix_dgram_sendmsg+0xaf4/0x17b0 [ 501.199637][ C0] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 501.205202][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.210839][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.216474][ C0] ? aa_sock_msg_perm+0xda/0x1b0 [ 501.221410][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.227038][ C0] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 501.232578][ C0] sock_sendmsg_nosec+0x13a/0x180 [ 501.237603][ C0] ____sys_sendmsg+0x54e/0x850 [ 501.242363][ C0] ? __pfx_____sys_sendmsg+0x10/0x10 [ 501.247640][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.253269][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.258902][ C0] ? import_iovec+0x73/0xa0 [ 501.263413][ C0] ___sys_sendmsg+0x2a5/0x360 [ 501.268091][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.273718][ C0] ? __lock_acquire+0x683/0x2cf0 [ 501.278658][ C0] ? __pfx____sys_sendmsg+0x10/0x10 [ 501.283846][ C0] ? __lock_acquire+0x683/0x2cf0 [ 501.288787][ C0] ? __pfx_futex_wake_mark+0x10/0x10 [ 501.294078][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.299705][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.305355][ C0] __sys_sendmmsg+0x273/0x4d0 [ 501.310031][ C0] ? __pfx___sys_sendmmsg+0x10/0x10 [ 501.315218][ C0] ? do_futex+0x3e7/0x4e0 [ 501.319543][ C0] ? srso_alias_return_thunk+0x5/0xfbef5 [ 501.325168][ C0] ? __sys_connect+0x3ae/0x460 [ 501.329927][ C0] ? __pfx___se_sys_futex+0x10/0x10 [ 501.335117][ C0] ? rcu_is_watching+0x15/0xb0 [ 501.339876][ C0] __x64_sys_sendmmsg+0xa0/0xc0 [ 501.344723][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.350784][ C0] do_syscall_64+0x174/0x580 [ 501.355372][ C0] ? trace_irq_disable+0x3b/0x140 [ 501.360397][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.366287][ C0] RIP: 0033:0x7f6b7099de99 [ 501.370701][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.390303][ C0] RSP: 002b:00007f6b718ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 501.398728][ C0] RAX: ffffffffffffffda RBX: 00007f6b70c25fa0 RCX: 00007f6b7099de99 [ 501.406699][ C0] RDX: 0000000000000651 RSI: 0000200000000000 RDI: 0000000000000004 [ 501.414752][ C0] RBP: 00007f6b70a33eaf R08: 0000000000000000 R09: 0000000000000000 [ 501.422720][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 501.430682][ C0] R13: 00007f6b70c26038 R14: 00007f6b70c25fa0 R15: 00007ffc0f945008 [ 501.438657][ C0] [ 501.441660][ C0] Modules linked in: [ 501.445686][ C0] ---[ end trace 0000000000000000 ]--- [ 501.451148][ C0] RIP: 0010:dummy_queue+0x1ae/0x900 [ 501.456399][ C0] Code: fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 0b 5c 7d fa 4d 8b 24 24 49 83 c4 60 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 f0 05 00 00 45 8b 24 24 44 89 e6 83 e6 02 [ 501.476051][ C0] RSP: 0018:ffffc90000007ca0 EFLAGS: 00010216 [ 501.482128][ C0] RAX: 000000000000000c RBX: ffff888028cb6510 RCX: dffffc0000000000 [ 501.490163][ C0] RDX: ffff888031fd0000 RSI: 0000000000000003 RDI: 0000000000000005 [ 501.498195][ C0] RBP: ffff888028cb6500 R08: ffffffff90579137 R09: 1ffffffff20af226 [ 501.506222][ C0] R10: dffffc0000000000 R11: ffffffff87b73db0 R12: 0000000000000060 [ 501.514249][ C0] R13: 1ffff11005196ca0 R14: ffff888027690248 R15: ffff888027690c00 [ 501.522243][ C0] FS: 00007f6b718ce6c0(0000) GS:ffff888124f4e000(0000) knlGS:0000000000000000 [ 501.531231][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 501.537847][ C0] CR2: 000055647b1a9008 CR3: 0000000035aeb000 CR4: 0000000000350ef0 [ 501.545870][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 501.553297][ C0] Kernel Offset: disabled [ 501.557606][ C0] Rebooting in 86400 seconds..