last executing test programs: 6.374304631s ago: executing program 0 (id=45): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x56, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/thread-self/fail-nth\x00', 0x2, 0x140) write(r0, &(0x7f0000000740)='3', 0x4e) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x38, 0x0, 0x0) request_key(&(0x7f0000000780)='asymmetric\x00', &(0x7f00000007c0)={'syz', 0x3, 0xc}, &(0x7f0000000800)='R\x10rust\xe3c*sgrVid:De', 0xfffffffffffffffe) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x200205, &(0x7f00000000c0), 0x1, 0x469, &(0x7f0000000100)="$eJzs3M+PE1UcAPDvtF1Wfm5F/AGiomgk/thlF1QOXjQx8aCJiR7wuC4LQQprYE2EbNzFELyYKAl3Y+LFxL/AEyeinky84t2QEMMF9FQzdFq63XYpbWlZ+vkkw87bvvZ9vzPzOm/eMBvA0NqV/pNEbIqIKxExFhG5+grrK0ta7+b1hZl/ry/MJFEuf/hPkr4tblxfmKlWTbKfGyuFQvpBuXNJFJu0e+r0mWPTpdLsyaw8MX/8s4lTp8+8evT49JHZI7Mnpg4c2L9v8o3Xp17rSZ5pTDd2fDm3c/u7H194f+bghU9++7kSb7l88fLeZXn0xkhELNS2SaMXetvYwG2uW08KAwyEuzIaEYXsaL0SY5E/t6X22li889VAgwPuqXK5XJ5q/fJSGXiAJTHoCIDBqJ7o0+vf6tKnocd94dpblQugNO+b2VJ5pRBnszojDde3vbQrIg4u/fd9ukTDfAoAwL1wKR3/vNJk/FeMeKyu3pZsKUbEwxGxNSIeiYhtEfFoVOo+HhFP3GX7uxrKK8c/uaudZdaedPz3ZnZva/n4r3YXrJjPSptv5T+SHD5amt2bbY89MTKaliebfnoSsZT+/PPbVu3Xj//SJW2/OhbM4rhaGF3+nkPT89NdJ565djZiR6FZ/kkUbmcR2yNiR4dtHH3pp53Lf5Ovrd05/1X04D5T+YeIFyv7fyka8q9KVr8/OfFQlGb3TlSPikaX4vc/zn/Qqv2u8u+BdP9vaHr81/IvJvX3a/MrPmLdndo4/9fXLa9pOj3+1yUfLWv8i+n5+ZOTEeuS91b+vm6Cu1qu1k/z37O7ef/fGre3xJMRkR7ET0XE0xHxTBb7sxHxXETsXiX/X99+/tPO87+30vwX72b/d7CSP3b5l1btt7f/91cLt4Jq5/uv3QC72XYAAACwVuQiYlMkufHaei43Pl75//LbYkOuNHdq/uXDc5+fOFR5RqAYI7nqTNdY3XzoZDY3XC1PZeXFrLwvmze+mF9/qzw+M1c6NOjkYchtbNH/U3+vnOsFHjSe14Lhpf/D8Oq8//vmgLXuDr041684gP5zFofh1az/Lw4gDqD/nP9heNX6/3dtVK573Kvx4U1g7XH+h+Gl/8NQ6ua5/vtiJX6MWL1O0l0To4PJ65tu3l7oQ4SRuz8OgD6uTOUjBhhGod2/ahGny4tdNzrobyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDe+D8AAP//Gvzn2A==") r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000000)) 6.038426989s ago: executing program 0 (id=47): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r1, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r2, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001c00)=ANY=[@ANYBLOB="b80000001300000100000000fbdbdf25fc000000000000000000000000002001e000000200000000000000000000000000000004000000000a0060803b0000fe", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000200000000000000000000000000000000000000000002004000000000000000fdfdffffffffffff50000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006000000000000400001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001d40)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000001e00)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001ec0)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000001f00)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001f80)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) getpid() mount(&(0x7f0000000400)=@loop={'/dev/loop', 0x0}, &(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)='tmpfs\x00', 0x850088, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') recvmmsg(r0, &(0x7f00000018c0)=[{{&(0x7f0000000880)=@phonet, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000900)=""/153, 0x99}, {&(0x7f00000009c0)=""/241, 0xf1}, {&(0x7f0000000ac0)=""/95, 0x5f}, {&(0x7f0000000b40)=""/216, 0xd8}, {&(0x7f0000000c40)=""/249, 0xf9}, {&(0x7f0000000d40)=""/88, 0x58}], 0x6, &(0x7f0000000e40)=""/145, 0x91}, 0x4}, {{&(0x7f0000000f00)=@sco={0x1f, @none}, 0x80, &(0x7f0000001200)=[{&(0x7f0000000f80)=""/80, 0x50}, {&(0x7f0000001000)=""/46, 0x2e}, {&(0x7f0000001040)=""/107, 0x6b}, {&(0x7f00000010c0)}, {&(0x7f0000001100)=""/227, 0xe3}], 0x5}, 0xdd5}, {{&(0x7f0000001280)=@xdp, 0x80, &(0x7f00000014c0)=[{&(0x7f0000001300)=""/27, 0x1b}, {&(0x7f0000001340)=""/181, 0xb5}, {&(0x7f0000001400)=""/190, 0xbe}], 0x3, &(0x7f0000001500)=""/133, 0x85}}, {{&(0x7f00000015c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000001880)=[{&(0x7f0000001640)=""/146, 0x92}, {&(0x7f0000001700)=""/207, 0xcf}, {&(0x7f0000001800)=""/93, 0x5d}], 0x3}, 0x2}], 0x4, 0x100, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002000), r0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, &(0x7f00000020c0)={&(0x7f0000001fc0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002080)={&(0x7f0000002040)={0x24, r6, 0x10, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x800) r7 = syz_open_dev$dvb_dvr(&(0x7f0000000040), 0x0, 0x20000) r8 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r10, {0x0, 0xa}, {0xffff, 0xffff}, {0xd, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x6, 0x0, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc084}, 0x44080) sendmsg$nl_route_sched(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd25, 0x0, {0x60, 0x0, 0x0, r10, {0x0, 0x2}, {0x0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xfff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) preadv(r7, &(0x7f0000000100)=[{&(0x7f0000000240)=""/163, 0xa3}], 0x1, 0x207, 0x0) syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000200)='./mnt\x00', 0x20000, &(0x7f0000000780)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) 5.151942277s ago: executing program 0 (id=55): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/4104, 0x1008}], 0x1, 0x96, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./dbg\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) inotify_init1(0x80000) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000140)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000013c0)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000001440), 0x651, 0x0) recvmmsg(r2, &(0x7f0000001480), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000014c0)=0x6) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f00000016c0)={0x28, 0x12, 0x1, 0x0, 0x0, "", [@nested={0x18, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x8, 0x1c, 0x0, 0x0, @u32=0xc9}]}]}, 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) 4.316599871s ago: executing program 3 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, 0x0, 0x0) write(r0, &(0x7f0000000140)='7', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xf, 0x4, 0x8, 0x2d04}, 0x50) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000e40)={0x6, 0x3, 0x4, "3a8e0300d6000000010001000000400040f2000000000016c713b41e2a3600", 0x41564e57}) 4.300710204s ago: executing program 0 (id=69): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) (async) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0xa, &(0x7f00000000c0)=0x5, 0x4) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x20, 0x22, 0x9, 0x2, 0x25dfdbff, {0x4}, [@typed={0xc, 0x4, 0x0, 0x0, @u64}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000850}, 0x4000) (async) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x20, 0x22, 0x9, 0x2, 0x25dfdbff, {0x4}, [@typed={0xc, 0x4, 0x0, 0x0, @u64}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000850}, 0x4000) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f0000000700)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff959bcecc7a95425a3a07e758044ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x994b6e03113064ae, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10000807, 0x0) 4.229706491s ago: executing program 3 (id=71): memfd_create(&(0x7f000000a3c0)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85HX\xa9\xa5\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xb0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9\x00'/143, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8102, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x800000000000006, 0x128202) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0xe, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f54016d1a85a056f5d759ded130e04d528539f3d328973747a75d1f3d000017deb7d6193b3e7772fd29f35239d200000000008000", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x6]}}) r2 = syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000200)='./file0\x00', 0x800008, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x1}}, {@max_read={'max_read', 0x3d, 0x1}}], [{@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@context={'context', 0x3d, 'unconfined_u'}}, {@euid_eq={'euid', 0x3d, 0xffffffffffffffff}}]}}, 0x1, 0x0, &(0x7f0000000380)="ad58ae814ad2e97f446e4703b47a8e2d8a1d71febef4277ab4440795439dee59f57f13be9902a8587dc9e5d0a5d8fd2e8f4d2aa5c783c893c785589940dfd4877f6dfd2f3801ae702a58180b358e4fd0a2dd6c01c0009e3ca9022d5b08b3d030ff828ca8c73feefc18c017e6482813a1da3f0462887518b0e3b9a7d4") execveat(r2, &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x1000) 4.189180238s ago: executing program 3 (id=72): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @rand_addr=0x64010102}, '\x00\x00\x00\x00\x00\x00 \x00'}}}}}, 0x0) (async) syz_emit_ethernet(0x46, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @rand_addr=0x64010102}, '\x00\x00\x00\x00\x00\x00 \x00'}}}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) capset(&(0x7f00000007c0)={0x20071026}, &(0x7f0000000800)={0x200000, 0x200000}) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f0000000880)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x3a) (async) r2 = socket$inet6(0xa, 0x2, 0x3a) mlockall(0x3) (async) mlockall(0x3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmmsg$inet6(r2, &(0x7f0000000e00)=[{{&(0x7f0000000e40)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5, '\x00', 0x0}}, 0x1c, &(0x7f0000000e80)=[{&(0x7f0000000ec0)="a0002883781ecc0e", 0x8}], 0x1}}], 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xd, 0x3, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000b40)='GPL\x00', 0x5, 0x1f6, &(0x7f0000000b80)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c40), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xd, 0x3, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000b40)='GPL\x00', 0x5, 0x1f6, &(0x7f0000000b80)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c40), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c80)={r3, 0xe0, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000dc0), 0x0, 0x20000, 0x10, 0x8, 0xffffffffffffff5a, 0x0}}, 0x10) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="180000001600010a"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="180000001600010a"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r4) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000640)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) (async) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000640)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0xc201}) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x20, 0x0) (async) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x20, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) r6 = socket$nl_route(0x10, 0x3, 0x0) fcntl$getflags(r6, 0x40a) 3.931053979s ago: executing program 3 (id=78): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000180)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000010003704000080000000000000000000", @ANYRES32=r2, @ANYRES8=r2], 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x4000) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x7, @empty, 0x4000ca}, 0x1c) recvmmsg(r3, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/37, 0x25}, 0x3}], 0x1, 0x820b, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4a, &(0x7f0000000240)=0x8, 0x4) setsockopt$inet6_int(r3, 0x29, 0x4d, &(0x7f0000000540)=0x8, 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x4098884, &(0x7f0000000580)={0xa, 0x4e20, 0x10, @mcast2}, 0x1c) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) sendto$inet6(r4, 0x0, 0x0, 0x810, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000416000/0x4000)=nil, 0x4000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_procfs(0x0, &(0x7f0000000740)='task\x00') fchdir(r5) r6 = syz_clone(0x2b009000, 0x0, 0x0, &(0x7f0000000800), 0x0, 0x0) r7 = syz_open_procfs$pagemap(r6, &(0x7f0000000840)) ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000880)={0x60, 0x0, &(0x7f000010d000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x7, 0x0, 0x0, 0x3, 0x32, 0x10, 0x5a, 0x58}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1000001) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000400)={0xa, 0x4e24, 0x0, @empty}, 0xa) syz_emit_ethernet(0x71, &(0x7f0000000440)=ANY=[@ANYBLOB="ffe5ffffffff0180c20000030800450000630066000000119078000000000000000000014e20004f9078f439595269774110b035df41759265763e867608f20e5901df2197e37da07c2e3f5c4a4a2336d69ccd814d1b436c5157000023afc6878d24e07e05f701efc194544268d75665ae"], 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000700), 0x40, 0x0) recvmmsg(r8, &(0x7f00000004c0), 0x400000000000284, 0x2, 0x0) 3.548251932s ago: executing program 1 (id=80): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="090000000e0000002f4900007f00000001010000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000030573ec8627774cc314472074ee27681b071a6234ab74a014f5ea0ca32a959d692446352493c665873cc3378b98c17d1778514f36050c505742c5958f0bed737e77037fd9731717a2abfd7688ccf4c357edca96ef892f16a3d9a8b2e3a4e023665788c88cbae6a194a85db3bc67d003bc8774e916819b931b046e84f725cda9082aee11e3b6d53b4cd002a13b407f8ce0d282cedd547aa019153c56bf455935602a0d089a5119eb76b13a75a9612e9"], 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xbf5ce000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x44b, 0x70bd25, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x8}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x31}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000005}, 0x48040) connect$unix(r2, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000540), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x6) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/udp\x00') lseek(r5, 0x1000000, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r6, 0x0, 0x2e, &(0x7f0000000700)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x400, @multicast2}}}, 0x108) setsockopt$inet_group_source_req(r6, 0x0, 0x2e, &(0x7f0000000840)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast2}}}, 0x108) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0x8, &(0x7f0000000000)=0x40049, 0x4) r10 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r10, &(0x7f00000000c0)='\t', 0x1, 0x100400c1, &(0x7f0000000140)={0x11, 0x8100, r11, 0x1, 0x87, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}, 0x14) recvmmsg(r9, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x1, 0x3}, {0x0, 0x9}, {0x3, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x8, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x4}}, @TCA_FLOWER_KEY_MPLS_TTL={0x5, 0x43, 0x8}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20040004) 2.983632621s ago: executing program 3 (id=83): mknodat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x800, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000ac0)='./bus\x00', 0x3820c50, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000b40), 0x8, &(0x7f0000000b80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) r0 = getpid() r1 = syz_open_dev$usbfs(&(0x7f0000000980), 0x76, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f00000009c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000a00)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000c80)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000d00), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000d40), 0x10106, 0x2, 0x0) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000d80)=0x6) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000dc0), 0x0) setsockopt$inet6_opts(r4, 0x29, 0x37, 0x0, 0x18) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000e00)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000e40)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000e80)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r6, &(0x7f0000000f00)='1\n', 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000f40), r7) sendmsg$TIPC_NL_NET_SET(r7, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000001000)={0x40, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) 2.915501365s ago: executing program 4 (id=86): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f00000003c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 2.621745134s ago: executing program 4 (id=88): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x3, 0x7, 0x9, 0x7}, {0x9, 0x8, 0x1b, 0x6}, {0x2, 0x1, 0x80, 0x80000001}, {0x2, 0x6, 0x3, 0xfffffffb}, {0x6, 0xb, 0x80, 0x7fffffff}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000100)='Q+%(\x00', 0x0, &(0x7f0000000140)={@align=0x6, {0x0, 0x7, 0x200, 0x9}}, 0x4, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)=0x6}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000240)={r1, 0x1, r2, 0x3f}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x4, 0x9, 0xd6, 0x800, 0x19, @loopback, @loopback, 0x80, 0x10, 0x1, 0x8}}) recvfrom$packet(r2, &(0x7f0000000280)=""/55, 0x37, 0x100, &(0x7f0000000380)={0x11, 0x2, r3, 0x1, 0x3, 0x6, @broadcast}, 0x14) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000003c0)={@empty, 0xfffffff7, 0x2, 0x0, 0x9, 0x4, 0xff}, &(0x7f0000000400)=0x20) r4 = eventfd2(0x85, 0x80800) write$eventfd(r4, &(0x7f0000000440)=0x1, 0x8) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000480)) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000500)={&(0x7f00000004c0)=[0x0, 0x0, 0x0], 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r2, 0xc0186445, &(0x7f0000000580)={0x5, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r2, 0xc0186445, &(0x7f00000005c0)={0x7, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_BO_QUERY_INFO(r2, 0xc0106450, &(0x7f0000000600)={0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f0000000640)={r5, 0x6, 0xffffffff, 0x6, 0x1, [r6, 0x0, r7, r8], [0x2, 0x6, 0x3, 0x2], [0x55, 0x6, 0x7, 0x3], [0x3000000, 0x3, 0x9525, 0x2]}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r2}, 0x20) r9 = socket$inet6(0xa, 0x5, 0x8000) ioctl$DVB_DEMUX_DMX_EXPBUF(r2, 0xc00c6f3e, &(0x7f0000000780)={0x80000000, 0x80000, r0}) ioctl$UFFDIO_MOVE(r10, 0xc028aa05, &(0x7f00000007c0)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x3000, 0x3}) socket$nl_route(0x10, 0x3, 0x0) r11 = syz_open_dev$dvb_frontend(&(0x7f0000000800), 0xfffffffffffffffa, 0x288680) ioctl$FE_READ_SNR(r11, 0x80026f48, &(0x7f0000000840)) ioctl$IOC_PR_CLEAR(r2, 0x401070cd, &(0x7f0000000880)={0x81}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r10, 0x81f8943c, &(0x7f00000008c0)={0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r11, 0xd000943e, &(0x7f0000000ac0)={0x0, 0x0, "7fa67187f991d9263b430c206a9de4e38866c53e699317c6a5bc504610c75d88dde2368978cd198231d0c1c0992e98b3cb546fb5cd482b2ea00611617856fc6c0985f60b089ce5f8395d525b6046cefabc95d7635a025065d4bbc688aa4b284a458f078d2f740069a5768eabdf702fc41f555d5f6653f96828bb8c5df23c860c53f75559343d3a387867e3eab8cec7adadeed19cb43f9535d9db725fbc2f7da3cafbb5ae3f906d24f09bda89fcb836d5b7f590109d699c59dcac6d9314ebacacd7321bae3626dc595d12d71f752919ce51ef660d95a4694120d66dd96f3b36b9b0d8c7e33db31ebaeaa0d2d2fae80bb7bda540ec94f14bf4c506997d98b19f61", "393c2e348fa0856f3078bfda61b2ef31acdcade66a0b87cc7925463ba089d1c6ab47f4e6b6a2f16b6c5dd67c14b274f20f074f0126e9aa7a8092d4b84e402719e72fad33c43ac3a8a9b3ffdd187fd46f0cc442fd484944d1a2fedcf6b78b14b4fb6bbc5b4411b61661fe1da1854e890f20d3c2be84c69ad9378bf17c2badbf31bf44c518813fd36d014faad42dbf942547cfa3404001023a24cfbf202b1937adcc23f59ff989a13bd454a64d82e195c182ca91338a1f21a3f8db2d45c2d6a8c6df73639fe0e6b3c35547f8bd8fb504fcefdbd9238d07f1ba5ad4b826657f1de0e86509366c88ddcc59df6c77b1e466581285038cecc457a29854ed936ed4f9607f800027e14885de12fb8650898d8ac7ef4d0a3d8141f1662e4ac24046d44f6622cfb6b96cb49eb1d523e493e5c6a5901524df5168a540485d5efec9bed3ef4c8c61043131cbe8331a7ba76f67dc2c3dfc4d85a1052f55f9a9abba285dbef15c699d9d68398b55653c40e3bf7f1e51521d8f8383010161fd27285ca67e68841287eeed44f054885a726623a548801c74ff0770f3b8885135e6574b17deb2b59f2de3b59b799e535d9a6a9ebaddc0f19a08cf745b74b5502ae5207df09311e923f0f7cbfbd900aecc82690bf1641734072c336dcbc79b7210b692ce0510860b5d302c16119cf4ebdb72299c66d35351ba9427fb3e0f48fb3c88895c1042ad9a1598a3f3287d889fe09e518ac24b63640afde81d5a048db618f2fea83328bba838fe1529649a931810dc58649092363b5dfbc739f7da4222772010599d44bd8e88cdc843993b097812424669b6866413dbe17eadf9f7376466cbcc1a0908ec08657a2b8115418b9f867269861bda4cf09d3916840873c157ce8a827b834950e4fc9a12763925f26dce5bfea47158f35b941ad7ef142e9bcf08ed471e72e56f9a03a3ac3a342e7c31fae8e5346496b222c16370e0fde5bd70f65c76615545f174ec06c42bb96c2bcbb12803c1023e1d2009f6b3b54fc173dae65874e5379e2449f34cf14cee0b9b0874606067fbc4a5ac522dd46c56139e2f10aa324ac77f0b011ddd8ac7f4c8b084d0902ed7def1d86e1cdf29d77d479e2b98bccc974d99f32a447e6088fd40b8500c5febbb37e92db79714d739b76b8b4e73e5947fc90fb01623c204fda580b70e7b568d880a81ab15a10ed1542f5e92ab106630d9d78a80c4935ce1a68e427d167661521da49692b4f7b28468025633f1ced134aaccf02ab2136defd0f0bc11722df16e16604aeee0f9217963dfdf663acb2c59c76344473fe7f61f0920df16ceea8395b7864e12ad9750294d40648476daa6a30e9223880f8b5f01d81a893a22ac363f36e0739643917c89482cbacd28f3da85a9406ac330a7f7e4f8a6a449ce4d4c7c192db7bb9848fbbde504775cd0efcbab7745ad7a44d935e26fe6f567fbc97b48ec278770a509ec52e53caa18da6af00d1e6af0dbfb5f14aa24b07ef66aae01c7bdfb65cdfb5678eb2c4f98b3c8069e2df0ccbdf48ae8c42ae8d5ab5766c19d81fa531d606aaa4bbe430dee7bf49705b39dcab81bc0ad4402f9d1b8fe724a62f1f2253bef8ac27c793bab1bf89509750a86465f3fcbb20ddce802966e44cd2636c43d032b87aedaa6e6ab33de89933d4b0b5a1dd977aec164139fe857787d11960f4dc858232166a3180057437c9ab69e9ebf73577827c2d23e8fcb030be8442dbee8de132549a2e30a4cdbe109ad2fb1c27f315893dea4f2c36e1e289c83f17ff60234c6574a7fe7f826417352bb946aeeff9d52be3cf436f11481a857b8d500100ef8d03ca84a16e054a4655d5840dc9e3218fb5dacce170b516775ca036eb2105d8810e4f212cafae62458dcc222e6fe5c20afc14847c4da37eaa12728670629b5716946b8bc3181fc73db6811f3e7497a5e1e7e483513b30bbe734b84c6dc928ea32638a0d71b7f416fe3972e17f93f8c196534092304777c636c04f5f430416f7317d7df894793548de4e22962a5ffd4ee194e4ab3d84c6663425ae020c5568d06337a8580169471319468dfadeb6d9ace8dec80020c315b7d6ebadeecd3423552274e2bac2ad595c3bdd1dd1deffaaf139126923873d4c75e4d0efa1b45110d6e1251b45707d2a2d459f3c9ddb9e33b4a74ad4d6a8807d73c0f5dd6504bf13d124ae90f6542775598f783fe5ce3923396085c9ca92330698fc612939776bd12c95c8dda351643c51f9069a48917f27b20b8b8dcd60a709e30f2a5283e3c14b617b8f7bc052dc95194bb91f3d4de4cd630b6437c9b2c1776636fa4e359e00ed0eb04286b9b1a4f5d2398dd3c92e547836a9e864d4bfcccfe38da9298f6d4f5a45915bbacf44f530f302c73a323e5fdff64fe009b0a721d3facf4a57fab5cf81d3559c49a08f6e53be257d95f94bd900ea9c6e1bf877ae74c70a4dfcad1a010a98a584f68fa3eb84d5413772fe8731aa2741ed95c07942d6b04078bf813e22cfdda9a3f00391f1f07a5e7e14b4627a02fe6e5c113196aa6baf94cd7045fed07ab946e9514f082895f1bb9a91474ee0b64948a72abe2a4d24359a4e0c72b1bcc7146bb51ff7fb46f0b4a987441445af6ee6a5c3a31cdf98462eebb145b247f1a2741770337c3ce31b11282ad3a932d3cb109d6f5ecf2f7414af9ec7466f3e4ed44a76d5e8d937b81bbdcc0c8e4c0f81226cc49b0f682a66cb7d2ee9c4befa242cf934e90991745e3f157149db57ff53015541a5d0370ce873eb15854daaa4c9b6f68abb6bdcc8c6e911a14059866f4d7573bb3a1f9adbb01a3ae2ddca03c264c3335e267b8db07bb573007d3f6c3112c2a0ebe61726c71bb1bba58086b602ae28dba4cfe62a49be8ba4fe631ed9e13b61b1629e5f2d98585824900c801119cb5a762616b4129addcd84f622c84efcd87d53880ee972021de06cdd59796e8b7245e8be3b51ed6b73a96002b81fdb725cadf026d4e8972547bce595993908756676401bc1192399f9b58bce184f11407bb649befc56dbfcba56dc17058fe86846a4efbf2e55b2f6a4dda427cead0498617834c030908b1c4e51082ee545f5b7d0adb825a23e60dc66c8b473c922563e21d63884c2a66a487e413e3fd3ddbf293ac48ce4bd763313a201bfa424b29b9f623cc25ac2851eae302d201bff75f7874c5c25b631e3c13fd18253c8c6a6f8583a9b6d2bb2fb2b5a706f431c39fc9cbb8b6863fca6b56c1c081eb472dfc2c515e29478bbbe708d5c1da95aff465dc4a9730ec74dac3ede8bec067da23605cbfa2aa5f6e4321f2bc11fa4c7c2f2cfe250076112e88e9e8d6d96f321a45058009025a997c643fbcb203223e9d8c2494dfe422a47a416e87a8925b21b63ba4d9b728854e49c2d02afce05a95a593e5e4de1cb250d23003b5f0482bc1266a84cded92e8ffd86e9ec80002ada77e224415eb16f85e3f9d0389bc21cf30a9f62f99b9516c7538bd8cf0df91295a475c97b7a57e095fdb8b83ee35d538f7969138d1092e45b51ec338c95b738419076ea83f0da63aca39843abbcd6b9fde93c9a3b7578b9b920b0b5aa1e37fb4eb13d8d85911c8523d04625546f898985d08ce781fbffbce0aa09dcedb2548ff32439c07a678edcd92f24278b3944452f5a9b48dcbd121ee6c9f15d471a9ea616f95b6c39c820bd5e041d5fcfcfa78682b535025f00f522a85cf90fa555991f4298a23b066aaec9014e57ac7e4589bbe7224ce7ac2a896ff38cd5f34470d2e14a5217e3cb6766dcfe7b0b403fad8d9b8a9f7d218d5b166f2ebd0c0c824d7ce4ff896be016c8511f174e28d8c757f3a98aed2ff20fc3ab5f6facb8d2775dd37ef29893d86b7ef21b66d31494fc5907beae53bcc4dacbe61e2a44ea0f943b9db43f967ee8fbe56747c41a7041e6833a84dc696f23ff2c6252987ce438ceb7fb27c21cde728ff3561661eec2ef167684f0bfc28a6fe3b3b2f2cda892fc9f9cdddab7c5b46aa6ab36b439c56770100164564f9758fc6c09c9bb9f33e1a936397971653b4a013064097e449cfbe52e86fc20f9dfb0026481f2cc1a89c7187b2a4006c9aeef31af1a9c5d869503ae6bc16da7c3c56874f02c4d3331bcfcc839da532306d678aabc45ad8827313914d1d05ce96efc882dafc5921cc3d2bd1a7bf0bd32635d924d03dd527782073b9a99efd46006a3d9c3e0a6fdfab6dd9224a3f78a278363af694ffe05c59703c3a15d0083858a5652e173edf7470002f02744ca5ea10907821b02cc971b1b5d45155e98ce49c6964ebbc7c513f7355af46cc1e6be150cbe9db072a09be846824d1cc490c4fe22618fd80e251a2d69edb781fd1f991aa5258c05da3b9458f07660d1effce06d4410e9317b398f820625f8e415c739a5f6c681eced366d766f37778d660ce3776a91c58576a91db29ef552a60366823ae2376d35a3811726ac60af1b7804a3d5e74686612d9ec77cf79061f160c05150dc0d95d2dc7ef9166265d488018e1f828da21f4557de648442289e803f708673d2ba68b1f5d072f010d1228cea13774fe7985ff15df90ffac47b06e0f032ff2708b8dee02e9f7fff490e8a006a2db37149d04b4b93d95e09527d0708122fe1cdd7a23a1e58dabae5c20b433fc4c255e94086291f66193bb5c81759c752db8dcdd33286558418e42b355e23bbb4b58038f22cb09d742e0ffb850f64c47a980fb796b639eb47003070f08e82a3eaf4ce376e51fa66d1c059ce9dda85f50d7da11003b309e526d281539c8667ef77505c061f65ea71094f98f5e3436046355134b59439145578dccf8f9161e4791c8857320d6ca750f96673d4df4f6d4eb855df6b9b9ba13d1c644301425f1071f2c516a0f824f9f1eca63a985a441f1ab18aff74bdc7a35fb9514ca9214e0dcd072b91705392cccd43f8ac9d79d7e9ada72a2a30eec6d9ff0bea46869fd82972a26deac2ec613dcf1c6bd2a1ac35d6c3dabd50ca47b28b07913151753a9b91d8e86f0940ca6fdfd9d3eae77ec88f25cf3071f4c936d2d32cfcb890bdbcf3b1f3a7373b9461bcf6670c72139b08c782d7b34edd139c9195f08b89f3a6ff58a0b1c4fe2d9a1de9a7add93e473073f0a5c77e49a5d73ef07cfd3368db651bd2efe49dcbc777b6427ed1ba3ac9b6ae80e329c6256558c4bd266d219537df88306024d70a4f57271401227a92fa297d48f3e198a5a2fc679962719c9dbf745b30114d3b98c3138c84cd2c66abe649273b4336492c7b1d678a01e7385a1c99dfc1d17527a5026a16835d29f8d713ebae83e41123896673b7c0c8604e6b1f490e18f361b25af001876538079dd3673e26f1c99a3303ceb6c082441a4e1582351780cde841fa3fde6c6707d2e5f5c5a39dc91bc1496ee2ec0b2311c5aa56daf85ffb0c0fe2b"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r10, 0xd000943d, &(0x7f0000001ac0)={0x3, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x9, "900f4b01f5f34c"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000002ac0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r10, 0xc0709411, &(0x7f0000002cc0)={{0x0, 0x80, 0xfff, 0x4, 0x1, 0x4, 0x0, 0xffffffff, 0x9, 0x80000001, 0xf3f, 0x4, 0x6, 0x3ff, 0x9}, 0x40, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r9, 0xd000943d, &(0x7f0000002d80)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x5, "e7055e60e22d49"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000107e40)={0x2, [{r12, r13}, {0x0, r14}, {0x0, r15}, {r16, r17}], 0x7, "75ee0ad8138c60"}) 2.617138697s ago: executing program 4 (id=89): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=@gettfilter={0x34, 0x2e, 0x20, 0x71bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x7, 0x7}, {0x1, 0xfff3}, {0x6}}, [{0x8, 0xb, 0xff}, {0x8, 0xb, 0x80}]}, 0x34}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x40040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000d96f7baa64d3aaca6e4eb7e079662d001000010800000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b0000000000"], 0x28}}, 0x4) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000007c0)={'xfrm0\x00', 0x0}) r6 = socket(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x26080, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x5c) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x4, 0x0, 0x0, &(0x7f0000000900)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r6, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x7], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}}}]}, 0x88}}, 0x20000000) socket$inet6(0xa, 0x5, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x2, 0xfff2}, {0x3, 0xffe0}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x2ac}]}, 0x2c}}, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000019008111e0020f060d8107040a60000000000000001455a12a0009000a000699e3ffffff14000500fe80817806000567b8b7b94002000009080016060000000000000000d67f6f9400f7d1d9bbe94fa27100a007a2f7457f01896034277ce06bbace8017cb39b62ee5a7cef4090000001fb791643a5e83d42365f003724a237ee4b61602b2a10000000014d6d930dfe1d9c322fe040000005025acca262f3d40fad95667e006dcdf634c1f215ce3bb9ad809d50b694138c9f1ac76efb42a9ecbee5de6ccd44242f4d643f6fd0f26187b51980dd6", 0xd8}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r11, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32=r11], 0x3c}}, 0x8000) openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x28000, 0x0) syz_emit_ethernet(0x15, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaa250180c20000028100100008050147013a3c10e9fd8fb36f5498d1c82e2581a08c1c5b311f17258e7f5cdd0f160564fd2e3fc2aa57e5574201ad38b86940c1"], 0x0) 2.603796894s ago: executing program 1 (id=90): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0), r2) sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x48, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0xa}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x7f, 0xf9, 0x3, 0x1]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000020) close(r3) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000500)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000540)={r7, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10) getsockopt$inet_sctp_SCTP_EVENT(0xffffffffffffffff, 0x84, 0x7f, &(0x7f00000001c0)={0x2, 0x8002}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={r8, 0xb8, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x9, @private0, 0xa}, @in6={0xa, 0x4e23, 0x9, @loopback, 0x718}, @in6={0xa, 0x4e23, 0x10001, @loopback, 0x6}, @in6={0xa, 0x4e21, 0x9bb, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x80}, @in6={0xa, 0x4e23, 0xfffffff9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x93b}, @in={0x2, 0x4e24, @multicast1}, @in6={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xc23}]}, &(0x7f0000000340)=0x10) sigaltstack(0x0, 0x0) ioctl$TUNGETVNETLE(r3, 0x4010744d, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}, 0x1, 0x0, 0x0, 0x4084}, 0x0) sendmsg$nl_route(r0, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001400)={&(0x7f0000000580)=ANY=[@ANYBLOB="00000000000a10000000000000000000001400010000002cb77e9d00000000000000000000050015000200"/54], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4040050) 2.578425961s ago: executing program 4 (id=91): syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x10, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1e}, @local, {[@dstopts={0x3a, 0x1, '\x00', [@generic={0x5}, @jumbo={0xc2, 0x4, 0xfffffffc}]}]}}}}}, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0), 0x0, 0x48e, &(0x7f0000000d00)="$eJzs3M1vVFUbAPDnTj+AAm/7In6AKFU0NhpbWlBZuACjiQtNTHSBy9oWRAo1bTVCiFYXuDQk7o1LE/8CV7ox6srErbo2JMSwAXVzzZ25t50ZZsZp6TDA/H7J0HPuuZdznnvumZ5zb2cC6Fmj2T9JxI6I+DUihivZ2h1GKz+uX70w89fVCzNJpOnrfybl/a5dvTBT7Foct73IrNRur7Z07vzp6fn5ucU8P7F85t2JpXPnnz51Zvrk3Mm5s1NHjhw+NPncs1PPbEqcWZuu7f1wYd+el9+89OrM8Utv/fh1UsRfE8f77f+nW1uWjjbY1lckHm+/ljvCzqp00t/FhrAub0dE1l0D5fE/HH2x1nnD8dInXW0c0FFpmqZbmhevpMBdLIlutwDojvz3fBKxMpOtgavX883dPQu8K8cq4WRxX89flZL+KOX7DNStbzdTdiaPr/z9RfaKuvspAACd8O2xys9i7rc2/yjVTPKO5s+GRiLi/xGxKyLuiYjdEXFvRNwXEfdHxANVxzR67lOv/iHJjfOf0uUNBdambP73fP5sq3b+V8z+YqQvz+0sxz+QnDg1P3cwIv4XEWMxsCXLT7ao47sXf/msWdlo1fwve2X1F3PBvB2X++tu0M1OL0/fTMzVrnwcsbe/UfzJ6iw/68c9EbF3/8bqOPXkV/ualf13/C1swjIk/TLiiUr/r0Rd/IWk9fPJia0xP3dworgqbvTTzxdfa1b/TcW/CbL+H2p4/a/GP5JUP69dWn8dF3/7tOmaps3rf7D6mOz6H0zeKKeLgg+ml5cXJyMGk1fy7Ufz7bX1lfebWts/i3/sQOPxvyvWzsSDEZFdxA9FxMMRsT9v+yMR8WhEHGgR/w8vPPbOxuPvrCz+2XX1f9NE8Wx7bnEgaor6Tn//Tbmk6KyRFvEn0aD/D5dTY/mWdt7/WrZ08WauZgAAALjzlCJiRySl8dV0qTQ+Xvl7+d0xVJpfWFp+6sTCe2dnK58RGImBUnGna3j1fmisTObL+uL+6FRd/lB+3/jzvm3l/PjMwvxst4OHHre9yfjP/NHX7dYBHXf3/DkfsF4bHf9pmn60yU0BbrF1jf/BzrUDuOWGzP+hdzUY/9vq8i2+IwC4kzX6/W9hD73B/B96l/EPvcv4h961gfH/+1AnGgLcSvkn4fvb+YB/xxLZ+0/3am8nETUtTNMuNWPw9jgb5USUulZ7bPDwsS6dsX/yL9u8PTquzUS335kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2x78BAAD//xsC4og=") 2.510780493s ago: executing program 4 (id=93): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$ptys(0xc, 0x3, 0x1) r1 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@loopback, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x0, 0x5, 0x0, 0xa, 0x20}, {0x0, 0x800000000000, 0x4, 0x3, 0x0, 0x80, 0x0, 0x10000000000}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x7}}, 0xe8) prlimit64(0x0, 0xe, &(0x7f0000000500)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x8) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000600)=@abs, 0x6e) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240), 0x10480, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d4c81bb3d3030302930303030307034a5303226e12ee558287965cbdd1b55302c75736572", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r4, &(0x7f0000000b80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000002bc0)={0x50, 0x0, r5, {0x7, 0x29, 0x5, 0xffffffff9080edc4, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x4}}, 0x50) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000002c40)='./file0\x00', 0x40000, 0x73) syz_fuse_handle_req(r4, &(0x7f0000002c80)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000004c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004d40)={0x20, 0x0, 0x8000000000, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r6, 0x40806685, &(0x7f0000004d80)) sendmmsg$unix(r3, &(0x7f0000000680), 0x651, 0x0) recvmmsg(r2, &(0x7f00000006c0), 0x0, 0x10002, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000a80)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000060000000000000000000000000000795381ff8c0342255ed25623e164a0238b0af1696bab78c1ff2b5f343bd5ba216b509b7809f59339ebf908a43761a45f919a13263c0e80eca3db6511d2ba505ec5d3983a53f55a58ec8d38f9919c4034e4d54386b9d1de"], 0x50) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config\x00', 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000006c0)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656eca", 0x1be}, {&(0x7f0000000880)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad5", 0x2e}], 0x2, 0x0, 0x0, 0x900}}], 0x1, 0x20004080) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f00000008c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r7, &(0x7f0000000900)=[{{&(0x7f0000000940)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f00000009c0)=[{&(0x7f0000004dc0)=""/102, 0x365}, {&(0x7f0000004e40)=""/76, 0x14c}, {&(0x7f0000004ec0)=""/4096, 0x197}, {&(0x7f0000005ec0)=""/92, 0x645}, {&(0x7f0000005f40)=""/73, 0x1b}, {&(0x7f0000005fc0)=""/77, 0x188}, {&(0x7f0000006040)=""/154, 0x2c}, {&(0x7f0000006100)=""/17, 0x1d8}], 0x21, &(0x7f0000006140)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000006200)={0x77359400}) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000680)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a40)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) 2.503471962s ago: executing program 2 (id=94): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000c40)) 2.477236213s ago: executing program 2 (id=95): fsopen(&(0x7f0000000000)='gfs2meta\x00', 0x1) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xeeeeeeee}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x200000000000000) fsopen(&(0x7f0000000000)='gfs2meta\x00', 0x1) (async) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xeeeeeeee}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$TCSBRKP(r1, 0x5425, 0x200000000000000) (async) 2.411746151s ago: executing program 1 (id=96): r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$alg(0x26, 0x5, 0x0) (async) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) socket$kcm(0x1e, 0x4, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000080)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000100)=[0x0], 0x1}) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'geneve0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newlink={0x58, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x12}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x100}}]}, @IFLA_VLAN_INGRESS_QOS={0x4}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x58}, 0x1, 0x0, 0x0, 0x48000}, 0x8000) (async, rerun: 64) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r3, 0x40086e81, &(0x7f00000004c0)=0x7) (rerun: 64) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{}, 0x0, &(0x7f00000001c0)=r5}, 0x20) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000300)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0], 0x6, r2, 0xdededede}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000200)={0x400, 0x4b, &(0x7f0000000240), &(0x7f0000000280), &(0x7f0000000340)=[r7, r6], &(0x7f0000000380)=[0x7, 0xa, 0x5, 0x81, 0x1], 0x0, 0xffffffffffffffff}) (async) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="2000000076001f4ca3bd7000fbdbdf250800000000000000080001"], 0x20}], 0x1, 0x0, 0x0, 0x2400c814}, 0x0) 2.410735861s ago: executing program 2 (id=97): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x6, 0x7, &(0x7f0000000c40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x8, 0x5, 0x0, 0x1}]}, &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1f9) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r1 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000500)={@link_local, @random, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x12, 0x0, 0x0, @rand_addr=0x64010101}}}}}, 0x0) sendmsg(r1, &(0x7f0000000540)={&(0x7f0000000580)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="19000000040000000400000010"], 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0xe, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) unshare(0x26020480) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000004c0)={r3, r2, 0x5, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x100000000, 0x0, 0x1, 0xffffffffffffffff}}, 0x40) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='27', 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0x0, 0x0) open_tree(r0, &(0x7f0000000040)='./cgroup\x00', 0x88802) r5 = syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000003c0)={[{@grpjquota}, {@dioread_lock}, {@i_version}, {@stripe={'stripe', 0x3d, 0xf0}}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x1}}, {@bh}, {@noblock_validity}]}, 0x3, 0x453, &(0x7f0000000600)="$eJzs281vFOUfAPDvzLbw+/HWivgColbR2PjS0oLKwYtGEw+amOgBj7UtBFmooTUR0mg1Bo+GxLvxaOJf4EkvRj2ZeNW7ISHaC+hpzczOlO2yu7R06xb280kGnmfm2T7Pt888O8/MMw2gb41k/yQRuyLit4gYqmdXFxip/3dteXH67+XF6SRqtTf/TPJyV5cXp8ui5ed2FpnRNCL9NCkqWW3+/IXTU9Xq7LkiP75w5r3x+fMXnjl1Zurk7MnZs5PHjh09MvH8c5PPrj2YJGl7aHfW1gMfzh3c/+rbl16fPn7pnZ++yUrvKo43xrERaUN6JAv8r1quudzj3ahsC9ndkE4Gbl6GraESEVl3Debjfygqcb3zhuKVT3raOGBTZdem7e0PL9VaqbTcC9x2kuh1C4DeKC/02f1vuf1HU48t4cqL9Rugq8ni9LXl+lY/MrByLz+4ifeuIxFxfOmfL7MtuvgcAgCgne+y+c/TreZ/adzbUG5PsTY0HBF3RcTeiLg7IvZFxD0Redn7IuL+G2pIO9bfvDR04/wnvXzLwa1BNv97oVjbWj3/W2n3cKXI7c7jH0xOnKrOHi5+J6MxuD3LT3So4/uXf/283bHG+V+2ZfWXc8GiHZcHmh7QzUwtTOWT0i648nHEgYFW8ScrKwFJROyPiAPr+9F7ysSpJ78+2K7QzePvoM0603rUvop4Iuv/WrIUTfGXks7rk+P/i+rs4fHyrLjRz79cfKNd/RuKvwuy/t+x+vxvLjKcNK7Xzq+/jou/f9b2nuZWz/9tyVt5v2wr9n0wtbBwbiJiW/Janl+1f/L6Z8t8WT6Lf/RQ6/G/t/hMVs8DEZGdxA9GxEMR8XDR9kci4tGIONQh/h9feuzdW49/c2Xxz7T8/ls5/5v6f/2Jyukfvm1X/9r6/2ieGi325N9/N7HWBm7kdwcAAAC3izR/Bz5Jx1bSaTo2Vn+Hf1/sSKtz8wtPnZh7/+xM/V354RhMyyddQw3PQyeSpeIn1vOTxbPi8viR4rnxF5X/5/mx6bnqTI9jh363s834z/xR6XXrgE3XhXU04DbVPP47v7IB3Elc/6F/Gf/Qv4x/6F+txv9HTXlrAXBncv2H/mX8Q/8y/qF/Gf/Qlzbyd/0S/ZyIdEs0Y5MSQ1ujGT1M9PqbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDv+DQAA//82merZ") mount_setattr(r4, &(0x7f0000000b00)='./file0\x00', 0x1980, &(0x7f0000000c80)={0x100000, 0x80, 0x0, {r5}}, 0x20) 2.369201147s ago: executing program 1 (id=98): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000200)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r2, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mlock(&(0x7f0000626000/0x5000)=nil, 0x5000) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=@newneigh={0x7c, 0x1c, 0x100, 0x70bd26, 0x25dfdbfd, {0x2, 0x0, 0x0, r4, 0x10, 0x2, 0x3}, [@NDA_LINK_NETNSID={0x8, 0xa, 0x1}, @NDA_SRC_VNI={0x8, 0xb, 0x10000}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}, @NDA_CACHEINFO={0x14, 0x3, {0x1, 0x6, 0x9, 0x101}}, @NDA_NH_ID={0x8, 0xd, 0x1}, @NDA_CACHEINFO={0x14, 0x3, {0x10001, 0xfffff543, 0x9, 0x7fff}}, @NDA_VLAN={0x6}, @NDA_PORT={0x6, 0x6, 0x4e23}, @NDA_PORT={0x6, 0x6, 0x4e22}]}, 0x7c}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) 2.27606983s ago: executing program 2 (id=99): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, 0x0, 0xfffffffffffffdc2) 2.216014407s ago: executing program 2 (id=100): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="28010000100007000000020000000000ff025958f3317aaa1226536a120000000000000000000000000001e00000020000000000000000000000e84e20000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc001b0000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200340000000000000014000e"], 0x128}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in=@rand_addr=0x64010102, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1, 0x10000000000000}, {0x0, 0x200000, 0x3}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0xa, 0x3, 0x87) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x18, r5}) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x8936, &(0x7f00000000c0)) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0c0100001a0007002abd700000000000fe80000000000000000000000000001b00000000000000000000000000000000000300004e2200000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="e6744a85c94562180000000000000001000000002b000000fc0000000000000000000000000000005a000000000000008f6b000000000000020000000000000004000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0180000000000000e80a000000000000000000000a000200700000000000000014000e"], 0x10c}}, 0x8000) 1.949432509s ago: executing program 3 (id=101): r0 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x80000001) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1860, 0x0, 0x1, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x158) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000200), 0x8, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) (async) linkat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0/file0\x00', 0x400) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./bus/file0\x00', 0x0, 0x12) (async) chdir(&(0x7f00000003c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0, 0x0, 0x100) (async) setresuid(0x0, r1, r1) (async) setreuid(r1, 0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x14000, &(0x7f00000002c0)={[{@sysvgroups}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@test_dummy_encryption_v1}, {@noblock_validity}, {@bh}]}, 0x1, 0x440, &(0x7f00000007c0)="$eJzs289PHFUcAPDv7EJb+kOwqT9Kq6LVSPwBhdbagxeNJl5MTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddreAC0vdzycZeG/mLe99983bfTOPCaBnjaQ/koiDEfF7RAxWs/UFRqq/7qwsTf+9sjSdRLn81l9JpdztlaXpvGj+ugN5pi+i8FkSx5rUu3D12sWpUmn2SpYfX7z0/vjC1WvPz12aujB7Yfby5Nmzp09NvHhm8oWOxJnGdXv4o/njR19/58Yb0+duvPvzt0kef0McHTLS7uBT5XKHq+uuQzXppK+LDWFTitVhGv2V8T8YxVjrvMF47dOuNg7YVuVyufxg68PLZeB/LIlutwDojvyLPr3+zbcdmnrsCrderl4ApXHfybbqkb4oZGX6G65vO2kkIs4t//NVusX23IcAAKjzfTr/ea7Z/K8QtfeF7svWUIYi4v6IOBwRZyLiSEQ8EFEp+1BEPNyskqR1/Y2LJOvnP4WbWw5uA9L530vZ2lb9/C+f/cVQMcsdqsTfn5yfK82ezN6T0ejfm+Yn2tTxw6u/fdHqWO38L93S+vO5YNaOm317618zM7U49V9irnXrk4jhvmbxJ6srAWn3HY2I4S3WMffMN8fbHW8ffxsdWGcqfx3xdLX/l6Mh/lzSfn1yfF+UZk+O52fFer/8ev3NVvXfvf+3V9r/+5ue/6vxDyW167ULm6/j+h+ft7ym2er5vyd5u27fh1OLi1cmIvYUs0bX7p9sKDe5Vj6Nf/RE8/F/ONbeiWMRkZ7Ej0TEoxHxWNb2xyPiiYg40Sb+n1558r2txb+3zV/tjDT+mU31/1piTzTuaZ4oXvzxu7pKhzYaf2T9f7qSGs32bOTzbyPt2trZDAAAAPeeQkQcjKQwtpouFMbGqv/DfyT2F0rzC4vPnp//4PJM9RmBoegv5He6Bmvuh05kl/V5frIhfyq7b/xlcaCSH5ueL810O3jocQdajP/Un8Vutw7Ydp7Xgt5l/EPvMv6hdxn/0LuajP+BbrQD2HnNvv8/7kI7gJ3XMP4t+0EPcf0Pvcv4h961mfE/uI3tAHbUwkDc/SF5CYl1iSjsimbc+4l9sSua0Zjo9icTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wbAAD//9FC5aU=") 1.649692481s ago: executing program 4 (id=102): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fedbdf254300000008000300", @ANYRES32=r2, @ANYBLOB='\f\x00X'], 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0x800) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c0000000400000001000084ffffffff0a000000030000000000000200000000000000010500000020000000000000000000000b0200000000305f302e4f00612e002e"], 0x0, 0x58, 0x0, 0x0, 0x400}, 0x28) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x1000c40, &(0x7f0000000240)={[{@discard}, {@errors_remount}, {@dioread_lock}, {@usrquota}], [{@obj_user={'obj_user', 0x3d, 'usrquota'}}, {@dont_appraise}]}, 0x5, 0x52a, &(0x7f0000000540)="$eJzs3cFvI1cZAPBvZpNNut02KVQqIKBLKSxotfbG266qnsoFhKpKiIoThzQk3iiKE0exU5qwUpP/AYlKHBCcOCOB4FCpJw4cENzg1ks5IC2wAjVISBjNeJx1E3vjZrO2sH8/aTTzZibzvWdr3rO/TPICmFhXImI/Ii5GxBsRMVfsT4olXmkv2Xkf3ruzfHjvznISrdbrf0/y49m+6PqZzOPFNWcj4tvfiPhecjJuY3dvfalWq24X5XJzY6vc2N27vraxtFpdrW5WKrcWbt146eaLlYHaMTvAOc9u/OLu19de/c67v/ncB3/c/+oPsmpdLo51t+M8tZs+fRQnMxURrz6KYCNwoWjPxVFXhDNJI+ITEfFcfv/PxYX83RxMj9saAPg/0GrNRWuuuwwAjLs0z4ElaanIBVyONC2V2jm8p+NSWqs3mtdu13c2V9q5svmYTm+v1ao3ilzhfEwnWXnh7Wz7frkSHy3fjIinIuKHM4/l5dLy4HkGAOB8PX5s/P/XTHv8BwDGXM+HZ7q/ny8Ory4AwHAM8vAsADBejP8AMHnuj/+XRloPAGB4fP8HgMlj/AeASfN+Z/y/MOqaAABD8a3XXsuW1mHx/69X3tzdWa+/eX2l2lgvbewsl5br21ul1Xp9tVYtLdc3TrterV7fWnghdt4qN6uNZrmxu7e4Ud/ZbC7m/9d7sTo9lFYBAA/y1LPv/TmJiP2XH8uX6JrLwVgN4y0ddQWAkTlDzt/TAjAmpo6tgcnhOz5Mrl8Wf/F72lyefT/0v3OGoK23z/BDwHm7+mn5f5hU8v8wuTzzD5NL3h8mV6uV9JvzPz06BQAYKx8zx+9XAjCGhvr7fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgTl/NlvqucpqVSxBMRMR/Tye21WvVGRDwZEX+amV5diqgujLTGAMDDS/+aFPN/XZ17/vLxoxeTf8/k64j4/o9f/9FbS83m9kK2/x9H+5vvFPsro6g/AHCazjjdGcc7Prx3Z7mzDLM+d7/Wnlw0i3tYLO0jUzGVrf4wm086fOmfSbtcyD6vXDiH+PsHEfGpXu1P8tzIfDHz6fH4Wewnhho//Uj8ND/WXmevxSdPXHmmb8zT5nqFSfFe1v+80uv+S+NKvp7tOfnxbN5DPbxO/3d4ov/r3O+zeV/Tq/+7MmiMF377zb7HDiI+M9UrfnIUP+kT//kB47//2c8/1+9Y66cRV6N3/O5Y5ebGVrmxu3c9e+Grq9XNSuXWwq0bL918sVLOc9TlTqa6W3uE+NvL157s2/6f/7roKE/Gnz2l/V96YKtbRx3wz/7zxne/0C/+QcRXvtj7/X/6AfGzMfHLxXb/nr5t6dKv+k7fffcganNZbVv/bX3c9//aKXE7PvjL3sqApwIAQ9DY3VtfqtWq2+e6MR35xu/O/8q1WvKI6mxjBBsxxFjZx+SHvc4zRcpsqXP/dJ/z+5+8+0y2b+Sv6rlsjK5PAobj/k0/6poAAAAAAAAAAAAAAAD9PPI/J0pH3UIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADG2f8CAAD//7yKxnU=") (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) 1.427798769s ago: executing program 1 (id=103): r0 = socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) r4 = socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r5, &(0x7f00000001c0)='1', 0x1) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000640)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000680)={0xa, 0x4e21, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x200}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000006c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000700)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000740)=@gcm_256={{0x303}, "6e93985104a4f04e", "d10c7c79fe45a46cbab02c3181ca0a91964de377dd4b49e01e682e4eab01e709", "f4c37363", "156870cb59bb8038"}, 0x38) r7 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000007c0)={r7, 0x58, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_inet6_SIOCDELRT(r6, 0x890c, &(0x7f0000000880)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffff8, 0x40, 0x5, 0x500, 0x4, 0x41200200, r8}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000980)={'ip6tnl0\x00', &(0x7f0000000900)={'syztnl1\x00', r8, 0x2f, 0x9, 0x80, 0x1, 0x40, @private0, @local, 0x20, 0x40, 0xff, 0x1}}) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @rand_addr=0x64010100}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}}}}}}, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x42, 0xa01, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000c40)={0x50, 0x0, &(0x7f0000000ac0)=[@register_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000a00)={@fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x180a}, @child_ptr={0x70742a85, 0x1, &(0x7f00000009c0)=[r5, r1, 0xffffffffffffffff, 0xffffffffffffffff], 0x10, 0x1, 0x1c}}, &(0x7f0000000a80)={0x0, 0x18, 0x30}}, 0x1000}], 0x100, 0x0, &(0x7f0000000b40)=@reply}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) r10 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, &(0x7f00000004c0)={0x0, 0x3}, 0x8) sendmsg$inet_sctp(r10, &(0x7f0000000500)={&(0x7f0000000540)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000580)=[{&(0x7f00000005c0)="b3", 0x1}], 0x1, &(0x7f0000000600)=[@init={0x18, 0x84, 0x0, {0x6, 0x101, 0x2a, 0x6}}], 0x18, 0x200008c0}, 0x6008045) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r11, @ANYRES16=r9, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r11, @ANYBLOB="0600eb00000800000400ec000a000600"], 0x44}}, 0x28000) 1.26809569s ago: executing program 0 (id=104): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f00000016c0)={0x28, 0x12, 0x1, 0x0, 0x0, "", [@nested={0x18, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x8, 0x1c, 0x0, 0x0, @u32=0xc9}]}]}, 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) 47.70913ms ago: executing program 0 (id=105): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000140)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./gadget/dummy_udc\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0d000000875a0000040000000100000000000000", @ANYRES32=r1], 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0d000000875a0000040000000100000000000000", @ANYRES32=r1], 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8050) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8050) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680), &(0x7f00000006c0), 0x2, r2, 0x0, 0x8000000}, 0x27) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x206080, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {r0}}, './gadget\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {r0}}, './gadget\x00'}) socket$inet(0x2, 0x3, 0x81) (async) r4 = socket$inet(0x2, 0x3, 0x81) close(0x3) socket$inet_tcp(0x2, 0x1, 0x0) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000240)={@in={{0x2, 0x4e23, @multicast1}}, 0x0, 0x0, 0x2d, 0x0, "f6a7346a1ca3caf66200f0e70b995efa20d5ddc09c0bc0c88e00bdea5e6998967d569964c8b68dae57dea91c0e3ef03a96483bcaaa5ab222d1993083e8e3619fbbff30da0288a8b78a3f921c40fdc06a"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e20, @multicast1}}, 0x0, 0x0, 0x0, 0x0, "698e86252c563a2eb894ac1de863c527984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8) bind$inet(r4, &(0x7f0000000440)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000004c0)={0x1, &(0x7f0000000500)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="340826bd7000020000cafc000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80080003001f00000008001b0000000000"], 0x34}}, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) (async) close_range(r6, 0xffffffffffffffff, 0x0) write(r0, &(0x7f00000001c0)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./gadget/ep1in-bulk\x00', 0x2, 0x0) read$alg(r8, 0x0, 0x0) 47.248679ms ago: executing program 1 (id=106): r0 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) bind$can_raw(r0, &(0x7f0000000100), 0x10) r1 = syz_open_dev$dvb_frontend(&(0x7f00000024c0), 0x0, 0x80801) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x6, 0x2080) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="05a300f2ffffffffffff0c000000040003"], 0x1c}}, 0x0) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f0000000040)={0x12}) ioctl$FE_GET_EVENT(r1, 0x80286f4e, &(0x7f0000002500)) socket$l2tp(0x2, 0x2, 0x73) 0s ago: executing program 2 (id=107): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000fcfff1ff00000000000000008500000036000000850000005000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r0, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0x76, &(0x7f0000000380)=ANY=[], 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1f, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000001c302a35f1000000b5080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b705000008000000850000006a0000009500000000000000"], &(0x7f0000000600)='GPL\x00', 0xa, 0x0, 0x0, 0x41000, 0x1e, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) kernel console output (not intermixed with test programs): [ 7.791075][ T4399] 8021q: adding VLAN 0 to HW filter on device bond0 [ 7.798208][ T4399] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK [ 7.841954][ T1242] gve 0000:00:00.0 enp0s0: Device link is up. Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.95' (ED25519) to the list of known hosts. syzkaller login: [ 28.926607][ T4696] cgroup: Unknown subsys name 'net' [ 29.066853][ T4696] cgroup: Unknown subsys name 'cpuset' [ 29.068190][ T4696] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.211819][ T4696] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 30.020333][ T4712] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.021273][ T4723] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.021907][ T4722] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.022157][ T4722] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.022796][ T4722] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.023109][ T4723] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.023245][ T4722] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.023615][ T4723] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.023923][ T4722] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.024033][ T4722] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.024412][ T4722] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.024474][ T4723] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.024700][ T4722] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.024745][ T4723] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.027357][ T4722] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.028870][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.029080][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.029202][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.029385][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.029699][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.029892][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.030829][ T4721] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.031041][ T4721] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.055419][ T4725] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.055914][ T4725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.218171][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.219572][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.231976][ T4708] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.234534][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.242489][ T4716] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.247729][ T4717] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.255622][ T4709] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.312460][ T4707] infiniband rxe0: set active [ 30.313438][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.315494][ T4707] infiniband rxe0: added rxe_eth0 [ 30.326710][ T4707] RDS/IB: rxe0: added [ 30.326773][ T4707] smc: adding ib device rxe0 with port count 1 [ 30.326795][ T4707] smc: ib device rxe0 port 1 has no pnetid [ 30.327533][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.328793][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.380431][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.452517][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.507315][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.540812][ T4717] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.540847][ T4717] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.540946][ T4717] bridge_slave_0: entered allmulticast mode [ 30.541954][ T4717] bridge_slave_0: entered promiscuous mode [ 30.568756][ T4717] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.568816][ T4717] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.568872][ T4717] bridge_slave_1: entered allmulticast mode [ 30.569282][ T4717] bridge_slave_1: entered promiscuous mode [ 30.578970][ T4716] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.578993][ T4716] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.579041][ T4716] bridge_slave_0: entered allmulticast mode [ 30.579940][ T4716] bridge_slave_0: entered promiscuous mode [ 30.583617][ T4716] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.583636][ T4716] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.583688][ T4716] bridge_slave_1: entered allmulticast mode [ 30.584081][ T4716] bridge_slave_1: entered promiscuous mode [ 30.595906][ T4717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.599787][ T4717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.607324][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.607349][ T4708] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.607549][ T4708] bridge_slave_0: entered allmulticast mode [ 30.607974][ T4708] bridge_slave_0: entered promiscuous mode [ 30.608768][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.608793][ T4708] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.608840][ T4708] bridge_slave_1: entered allmulticast mode [ 30.609214][ T4708] bridge_slave_1: entered promiscuous mode [ 30.617147][ T4708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.618130][ T4716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.619043][ T4716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.626767][ T4707] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.639908][ T4717] team0: Port device team_slave_0 added [ 30.640776][ T4717] team0: Port device team_slave_1 added [ 30.651157][ T4708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.661702][ T4716] team0: Port device team_slave_0 added [ 30.662513][ T4716] team0: Port device team_slave_1 added [ 30.673074][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.673085][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.673099][ T4717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.675489][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.675498][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.675512][ T4717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.676413][ T4708] team0: Port device team_slave_0 added [ 30.680338][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.680346][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.680359][ T4716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.686230][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.686325][ T4709] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.686420][ T4709] bridge_slave_0: entered allmulticast mode [ 30.686843][ T4709] bridge_slave_0: entered promiscuous mode [ 30.692913][ T4708] team0: Port device team_slave_1 added [ 30.693185][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.693192][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.693204][ T4716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.705623][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.705648][ T4709] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.705705][ T4709] bridge_slave_1: entered allmulticast mode [ 30.706108][ T4709] bridge_slave_1: entered promiscuous mode [ 30.712519][ T4709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.713350][ T4709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.726732][ T4717] hsr_slave_0: entered promiscuous mode [ 30.727078][ T4717] hsr_slave_1: entered promiscuous mode [ 30.739970][ T4716] hsr_slave_0: entered promiscuous mode [ 30.740289][ T4716] hsr_slave_1: entered promiscuous mode [ 30.740520][ T4716] debugfs: 'hsr0' already exists in 'hsr' [ 30.740568][ T4716] Cannot create hsr debugfs directory [ 30.742224][ T4709] team0: Port device team_slave_0 added [ 30.742490][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.742498][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.742510][ T4708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.743196][ T4709] team0: Port device team_slave_1 added [ 30.766886][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.766900][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.766913][ T4708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.795024][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.795037][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.795051][ T4709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.801116][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.801126][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.801140][ T4709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.848490][ T4708] hsr_slave_0: entered promiscuous mode [ 30.848777][ T4708] hsr_slave_1: entered promiscuous mode [ 30.848958][ T4708] debugfs: 'hsr0' already exists in 'hsr' [ 30.848968][ T4708] Cannot create hsr debugfs directory [ 30.857654][ T4709] hsr_slave_0: entered promiscuous mode [ 30.857918][ T4709] hsr_slave_1: entered promiscuous mode [ 30.858096][ T4709] debugfs: 'hsr0' already exists in 'hsr' [ 30.858106][ T4709] Cannot create hsr debugfs directory [ 30.941843][ T4707] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.941902][ T4707] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.941994][ T4707] bridge_slave_0: entered allmulticast mode [ 30.942425][ T4707] bridge_slave_0: entered promiscuous mode [ 30.951945][ T4707] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.951975][ T4707] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.952029][ T4707] bridge_slave_1: entered allmulticast mode [ 30.952456][ T4707] bridge_slave_1: entered promiscuous mode [ 30.973687][ T4707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.974646][ T4707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.983824][ T4717] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.986625][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.986992][ T4717] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.988875][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.989608][ T4717] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.991627][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.993107][ T4707] team0: Port device team_slave_0 added [ 30.993925][ T4707] team0: Port device team_slave_1 added [ 30.998965][ T4717] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.000424][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.010271][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.010288][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.010299][ T4707] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.010910][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.010917][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.010929][ T4707] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.032484][ T4717] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.032518][ T4717] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.032675][ T4717] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.032703][ T4717] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.040785][ T4709] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.041819][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.042128][ T4709] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.043157][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.043481][ T4709] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.044933][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.054172][ T4709] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.056290][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.061529][ T4707] hsr_slave_0: entered promiscuous mode [ 31.061839][ T4707] hsr_slave_1: entered promiscuous mode [ 31.062034][ T4707] debugfs: 'hsr0' already exists in 'hsr' [ 31.062043][ T4707] Cannot create hsr debugfs directory [ 31.092356][ T4717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.099195][ T195] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.099843][ T195] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.127209][ T4717] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.135082][ T4716] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.137792][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.138125][ T4716] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.140222][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.150033][ T4716] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.151169][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.151481][ T4716] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.152470][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.153473][ T195] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.153504][ T195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.155725][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.155749][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.179168][ T4708] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.180409][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.181105][ T4708] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.181975][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.192714][ T4708] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.194013][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.194306][ T4708] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.199316][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.220697][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.250043][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.269865][ T4716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.270995][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.271017][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.271522][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.271542][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.274878][ T4707] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.279218][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.279593][ T4707] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.282786][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.287458][ T4716] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.293023][ T4708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.298521][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.298547][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.299470][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.299498][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.299833][ T4707] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.301084][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.301403][ T4707] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.302391][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.319060][ T4708] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.323688][ T4716] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.323703][ T4716] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.332526][ T4709] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.332542][ T4709] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.349793][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.349826][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.350134][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.350153][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.413545][ T4707] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.419422][ T4707] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.427841][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.427868][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.428405][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.428424][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.440051][ T4707] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.440067][ T4707] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.484027][ T4717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.504861][ T4717] veth0_vlan: entered promiscuous mode [ 31.522171][ T4717] veth1_vlan: entered promiscuous mode [ 31.539498][ T4717] veth0_macvtap: entered promiscuous mode [ 31.560146][ T4717] veth1_macvtap: entered promiscuous mode [ 31.568399][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.580430][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.583926][ T1242] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.584120][ T1242] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.584388][ T1242] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.596428][ T195] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.640500][ T4708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.642825][ T1242] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.642837][ T1242] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.651165][ T4716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.676574][ T4852] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.676592][ T4852] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.682119][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.696933][ T4716] veth0_vlan: entered promiscuous mode [ 31.698767][ T4716] veth1_vlan: entered promiscuous mode [ 31.703693][ T4716] veth0_macvtap: entered promiscuous mode [ 31.704696][ T4716] veth1_macvtap: entered promiscuous mode [ 31.711668][ T4707] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.741093][ T4717] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.743768][ T4707] veth0_vlan: entered promiscuous mode [ 31.748294][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.751522][ T4708] veth0_vlan: entered promiscuous mode [ 31.758565][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.782833][ T4707] veth1_vlan: entered promiscuous mode [ 31.788585][ T4892] binder: 4892 RLIMIT_NICE not set [ 31.798407][ T4708] veth1_vlan: entered promiscuous mode [ 31.817697][ T61] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.817734][ T61] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.817758][ T61] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.821824][ T195] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.821835][ T195] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.837524][ T4707] veth0_macvtap: entered promiscuous mode [ 31.843314][ T4707] veth1_macvtap: entered promiscuous mode [ 31.858294][ T4709] veth0_vlan: entered promiscuous mode [ 31.864758][ T4708] veth0_macvtap: entered promiscuous mode [ 31.865684][ T195] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.865696][ T195] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.871628][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.872614][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.872963][ T4709] veth1_vlan: entered promiscuous mode [ 31.878186][ T4895] loop2: detected capacity change from 0 to 256 [ 31.880621][ T4895] vfat: Unexpected value for 'rodir' [ 31.888443][ T4708] veth1_macvtap: entered promiscuous mode [ 31.896498][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.896675][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.896794][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.896906][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.896991][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.922078][ T4709] veth0_macvtap: entered promiscuous mode [ 31.924381][ T4709] veth1_macvtap: entered promiscuous mode [ 31.927384][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.945893][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.945909][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.949090][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.957111][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.962904][ T4852] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.962917][ T4852] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.968138][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.988623][ T4898] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4'. [ 32.006152][ T4892] binder: 4891:4892 ioctl c0306201 20000140 returned -14 [ 32.039859][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.039878][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.055791][ T61] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.056328][ T61] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.056442][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.056452][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.056547][ T61] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.057210][ T61] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.057309][ T61] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.057333][ T61] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.057349][ T61] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.061721][ T4901] mmap: syz.3.4 (4901) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 32.065773][ T61] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.085770][ T4725] Bluetooth: hci3: command tx timeout [ 32.085926][ T4725] Bluetooth: hci0: command tx timeout [ 32.085990][ T4725] Bluetooth: hci2: command tx timeout [ 32.086049][ T4725] Bluetooth: hci1: command tx timeout [ 32.086189][ T4710] Bluetooth: hci4: command tx timeout [ 32.093737][ T195] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.093746][ T195] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.111996][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.112012][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.114699][ T4903] binder: 4902:4903 BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 32.114716][ T4903] binder: 4902:4903 ioctl c0306201 20000680 returned -22 [ 32.121465][ T4900] FAULT_INJECTION: forcing a failure. [ 32.121465][ T4900] name failslab, interval 1, probability 0, space 0, times 1 [ 32.121484][ T4900] CPU: 0 UID: 0 PID: 4900 Comm: syz.2.6 Not tainted syzkaller #0 PREEMPT [ 32.121495][ T4900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 32.121500][ T4900] Call trace: [ 32.121503][ T4900] show_stack+0x2c/0x3c (C) [ 32.121523][ T4900] __dump_stack+0x30/0x40 [ 32.121535][ T4900] dump_stack_lvl+0xd8/0x12c [ 32.121546][ T4900] dump_stack+0x1c/0x28 [ 32.121558][ T4900] should_fail_ex+0x418/0x58c [ 32.121567][ T4900] should_failslab+0xc4/0x120 [ 32.121576][ T4900] kmem_cache_alloc_noprof+0x94/0x5d4 [ 32.121585][ T4900] security_inode_alloc+0x40/0x304 [ 32.121595][ T4900] inode_init_always_gfp+0x704/0xb20 [ 32.121607][ T4900] alloc_inode+0x9c/0x198 [ 32.121617][ T4900] new_inode+0x20/0x50 [ 32.121628][ T4900] gadgetfs_make_inode+0x34/0x18c [ 32.121641][ T4900] gadgetfs_create_file+0x48/0xd8 [ 32.121653][ T4900] gadgetfs_bind+0x3f8/0x75c [ 32.121665][ T4900] gadget_bind_driver+0x274/0x834 [ 32.121676][ T4900] really_probe+0x29c/0x800 [ 32.121686][ T4900] __driver_probe_device+0x1e0/0x350 [ 32.121694][ T4900] driver_probe_device+0x6c/0x19c [ 32.121703][ T4900] __driver_attach+0x168/0x384 [ 32.121711][ T4900] bus_for_each_dev+0x128/0x1b4 [ 32.121723][ T4900] driver_attach+0x50/0x60 [ 32.121731][ T4900] bus_add_driver+0x208/0x500 [ 32.121742][ T4900] driver_register+0x220/0x310 [ 32.121751][ T4900] usb_gadget_register_driver_owner+0xf0/0x25c [ 32.121762][ T4900] dev_config+0x91c/0xcc0 [ 32.121774][ T4900] vfs_write+0x2a4/0xa0c [ 32.121782][ T4900] ksys_write+0x12c/0x228 [ 32.121789][ T4900] __arm64_sys_write+0x84/0x98 [ 32.121797][ T4900] invoke_syscall+0x98/0x244 [ 32.121809][ T4900] el0_svc_common+0xec/0x23c [ 32.121821][ T4900] do_el0_svc+0x4c/0x5c [ 32.121832][ T4900] el0_svc+0x60/0x1d8 [ 32.121841][ T4900] el0t_64_sync_handler+0x44/0x104 [ 32.121849][ T4900] el0t_64_sync+0x198/0x19c [ 32.123149][ T4900] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 32.123162][ T4900] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 32.123333][ T4900] gadgetfs expected dummy_udc controller not usbip-vudc [ 32.123341][ T4900] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 32.129404][ T4903] FAULT_INJECTION: forcing a failure. [ 32.129404][ T4903] name failslab, interval 1, probability 0, space 0, times 0 [ 32.129421][ T4903] CPU: 0 UID: 0 PID: 4903 Comm: syz.1.2 Not tainted syzkaller #0 PREEMPT [ 32.129431][ T4903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 32.129436][ T4903] Call trace: [ 32.129439][ T4903] show_stack+0x2c/0x3c (C) [ 32.129457][ T4903] __dump_stack+0x30/0x40 [ 32.129469][ T4903] dump_stack_lvl+0xd8/0x12c [ 32.129481][ T4903] dump_stack+0x1c/0x28 [ 32.129492][ T4903] should_fail_ex+0x418/0x58c [ 32.129501][ T4903] should_failslab+0xc4/0x120 [ 32.129509][ T4903] __kmalloc_noprof+0x108/0x6c8 [ 32.129518][ T4903] tomoyo_encode2+0x10c/0x330 [ 32.129530][ T4903] tomoyo_encode+0x34/0x50 [ 32.129541][ T4903] tomoyo_realpath_from_path+0x488/0x4dc [ 32.129553][ T4903] tomoyo_check_open_permission+0x1c4/0x394 [ 32.129564][ T4903] tomoyo_file_open+0x78/0xcc [ 32.129576][ T4903] security_file_open+0xbc/0x258 [ 32.129587][ T4903] do_dentry_open+0x2a8/0xfbc [ 32.129599][ T4903] vfs_open+0x44/0x2dc [ 32.129610][ T4903] path_openat+0x1084/0x18f0 [ 32.129621][ T4903] do_file_open+0x1c8/0x2e8 [ 32.129631][ T4903] do_sys_openat2+0x114/0x1e8 [ 32.129643][ T4903] do_sys_open+0xb0/0xe0 [ 32.129654][ T4903] __arm64_sys_openat+0xa8/0xc4 [ 32.129666][ T4903] invoke_syscall+0x98/0x244 [ 32.129678][ T4903] el0_svc_common+0xec/0x23c [ 32.129690][ T4903] do_el0_svc+0x4c/0x5c [ 32.129701][ T4903] el0_svc+0x60/0x1d8 [ 32.129709][ T4903] el0t_64_sync_handler+0x44/0x104 [ 32.129717][ T4903] el0t_64_sync+0x198/0x19c [ 32.129732][ T4903] ERROR: Out of memory at tomoyo_realpath_from_path. [ 32.131549][ T4900] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 32.171970][ T4900] rxe_eth0 speed is unknown, defaulting to 1000 [ 32.321169][ T4909] ======================================================= [ 32.321169][ T4909] WARNING: The mand mount option has been deprecated and [ 32.321169][ T4909] and is ignored by this kernel. Remove the mand [ 32.321169][ T4909] option from the mount to silence this warning. [ 32.321169][ T4909] ======================================================= [ 32.459693][ T4917] capability: warning: `syz.2.8' uses deprecated v2 capabilities in a way that may be insecure [ 32.549118][ T4913] netlink: 312 bytes leftover after parsing attributes in process `syz.4.5'. [ 32.557809][ T4918] syz.2.8 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 32.575066][ T4918] loop2: detected capacity change from 0 to 512 [ 32.643508][ T4918] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 32.643525][ T4918] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 32.652898][ T4918] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 32.653309][ T4918] EXT4-fs (loop2): Remounting filesystem read-only [ 32.653669][ T4918] EXT4-fs (loop2): 1 truncate cleaned up [ 32.663601][ T4918] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.723060][ T4922] capability: warning: `syz.0.9' uses 32-bit capabilities (legacy support in use) [ 32.834428][ T4929] binder: 4927:4929 ioctl c0306201 20000340 returned -14 [ 32.835889][ T4929] binder: 4927:4929 context manager tried to acquire desc 0 [ 32.835901][ T4929] binder: 4927:4929 ioctl c0306201 20000440 returned -22 [ 32.836521][ T4929] binder: 4927:4929 got transaction to invalid handle, 1 [ 32.836565][ T4929] binder: 4927:4929 cannot find target node [ 32.836581][ T4929] binder: 4927:4929 transaction call to 0:0 failed 5/29201/-22, code 0 size 112-24 line 3253 [ 32.837930][ T4929] netlink: 32 bytes leftover after parsing attributes in process `syz.0.11'. [ 32.847992][ T4928] binder: undelivered TRANSACTION_ERROR: 29201 [ 32.861528][ T4932] loop1: detected capacity change from 0 to 256 [ 32.883813][ T4931] 9p: Bad value for 'rfdno' [ 33.149827][ T4953] process 'syz.0.17' launched './file2' with NULL argv: empty string added [ 33.186416][ T4953] batadv_slave_1: entered promiscuous mode [ 33.426940][ T4918] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.524646][ T4963] loop1: detected capacity change from 0 to 512 [ 33.531578][ T4957] FAULT_INJECTION: forcing a failure. [ 33.531578][ T4957] name failslab, interval 1, probability 0, space 0, times 0 [ 33.531596][ T4957] CPU: 1 UID: 0 PID: 4957 Comm: syz.4.20 Not tainted syzkaller #0 PREEMPT [ 33.531606][ T4957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 33.531611][ T4957] Call trace: [ 33.531613][ T4957] show_stack+0x2c/0x3c (C) [ 33.531633][ T4957] __dump_stack+0x30/0x40 [ 33.531644][ T4957] dump_stack_lvl+0xd8/0x12c [ 33.531653][ T4957] dump_stack+0x1c/0x28 [ 33.531663][ T4957] should_fail_ex+0x418/0x58c [ 33.531671][ T4957] should_failslab+0xc4/0x120 [ 33.531679][ T4957] kmem_cache_alloc_noprof+0x94/0x5d4 [ 33.531687][ T4957] skb_clone+0x1ac/0x320 [ 33.531698][ T4957] __netlink_deliver_tap+0x364/0x6f4 [ 33.531709][ T4957] netlink_deliver_tap+0x1d8/0x1dc [ 33.531718][ T4957] netlink_unicast+0x5dc/0x7f8 [ 33.531727][ T4957] netlink_sendmsg+0x648/0x948 [ 33.531736][ T4957] __sock_sendmsg+0xc8/0x17c [ 33.531745][ T4957] sock_write_iter+0x220/0x310 [ 33.531755][ T4957] do_iter_readv_writev+0x48c/0x6f8 [ 33.531763][ T4957] vfs_writev+0x2a8/0x630 [ 33.531770][ T4957] do_writev+0x134/0x2a8 [ 33.531777][ T4957] __arm64_sys_writev+0x88/0x9c [ 33.531784][ T4957] invoke_syscall+0x98/0x244 [ 33.531794][ T4957] el0_svc_common+0xec/0x23c [ 33.531804][ T4957] do_el0_svc+0x4c/0x5c [ 33.531813][ T4957] el0_svc+0x60/0x1d8 [ 33.531821][ T4957] el0t_64_sync_handler+0x44/0x104 [ 33.531828][ T4957] el0t_64_sync+0x198/0x19c [ 33.537009][ T4963] EXT4-fs error (device loop1): ext4_xattr_inode_iget:437: comm syz.1.21: inode #11: comm syz.1.21: iget: illegal inode # [ 33.537075][ T4963] loop1: lost filesystem error report for type 5 error -117 [ 33.538743][ T4963] EXT4-fs error (device loop1): ext4_xattr_inode_iget:442: comm syz.1.21: error while reading EA inode 11 err=-117 [ 33.538768][ T4963] loop1: lost filesystem error report for type 5 error -117 [ 33.539015][ T4963] EXT4-fs (loop1): 1 orphan inode deleted [ 33.539490][ T4963] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.588716][ T4707] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.713677][ T4971] loop2: detected capacity change from 0 to 1024 [ 33.732654][ T4971] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.863664][ T5004] Injecting memory failure for pfn 0x134d5a at process virtual address 0x20000000 [ 33.890729][ T5004] Memory failure: 0x134d5a: Sending SIGBUS to syz.1.26:5004 due to hardware memory corruption [ 33.890798][ T5004] Memory failure: 0x134d5a: recovery action for dirty LRU page: Recovered [ 33.890822][ T5004] Injecting memory failure for pfn 0x216bf1 at process virtual address 0x20001000 [ 33.890836][ T5004] Memory failure: 0x216bf1: unhandlable page. [ 33.890844][ T5004] Memory failure: 0x216bf1: recovery action for reserved kernel page: Ignored [ 33.917085][ T5007] loop0: detected capacity change from 0 to 1024 [ 33.921314][ T5007] EXT4-fs: Ignoring removed bh option [ 33.940555][ T5007] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.985075][ T4708] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.074882][ T5018] loop0: detected capacity change from 0 to 512 [ 34.081372][ T5018] EXT4-fs error (device loop0): ext4_orphan_get:1429: comm syz.0.28: bad orphan inode 13 [ 34.081405][ T5018] loop0: lost filesystem error report for type 5 error -117 [ 34.082037][ T5018] ext4_test_bit(bit=12, block=4) = 1 [ 34.082049][ T5018] is_bad_inode(inode)=0 [ 34.082054][ T5018] NEXT_ORPHAN(inode)=0 [ 34.082060][ T5018] max_ino=32 [ 34.082065][ T5018] i_nlink=1 [ 34.094320][ T5018] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.103859][ T5021] loop1: detected capacity change from 0 to 512 [ 34.111978][ T5021] EXT4-fs error (device loop1): ext4_xattr_inode_iget:473: comm syz.1.29: EA inode 11 has unexpected i_nlink=2 ref_count=7168870745731235840 [ 34.112003][ T5021] loop1: lost filesystem error report for type 5 error -117 [ 34.112681][ T5021] EXT4-fs (loop1): 1 orphan inode deleted [ 34.113103][ T5021] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.132899][ T4708] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.164707][ T5026] Zero length message leads to an empty skb [ 34.165994][ T4721] Bluetooth: hci4: command tx timeout [ 34.166018][ T4721] Bluetooth: hci1: command tx timeout [ 34.166034][ T4721] Bluetooth: hci2: command tx timeout [ 34.166049][ T4721] Bluetooth: hci0: command tx timeout [ 34.166063][ T4721] Bluetooth: hci3: command tx timeout [ 34.642168][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.690648][ T5074] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 34.694560][ T5074] loop2: detected capacity change from 0 to 512 [ 34.713736][ T5074] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.730517][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.804246][ T5090] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.810534][ T5089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.811673][ T5090] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.812627][ T5089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.821227][ T5089] x_tables: duplicate underflow at hook 2 [ 34.822317][ T5089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.822826][ T5089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.952719][ T4707] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.010124][ T5122] loop1: detected capacity change from 0 to 1024 [ 35.014512][ T5122] ext4: Unknown parameter 'nouser_xattr' [ 35.028739][ T5122] ip_tables: iptables: counters copy to user failed while replacing table [ 35.063017][ T5126] vfat: Bad value for 'shortname' [ 35.146474][ T5130] FAULT_INJECTION: forcing a failure. [ 35.146474][ T5130] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 35.146495][ T5130] CPU: 0 UID: 0 PID: 5130 Comm: syz.0.45 Not tainted syzkaller #0 PREEMPT [ 35.146506][ T5130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.146511][ T5130] Call trace: [ 35.146514][ T5130] show_stack+0x2c/0x3c (C) [ 35.146533][ T5130] __dump_stack+0x30/0x40 [ 35.146545][ T5130] dump_stack_lvl+0xd8/0x12c [ 35.146557][ T5130] dump_stack+0x1c/0x28 [ 35.146568][ T5130] should_fail_ex+0x418/0x58c [ 35.146577][ T5130] should_fail+0x14/0x24 [ 35.146584][ T5130] should_fail_usercopy+0x20/0x30 [ 35.146592][ T5130] do_seccomp+0x344/0xbfc [ 35.146603][ T5130] __arm64_sys_seccomp+0x84/0x98 [ 35.146614][ T5130] invoke_syscall+0x98/0x244 [ 35.146626][ T5130] el0_svc_common+0xec/0x23c [ 35.146637][ T5130] do_el0_svc+0x4c/0x5c [ 35.146649][ T5130] el0_svc+0x60/0x1d8 [ 35.146658][ T5130] el0t_64_sync_handler+0x44/0x104 [ 35.146666][ T5130] el0t_64_sync+0x198/0x19c [ 35.153835][ T5130] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 35.164566][ T5130] EXT4-fs (loop0): orphan cleanup on readonly fs [ 35.167443][ T5130] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:521: comm syz.0.45: Block bitmap for bg 0 marked uninitialized [ 35.167461][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.172363][ T5130] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 35.172387][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.173099][ T5130] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:521: comm syz.0.45: Block bitmap for bg 0 marked uninitialized [ 35.173118][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.173504][ T5130] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 35.173522][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.173678][ T5130] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:521: comm syz.0.45: Block bitmap for bg 0 marked uninitialized [ 35.173689][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.173804][ T5130] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 35.173812][ T5130] loop0: lost filesystem error report for type 5 error -117 [ 35.173982][ T5130] EXT4-fs (loop0): 1 orphan inode deleted [ 35.174468][ T5130] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 35.432758][ T4708] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.470855][ T5140] netlink: 156 bytes leftover after parsing attributes in process `syz.0.47'. [ 35.533638][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.533658][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534424][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534434][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534536][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534543][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534640][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534646][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534727][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534734][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534833][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534842][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.534935][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.534941][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.535089][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.535097][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.539474][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.539484][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.550267][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.550283][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.559223][ T5135] vhci_hcd vhci_hcd.3: invalid port number 252 [ 35.559235][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 1f03 v0000 i00fc l0 [ 35.616139][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.616538][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.617786][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.618126][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.618217][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.618603][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.631537][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.632603][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.632707][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.632782][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.632928][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.633003][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.633075][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.633315][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.633404][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.633474][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.635540][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.661108][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.670229][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.670488][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.672038][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.672792][ T5135] vhci_hcd vhci_hcd.3: default hub control req: 0000 v0000 i0000 l0 [ 35.750482][ T5156] xt_ipcomp: unknown flags 1D [ 36.245184][ T4710] Bluetooth: hci3: command tx timeout [ 36.245214][ T4710] Bluetooth: hci0: command tx timeout [ 36.245231][ T4710] Bluetooth: hci2: command tx timeout [ 36.245879][ T4710] Bluetooth: hci1: command tx timeout [ 36.245902][ T4710] Bluetooth: hci4: command tx timeout [ 36.342369][ T5186] netlink: 'syz.3.56': attribute type 1 has an invalid length. [ 36.344655][ T5186] netlink: 8 bytes leftover after parsing attributes in process `syz.3.56'. [ 36.346714][ T5186] FAULT_INJECTION: forcing a failure. [ 36.346714][ T5186] name failslab, interval 1, probability 0, space 0, times 0 [ 36.346731][ T5186] CPU: 1 UID: 0 PID: 5186 Comm: syz.3.56 Not tainted syzkaller #0 PREEMPT [ 36.346741][ T5186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 36.346747][ T5186] Call trace: [ 36.346750][ T5186] show_stack+0x2c/0x3c (C) [ 36.346771][ T5186] __dump_stack+0x30/0x40 [ 36.346784][ T5186] dump_stack_lvl+0xd8/0x12c [ 36.346796][ T5186] dump_stack+0x1c/0x28 [ 36.346807][ T5186] should_fail_ex+0x418/0x58c [ 36.346816][ T5186] should_failslab+0xc4/0x120 [ 36.346824][ T5186] __kmalloc_cache_noprof+0x94/0x5fc [ 36.346834][ T5186] syslog_print_all+0x108/0x51c [ 36.346846][ T5186] do_syslog+0x2b0/0x5b4 [ 36.346857][ T5186] __arm64_sys_syslog+0x88/0xa0 [ 36.346868][ T5186] invoke_syscall+0x98/0x244 [ 36.346881][ T5186] el0_svc_common+0xec/0x23c [ 36.346892][ T5186] do_el0_svc+0x4c/0x5c [ 36.346904][ T5186] el0_svc+0x60/0x1d8 [ 36.346913][ T5186] el0t_64_sync_handler+0x44/0x104 [ 36.346921][ T5186] el0t_64_sync+0x198/0x19c [ 36.347500][ T5186] netlink: 'syz.3.56': attribute type 4 has an invalid length. [ 36.411752][ T5190] input: syz0 as /devices/virtual/input/input2 [ 36.766209][ T5212] netlink: 12 bytes leftover after parsing attributes in process `syz.3.61'. [ 36.796066][ T5209] netlink: 8 bytes leftover after parsing attributes in process `syz.1.60'. [ 36.825962][ T5209] tipc: Started in network mode [ 36.825982][ T5209] tipc: Node identity 8a75aa23d0e7, cluster identity 4711 [ 36.826064][ T5209] tipc: Enabled bearer , priority 1 [ 36.852865][ T5208] tipc: Resetting bearer [ 36.868648][ T5208] tipc: Disabling bearer [ 36.896625][ T5222] set_capacity_and_notify: 3 callbacks suppressed [ 36.896639][ T5222] loop2: detected capacity change from 0 to 512 [ 36.905702][ T5222] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 36.910423][ T5222] EXT4-fs (loop2): invalid journal inode [ 36.910471][ T5222] EXT4-fs (loop2): can't get journal size [ 36.916582][ T5222] EXT4-fs error (device loop2): ext4_protect_reserved_inode:182: inode #2: comm syz.2.64: blocks 4-4 from inode overlap system zone [ 36.916658][ T5222] loop2: lost file I/O error report for ino 2 type 5 pos 0x0 len 0x0 error -117 [ 36.917164][ T5222] EXT4-fs (loop2): failed to initialize system zone (-117) [ 36.917281][ T5222] EXT4-fs (loop2): mount failed [ 36.957794][ T5222] netlink: 20 bytes leftover after parsing attributes in process `syz.2.64'. [ 37.026414][ T5220] loop3: detected capacity change from 0 to 1024 [ 37.028619][ T5225] Soft offlining pfn 0x13976e at process virtual address 0x2016e000 [ 37.057893][ T5225] Soft offlining pfn 0x138776 at process virtual address 0x2016e000 [ 37.063576][ T5225] Soft offlining pfn 0x13976f at process virtual address 0x2016f000 [ 37.063654][ T5225] Soft offlining pfn 0x134c48 at process virtual address 0x2016e000 [ 37.063775][ T5225] Soft offlining pfn 0x134c52 at process virtual address 0x2016f000 [ 37.065802][ T5225] Soft offlining pfn 0x11fa62 at process virtual address 0x2016e000 [ 37.066308][ T5225] Soft offlining pfn 0x1215b7 at process virtual address 0x2016f000 [ 37.066375][ T5225] Soft offlining pfn 0x1233df at process virtual address 0x2016e000 [ 37.066474][ T5225] Soft offlining pfn 0x1216be at process virtual address 0x2016f000 [ 37.068039][ T5225] Soft offlining pfn 0x121690 at process virtual address 0x2016e000 [ 37.068736][ T5225] Soft offlining pfn 0x121768 at process virtual address 0x2016f000 [ 37.069642][ T5225] Soft offlining pfn 0x121647 at process virtual address 0x2016e000 [ 37.070531][ T5225] Soft offlining pfn 0x12056e at process virtual address 0x2016f000 [ 37.071424][ T5225] Soft offlining pfn 0x12175d at process virtual address 0x2016e000 [ 37.078140][ T5225] Soft offlining pfn 0x12160b at process virtual address 0x2016f000 [ 37.078212][ T5225] Soft offlining pfn 0x1392dd at process virtual address 0x2016e000 [ 37.078326][ T5225] Soft offlining pfn 0x121633 at process virtual address 0x2016f000 [ 37.081378][ T5225] Soft offlining pfn 0x121657 at process virtual address 0x2016e000 [ 37.081835][ T5225] Soft offlining pfn 0x11f9a4 at process virtual address 0x2016f000 [ 37.081894][ T5225] Soft offlining pfn 0x137dcf at process virtual address 0x2016e000 [ 37.081983][ T5225] Soft offlining pfn 0x134c40 at process virtual address 0x2016f000 [ 37.082136][ T5225] Soft offlining pfn 0x11f974 at process virtual address 0x2016e000 [ 37.083768][ T5225] Soft offlining pfn 0x11f9bd at process virtual address 0x2016f000 [ 37.087545][ T5225] Soft offlining pfn 0x134c4f at process virtual address 0x2016e000 [ 37.087719][ T5225] Soft offlining pfn 0x134d12 at process virtual address 0x2016f000 [ 37.088028][ T5225] Soft offlining pfn 0x11f9ed at process virtual address 0x2016e000 [ 37.088667][ T5225] Soft offlining pfn 0x11fa3d at process virtual address 0x2016f000 [ 37.089555][ T5225] Soft offlining pfn 0x134d22 at process virtual address 0x2016e000 [ 37.090443][ T5225] Soft offlining pfn 0x121623 at process virtual address 0x2016f000 [ 37.091320][ T5225] Soft offlining pfn 0x11dcd5 at process virtual address 0x2016e000 [ 37.100564][ T5225] Soft offlining pfn 0x12057c at process virtual address 0x2016f000 [ 37.100638][ T5225] Soft offlining pfn 0x1392cd at process virtual address 0x2016e000 [ 37.100732][ T5225] Soft offlining pfn 0x1392f2 at process virtual address 0x2016f000 [ 37.100887][ T5225] Soft offlining pfn 0x1392d6 at process virtual address 0x2016e000 [ 37.101198][ T5225] Soft offlining pfn 0x11e61c at process virtual address 0x2016f000 [ 37.101907][ T5225] Soft offlining pfn 0x137ddc at process virtual address 0x2016e000 [ 37.103692][ T5225] Soft offlining pfn 0x137dd7 at process virtual address 0x2016f000 [ 37.103971][ T5225] Soft offlining pfn 0x13865e at process virtual address 0x2016e000 [ 37.104070][ T5225] Soft offlining pfn 0x134d5b at process virtual address 0x2016f000 [ 37.104226][ T5225] Soft offlining pfn 0x12056d at process virtual address 0x2016e000 [ 37.105732][ T5225] Soft offlining pfn 0x134c50 at process virtual address 0x2016f000 [ 37.106830][ T5225] Soft offlining pfn 0x1214e0 at process virtual address 0x2016e000 [ 37.133963][ T5225] Soft offlining pfn 0x12053d at process virtual address 0x2016f000 [ 37.134194][ T5225] Soft offlining pfn 0x122fed at process virtual address 0x2016e000 [ 37.139314][ T5225] Soft offlining pfn 0x138058 at process virtual address 0x2016f000 [ 37.139663][ T5225] Soft offlining pfn 0x138047 at process virtual address 0x2016e000 [ 37.142847][ T5225] Soft offlining pfn 0x1215f4 at process virtual address 0x2016f000 [ 37.142921][ T5225] Soft offlining pfn 0x12161c at process virtual address 0x2016e000 [ 37.143036][ T5225] Soft offlining pfn 0x137eb8 at process virtual address 0x2016f000 [ 37.143214][ T5225] Soft offlining pfn 0x137e6f at process virtual address 0x2016e000 [ 37.145943][ T5238] loop2: detected capacity change from 0 to 512 [ 37.147786][ T5225] Soft offlining pfn 0x1392eb at process virtual address 0x2016f000 [ 37.149163][ T5225] Soft offlining pfn 0x11ff3c at process virtual address 0x2016e000 [ 37.149247][ T5225] Soft offlining pfn 0x1215f5 at process virtual address 0x2016f000 [ 37.149346][ T5225] Soft offlining pfn 0x12145a at process virtual address 0x2016e000 [ 37.149509][ T5225] Soft offlining pfn 0x134c54 at process virtual address 0x2016f000 [ 37.149827][ T5225] Soft offlining pfn 0x134d33 at process virtual address 0x2016e000 [ 37.150459][ T5225] Soft offlining pfn 0x1215f2 at process virtual address 0x2016f000 [ 37.151340][ T5225] Soft offlining pfn 0x1214cd at process virtual address 0x2016e000 [ 37.152222][ T5225] Soft offlining pfn 0x120579 at process virtual address 0x2016f000 [ 37.153093][ T5225] Soft offlining pfn 0x121459 at process virtual address 0x2016e000 [ 37.153967][ T5225] Soft offlining pfn 0x122fec at process virtual address 0x2016f000 [ 37.171283][ T5225] Soft offlining pfn 0x122fee at process virtual address 0x2016e000 [ 37.171380][ T5225] Soft offlining pfn 0x134c4d at process virtual address 0x2016f000 [ 37.176781][ T5238] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.67: corrupted in-inode xattr: invalid size in ea xattr [ 37.176803][ T5238] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 37.176961][ T5238] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.67: couldn't read orphan inode 15 (err -117) [ 37.177645][ T5238] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.207043][ T5225] Soft offlining pfn 0x120577 at process virtual address 0x2016e000 [ 37.207150][ T5225] Soft offlining pfn 0x1391a2 at process virtual address 0x2016f000 [ 37.234096][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.284492][ T5250] loop4: detected capacity change from 0 to 2640 [ 37.291760][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291796][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291814][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291828][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291841][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291860][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291878][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291890][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291897][ T5250] ldm_validate_partition_table(): Disk read failed. [ 37.291908][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291920][ T5250] Buffer I/O error on dev loop4, logical block 0, async page read [ 37.291939][ T5250] Dev loop4: unable to read RDB block 0 [ 37.292005][ T5250] loop4: unable to read partition table [ 37.296340][ T5250] loop_reread_partitions: partition scan of loop4 (3 ) failed (rc=-5) [ 37.297117][ T5250] fuse: Bad value for 'fd' [ 37.373294][ T5255] netlink: 'syz.2.73': attribute type 21 has an invalid length. [ 37.373340][ T5255] netlink: 132 bytes leftover after parsing attributes in process `syz.2.73'. [ 37.559081][ T5274] netlink: 24 bytes leftover after parsing attributes in process `syz.3.78'. [ 38.325913][ T4721] Bluetooth: hci4: command tx timeout [ 38.325946][ T4721] Bluetooth: hci1: command tx timeout [ 38.325964][ T4721] Bluetooth: hci2: command tx timeout [ 38.325981][ T4721] Bluetooth: hci3: command tx timeout [ 38.326018][ T4710] Bluetooth: hci0: command tx timeout [ 38.440589][ T5289] loop4: detected capacity change from 0 to 512 [ 38.451752][ T5289] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 38.463284][ T5289] EXT4-fs (loop4): 1 truncate cleaned up [ 38.463844][ T5289] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 38.564046][ T5302] sctp: [Deprecated]: syz.2.84 (pid 5302) Use of int in max_burst socket option deprecated. [ 38.564046][ T5302] Use struct sctp_assoc_value instead [ 38.597337][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.660410][ T5304] tipc: Started in network mode [ 38.660656][ T5304] tipc: Node identity 1000001, cluster identity 4369 [ 38.660675][ T5304] tipc: Node number set to 16777217 [ 38.661384][ T5304] tipc: Cannot configure node identity twice [ 38.857008][ T5311] loop2: detected capacity change from 0 to 512 [ 38.900927][ T5315] netlink: 144 bytes leftover after parsing attributes in process `syz.4.89'. [ 38.901513][ T5315] netlink: 'syz.4.89': attribute type 1 has an invalid length. [ 38.914331][ T5311] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.921850][ T5311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.940024][ T5321] loop4: detected capacity change from 0 to 512 [ 38.942362][ T5321] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 38.942378][ T5321] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 38.956238][ T5321] EXT4-fs error (device loop4): ext4_validate_block_bitmap:436: comm syz.4.91: bg 0: block 104: invalid block bitmap [ 38.956279][ T5321] fserror_report: 1 callbacks suppressed [ 38.956291][ T5321] loop4: lost filesystem error report for type 5 error -117 [ 38.957093][ T5321] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 38.957106][ T5321] loop4: lost filesystem error report for type 5 error -117 [ 38.957319][ T5321] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.91: invalid indirect mapped block 1 (level 1) [ 38.957334][ T5321] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 38.961389][ T5321] EXT4-fs (loop4): 1 truncate cleaned up [ 38.962764][ T5321] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 38.990557][ T5319] veth0: entered promiscuous mode [ 38.991005][ T5318] veth0: left promiscuous mode [ 38.997605][ T4709] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.021896][ T5328] fuse: Unknown parameter 'rootmL' [ 39.107184][ T5345] FAULT_INJECTION: forcing a failure. [ 39.107184][ T5345] name failslab, interval 1, probability 0, space 0, times 0 [ 39.107205][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.2.97 Not tainted syzkaller #0 PREEMPT [ 39.107215][ T5345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.107222][ T5345] Call trace: [ 39.107225][ T5345] show_stack+0x2c/0x3c (C) [ 39.107246][ T5345] __dump_stack+0x30/0x40 [ 39.107264][ T5345] dump_stack_lvl+0xd8/0x12c [ 39.107276][ T5345] dump_stack+0x1c/0x28 [ 39.107288][ T5345] should_fail_ex+0x418/0x58c [ 39.107297][ T5345] should_failslab+0xc4/0x120 [ 39.107305][ T5345] kmem_cache_alloc_noprof+0x94/0x5d4 [ 39.107315][ T5345] security_inode_alloc+0x40/0x304 [ 39.107325][ T5345] inode_init_always_gfp+0x704/0xb20 [ 39.107337][ T5345] alloc_inode+0x9c/0x198 [ 39.107348][ T5345] new_inode+0x20/0x50 [ 39.107359][ T5345] debugfs_get_inode+0x20/0x7c [ 39.107368][ T5345] __debugfs_create_file+0xb8/0x36c [ 39.107376][ T5345] debugfs_create_file_full+0x58/0x70 [ 39.107385][ T5345] drm_debugfs_clients_add+0xc4/0x188 [ 39.107395][ T5345] drm_file_alloc+0x49c/0x878 [ 39.107407][ T5345] drm_open_helper+0x17c/0x3ec [ 39.107419][ T5345] drm_open+0x188/0x314 [ 39.107430][ T5345] drm_stub_open+0x19c/0x200 [ 39.107440][ T5345] chrdev_open+0x398/0x3e8 [ 39.107451][ T5345] do_dentry_open+0x5c4/0xfbc [ 39.107462][ T5345] vfs_open+0x44/0x2dc [ 39.107473][ T5345] path_openat+0x1084/0x18f0 [ 39.107484][ T5345] do_file_open+0x1c8/0x2e8 [ 39.107494][ T5345] do_sys_openat2+0x114/0x1e8 [ 39.107506][ T5345] do_sys_open+0xb0/0xe0 [ 39.107517][ T5345] __arm64_sys_openat+0xa8/0xc4 [ 39.107529][ T5345] invoke_syscall+0x98/0x244 [ 39.107541][ T5345] el0_svc_common+0xec/0x23c [ 39.107552][ T5345] do_el0_svc+0x4c/0x5c [ 39.107564][ T5345] el0_svc+0x60/0x1d8 [ 39.107572][ T5345] el0t_64_sync_handler+0x44/0x104 [ 39.107580][ T5345] el0t_64_sync+0x198/0x19c [ 39.107616][ T5345] debugfs: out of free dentries, can not create file 'proc_info' [ 39.112976][ T5345] loop2: detected capacity change from 0 to 512 [ 39.113382][ T5345] EXT4-fs: Ignoring removed i_version option [ 39.113406][ T5345] EXT4-fs: Ignoring removed bh option [ 39.143946][ T5345] EXT4-fs error (device loop2): ext4_orphan_get:1403: comm syz.2.97: inode #13: comm syz.2.97: iget: illegal inode # [ 39.143966][ T5345] loop2: lost filesystem error report for type 5 error -117 [ 39.144133][ T5345] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.97: couldn't read orphan inode 13 (err -117) [ 39.144153][ T5345] loop2: lost filesystem error report for type 5 error -117 [ 39.149683][ T5345] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.217830][ T5345] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.283627][ T24] rxe_eth0 speed is unknown, defaulting to 1000 [ 41.404593][ T5362] netlink: 36 bytes leftover after parsing attributes in process `syz.2.100'. [ 41.409106][ T5364] loop4: detected capacity change from 0 to 512 [ 41.423378][ T5365] loop3: detected capacity change from 0 to 512 [ 41.423756][ T5365] EXT4-fs: Ignoring removed bh option [ 41.427425][ T5365] EXT4-fs (loop3): Test dummy encryption mode enabled [ 41.427444][ T5365] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 41.427451][ T5365] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 41.445982][ T5362] netlink: 8 bytes leftover after parsing attributes in process `syz.2.100'. [ 41.470367][ T5365] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.101: corrupted in-inode xattr: overlapping e_value [ 41.470396][ T5365] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 41.470632][ T5365] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.101: couldn't read orphan inode 15 (err -117) [ 41.470644][ T5365] loop3: lost filesystem error report for type 5 error -117 [ 41.471156][ T5365] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.520651][ T5381] EXT4-fs: Ignoring removed bh option [ 41.528448][ T5378] ================================================================== [ 41.528457][ T5378] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 41.528473][ T5378] Read of size 1 at addr ffff0000cb8e1818 by task syz.0.105/5378 [ 41.528480][ T5378] [ 41.528484][ T5378] CPU: 1 UID: 0 PID: 5378 Comm: syz.0.105 Not tainted syzkaller #0 PREEMPT [ 41.528493][ T5378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 41.528498][ T5378] Call trace: [ 41.528500][ T5378] show_stack+0x2c/0x3c (C) [ 41.528516][ T5378] __dump_stack+0x30/0x40 [ 41.528526][ T5378] dump_stack_lvl+0xd8/0x12c [ 41.528536][ T5378] print_address_description+0xb0/0x238 [ 41.528545][ T5378] print_report+0x68/0x84 [ 41.528551][ T5378] kasan_report+0x8c/0xc4 [ 41.528561][ T5378] __kasan_check_byte+0x3c/0x54 [ 41.528569][ T5378] lock_acquire+0xa4/0x320 [ 41.528578][ T5378] _raw_spin_lock_irq+0x58/0x70 [ 41.528585][ T5378] gadget_dev_open+0x50/0x1c4 [ 41.528596][ T5378] do_dentry_open+0x5c4/0xfbc [ 41.528607][ T5378] vfs_open+0x44/0x2dc [ 41.528616][ T5378] path_openat+0x1084/0x18f0 [ 41.528626][ T5378] do_file_open+0x1c8/0x2e8 [ 41.528634][ T5378] do_sys_openat2+0x114/0x1e8 [ 41.528644][ T5378] do_sys_open+0xb0/0xe0 [ 41.528653][ T5378] __arm64_sys_openat+0xa8/0xc4 [ 41.528663][ T5378] invoke_syscall+0x98/0x244 [ 41.528673][ T5378] el0_svc_common+0xec/0x23c [ 41.528683][ T5378] do_el0_svc+0x4c/0x5c [ 41.528692][ T5378] el0_svc+0x60/0x1d8 [ 41.528699][ T5378] el0t_64_sync_handler+0x44/0x104 [ 41.528706][ T5378] el0t_64_sync+0x198/0x19c [ 41.528714][ T5378] [ 41.528716][ T5378] Allocated by task 195: [ 41.528720][ T5378] kasan_save_track+0x40/0x78 [ 41.528727][ T5378] kasan_save_alloc_info+0x40/0x50 [ 41.528735][ T5378] __kasan_kmalloc+0x9c/0xb4 [ 41.528742][ T5378] __kmalloc_noprof+0x34c/0x6c8 [ 41.528748][ T5378] ieee802_11_parse_elems_full+0x114/0x2208 [ 41.528759][ T5378] ieee80211_ibss_rx_queued_mgmt+0x3d0/0x242c [ 41.528768][ T5378] ieee80211_iface_work+0x600/0xd3c [ 41.528776][ T5378] cfg80211_wiphy_work+0x278/0x464 [ 41.528784][ T5378] process_scheduled_works+0x91c/0x1250 [ 41.528792][ T5378] worker_thread+0x798/0xbd0 [ 41.528799][ T5378] kthread+0x304/0x3d4 [ 41.528805][ T5378] ret_from_fork+0x10/0x20 [ 41.528811][ T5378] [ 41.528812][ T5378] Freed by task 195: [ 41.528815][ T5378] kasan_save_track+0x40/0x78 [ 41.528821][ T5378] kasan_save_free_info+0x54/0x6c [ 41.528829][ T5378] __kasan_slab_free+0x74/0xa4 [ 41.528835][ T5378] kfree+0x188/0x658 [ 41.528840][ T5378] ieee80211_ibss_rx_queued_mgmt+0x1038/0x242c [ 41.528848][ T5378] ieee80211_iface_work+0x600/0xd3c [ 41.528856][ T5378] cfg80211_wiphy_work+0x278/0x464 [ 41.528862][ T5378] process_scheduled_works+0x91c/0x1250 [ 41.528869][ T5378] worker_thread+0x798/0xbd0 [ 41.528877][ T5378] kthread+0x304/0x3d4 [ 41.528882][ T5378] ret_from_fork+0x10/0x20 [ 41.528888][ T5378] [ 41.528889][ T5378] The buggy address belongs to the object at ffff0000cb8e1800 [ 41.528889][ T5378] which belongs to the cache kmalloc-1k of size 1024 [ 41.528895][ T5378] The buggy address is located 24 bytes inside of [ 41.528895][ T5378] freed 1024-byte region [ffff0000cb8e1800, ffff0000cb8e1c00) [ 41.528902][ T5378] [ 41.528904][ T5378] The buggy address belongs to the physical page: [ 41.528908][ T5378] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b8e0 [ 41.528915][ T5378] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 41.528921][ T5378] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 41.528929][ T5378] page_type: f5(slab) [ 41.528936][ T5378] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 41.528942][ T5378] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 41.528948][ T5378] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 41.528953][ T5378] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 41.528958][ T5378] head: 05ffc00000000003 fffffdffc32e3801 00000000ffffffff 00000000ffffffff [ 41.528964][ T5378] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 41.528967][ T5378] page dumped because: kasan: bad access detected [ 41.528970][ T5378] [ 41.528972][ T5378] Memory state around the buggy address: [ 41.528975][ T5378] ffff0000cb8e1700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.528980][ T5378] ffff0000cb8e1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.528984][ T5378] >ffff0000cb8e1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.528987][ T5378] ^ [ 41.528991][ T5378] ffff0000cb8e1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.528995][ T5378] ffff0000cb8e1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.528998][ T5378] ================================================================== [ 41.529001][ T5378] Disabling lock debugging due to kernel taint [ 41.529005][ T5378] ------------[ cut here ]------------ [ 41.529007][ T5378] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 41.529013][ T5378] index 13912 is out of range for type 'unsigned long[8]' [ 41.529019][ T5378] CPU: 1 UID: 0 PID: 5378 Comm: syz.0.105 Tainted: G B syzkaller #0 PREEMPT [ 41.529028][ T5378] Tainted: [B]=BAD_PAGE [ 41.529031][ T5378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 41.529034][ T5378] Call trace: [ 41.529036][ T5378] show_stack+0x2c/0x3c (C) [ 41.529046][ T5378] __dump_stack+0x30/0x40 [ 41.529055][ T5378] dump_stack_lvl+0xd8/0x12c [ 41.529064][ T5378] dump_stack+0x1c/0x28 [ 41.529073][ T5378] ubsan_epilogue+0x14/0x48 [ 41.529082][ T5378] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 41.529093][ T5378] queued_spin_lock_slowpath+0x834/0xb5c [ 41.529101][ T5378] do_raw_spin_lock+0x21c/0x2d0 [ 41.529110][ T5378] _raw_spin_lock_irq+0x60/0x70 [ 41.529117][ T5378] gadget_dev_open+0x50/0x1c4 [ 41.529126][ T5378] do_dentry_open+0x5c4/0xfbc [ 41.529135][ T5378] vfs_open+0x44/0x2dc [ 41.529144][ T5378] path_openat+0x1084/0x18f0 [ 41.529153][ T5378] do_file_open+0x1c8/0x2e8 [ 41.529161][ T5378] do_sys_openat2+0x114/0x1e8 [ 41.529170][ T5378] do_sys_open+0xb0/0xe0 [ 41.529179][ T5378] __arm64_sys_openat+0xa8/0xc4 [ 41.529189][ T5378] invoke_syscall+0x98/0x244 [ 41.529198][ T5378] el0_svc_common+0xec/0x23c [ 41.529207][ T5378] do_el0_svc+0x4c/0x5c [ 41.529216][ T5378] el0_svc+0x60/0x1d8 [ 41.529223][ T5378] el0t_64_sync_handler+0x44/0x104 [ 41.529230][ T5378] el0t_64_sync+0x198/0x19c [ 41.529236][ T5378] ---[ end trace ]--- [ 41.529248][ T5378] Unable to handle kernel paging request at virtual address ffff7fbfe5ad63ac [ 41.529252][ T5378] KASAN: probably wild-memory-access in range [0xfffffdff2d6b1d60-0xfffffdff2d6b1d67] [ 41.529257][ T5378] Mem abort info: [ 41.529259][ T5378] ESR = 0x0000000096000006 [ 41.529262][ T5378] EC = 0x25: DABT (current EL), IL = 32 bits [ 41.529266][ T5378] SET = 0, FnV = 0 [ 41.529269][ T5378] EA = 0, S1PTW = 0 [ 41.529276][ T5378] FSC = 0x06: level 2 translation fault [ 41.529280][ T5378] Data abort info: [ 41.529282][ T5378] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 41.529285][ T5378] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 41.529289][ T5378] GCS = 0, Overlay = 0, DirtyBit = 0 [ 41.529293][ T5378] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000002196a1000 [ 41.529298][ T5378] [ffff7fbfe5ad63ac] pgd=0000000000000000, p4d=100000023cb06403, pud=100000023cb05403, pmd=0000000000000000 [ 41.529314][ T5378] Internal error: Oops: 0000000096000006 [#1] SMP [ 41.587242][ T4716] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.657917][ T5378] Modules linked in: [ 41.658630][ T5378] CPU: 1 UID: 0 PID: 5378 Comm: syz.0.105 Tainted: G B syzkaller #0 PREEMPT [ 41.660495][ T5378] Tainted: [B]=BAD_PAGE [ 41.661277][ T5378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 41.663091][ T5378] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 41.664503][ T5378] pc : queued_spin_lock_slowpath+0x52c/0xb5c [ 41.665608][ T5378] lr : queued_spin_lock_slowpath+0x834/0xb5c [ 41.666669][ T5378] sp : ffff800097aa7620 [ 41.667413][ T5378] x29: ffff800097aa76c0 x28: 1fffe000349fea28 x27: 1fffe000192b8b12 [ 41.668860][ T5378] x26: ffff0001a4ff5148 x25: fffffdff2d6b1d60 x24: dfff800000000000 [ 41.670321][ T5378] x23: ffff700012f54ec8 x22: 1fffe0001971c300 x21: ffff0001a4ff5140 [ 41.671760][ T5378] x20: ffff0000c95c5890 x19: ffff0000cb8e1800 x18: 0000000000000000 [ 41.673185][ T5378] x17: 363a682e6b636f6c x16: 0000000000000001 x15: 0000000000000000 [ 41.674614][ T5378] x14: 0000000000000bdb x13: 0000000000000001 x12: 0000000000000004 [ 41.676021][ T5378] x11: ffff7000115f6068 x10: ffff800089759140 x9 : ffff800089759160 [ 41.677492][ T5378] x8 : 1fffffbfe5ad63ac x7 : 0000000000000001 x6 : ffff800080483084 [ 41.678953][ T5378] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f31d4 [ 41.680408][ T5378] x2 : 0000000000000002 x1 : ffff0000c95c5880 x0 : 0000000000000000 [ 41.681891][ T5378] Call trace: [ 41.682512][ T5378] queued_spin_lock_slowpath+0x52c/0xb5c (P) [ 41.683654][ T5378] do_raw_spin_lock+0x21c/0x2d0 [ 41.684571][ T5378] _raw_spin_lock_irq+0x60/0x70 [ 41.685476][ T5378] gadget_dev_open+0x50/0x1c4 [ 41.686368][ T5378] do_dentry_open+0x5c4/0xfbc [ 41.687245][ T5378] vfs_open+0x44/0x2dc [ 41.687972][ T5378] path_openat+0x1084/0x18f0 [ 41.688829][ T5378] do_file_open+0x1c8/0x2e8 [ 41.689638][ T5378] do_sys_openat2+0x114/0x1e8 [ 41.690512][ T5378] do_sys_open+0xb0/0xe0 [ 41.691300][ T5378] __arm64_sys_openat+0xa8/0xc4 [ 41.692197][ T5378] invoke_syscall+0x98/0x244 [ 41.693068][ T5378] el0_svc_common+0xec/0x23c [ 41.693920][ T5378] do_el0_svc+0x4c/0x5c [ 41.694714][ T5378] el0_svc+0x60/0x1d8 [ 41.695437][ T5378] el0t_64_sync_handler+0x44/0x104 [ 41.696332][ T5378] el0t_64_sync+0x198/0x19c [ 41.697194][ T5378] Code: f94007e9 f9400328 8b090119 d343ff28 (38786908) [ 41.698473][ T5378] ---[ end trace 0000000000000000 ]--- [ 42.075050][ T5378] Kernel panic - not syncing: Oops: Fatal exception [ 42.076237][ T5378] SMP: stopping secondary CPUs [ 42.077114][ T5378] Kernel Offset: disabled [ 42.077975][ T5378] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 42.079379][ T5378] Memory Limit: none [ 42.381559][ T5378] Rebooting in 86400 seconds..