last executing test programs: 1m58.832111677s ago: executing program 3 (id=91): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @dev={0xac, 0x14, 0x14, 0x10}}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0xfff8, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) dup3(r1, r0, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f00000001c0)="f61827", 0x3}], 0x1) 1m58.593482238s ago: executing program 3 (id=92): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x6, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x7391, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0xb, 0xfff3}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x2, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x8000, 0x20000000, 0x6, 0x77}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x2}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x24040894}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1m58.452433244s ago: executing program 3 (id=94): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x222040, 0x0) close(r2) 1m57.372017585s ago: executing program 3 (id=98): syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000280)='./file0\x00', 0x80800c, &(0x7f00000003c0)=ANY=[@ANYRES64=0x0, @ANYRESDEC, @ANYRESOCT, @ANYRESOCT], 0x0, 0x250, &(0x7f0000000d40)="$eJzs2k9rXFUYB+D3pqlpE9OJ+I8WxIMu1M2lydpFg7QgBhRthCpIb82NDrnOhLlDYERsVrr1I7gWl+4E6dJNNn4CF+6yybIL8cp0ptopE6XUOrU+z2ZeOPc355w5M4fDcA5f/eqTne063y76MZdlMXch9uNmFisxF7ftxysvXfnxuXeuvPfG+sbGxbdTurR+eXUtpXTm+R/e/+zbF270l9797sz3C3Gw8sHh0dovB88cnD387fLH7Tq169Tp9lORrnW7/eJaVaatdr2Tp/RWVRZ1mdqduuxNtG9X3d3dQSo6W8uLu72yrlPRGaSdcpD63dTvDVLxUdHupDzP0/JicD82v7nZNHHUnLwaTdOc/jqWbsTyz9GK7ImUPXkhe/pq9ux+dvaoaVqzHioPhPX/f7tjUz8VUX25t7m3OXodta9vRzuqKON8tOLXGH5Nxkb1pdc3Lp5Pt6zEF9X1cf763uaJyfxqtGJlen51lE+T+YVYjDgZMc6vRSuemp5fm5o/FS+/eEf/ebTipw+jG1VsxTD7Z/7z1ZRee3Pjrvy5W88BADxq8vSHqee3PD+ufZS/h/PhXeer+Tg3P9u5E1EPPt0pqqrszaS4/R/Tsc88fv99Dd9/FhOc/6t5PbrF6fGSPti+FuKeUlnE/nBQD8Hn06sfeyh+en9XLM1kO+JfNrlPAgAAAAAAAAAA8F/xj18ePDH9Bi4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBxfg8AAP//Sy7Cew==") ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40085507, &(0x7f0000002340)=0x4c3) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x18d883, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0/../file0\x00', 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x80782, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') syz_genetlink_get_family_id$nl80211(0x0, r1) read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0x2020) 1m56.265392727s ago: executing program 3 (id=101): syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="73686f727461642c756e64656c6574652c73657373696f6e3d30303030000800003030303030303030303139302c6d6f64653d30303030303030303030303030303030303030303030352c726f6f746469723d30303030303030303030303030303030303030352c646d6f64653d30303030303030303030303030303030303030303030362c696f636861727365743d6370313235312c696f636861727365743d6b6f69382d722c6e6f7672732c0084f5b23d82aacbefd1de1daab7394a9b4696461da9ab46f2d71c895d8c"], 0xfc, 0xc41, &(0x7f0000001b80)="$eJzs3U9sHNd9B/DfG5Hi0m4rxnYUJ42LTVuksmK5+hdTsQp3VdNsA8gyEYq5BeCKpNSFKZIgqUY20oLupYceAhRFDzkRaI0CKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAOQUMZvatuKRJmzb/iLI+H5v67s68N/PezHJGIvjmBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ8QcvXTl7Lt3vVgAAh+na6NfOnnf/B4CHynX//gcAAAAAAAAAAAAAgKMuRRGPR4q5a2tpvHrfVrva6r1zd2xoePtq/amqeawqX37Vzp2/cPHLzw1e6uTV1swH1N9vn4tXRq9fqb84e3tufmphYWqyPjbTmpidnNr1FvZaf6vT1QGo3371zuTNmwv1889e2LT67sB7fY+eHLg8+PSZpzplx4aGh0c3itS6y/d87Ia07TTC43gUcSZSPPO9n6ZmRBSx92NRO9xzv1V/1YnTVSfGhoarjky3mjOL5cqRzoEoIupdlRqdY7T9uYie3kPtw84aEUtl88sGny67NzrXnG/emJ6qjzTnF1uLrdmZkdRubdmfehRxKUUsR8Rq3/s31xtF9ESK75xYSzci4ljnOHypGhi8czuKA+zjLpTtrPdGLBcPwDk7wvqiiJcjxc/ePhUT+TpTXWu+GPFymT+IeLPMFyJS+cG4GPHuNp8jHkw9UcRfluf/8lqarK4HnevK1a/Xvzpzc7arbOe68hHvD++7Utyn+0P/ljwcR/zaVIsimtUVfy19/L/sAAAAAAAAAAAAAAAAALDf+qOIz0aKl/7jT6pxxVGNSz9xefAPB361e8z4kx+ynbLssxGxVOxuTO7xPDBwJI2kdJ/HEj/MalHEn+bxf2/c78YAAAAAAAAAAAAAAAAAAAA81Ir4SaR4/p1TaTm65xRvzdyqX2/emG7PCtuZ+7czZ/r6+vp6PbWzkXM851LO5ZwrOVdzRpHr52zkHM+5lHM550rO1ZxxLNfP2cg5nnMp53LOlZyrOaMn18/ZyDmecynncs6VnKs544jM3QsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8ElSRBG/iBTf/uZaihQRjYjxaOdK3/1uHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ6ktFfD9S1P+ocW9ZT0Sk6v+2U+UfF6NxvMzHojFY5gvRuJKzWWVP44370H72pjcV8eNI0Vd7K1JPe1k+/73td/c+BvHmtzbefS6XPdZZOfBe36MnT1weHP6NJ3d6nbZrwOmrrZk7d+tjQ8PDo12Le/LeH+taNpD3W+xT34lYeO31V5vT01PzH/9F+RHYQ/UH6EX5DXIEmuHFYb2IniPRjPvTdx4C5f3/3Ujxu+/8Z+eG377/1+JX2u/u3eHj53+2cf9/fuuGdnn/79laL9//y3v6dvf/x7uWPZ//NtLbE1FbvD3XezKitvDa62dat5u3pm5NzVw8e/Yrg4NfuXC293hE7WZreqrr1b4cLgAAAAAAAAAAAAAAAIDDk4r4/UjR/PFaqkfE3Wq81sDlwafPPHUsjlXjrTaN235l9PqV+ouzt+fmpxYWpibrYzOtidnJqd3urlYN9xobGj6Qznyo/gNuf3/txdm51+Zbt/54cdv1j9Su3FhYnG9ObL86+qOIaHQvOV01eGxouGr0dKs5U1Ud2XYw/UfXm4r4r0gxcbGevpCX5fH/W0f4bxr/v7R1Qwc0/v9TXcvKfaZUxM8jxe/81ZPxhaqdj8T7jlku93eR4vSlz+dycbws12nDY9VDBNojA8uy/xcp/ukXm8t2xkO2xyBWZc/t/sg+GMrzfyJSfP8vvhu/mZdtfv7D9uf/ka0bOqDz/0TXskc2Pa9gz10nn/8zkeKFx9+K38rLPuj5H51nb5zKhe89n+OAzv+nu5YN5P3+9v50HQAAAAAAAAAA4IHWm4r4+0jxw+Ge9Fxetpvf/5vcuqED+v2vz3Qtm9yf+Yo+9MWeDyoAAAAAHBG9qYifRIpbi2/dG0O9efx31/jP39sY/zmUtqytfs73a9VzA/bz53/dBvJ+x/febQAAAAAAAAAAAAAAAAAAADhSUiriuTyf+ng1nn9yx/nUVyLFS//zTC6XTpblOvPAD1R/1q7Nzpy5Mj09O9FcbN6YnqqPzjUnpsq6T0SKtb/9fK5bVPOrd+abb8/xvjEX+3ykGP6HTtn2XOyducmf2Ch7riz7qUjx3/+Yy66vV2U781h/eqPs+bLs30SKb/zL5u12yp7cKHuhLPvdSPGjb9Q7ZR8py3aej/qZjbLPTswWB3BWAAAAAAAAAAAAAAAAAAAAeNj0piL+PFL87+3le2P58/z/vV1vK29+q2u+/y3uVvP8D1Tz/+/0+uPM/189V2Bpp70CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAnU4oiXo8Uc9fW0kpf+b6tdrU1c+fu2NDw9tX6U1XzWFW+/KqdO3/h4pefG7zUyQ+uv98+G6+MXr9Sf3H29tz81MLC1GR9bKY1MTs5test7LX+VqerA1C//eqdyZs3F+rnn72wafXdgff6Hj05cHnw6TNPdcqODQ0Pj3aV6en9qDt9Y8c1aYflx6OIv44Uz3zvp+mHfRFF7P1YbPvZ6dt9L/aov+rE6aoTY0PDVUemW82ZxXLlSOdAFBH1rkqNzjHat3NxQBoRS2XzywafLrs3Otecb96YnqqPNOcXW4ut2ZmR1G5t2Z96FHEpRSxHxOo256A3ing1UnznxFr6176IY53j8KVro187e37ndhQH2MddKNtZ741YLh6Ac3aE9UUR/xwpfvb2qfi3voieaH/FFyNeLvMHEW9G+3yn8oNxMeLdw/te5oD1RBH/X57/y2vp7b7yetC5rlz9ev2rMzdnu8p2risHcn84PP2Hurcjfm2qRRE/qq74a+nffV8DAAAAAAAAAAAAAAAAHCFF/HqkeP6dU6kaH3xvTHFr5lb9evPGdHtYX2fsX2fM9Pr6+no9tbORczznUs7lnCs5V3NGkevnbJRZW18fz++Xci7nXMm5mjOO5fo5GznHcy7lXM65knM1Z/Tk+jkbOcdzLuVczrmSczVnHJGxewAAAAAAAAAAAAAAAAAAwCdLUf2X4tvfXEvrfe35pcejnSvmA/3E+2UAAAD//xtt+zc=") r0 = open(&(0x7f0000000040)='.\x00', 0x8c00, 0x0) getdents64(r0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x1000) syz_open_procfs(0x0, 0x0) syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f0000000000)='./file0\x00', 0x801, &(0x7f00000003c0)=ANY=[], 0x2, 0x184, &(0x7f0000000400)="$eJzskr9S6kAUxr9NQgL3D3NvSwMFc/8USgzq2GmJvZ2NTIjIGFQIMwpDEcdxKCwcS5+AB/EFtHB8AGoKxtqJs7snmRUfwf0VfHu+nD2bb8lR1IscAG+LsY8dCEwU8cQYLABlJr25IfWO9Jn0VgoeqW+X/CvSUjQc2dRTwW9pHDfDMOhXALwKL7Oi7UsDczHqZTH2+eIAQJIkCfdaAG/HD6XHBNBTekoWUBAhkqyHB+HFXwC1QfesFg1HK51usx20gxPPrG+666674dUOO2Hgyl+mHEFRwPU/ACePDP48B+BaVDa+4QMievpqnBzACtjnyzww9u30DosMyxjKXnWGGkv+X8Ae/vCBOI+Z4lbFFAsiUgMM5nd6mu5lcOisvOha9U/D1gQMjLY5U1gwRVGQAdKB3kwp6lsxfsqRExpdJW2QTklnpOWlT8aKecgbqv7x98dFczDor9nZiqUrL/O8X7F6YfzUeyMNJ3kwPt2tRqPRaDQajUaj0Xw13gMAAP//IydzKQ==") 1m54.230586412s ago: executing program 0 (id=104): socket$nl_generic(0x10, 0x3, 0x10) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000000000/0x1000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/bus/input/devices\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000300)=0x0) io_submit(r2, 0x1, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x100, 0x2}, 'syz1\x00', 0x2d}) ioctl$UI_DEV_CREATE(r3, 0x5501) close_range(r0, 0xffffffffffffffff, 0x2000000000000000) 1m54.149527116s ago: executing program 3 (id=106): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="0100"}) close(0x3) 1m53.701217357s ago: executing program 32 (id=106): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="0100"}) close(0x3) 1m53.689952967s ago: executing program 0 (id=109): syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000540)='./file2\x00', 0x10, &(0x7f0000000580), 0x1, 0x4f8, &(0x7f0000005e40)="$eJzs3U9oVdkZAPDvvvyxxsSkpWKrLQRarGL7YhKNCqWYVUG0tLXQTVuJSUzEJC+YF1Ap1FAsUqh0MQsHV7NxFrMJs5UZhIGBWc3CxcxCFGY1I+PIyLhwleG+3KfP+EwmJuY68feDy7vnvOSd776Pe9+5l3PPDeC11RkRhyKiISKKEdGe1ReyJS7ML+nfneidHU2XJObmjt1PIomIw72zo9XPSrLXTdkH/CR9uRixu/HZdqfOnT89MDY2fCYrd5XHJ7umzp3/zanxgZHhkeGJvv37Dx7Y17fv4Opt68atV6799M0jNy9/OPPzLZsGx9N4W7P3ardjtXRGZ/adNEVb7RtJxInVbixnP8g7AJbty8L263nHAACsvULW92+s9P/boyHmO+t3bv3tQXv8qyXv+AAAAICVm5tryF4BAACA9Stx7g8AAADrXHUcwOHe2dHqslZjD+7+fq1a4nnu9UdEx3z+q/d3z7/T+Pie3qaXdH/vPx9FdEbbw89/96MP0iVe0n3YvJpmP8s7AvLUvDfvCMjTtj/lHQF5+vhS3hFwYSYibhyq0/9PVtzna11QThaUj/an/b//TdXW6f+9Pv58LO8IyNMf+vKOgDxdvZ93BNzoj4g99a7/FSrz91VtjIiW6tx+q+RAa/r7/+6d2rpnf/8Ld1exSRa41x/x25q5HU/U5D/T0ZCV2iqXCpuSk6fGhvdExOaI2BlNG9Jy9yJtdPdd/X+9+p89TPP/dlK9/pcuafvVa4FZHHcbNzz9f0MD5YGVbjfz7s1EbGusl/8n/f8ky/WLeq90+b/16vt2VeYV3bF4/nmZ5t6K2FF3/39ytpYsOj9rV+Vw0FU9KNTxzqdfX6xX/8t/pPk/vUv+85Pu/y2L579y/H88X+/U8tv49/vXHtarf3Q9zf8bF17k+N+c/KUSYHNWd3agXD7THdGcHHm2vmf5Ma9X1e+j+n2l+d/5i/q//9X+X5LNC90RET98gTZnbk/erFd/pZDm/+rf7f/5SfM/tMT+nzy1/y9/ZfaTX/+qXtvbL6X57/jr0vv/3kowO7Ma/b+lfdcE5R0nAAAAAAAAAKujULlPJykUH68XCsXi/DjfH0dLYaw0Vd59sjQ9MTR/P09HNBWqQ73aa8aDdmfjQ6rlngXl3mzsyKX2jZVycbA0NpT3xgMAAMD6l0TE1k3POf9P3WrPO0QAAABgJVojbrfdbqlM5/WN83wAAABYl9Lz/wf/+eqjcP4PAAAA61bt+T8AAACwvv3x6NF0mas+92+iNHLq9OjkwZ49xfHpweJg6cxkcaRUGqnM2De+9OeNlUqT3T0xfbarPDxV7po6d/74eGl6ony88tzY48NNa7BNwNKKm7/YkncMAADA2lnJc/2//yuNy3hSvpWnVyrzR0ZE7VuN8QoEZmVVVvI+MgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsBLfBgAA//+hWPT+") open(0x0, 0x20c1, 0x101) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000340)={0x0, 0x2904c, 0x5, 0x10003, '\x00', [{0x0, 0x5, 0x404, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x9, 0xa}], ['\x00', '\x00', '\x00', '\x00', '\x00']}) socket$nl_netfilter(0x10, 0x3, 0xc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) 1m53.276759077s ago: executing program 0 (id=113): syz_open_dev$video4linux(&(0x7f0000000240), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x220b03) dup(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @empty, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x304}, "3451611b93f96287", "3574248912198578b587070fe8aa7548", "80507d52", "fa210fb309a1aa52"}, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f00000001c0)={0x1ff, 0x0, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 1m52.095314472s ago: executing program 0 (id=119): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000540)='./file1\x00', 0x3010018, &(0x7f00000000c0)={[{@delalloc}, {@bsdgroups}, {@stripe={'stripe', 0x3d, 0x2}}, {@noquota}]}, 0x5, 0x4d0, &(0x7f00000013c0)="$eJzs3V9oVuUfAPDveffH/eb8bb9fUeLVSjBD3JyvSwQDvRKkhDQoqIuGezen71TchLaL6A+UUYHeeJMEdVEQXqyr6ibCi6gIuvAmKLwoiBxMyyK8CBbn/bOme7c5pzu6Ph84nOc55z3n+b7v43ne83w97A3gX6s9InZERF1EbIqI1sr2XGWJF8tL+rpCfuxAuiQxObnvchJJROzOjx2oniuprFdWTtAUEee+iGiun9nu0MjooZ5isXCsUu8cHjzaOTQyunFgsKe/0F84nO/ams/nu7flu2/Ze/3tr4OnPrm66/XTl3795qfzH59NYke0VPZNfx+3Snu0T30m09UnEY/e6sYy1pR1ACzY2cdPvZV1DADA0kvv8f8fEQ+W7v9boy7KN+sHx5+90hpX+mY7ru3Pdy4uZZwAAADAzZuM1tiermtqmHUPAAAAcPfIRURLJLmOyrMALZHLdXSUn+G9N5pzxSNDwxv6jhw/3BulZ2XboiHXN1AsVJ8VbouGJK13lcr/1DdfV89HxP8i4kTrf0r1jv1Hir1ZJz8AAABgmWuJuPDMK5/ev3KW+X/qh9asowQAAAAWI53/r7rQXPpTXX+Y5wMAAMCylM7/r7x66asw/wcAAIBlqzr/n/odLoXbWKj+ANqdEo+CwnyFjAcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqGFyMolJAAAAYFnLOv8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDdZXd+7EB1Wao2x3ctVUvMZmJnRLSV+79QWcp76qOptG6Khoho/j2J+mnHJRFRt8i2O9ZFtMeG706+8MtH6RKVf4eLPC13ibEfs46A261+jn2NW5YwEO44a57IOgKy9O2JrCMgS+cnso6ALO3dl3UEZGnPI1lHQJbevpx1BHy+MyI21cr/5WJ1aV3OAl2f/6mbZ253I74+E9EeHT9P3zYz/5MbX2QzzGFiZ8T2iCjMyP/lqi9pq6vUVpVShQ1J30CxsCki/hsR66NhRVrvmqON3avP1cz0vHlf2v/H91Tzf+mStl/NBVbiGK9fce1xvT3DPYt935RNvBSxpr5W/ydT+d9klvzvihtrIj1ssNaOq1+m/f/GZ3P3P7fT5LsRD9W8/pOp16SlzuHBo51DI6MbBwZ7+gv9hcP5rq35fL57W767szQedFZHhZk+fPn9mt/0D+wvjf8j+j876fXfPHf/l8b/oZHRQz3FYuHY0MLbeG3d6Zrf4R+cTvu/8dzNjP+NyZOlABsr257vGR4+1hXRmDw2c/vmhce8XFU/j+rnlfb/+rW1v/+r93/l8T83Y/y/p7LOlf8LcVYPv3ex5vbvT6b9n3/K9Z+dtP9757n+k2uu/4UXnlu7d32ttp+O0v3fmfmv/y2lYKoncf83vxvtoKzjBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6f4OAAD//1/T7bc=") r0 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000000280)={0xa0, 0x0, 0x0, {{0x1, 0x1, 0x2, 0xa, 0x3, 0x80, {0x6, 0x17d, 0xfffffffffffffffd, 0x0, 0x103, 0x7cf4, 0x9, 0x7ffffffd, 0x0, 0x1000, 0x20000000, 0x0, 0x0, 0x3ff, 0x7}}, {0x0, 0x3}}}, 0xa0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) sendfile(r0, r0, &(0x7f0000000080)=0x2, 0x7f03) 1m49.56583023s ago: executing program 0 (id=125): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcff, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1m48.439275393s ago: executing program 0 (id=128): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7fd}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000040)={r0, r0, 0x8, 0x0, 0x0, 0x1, 0x61, 0x6, 0x1012, 0xc3, 0x2, 0x7, 'syz1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 1m48.011394463s ago: executing program 33 (id=128): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7fd}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000040)={r0, r0, 0x8, 0x0, 0x0, 0x1, 0x61, 0x6, 0x1012, 0xc3, 0x2, 0x7, 'syz1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 1m34.685352007s ago: executing program 2 (id=166): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$video(&(0x7f0000000080), 0xe, 0x8800) syz_init_net_socket$llc(0x1a, 0x1, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80082) socket$inet6_mptcp(0xa, 0x1, 0x106) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 1m33.460834204s ago: executing program 2 (id=167): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x3, 0x0, 0x9000, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/sem\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001f80)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10, 0x0}}], 0x1, 0x4004) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x2, 0x184, 0x2, 0x10, 0xf1, 0x100000001, 0x1, 0x5, 0x0, 0x29, 0x0, 0x2, 0x0, 0xbd9], 0xffff1001, 0x53101}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0x40a7f, 0x68ff, 0x7, 0x8, 0x803, 0x0, 0x9, 0x2], 0xeeee8000, 0x102280}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0x3, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x0, 0x0, 0x1, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x4, 0x6, 0x5, 0x7f, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0xd000, 0xf, 0x3, 0x16, 0x87, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0x0, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x18227000, 0xe, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xa, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x2, 0xc, 0xb0, 0x91}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x1, 0x0, 0xe000, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m33.176568688s ago: executing program 2 (id=169): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x3, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000140)="05", 0x1, 0x4040094, &(0x7f00000000c0)={0x11, 0x10, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 1m31.854415989s ago: executing program 2 (id=172): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x80580, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000}, 0x94) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@ipv6_newaddr={0x40, 0x14, 0x101, 0x70bd26, 0x25dffbf8, {0xa, 0x38, 0x78, 0xff, r2}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004051}, 0x0) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newaddr={0x48, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x8, 0x0, 0xff, r5}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_ADDRESS={0x14, 0x1, @empty}, @IFA_RT_PRIORITY={0x8, 0x9, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) 1m31.432407279s ago: executing program 2 (id=173): syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') io_submit(0x0, 0x0, 0x0) syz_emit_ethernet(0x3e, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r1, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone3(&(0x7f0000000400)={0x80400, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), {0x1a}, 0x0, 0x0, 0x0, &(0x7f00000003c0), 0x0, {r1}}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x39163000) 1m31.221927419s ago: executing program 2 (id=174): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) sendmsg$nl_route_sched(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x8170b922, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x5, 0xb}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0xb32019a74e55d2de) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 1m15.934927065s ago: executing program 34 (id=174): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) sendmsg$nl_route_sched(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x8170b922, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x5, 0xb}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0xb32019a74e55d2de) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 57.019562081s ago: executing program 5 (id=287): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x1ff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000780)=""/4096, 0xffffffa2}], 0x1, 0x12c, 0x0) 55.951045811s ago: executing program 5 (id=290): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setrlimit(0xb, 0x0) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r3, &(0x7f00000003c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 54.921369939s ago: executing program 5 (id=291): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x10}]}}, @TCA_RATE={0x4, 0x5, {0x5, 0x9}}]}, 0x40}}, 0x4800) 51.153447725s ago: executing program 5 (id=297): socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000009c0)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020601020000000000000010000000000900020073797a3100000000050004000000000011000300686173683a6e65742c6e6574000000000c00078008000640000000cd050005000a0000000500010006"], 0x58}}, 0x0) 49.703704003s ago: executing program 5 (id=300): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, 0x0) sendfile(r1, r0, 0x0, 0x100000500) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x80481, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x800, 0xffffffff, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x800) sendto$inet(r2, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x0) 48.445093622s ago: executing program 5 (id=305): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='10\n', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='tcp 2049\n', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='1\n', 0x2) close(r3) 35.352025825s ago: executing program 4 (id=345): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000930000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92, 0x4000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000001540)=""/4092}) r2 = eventfd(0xf7b2) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000680)={0x0, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 32.228257951s ago: executing program 35 (id=305): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='10\n', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='tcp 2049\n', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='1\n', 0x2) close(r3) 27.793523089s ago: executing program 4 (id=360): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(0xffffffffffffffff, 0xf502, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) write$binfmt_aout(r1, &(0x7f0000000540)=ANY=[], 0xff70) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)) 27.609418317s ago: executing program 4 (id=362): socket$nl_route(0x10, 0x3, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2000b, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000040)=0x2) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r4, 0x40047438, &(0x7f0000000500)=0x2) 27.450658984s ago: executing program 4 (id=363): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000200)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f041, 0x0, '\x00', @value=0x100}}) 26.654938902s ago: executing program 4 (id=365): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb0}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x86}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x1, 0x9}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000020000000000000f0400000000005f"], 0x0, 0x28}, 0x20) socket$tipc(0x1e, 0x4, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000840), &(0x7f0000000140)=r2}, 0x20) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r3, r5, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty=0xe0000001}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 23.139268747s ago: executing program 4 (id=374): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='udp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='4\n', 0x2) close(r2) 11.869897474s ago: executing program 1 (id=394): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) r2 = io_uring_setup(0x178e, &(0x7f0000000140)={0x0, 0x52c1, 0x8, 0xfffffffc, 0xc}) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85512, &(0x7f0000000040)={{0x0, 0x0, 0x1000000, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x1ff, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc]}) close_range(r2, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 10.382394664s ago: executing program 7 (id=397): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000002c0)) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000000)={0x18, 0x0, {0x3, @remote, 'ip6_vti0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r4, 0x80047437, &(0x7f0000000040)) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r5, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r5, 0x4004743a, &(0x7f00000000c0)) pread64(r3, 0x0, 0x0, 0x100008) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 9.737216324s ago: executing program 8 (id=399): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) r5 = eventfd(0x80000) ioctl$VHOST_SET_VRING_BASE(r4, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f00000001c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/245, &(0x7f0000000780)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000001a40)={0x2, 0x0, [{0x0, 0x24, &(0x7f0000000000)=""/36}, {0x4, 0x1000, &(0x7f0000001ac0)=""/4096}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r4, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) 8.718295672s ago: executing program 6 (id=400): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80040100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = epoll_create1(0x80000) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000040)={0xc0000015}) 8.625476706s ago: executing program 8 (id=401): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@errors_remount}, {@nombcache}]}, 0x1, 0x437, &(0x7f0000000900)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=") ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, 0x0, 0x0) creat(0x0, 0x17e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$int_in(r1, 0x5452, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r2, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) close_range(r3, 0xffffffffffffffff, 0x0) 7.923630889s ago: executing program 6 (id=402): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002500)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000500000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8f23e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae0000c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910a3193e90be231a05fd82e6003969c31082ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a3d19c158a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b884057aeb68f3d675a79907a72ace70902459f6950a06a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbd488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc816df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d044fa492aa38717481455e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000000000000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634e89aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3319f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f9863800f127d6b4518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c104fe52837a19dd6952fe2724c0105ab158a54a6a73000000000000000000"], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(0x3) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x80) syz_usb_connect$midi(0x2, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000000000844060e8040010000000109023c00010102000409040000030103000209050c0300040195050525bb0c020425010009050e03"], 0x0) syz_usb_connect$uac2(0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xa, 0x7, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r2}, @generic={0xb7, 0x3, 0x0, 0x0, 0x8}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000001c0)="b15dd7cf1c000004000000000000", 0x0, 0x5845, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x43, 0x101, 0xc, 0xbb0}) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000180)={0x1, 0x0, [{0x8b, 0x0, 0x7}]}) 7.828964334s ago: executing program 36 (id=374): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='udp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='4\n', 0x2) close(r2) 7.561867196s ago: executing program 7 (id=404): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x24040810) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ptrace$peekuser(0x3, r0, 0x1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r3, 0x9) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 7.345429876s ago: executing program 1 (id=405): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = fanotify_init(0xf00, 0x1) fanotify_mark(r4, 0x105, 0x40009967, r0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1860, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) 6.458274978s ago: executing program 7 (id=406): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000500)=""/102400, 0x19000) sched_setaffinity(r2, 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000180), 0x78, 0xa02) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) 6.272503756s ago: executing program 1 (id=407): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x12, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000ef2000/0x4000)=nil, 0x4000, 0x0, 0x3fa, 0x1000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = syz_open_procfs(0x0, &(0x7f00000193c0)='net/igmp6\x00') pread64(r1, &(0x7f0000019400)=""/102344, 0xfffffcbb, 0x1c2a) 5.169399978s ago: executing program 7 (id=408): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, 0x0, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x800) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) syz_open_dev$vim2m(&(0x7f0000000e40), 0x8, 0x2) 5.169070048s ago: executing program 8 (id=409): openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() syncfs(0xffffffffffffffff) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 4.860386333s ago: executing program 1 (id=410): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000000)={0x1d, 0x0}) 3.516259065s ago: executing program 1 (id=411): ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) open(0x0, 0x4c37e, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1000, r0}, 0x38) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e1c, @dev={0xac, 0x14, 0x14, 0xfc}}, 0x10) 3.42144145s ago: executing program 8 (id=412): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) sendto$inet6(r1, 0x0, 0x0, 0x20000000, &(0x7f0000000380)={0xa, 0x4e1d, 0x6, @dev={0xfe, 0x80, '\x00', 0x25}, 0x2}, 0x1c) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x2}, 0x6) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000000)="d0e3b25f8c49460df0af8732cbbdfc5608ebc385397f21085ff88fd57c58af7447c47a1763e689741d04d882dba7033b9438f34e7dc6c5837108966f2308befe74778d1f77207c3ba98d71d45c0fb80f365e1c776821b487929ded58c093870bf758db718eca68808ca6b37a17afd5c81cc7b9376f7df18674e3504082b8df8c3abc584c0054ecd955a953cdab5ed2e5cfb1da76550badd5fb0080a7a7c40174d922ac76b85b316432570fce9cd1e2d6b70374e4390b64fd99edf6f6dc5e5e385023dc9365103be257cc6c4753bcb4bdec83d1c2d98ce8957f092b") 1.885765062s ago: executing program 7 (id=413): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000061181c000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc4c85513, &(0x7f0000000580)={{0x5, 0x3, 0x3, 0xfffffffe, '\x00', 0x2}, 0x1, [0xd44, 0x7fffffffffffffff, 0x0, 0x2, 0x5, 0x4, 0x7ff, 0x2, 0x2, 0x101, 0x2, 0x9, 0xf, 0x8, 0x1, 0x7, 0x4, 0x2, 0x2, 0x9, 0x0, 0xfffffffffefffffe, 0xfe7, 0x8000000000000000, 0xd, 0x18, 0x7ff, 0x9, 0xfffffffffffffffa, 0x2, 0xfffffffffffffff7, 0x5, 0x7, 0x3ff, 0x2, 0x2, 0xe, 0x5, 0x1, 0x88, 0x2, 0x6, 0x5, 0xffffffff, 0x0, 0x9, 0x1b9315a1, 0x6, 0xa, 0x4, 0x7fff, 0x6, 0x8001, 0xffa5, 0x6, 0x2, 0x1, 0xfffffffbfffff800, 0x244, 0x1, 0x20, 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x5, 0x1, 0x2, 0x4, 0x4, 0xf, 0xae8, 0x3, 0x2, 0x6, 0x9, 0x7, 0x0, 0x0, 0x7ff, 0x2, 0x7, 0x4, 0x9, 0x0, 0x3, 0x3, 0x6, 0xf8, 0xfffffffffffffff9, 0xfffffffffffffffb, 0xfff, 0x93, 0x6, 0x3, 0x8000000000000000, 0x800000000009, 0x2, 0x7ff, 0x7, 0x8, 0x1ff, 0x0, 0x2, 0x8, 0x5, 0x796a, 0xb0b, 0x9, 0x7, 0x4, 0x4, 0x0, 0x8, 0x4, 0x2dd, 0x4, 0x4, 0x8, 0x10000, 0x1da0, 0x38, 0x7, 0x5, 0x5, 0x8000000000000001, 0xffffffffffffffff, 0x7]}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r4, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) 1.884823252s ago: executing program 6 (id=414): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40400000000000061111c0000000007000000000000000095007500000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) write(r2, &(0x7f0000001800)="2d2519d010bae03d46fdca85c1a1862b9b169eceaaca9ccf1cb8d871123f1c9c5e4ee16a1d71f8876bd9dd39cbd2831a51bf6016afee9c90f6acc9f9da99563bcef07ea1a92a75", 0x47) r3 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r3, &(0x7f00000091c0)=""/16384, 0x4000) 1.634485513s ago: executing program 6 (id=415): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000040)=0x4) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4b, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x74, 0x0, 0x54}) 1.557451787s ago: executing program 8 (id=416): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, 0x0, 0x0, 0xb, 0x0, 0x0, 0x41100, 0x5e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 863.33754ms ago: executing program 7 (id=417): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) 763.868644ms ago: executing program 6 (id=418): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x38, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) epoll_create(0x567) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}}, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0x70}}, 0x0) 97.863886ms ago: executing program 1 (id=419): openat$sequencer(0xffffffffffffff9c, 0x0, 0xa0602, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x80) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x1, 0x6, 0x0, 0x100, 0x4, 0x540000, r2}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, 0x0, 0x300) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0={0xfc, 0x0, '\x00', 0x9}, 0x4, 0x6, 0x3, 0x100, 0x3df4, 0x180107, r2}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x43d, 0x3, 0x0, {0x0, 0x0, 0x0, r6, {0x7, 0xffff}, {0x4, 0xfff3}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) 17.654759ms ago: executing program 8 (id=420): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000140)={@rand_addr, @initdev}, &(0x7f00000001c0)=0xc) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x8000) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0xc0100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4010000}, 0x804) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_GET_MSRS_cpu(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000200)={0x1, 0x0, [{0xc0000103, 0x0, 0x4}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 6 (id=421): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_io_uring_setup(0x3bd4, 0x0, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) write$cgroup_devices(0xffffffffffffffff, 0x0, 0xa) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x4000000) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpriority(0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) kernel console output (not intermixed with test programs): CONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.687132][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.695831][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.704353][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.726782][ T4275] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.740221][ T4274] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 65.761222][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.780778][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 65.789550][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.800184][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.809314][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.819067][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.828550][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.837422][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.848182][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 65.857883][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 65.867173][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.876577][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.885533][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.894377][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.902160][ T4282] Bluetooth: hci1: command 0x041b tx timeout [ 65.902192][ T4282] Bluetooth: hci0: command 0x041b tx timeout [ 65.902228][ T4282] Bluetooth: hci4: command 0x041b tx timeout [ 65.902250][ T4282] Bluetooth: hci2: command 0x041b tx timeout [ 65.927274][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.952235][ T4273] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 65.966170][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.981057][ T4289] Bluetooth: hci3: command 0x041b tx timeout [ 65.991899][ T4280] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 66.004183][ T4280] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 66.013369][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 66.024386][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.035223][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 66.046754][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.057697][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.074734][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.126061][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.161511][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.193248][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.222506][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.279597][ T4275] device veth0_vlan entered promiscuous mode [ 66.336276][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.351535][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.361393][ T4286] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.371815][ T4275] device veth1_vlan entered promiscuous mode [ 66.429742][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.439279][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.469524][ T4275] device veth0_macvtap entered promiscuous mode [ 66.502220][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.521889][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.550821][ T4275] device veth1_macvtap entered promiscuous mode [ 66.563396][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.581824][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.596185][ T4286] device veth0_vlan entered promiscuous mode [ 66.618175][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.628467][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.639613][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.648211][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.673752][ T4275] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.685402][ T4275] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.700924][ T4286] device veth1_vlan entered promiscuous mode [ 66.707669][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.716677][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.726405][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.736087][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.745297][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.753085][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.762180][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.770997][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.778415][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.793351][ T4275] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.805057][ T4275] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.815060][ T4275] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.823980][ T4275] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.836950][ T4273] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.847163][ T4274] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.856528][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.864797][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.905973][ T4280] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.950695][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.958960][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.982865][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.991701][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 67.000622][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 67.015099][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 67.024805][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.045213][ T4286] device veth0_macvtap entered promiscuous mode [ 67.068929][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 67.087256][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.097538][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.113665][ T4274] device veth0_vlan entered promiscuous mode [ 67.135007][ T4286] device veth1_macvtap entered promiscuous mode [ 67.151127][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 67.159215][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 67.169447][ T4323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.201435][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 67.209755][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.228965][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.232391][ T4273] device veth0_vlan entered promiscuous mode [ 67.246213][ T4274] device veth1_vlan entered promiscuous mode [ 67.258022][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.269796][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.281472][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.293037][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.300738][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.309070][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.317679][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 67.326218][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 67.335175][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 67.352846][ T4273] device veth1_vlan entered promiscuous mode [ 67.368882][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.382315][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.393863][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.426915][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 67.437194][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 67.450991][ T4286] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.459724][ T4286] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.471630][ T4286] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.480693][ T4286] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.500076][ T4274] device veth0_macvtap entered promiscuous mode [ 67.540559][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.548409][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.565547][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 67.577995][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 67.587653][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 67.596703][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 67.605479][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 67.615222][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 67.627620][ T4273] device veth0_macvtap entered promiscuous mode [ 67.647656][ T4274] device veth1_macvtap entered promiscuous mode [ 67.657632][ T4273] device veth1_macvtap entered promiscuous mode [ 67.689650][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 67.699873][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 67.708554][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 67.717970][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 67.726794][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.746206][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.759188][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.769178][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.779667][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.791995][ T4273] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.813058][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.825177][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.837445][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.848403][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.859046][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.884707][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.904734][ T4274] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.918381][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 67.927792][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 67.938347][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 67.947835][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 67.958092][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.970075][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.980411][ T4273] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.981677][ T4289] Bluetooth: hci2: command 0x040f tx timeout [ 67.996991][ T4289] Bluetooth: hci4: command 0x040f tx timeout [ 67.999283][ T4282] Bluetooth: hci0: command 0x040f tx timeout [ 68.003270][ T4276] Bluetooth: hci1: command 0x040f tx timeout [ 68.009953][ T4273] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.027017][ T4273] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.042149][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.053444][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.063276][ T4289] Bluetooth: hci3: command 0x040f tx timeout [ 68.071439][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.086518][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.097767][ T4274] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.112228][ T4274] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.124207][ T4274] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.133160][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.156225][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.167780][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.180985][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.197873][ T4273] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.201046][ T4356] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 68.207310][ T4273] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.232856][ T4273] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.245843][ T4273] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.270453][ T4274] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.287289][ T4274] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.297235][ T4274] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.306746][ T4274] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.353721][ T4280] device veth0_vlan entered promiscuous mode [ 68.362501][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.373492][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.421005][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.442417][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.466918][ T4360] loop0: detected capacity change from 0 to 128 [ 68.476963][ T4280] device veth1_vlan entered promiscuous mode [ 68.525826][ T4323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.547538][ T4323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.587161][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.604821][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.619540][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.659921][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.667930][ T4280] device veth0_macvtap entered promiscuous mode [ 68.671630][ T4280] device veth1_macvtap entered promiscuous mode [ 68.695150][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.725490][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.735334][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.744267][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.753231][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.768689][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.782009][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.789852][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.811429][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.822564][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.835012][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.845553][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.856113][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.867013][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.877009][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.887635][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.898735][ T4280] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.907215][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.915759][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.924441][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.942593][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.955482][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.963763][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.970706][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.973878][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.991792][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.002184][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.012754][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.022968][ T4280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.033531][ T4280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.044375][ T4280] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.064177][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.072733][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.081741][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.092108][ T4280] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.104372][ T4280] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.113488][ T4280] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.122257][ T4280] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.190946][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.196178][ T4331] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.198785][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.198997][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.221695][ T4331] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.233561][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.286761][ T4331] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.320075][ T4331] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.350644][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.450666][ T4323] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.482387][ T4323] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.489956][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.848831][ T4380] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 69.979961][ T4387] loop4: detected capacity change from 0 to 512 [ 69.997250][ T4387] EXT4-fs: Ignoring removed oldalloc option [ 70.057970][ T4387] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 70.061259][ T4289] Bluetooth: hci4: command 0x0419 tx timeout [ 70.073769][ T4276] Bluetooth: hci1: command 0x0419 tx timeout [ 70.079795][ T4276] Bluetooth: hci0: command 0x0419 tx timeout [ 70.080413][ T4292] Bluetooth: hci2: command 0x0419 tx timeout [ 70.141702][ T4289] Bluetooth: hci3: command 0x0419 tx timeout [ 70.202184][ T4387] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.11: Invalid inode table block 2510264359 in block_group 0 [ 70.218029][ T4387] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 70.232527][ T4387] EXT4-fs error (device loop4): ext4_dirty_inode:6166: inode #4: comm syz.4.11: mark_inode_dirty error [ 70.244794][ T4387] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:477: comm syz.4.11: Invalid block bitmap block 2945682684 in block_group 0 [ 70.270820][ T4387] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.11: Invalid inode table block 2510264359 in block_group 0 [ 70.292266][ T4387] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 70.312677][ T4387] EXT4-fs error (device loop4): ext4_dirty_inode:6166: inode #4: comm syz.4.11: mark_inode_dirty error [ 70.348503][ T4387] Quota error (device loop4): write_blk: dquota write failed [ 70.370481][ T4387] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 70.409385][ T4387] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.11: Failed to acquire dquot type 1 [ 70.442566][ T4387] syz.4.11 (4387) used greatest stack depth: 20784 bytes left [ 70.598023][ T4323] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm kworker/u4:5: Invalid inode table block 2510264359 in block_group 0 [ 70.656758][ T4405] device syzkaller0 entered promiscuous mode [ 70.666909][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 70.675294][ T4408] binder: 4407:4408 ioctl c0306201 200000000680 returned -14 [ 71.268484][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.302623][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.410289][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 71.446794][ T4426] binder: 4425:4426 ioctl c0306201 200000000180 returned -14 [ 73.186253][ T4442] loop0: detected capacity change from 0 to 512 [ 73.292064][ T4442] EXT4-fs: Ignoring removed i_version option [ 73.394000][ T4442] EXT4-fs: Ignoring removed oldalloc option [ 73.573078][ T4442] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 73.808872][ T4466] loop1: detected capacity change from 0 to 64 [ 73.964815][ T4275] EXT4-fs (loop0): unmounting filesystem. [ 74.276001][ T4479] netlink: 4 bytes leftover after parsing attributes in process `syz.4.35'. [ 74.538613][ T4479] team0: Port device team_slave_0 removed [ 75.082201][ T4501] loop2: detected capacity change from 0 to 512 [ 75.140524][ T4431] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.169729][ T4503] loop3: detected capacity change from 0 to 512 [ 75.193255][ T4501] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 75.211446][ T4503] ext4: Unknown parameter 'smackfshat' [ 75.217884][ T4501] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 75.287381][ T4267] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 75.344638][ T4431] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 75.368766][ T4431] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.427921][ T4501] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.43: bg 0: block 408: padding at end of block bitmap is not set [ 75.429988][ T4431] usb 5-1: config 0 descriptor?? [ 75.462984][ T26] audit: type=1800 audit(1790181881.600:2): pid=4511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.46" name="ipv4_address" dev="configfs" ino=35311 res=0 errno=0 [ 75.489119][ T4509] EXT4-fs (loop2): shut down requested (1) [ 75.493797][ T4431] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 75.503586][ T4501] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 75.520190][ T26] audit: type=1800 audit(1790181881.620:3): pid=4511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.46" name="num" dev="configfs" ino=35312 res=0 errno=0 [ 75.555040][ T26] audit: type=1800 audit(1790181881.630:4): pid=4511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.46" name="ipv4_address" dev="configfs" ino=35314 res=0 errno=0 [ 75.684094][ T4514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.47'. [ 75.695926][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 75.745279][ T4514] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 77.857991][ T4431] usb 5-1: USB disconnect, device number 2 [ 77.962613][ T4542] process 'syz.1.54' launched './file0' with NULL argv: empty string added [ 78.023262][ T4540] device syzkaller0 entered promiscuous mode [ 78.174028][ T4550] af_packet: tpacket_rcv: packet too big, clamped from 14 to 4294967286. macoff=82 [ 78.354369][ T4556] netlink: 28 bytes leftover after parsing attributes in process `syz.3.62'. [ 78.368008][ T4556] netlink: 28 bytes leftover after parsing attributes in process `syz.3.62'. [ 79.046320][ T4575] device syzkaller0 entered promiscuous mode [ 79.344210][ T7] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 79.359519][ T4579] loop2: detected capacity change from 0 to 4096 [ 79.455908][ T4584] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 79.556444][ T7] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 79.600643][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.654720][ T7] usb 2-1: config 0 descriptor?? [ 79.675794][ T7] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 79.992755][ T4593] svc: failed to register lockdv1 RPC service (errno 101). [ 80.015048][ T4593] lockd_up: makesock failed, error=-101 [ 81.121378][ T7] usb 2-1: USB disconnect, device number 2 [ 81.164465][ T4605] device syzkaller0 entered promiscuous mode [ 81.326652][ T4588] loop4: detected capacity change from 0 to 40427 [ 81.386558][ T4614] loop0: detected capacity change from 0 to 256 [ 81.487322][ T4614] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 81.592504][ T26] audit: type=1800 audit(1790181887.720:5): pid=4614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.79" name="file1" dev="loop0" ino=1048596 res=0 errno=0 [ 81.668199][ T4588] F2FS-fs (loop4): invalid crc value [ 81.751542][ T4608] loop3: detected capacity change from 0 to 512 [ 81.965138][ T130] cfg80211: failed to load regulatory.db [ 82.009069][ T4588] F2FS-fs (loop4): Found nat_bits in checkpoint [ 82.053238][ T4608] EXT4-fs: Ignoring removed i_version option [ 82.066928][ T4608] EXT4-fs: Ignoring removed oldalloc option [ 82.319945][ T4588] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 82.336706][ T4608] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 82.409439][ T4588] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 82.948860][ T4286] EXT4-fs (loop3): unmounting filesystem. [ 84.637980][ T4669] loop3: detected capacity change from 0 to 128 [ 85.607721][ T4662] loop1: detected capacity change from 0 to 32768 [ 85.630370][ T22] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 85.891162][ T4662] XFS (loop1): Mounting V5 Filesystem [ 86.470676][ T4662] XFS (loop1): Ending clean mount [ 86.855294][ T22] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.408294][ T22] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 87.419529][ T22] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 10 [ 87.431642][ T22] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 87.441834][ T22] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 87.455032][ T22] usb 5-1: New USB device found, idVendor=0644, idProduct=800e, bcdDevice= 1.40 [ 87.476560][ T22] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.495020][ T4674] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 87.571203][ T4693] input: syz1 as /devices/virtual/input/input5 [ 87.652347][ T4274] XFS (loop1): Unmounting Filesystem [ 87.747533][ T51] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.829235][ T22] usb 5-1: string descriptor 0 read error: -71 [ 87.845093][ T22] usb 5-1: MIDIStreaming interface descriptor not found [ 87.887658][ T51] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.946735][ T22] usb 5-1: USB disconnect, device number 3 [ 88.071465][ T51] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.130540][ T4703] loop0: detected capacity change from 0 to 512 [ 88.186364][ T51] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.217492][ T4703] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 88.224154][ T4697] udevd[4697]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 88.535367][ T4275] EXT4-fs (loop0): unmounting filesystem. [ 88.889390][ T4711] udevd[4711]: incorrect ext4 checksum on /dev/sda1 [ 88.960008][ T4726] loop1: detected capacity change from 0 to 16 [ 89.066426][ T4726] erofs: (device loop1): mounted with root inode @ nid 36. [ 89.164731][ T4292] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 89.174445][ T4292] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 89.182716][ T4292] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 89.192628][ T4292] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 89.206951][ T4282] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 89.221965][ T4282] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 89.610105][ T4750] FAULT_INJECTION: forcing a failure. [ 89.610105][ T4750] name fail_futex, interval 1, probability 0, space 0, times 1 [ 89.666064][ T4750] CPU: 0 PID: 4750 Comm: syz.2.117 Not tainted syzkaller #0 [ 89.673419][ T4750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 89.683528][ T4750] Call Trace: [ 89.686822][ T4750] [ 89.689766][ T4750] dump_stack_lvl+0x188/0x24e [ 89.694482][ T4750] ? show_regs_print_info+0x12/0x12 [ 89.699702][ T4750] ? load_image+0x410/0x410 [ 89.704235][ T4750] ? finish_task_switch+0x262/0x8e0 [ 89.709464][ T4750] ? lockdep_hardirqs_on+0x94/0x140 [ 89.714692][ T4750] should_fail_ex+0x390/0x4c0 [ 89.719402][ T4750] get_futex_key+0x1b1/0x1000 [ 89.724109][ T4750] ? futex_setup_timer+0xc0/0xc0 [ 89.729074][ T4750] futex_wait_requeue_pi+0x2bf/0x9c0 [ 89.734382][ T4750] ? futex_requeue_pi_complete+0x210/0x210 [ 89.740224][ T4750] ? futex_wait+0x4a3/0x5c0 [ 89.744768][ T4750] ? futex_wait_setup+0x270/0x270 [ 89.749833][ T4750] ? file_end_write+0x156/0x250 [ 89.754714][ T4750] ? vfs_write+0x777/0x9a0 [ 89.759159][ T4750] do_futex+0x165/0x320 [ 89.763331][ T4750] ? file_end_write+0x250/0x250 [ 89.768215][ T4750] ? __ia32_sys_get_robust_list+0x100/0x100 [ 89.774143][ T4750] __se_sys_futex+0x381/0x410 [ 89.778843][ T4750] ? __x64_sys_futex+0xf0/0xf0 [ 89.783635][ T4750] ? __x64_sys_futex+0x1d/0xf0 [ 89.788420][ T4750] do_syscall_64+0x4c/0xa0 [ 89.792853][ T4750] ? clear_bhb_loop+0x60/0xb0 [ 89.797558][ T4750] ? clear_bhb_loop+0x60/0xb0 [ 89.802259][ T4750] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 89.808188][ T4750] RIP: 0033:0x7f0dd0f9e159 [ 89.812632][ T4750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.832251][ T4750] RSP: 002b:00007f0dd1e7d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 89.840693][ T4750] RAX: ffffffffffffffda RBX: 00007f0dd1225fa0 RCX: 00007f0dd0f9e159 [ 89.848687][ T4750] RDX: 0000000000000004 RSI: 000000000000010b RDI: 000020000000cffc [ 89.856674][ T4750] RBP: 00007f0dd103506b R08: 0000000000000000 R09: 0000000000000000 [ 89.864661][ T4750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.868546][ T4757] loop0: detected capacity change from 0 to 512 [ 89.872637][ T4750] R13: 00007f0dd1226038 R14: 00007f0dd1225fa0 R15: 00007fff49ed1d18 [ 89.872673][ T4750] [ 90.108668][ T4757] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 90.128696][ T4734] chnl_net:caif_netlink_parms(): no params data found [ 90.356226][ T4757] loop0: detected capacity change from 512 to 0 [ 90.400031][ T4757] syz.0.119: attempt to access beyond end of device [ 90.400031][ T4757] loop0: rw=524288, sector=272, nr_sectors = 8 limit=0 [ 90.430511][ T4757] syz.0.119: attempt to access beyond end of device [ 90.430511][ T4757] loop0: rw=524288, sector=288, nr_sectors = 8 limit=0 [ 90.518046][ T4757] syz.0.119: attempt to access beyond end of device [ 90.518046][ T4757] loop0: rw=12288, sector=280, nr_sectors = 8 limit=0 [ 90.545193][ T4757] EXT4-fs error (device loop0): ext4_get_inode_loc:4658: inode #15: block 35: comm syz.0.119: unable to read itable block [ 90.568969][ T4757] syz.0.119: attempt to access beyond end of device [ 90.568969][ T4757] loop0: rw=145409, sector=0, nr_sectors = 8 limit=0 [ 90.584193][ T4757] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 90.592675][ T4757] EXT4-fs (loop0): I/O error while writing superblock [ 90.615324][ T4757] EXT4-fs error (device loop0): ext4_get_max_inline_size:116: inode #15: comm syz.0.119: can't get inode location 15 [ 90.917697][ T4757] syz.0.119: attempt to access beyond end of device [ 90.917697][ T4757] loop0: rw=145409, sector=0, nr_sectors = 8 limit=0 [ 91.063835][ T4757] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 91.152546][ T4757] EXT4-fs (loop0): I/O error while writing superblock [ 91.200064][ T4757] syz.0.119: attempt to access beyond end of device [ 91.200064][ T4757] loop0: rw=524288, sector=272, nr_sectors = 8 limit=0 [ 91.225408][ T4779] loop4: detected capacity change from 0 to 2048 [ 91.242580][ T4734] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.260364][ T4292] Bluetooth: hci4: command 0x0409 tx timeout [ 91.289582][ T4757] syz.0.119: attempt to access beyond end of device [ 91.289582][ T4757] loop0: rw=524288, sector=288, nr_sectors = 8 limit=0 [ 91.316220][ T4734] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.351449][ T4734] device bridge_slave_0 entered promiscuous mode [ 91.384980][ T4779] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 91.398745][ T4757] syz.0.119: attempt to access beyond end of device [ 91.398745][ T4757] loop0: rw=12288, sector=280, nr_sectors = 8 limit=0 [ 91.423500][ T4734] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.464177][ T4734] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.487916][ T4757] EXT4-fs error (device loop0): ext4_get_inode_loc:4658: inode #15: block 35: comm syz.0.119: unable to read itable block [ 91.509867][ T4734] device bridge_slave_1 entered promiscuous mode [ 91.567161][ T4757] syz.0.119: attempt to access beyond end of device [ 91.567161][ T4757] loop0: rw=145409, sector=0, nr_sectors = 8 limit=0 [ 91.684157][ T4734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.709432][ T4757] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 91.764339][ T4757] EXT4-fs (loop0): I/O error while writing superblock [ 91.826326][ T4734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.949426][ T4275] syz-executor: attempt to access beyond end of device [ 91.949426][ T4275] loop0: rw=12288, sector=24, nr_sectors = 8 limit=0 [ 92.026143][ T4734] team0: Port device team_slave_0 added [ 92.073778][ T4734] team0: Port device team_slave_1 added [ 92.237890][ T26] audit: type=1800 audit(1790181898.370:6): pid=4784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.123" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 92.277941][ T4275] EXT4-fs error (device loop0): ext4_get_inode_loc:4658: inode #15: block 35: comm syz-executor: unable to read itable block [ 92.312368][ T4734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.319368][ T4734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.323432][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.374965][ T4734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.399290][ T4734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.407080][ T4734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.433982][ T4734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.445919][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 92.491457][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.499426][ T4275] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: IO failure [ 92.525070][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.570410][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.587393][ T4275] EXT4-fs error (device loop0): ext4_dirty_inode:6166: inode #15: comm syz-executor: mark_inode_dirty error [ 92.602044][ T4734] device hsr_slave_0 entered promiscuous mode [ 92.611403][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.625404][ T4282] Bluetooth: hci5: command 0x1003 tx timeout [ 92.626051][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.633147][ T4289] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 92.649678][ T4275] EXT4-fs error (device loop0): ext4_get_inode_loc:4658: inode #2: block 34: comm syz-executor: unable to read itable block [ 92.672193][ T4734] device hsr_slave_1 entered promiscuous mode [ 92.688930][ T4734] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.697889][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.707417][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.715553][ T4275] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: IO failure [ 92.724381][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.737915][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.744783][ T4275] EXT4-fs error (device loop0): ext4_dirty_inode:6166: inode #2: comm syz-executor: mark_inode_dirty error [ 92.745069][ T4734] Cannot create hsr debugfs directory [ 92.756407][ T4275] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.756429][ T4275] EXT4-fs (loop0): I/O error while writing superblock [ 92.778793][ T4691] EXT4-fs error (device loop0): __ext4_get_inode_loc_noinmem:4643: inode #15: block 35: comm kworker/u4:15: unable to read itable block [ 92.822863][ T4691] Buffer I/O error on dev loop0, logical block 0, lost sync page write [ 92.974037][ T127] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 93.145393][ T51] device hsr_slave_0 left promiscuous mode [ 93.166384][ T51] device hsr_slave_1 left promiscuous mode [ 93.180336][ T127] usb 5-1: Using ep0 maxpacket: 32 [ 93.187053][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.189975][ T127] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 93.206663][ T51] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.226242][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.234748][ T127] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 93.242755][ T51] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.259707][ T127] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 93.277393][ T51] device bridge_slave_1 left promiscuous mode [ 93.281505][ T127] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 93.286423][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.302861][ T127] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.325314][ T51] device bridge_slave_0 left promiscuous mode [ 93.330344][ T127] usb 5-1: Product: syz [ 93.339376][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.340823][ T127] usb 5-1: Manufacturer: syz [ 93.348492][ T4289] Bluetooth: hci4: command 0x041b tx timeout [ 93.368904][ T127] usb 5-1: SerialNumber: syz [ 93.405790][ T127] usb 5-1: config 0 descriptor?? [ 93.468104][ T127] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input6 [ 93.506506][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.518937][ T51] device veth1_macvtap left promiscuous mode [ 93.530752][ T51] device veth0_macvtap left promiscuous mode [ 93.548559][ T51] device veth1_vlan left promiscuous mode [ 93.556764][ T51] device veth0_vlan left promiscuous mode [ 93.566685][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.590152][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.609120][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.642051][ T4711] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.680579][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.714115][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.755070][ T3625] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 93.939067][ T4811] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 94.007645][ T4282] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 94.017430][ T4282] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 94.026217][ T4282] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 94.034571][ T4282] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 94.042258][ T4282] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 94.060714][ T4282] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 94.397617][ T51] team0 (unregistering): Port device team_slave_1 removed [ 94.439351][ T51] team0 (unregistering): Port device team_slave_0 removed [ 94.483450][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.522208][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.854791][ T51] bond0 (unregistering): Released all slaves [ 94.951369][ T4810] tap0: tun_chr_ioctl cmd 1074025677 [ 94.956881][ T4810] tap0: linktype set to 1 [ 94.992625][ T4819] device syzkaller0 entered promiscuous mode [ 95.077702][ T127] usb 5-1: USB disconnect, device number 4 [ 95.420618][ T4282] Bluetooth: hci4: command 0x040f tx timeout [ 96.146159][ T4282] Bluetooth: hci2: command 0x0409 tx timeout [ 96.644329][ T4839] TC_ACT_REPEAT abuse ? [ 96.853133][ T4842] device syzkaller0 entered promiscuous mode [ 97.050164][ T4812] chnl_net:caif_netlink_parms(): no params data found [ 97.078188][ T4734] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 97.137268][ T4734] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 97.181481][ T4734] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 97.214084][ T4734] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 97.345902][ T51] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.347923][ T4869] loop2: detected capacity change from 0 to 512 [ 97.377767][ T4866] device syzkaller0 entered promiscuous mode [ 97.401237][ T4812] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.448293][ T4812] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.459346][ T4869] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 97.480112][ T4812] device bridge_slave_0 entered promiscuous mode [ 97.500151][ T4869] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.140: invalid indirect mapped block 256 (level 1) [ 97.516194][ T4282] Bluetooth: hci4: command 0x0419 tx timeout [ 97.518900][ T4812] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.537939][ T4812] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.547632][ T4812] device bridge_slave_1 entered promiscuous mode [ 97.567535][ T4869] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.140: invalid indirect mapped block 2683928664 (level 1) [ 97.591874][ T4869] EXT4-fs (loop2): 1 truncate cleaned up [ 97.598919][ T4869] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 97.745255][ T4812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.764022][ T4812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.828407][ T51] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.931970][ T4875] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:477: comm syz.2.140: Invalid block bitmap block 3 in block_group 0 [ 98.225879][ T4282] Bluetooth: hci2: command 0x041b tx timeout [ 98.253183][ T4812] team0: Port device team_slave_0 added [ 98.288267][ T4812] team0: Port device team_slave_1 added [ 98.379404][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 98.384643][ T4812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.392157][ T4812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.419672][ T4812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.451644][ T51] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.479228][ T4812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.487139][ T4812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.513379][ T4812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.567445][ T51] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.588539][ T4734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.635849][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 98.666469][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 98.674112][ T7] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 98.684572][ T4881] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 98.732991][ T4812] device hsr_slave_0 entered promiscuous mode [ 98.750177][ T4812] device hsr_slave_1 entered promiscuous mode [ 98.772838][ T4812] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 98.802334][ T4812] Cannot create hsr debugfs directory [ 98.811425][ T4734] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.872478][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.895962][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.922169][ T7] usb 2-1: Using ep0 maxpacket: 8 [ 98.932392][ T7] usb 2-1: config 0 has no interfaces? [ 98.949466][ T7] usb 2-1: New USB device found, idVendor=0644, idProduct=8020, bcdDevice= 0.40 [ 98.959091][ T4448] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.966227][ T4448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.974995][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.983364][ T7] usb 2-1: Product: syz [ 98.987539][ T7] usb 2-1: Manufacturer: syz [ 98.996862][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 99.005817][ T7] usb 2-1: SerialNumber: syz [ 99.014590][ T7] usb 2-1: config 0 descriptor?? [ 99.077514][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.089515][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 99.118340][ T4448] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.121973][ T4898] loop2: detected capacity change from 0 to 512 [ 99.125511][ T4448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.152835][ T4898] EXT4-fs: Ignoring removed nomblk_io_submit option [ 99.209925][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 99.239440][ T4898] EXT4-fs (loop2): 1 orphan inode deleted [ 99.246307][ T4431] usb 2-1: USB disconnect, device number 3 [ 99.259082][ T4898] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 99.273159][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 99.338836][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 99.353138][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 99.387702][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 99.399631][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.446921][ T4904] netlink: 'syz.2.146': attribute type 8 has an invalid length. [ 99.464134][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 99.488922][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 99.513297][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 99.535315][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 99.546891][ T4415] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 99.562050][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 99.597512][ T4734] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 100.007392][ T4812] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 100.053572][ T4812] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 100.148525][ T4812] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 100.186043][ T4812] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 100.294457][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.308721][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.310604][ T4282] Bluetooth: hci2: command 0x040f tx timeout [ 100.605811][ T4734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.794723][ T4812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.876090][ T4691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 100.897487][ T4691] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.983047][ T4812] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.563197][ T4812] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 101.636756][ T4812] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 102.380946][ T4282] Bluetooth: hci2: command 0x0419 tx timeout [ 102.431938][ T4964] binder: 4963:4964 unknown command 0 [ 102.437393][ T4964] binder: 4963:4964 ioctl c0306201 200000000980 returned -22 [ 102.486596][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 102.497966][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 102.529035][ T4336] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.536238][ T4336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.567959][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 102.595271][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 102.617587][ T4336] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.624774][ T4336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.643003][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 102.653419][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 102.830759][ T4319] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 102.912536][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 103.132835][ T4319] usb 3-1: New USB device found, idVendor=06a5, idProduct=d001, bcdDevice= 1.00 [ 103.153356][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 103.190288][ T4319] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.209293][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 103.238175][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 103.269520][ T4319] gspca_main: nw80x-2.14.0 probing 06a5:d001 [ 103.285658][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 103.327053][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 103.356657][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 103.384761][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.432766][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 103.458640][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 103.488110][ T4336] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 103.805235][ T4319] gspca_nw80x: reg_w err -110 [ 103.810115][ T4319] gspca_nw80x: Bad webcam type 6 for NW801 [ 103.968940][ T4959] batman_adv: batadv0: Adding interface: dummy0 [ 103.975363][ T4959] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.001521][ T4959] batman_adv: batadv0: Interface activated: dummy0 [ 104.021526][ T4962] batadv0: mtu less than device minimum [ 104.028936][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.041492][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.053659][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.065778][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.077968][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.090020][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.102130][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.114263][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.126363][ T4962] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 104.506007][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 104.530690][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 104.552316][ T3600] usb 3-1: USB disconnect, device number 2 [ 104.570373][ T4319] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 104.679466][ T4812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.705845][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.729342][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.771847][ T4319] usb 2-1: config 0 has no interfaces? [ 104.777379][ T4319] usb 2-1: New USB device found, idVendor=0424, idProduct=274e, bcdDevice= 1.00 [ 104.797595][ T4319] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.819381][ T4319] usb 2-1: config 0 descriptor?? [ 105.303846][ T4347] usb 2-1: USB disconnect, device number 4 [ 106.790294][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 108.376913][ T51] device hsr_slave_0 left promiscuous mode [ 108.410452][ T51] device hsr_slave_1 left promiscuous mode [ 108.437773][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.451878][ T51] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 108.462588][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.470415][ T51] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.479851][ T51] device bridge_slave_1 left promiscuous mode [ 108.486926][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.495755][ T51] device bridge_slave_0 left promiscuous mode [ 108.502344][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.527512][ T51] device veth1_macvtap left promiscuous mode [ 108.533745][ T51] device veth0_macvtap left promiscuous mode [ 108.539781][ T51] device veth1_vlan left promiscuous mode [ 108.548773][ T51] device veth0_vlan left promiscuous mode [ 109.157164][ T51] team0 (unregistering): Port device team_slave_1 removed [ 109.198066][ T51] team0 (unregistering): Port device team_slave_0 removed [ 109.234559][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.275090][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 109.498322][ T51] bond0 (unregistering): Released all slaves [ 109.718146][ T4734] device veth0_vlan entered promiscuous mode [ 109.746480][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 109.755938][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 109.822311][ T4734] device veth1_vlan entered promiscuous mode [ 109.830820][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 109.845393][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 109.868942][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 109.992129][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 110.008381][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 110.029059][ T5066] FAULT_INJECTION: forcing a failure. [ 110.029059][ T5066] name failslab, interval 1, probability 0, space 0, times 1 [ 110.052471][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 110.069200][ T5066] CPU: 0 PID: 5066 Comm: syz.4.171 Not tainted syzkaller #0 [ 110.076532][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 110.082380][ T4734] device veth0_macvtap entered promiscuous mode [ 110.086581][ T5066] Call Trace: [ 110.096116][ T5066] [ 110.099078][ T5066] dump_stack_lvl+0x188/0x24e [ 110.103780][ T5066] ? show_regs_print_info+0x12/0x12 [ 110.108577][ T4734] device veth1_macvtap entered promiscuous mode [ 110.108980][ T5066] ? load_image+0x410/0x410 [ 110.119725][ T5066] ? __might_sleep+0xd0/0xd0 [ 110.124330][ T5066] ? __lock_acquire+0x7c40/0x7c40 [ 110.130074][ T5066] ? _raw_spin_lock_irq+0xb7/0xf0 [ 110.135733][ T5066] ? _raw_spin_lock_irqsave+0x100/0x100 [ 110.140213][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.141285][ T5066] should_fail_ex+0x390/0x4c0 [ 110.141318][ T5066] should_failslab+0x5/0x20 [ 110.158769][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.160947][ T5066] slab_pre_alloc_hook+0x59/0x300 [ 110.160980][ T5066] kmem_cache_alloc+0x56/0x2f0 [ 110.160995][ T5066] ? fanotify_add_mark+0x411/0xd30 [ 110.161018][ T5066] fanotify_add_mark+0x411/0xd30 [ 110.161044][ T5066] do_fanotify_mark+0xc99/0xda0 [ 110.161071][ T5066] ? copy_fid_info_to_user+0x780/0x780 [ 110.201007][ T5066] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 110.206994][ T5066] ? lock_chain_count+0x20/0x20 [ 110.211843][ T5066] __x64_sys_fanotify_mark+0xb1/0xc0 [ 110.217131][ T5066] do_syscall_64+0x4c/0xa0 [ 110.221545][ T5066] ? clear_bhb_loop+0x60/0xb0 [ 110.226219][ T5066] ? clear_bhb_loop+0x60/0xb0 [ 110.230898][ T5066] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.236789][ T5066] RIP: 0033:0x7fcf0259e159 [ 110.241203][ T5066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.260823][ T5066] RSP: 002b:00007fcf0338a028 EFLAGS: 00000246 ORIG_RAX: 000000000000012d [ 110.269236][ T5066] RAX: ffffffffffffffda RBX: 00007fcf02826090 RCX: 00007fcf0259e159 [ 110.277202][ T5066] RDX: 0000000048001028 RSI: 0000000000000001 RDI: 0000000000000004 [ 110.285165][ T5066] RBP: 00007fcf0263506b R08: 0000000000000000 R09: 0000000000000000 [ 110.293125][ T5066] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 110.301085][ T5066] R13: 00007fcf02826128 R14: 00007fcf02826090 R15: 00007ffd213572a8 [ 110.309058][ T5066] [ 110.347262][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.360821][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.372284][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.382947][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.402099][ T4734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.423578][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.454857][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.490268][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.525930][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.550636][ T4734] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.569816][ T4734] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.591820][ T4734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.610642][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 110.627155][ T5070] x86/PAT: syz.2.173:5070 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 110.665724][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 110.696228][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 110.716488][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 110.746239][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 110.763706][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 110.795858][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 110.812824][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 110.842642][ T4734] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.871489][ T4734] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.899065][ T4734] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.919465][ T4734] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.995526][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 111.041372][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 111.065275][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 111.082145][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 111.109260][ T4812] device veth0_vlan entered promiscuous mode [ 111.170211][ T4812] device veth1_vlan entered promiscuous mode [ 111.307400][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.335751][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.374348][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 111.399755][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 111.434809][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 111.475400][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 111.493001][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 111.550953][ T4812] device veth0_macvtap entered promiscuous mode [ 111.591780][ T4422] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.602111][ T4812] device veth1_macvtap entered promiscuous mode [ 111.610030][ T4422] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.642251][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 111.650969][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 111.670897][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 111.706704][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.733900][ T5098] loop1: detected capacity change from 0 to 256 [ 111.750420][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.774464][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.804255][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.842073][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.876070][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.910493][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.933215][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.957043][ T4812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.978138][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 112.010886][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 112.036483][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.068351][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.098710][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.120469][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.142501][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.177038][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.192249][ T5104] loop4: detected capacity change from 0 to 512 [ 112.198589][ T4812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 112.209762][ T4812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.235640][ T5104] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 112.263262][ T4812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.310909][ T5104] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 112.329105][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 112.358661][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 112.390343][ T5104] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm syz.4.181: bg 0: block 104: invalid block bitmap [ 112.428839][ T4812] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.442565][ T5104] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 112.461846][ T4812] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.488264][ T5104] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.181: invalid indirect mapped block 1 (level 1) [ 112.516532][ T4812] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.559057][ T5104] EXT4-fs (loop4): 1 truncate cleaned up [ 112.560458][ T4812] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.577213][ T5104] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 112.757011][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.780503][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.811325][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 112.857612][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.878593][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.937135][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 113.289032][ T5131] loop5: detected capacity change from 0 to 2048 [ 113.416223][ T5131] loop5: p1 p3 < > p4 < p5 > [ 113.449872][ T5131] loop5: partition table partially beyond EOD, truncated [ 113.481077][ T5131] loop5: p1 size 196608 extends beyond EOD, truncated [ 113.509398][ T5131] loop5: p3 start 614273 is beyond EOD, truncated [ 113.526964][ T5131] loop5: p5 size 196608 extends beyond EOD, truncated [ 113.560404][ T3640] loop5: p1 p3 < > p4 < p5 > [ 113.565128][ T3640] loop5: partition table partially beyond EOD, truncated [ 113.611615][ T3640] loop5: p1 size 196608 extends beyond EOD, truncated [ 113.637446][ T3640] loop5: p3 start 614273 is beyond EOD, truncated [ 113.644448][ T32] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 113.673619][ T3640] loop5: p5 size 196608 extends beyond EOD, truncated [ 113.757141][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 113.774829][ T4263] udevd[4263]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 113.787771][ T4711] udevd[4711]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 113.787997][ T4697] udevd[4697]: inotify_add_watch(7, /dev/loop5p5, 10) failed: No such file or directory [ 113.833932][ T32] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 113.853344][ T32] usb 2-1: config 0 has no interface number 0 [ 113.878774][ T32] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 113.905197][ T4711] udevd[4711]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 113.906122][ T4697] udevd[4697]: inotify_add_watch(7, /dev/loop5p5, 10) failed: No such file or directory [ 113.922422][ T4263] udevd[4263]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 113.986634][ T32] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 114.216889][ T26] audit: type=1800 audit(1790181920.350:7): pid=5150 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.186" name="protocol" dev="configfs" ino=39390 res=0 errno=0 [ 114.277385][ T5147] loop4: detected capacity change from 0 to 32768 [ 114.288054][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.298815][ T5147] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 114.307297][ T5147] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 114.320841][ T32] usb 2-1: Product: syz [ 114.331331][ T32] usb 2-1: Manufacturer: syz [ 114.338558][ T32] usb 2-1: SerialNumber: syz [ 114.344581][ T5147] gfs2: fsid=syz:syz.0: journal 0 mapped with 9 extents in 0ms [ 114.354295][ T32] usb 2-1: config 0 descriptor?? [ 114.373079][ T32] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 114.383543][ T32] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 114.390920][ T32] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 114.399000][ T26] audit: type=1800 audit(1790181920.460:8): pid=5150 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.186" name="local" dev="configfs" ino=39392 res=0 errno=0 [ 114.515127][ T5154] netlink: 4 bytes leftover after parsing attributes in process `syz.6.187'. [ 114.531738][ T32] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 140ms [ 114.691386][ T32] gfs2: fsid=syz:syz.0: jid=0: Done [ 114.848237][ T5147] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 114.867218][ T5147] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 114.867218][ T5147] inode = 0 2340 [ 114.867218][ T5147] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 409 [ 114.885872][ T5147] gfs2: fsid=syz:syz.0: G: s:SH n:2/924 f:qobnN t:SH d:EX/0 a:0 v:0 r:3 m:20 p:1 [ 114.895134][ T5147] gfs2: fsid=syz:syz.0: H: s:SH f:AH e:0 p:5147 [syz.4.185] inode_permission+0x239/0x480 [ 114.905350][ T5147] gfs2: fsid=syz:syz.0: I: n:0/2340 t:4 f:0x00 d:0x00000000 s:0 p:0 [ 114.913482][ T5147] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 114.921014][ T5147] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 114.929786][ T5147] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 114.936497][ T5147] gfs2: fsid=syz:syz.0: File system withdrawn [ 114.942787][ T5147] CPU: 1 PID: 5147 Comm: syz.4.185 Not tainted syzkaller #0 [ 114.950056][ T5147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 114.960114][ T5147] Call Trace: [ 114.963379][ T5147] [ 114.966295][ T5147] dump_stack_lvl+0x188/0x24e [ 114.970962][ T5147] ? show_regs_print_info+0x12/0x12 [ 114.976167][ T5147] ? load_image+0x410/0x410 [ 114.980664][ T5147] ? kobject_uevent_env+0x364/0x890 [ 114.985853][ T5147] gfs2_withdraw+0xc69/0x1450 [ 114.990523][ T5147] ? gfs2_lm+0x240/0x240 [ 114.994754][ T5147] ? gfs2_consist_inode_i+0xf1/0x110 [ 115.000096][ T5147] gfs2_inode_refresh+0xb2d/0x1190 [ 115.005221][ T5147] ? gfs2_inode_metasync+0xf0/0xf0 [ 115.010319][ T5147] ? gfs2_glock_nq+0xcee/0x14d0 [ 115.015160][ T5147] gfs2_instantiate+0x15e/0x210 [ 115.020004][ T5147] gfs2_glock_wait+0x1d0/0x2a0 [ 115.024755][ T5147] gfs2_permission+0x2e1/0x4e0 [ 115.029502][ T5147] ? gfs2_lookupi+0x660/0x660 [ 115.034161][ T5147] ? inode_permission+0x239/0x480 [ 115.039171][ T5147] ? do_raw_spin_unlock+0x11d/0x230 [ 115.044359][ T5147] ? gfs2_lookupi+0x660/0x660 [ 115.049015][ T5147] inode_permission+0x239/0x480 [ 115.053852][ T5147] may_open+0x262/0x400 [ 115.057994][ T5147] path_openat+0x251a/0x2f10 [ 115.062573][ T5147] ? verify_lock_unused+0x140/0x140 [ 115.067755][ T5147] ? do_sys_openat2+0xdd/0x4f0 [ 115.072507][ T5147] ? do_filp_open+0x420/0x420 [ 115.077173][ T5147] do_filp_open+0x1ee/0x420 [ 115.081668][ T5147] ? vfs_tmpfile+0x470/0x470 [ 115.086270][ T5147] ? _raw_spin_unlock+0x24/0x40 [ 115.091108][ T5147] ? alloc_fd+0x590/0x640 [ 115.095426][ T5147] do_sys_openat2+0x14b/0x4f0 [ 115.100098][ T5147] ? __kmem_cache_free+0xb6/0x200 [ 115.105113][ T5147] ? do_sys_open+0xe0/0xe0 [ 115.109518][ T5147] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 115.115484][ T5147] ? lock_chain_count+0x20/0x20 [ 115.120338][ T5147] __x64_sys_openat+0x135/0x160 [ 115.125188][ T5147] do_syscall_64+0x4c/0xa0 [ 115.129586][ T5147] ? clear_bhb_loop+0x60/0xb0 [ 115.134299][ T5147] ? clear_bhb_loop+0x60/0xb0 [ 115.138968][ T5147] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.144876][ T5147] RIP: 0033:0x7fcf0255e98e [ 115.149278][ T5147] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.168875][ T5147] RSP: 002b:00007fcf033aada8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 115.177286][ T5147] RAX: ffffffffffffffda RBX: 00007fcf033ab6c0 RCX: 00007fcf0255e98e [ 115.185237][ T5147] RDX: 0000000000010000 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 115.193192][ T5147] RBP: 0000200000000040 R08: 0000000000000000 R09: 0000000000000000 [ 115.201149][ T5147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000240 [ 115.209110][ T5147] R13: 00007fcf033aaea0 R14: 00000000000125b6 R15: 0000200000000000 [ 115.217079][ T5147] [ 115.798327][ T5159] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 116.465975][ T4263] udevd[4263]: incorrect ext4 checksum on /dev/sda1 [ 116.613911][ T5172] loop6: detected capacity change from 0 to 512 [ 116.621541][ C1] usb 2-1: yurex_control_callback - control failed: -2 [ 116.707710][ T5156] loop5: detected capacity change from 0 to 32768 [ 116.708657][ T5172] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 116.758150][ T4347] usb 2-1: USB disconnect, device number 5 [ 116.773441][ T4347] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 116.833537][ T5172] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 116.875318][ T5180] loop1: detected capacity change from 0 to 16 [ 116.914260][ T5180] erofs: (device loop1): mounted with root inode @ nid 36. [ 117.010593][ T4282] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[9000] [ 117.037769][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.050033][ T26] audit: type=1800 audit(1790181923.180:9): pid=5180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.194" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 117.069759][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.090026][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.144881][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.185594][ T5187] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.199119][ T5156] ERROR: (device loop5): jfs_readdir: JFS:Dtree error: ino = 2, bn=48, index = 8 [ 117.199119][ T5156] [ 117.266845][ T5187] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.285725][ T5156] ERROR: (device loop5): remounting filesystem as read-only [ 117.297890][ T4812] EXT4-fs (loop6): unmounting filesystem. [ 117.343963][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.416821][ T5187] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.496045][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.603640][ T5180] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.645064][ T5187] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 117.703097][ T5180] syz.1.194 (5180) used greatest stack depth: 20576 bytes left [ 118.373821][ T5211] loop1: detected capacity change from 0 to 512 [ 118.458792][ T5213] device lo entered promiscuous mode [ 118.530130][ T5211] EXT4-fs error (device loop1): __ext4_fill_super:5465: inode #2: comm syz.1.202: iget: bogus i_mode (4000) [ 118.548351][ T4711] udevd[4711]: incorrect ext4 checksum on /dev/sda1 [ 118.612008][ T5211] EXT4-fs (loop1): get root inode failed [ 118.630409][ T5211] EXT4-fs (loop1): mount failed [ 118.639005][ T5213] device tunl0 entered promiscuous mode [ 118.680706][ T5213] device gre0 entered promiscuous mode [ 118.896263][ T5213] device gretap0 entered promiscuous mode [ 118.967282][ T5213] device erspan0 entered promiscuous mode [ 119.616149][ T5213] device ip_vti0 entered promiscuous mode [ 119.641737][ T5213] device ip6_vti0 entered promiscuous mode [ 119.727217][ T5213] device sit0 entered promiscuous mode [ 119.855750][ T5244] binder_alloc: 5243: pid 5243 spamming oneway? 2 buffers allocated for a total size of 5120 [ 119.868426][ T5213] device ip6tnl0 entered promiscuous mode [ 119.954625][ T5213] device ip6gre0 entered promiscuous mode [ 119.999514][ T5213] device syz_tun entered promiscuous mode [ 120.066269][ T5213] device ip6gretap0 entered promiscuous mode [ 120.097298][ T5213] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.106004][ T5213] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.120989][ T5213] device bridge0 entered promiscuous mode [ 120.171857][ T5213] device vcan0 entered promiscuous mode [ 120.204912][ T5213] device bond0 entered promiscuous mode [ 120.230316][ T5213] device bond_slave_0 entered promiscuous mode [ 120.247710][ T5213] device bond_slave_1 entered promiscuous mode [ 120.309589][ T5213] device team0 entered promiscuous mode [ 120.315573][ T5213] device team_slave_1 entered promiscuous mode [ 120.341218][ T5213] batman_adv: batadv0: Interface deactivated: dummy0 [ 120.364674][ T5213] device dummy0 entered promiscuous mode [ 120.390607][ T5213] device nlmon0 entered promiscuous mode [ 120.414277][ T5213] device caif0 entered promiscuous mode [ 120.435217][ T5213] device batadv0 entered promiscuous mode [ 120.491270][ T5213] device vxcan0 entered promiscuous mode [ 120.507746][ T5213] device vxcan1 entered promiscuous mode [ 120.527997][ T5213] device veth0 entered promiscuous mode [ 120.557770][ T5213] device veth1 entered promiscuous mode [ 120.758388][ T5213] device wg0 entered promiscuous mode [ 121.028627][ T5213] device wg1 entered promiscuous mode [ 121.205510][ T5213] device wg2 entered promiscuous mode [ 121.365017][ T5213] device veth0_to_bridge entered promiscuous mode [ 121.662406][ T5213] device veth1_to_bridge entered promiscuous mode [ 121.702194][ T5213] device veth0_to_bond entered promiscuous mode [ 121.730780][ T5213] device veth1_to_bond entered promiscuous mode [ 121.762814][ T5213] device veth1_to_team entered promiscuous mode [ 121.809356][ T5213] device veth0_to_batadv entered promiscuous mode [ 121.825168][ T5213] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.847887][ T5213] device batadv_slave_0 entered promiscuous mode [ 121.873000][ T5213] device veth1_to_batadv entered promiscuous mode [ 121.887138][ T5213] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.907802][ T5213] device batadv_slave_1 entered promiscuous mode [ 121.937667][ T5213] device xfrm0 entered promiscuous mode [ 121.961909][ T5213] device veth0_to_hsr entered promiscuous mode [ 121.996330][ T5213] device veth1_to_hsr entered promiscuous mode [ 122.030706][ T5213] device hsr0 entered promiscuous mode [ 122.057206][ T5213] device veth1_virt_wifi entered promiscuous mode [ 122.086654][ T5213] device veth0_virt_wifi entered promiscuous mode [ 122.107512][ T5213] device virt_wifi0 entered promiscuous mode [ 122.217410][ T5213] device vlan0 entered promiscuous mode [ 122.230712][ T5213] device vlan1 entered promiscuous mode [ 122.243276][ T5213] device macvlan0 entered promiscuous mode [ 122.264771][ T5213] device macvlan1 entered promiscuous mode [ 122.294097][ T5213] device ipvlan0 entered promiscuous mode [ 122.299980][ T5213] device ipvlan1 entered promiscuous mode [ 122.376079][ T5213] device macvtap0 entered promiscuous mode [ 122.407614][ T5213] device macsec0 entered promiscuous mode [ 122.447305][ T5213] device geneve0 entered promiscuous mode [ 122.465775][ T5213] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.481510][ T5213] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.495323][ T5213] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.504641][ T5213] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.515980][ T5213] device geneve1 entered promiscuous mode [ 122.538872][ T5213] device netdevsim0 entered promiscuous mode [ 122.556075][ T5213] device netdevsim1 entered promiscuous mode [ 122.573167][ T5213] device netdevsim2 entered promiscuous mode [ 122.590157][ T5213] device netdevsim3 entered promiscuous mode [ 122.632556][ T5213] device wlan0 entered promiscuous mode [ 122.659098][ T5213] device wlan1 entered promiscuous mode [ 122.733361][ T5237] device syzkaller0 entered promiscuous mode [ 122.774170][ T5269] tipc: Started in network mode [ 122.779095][ T5269] tipc: Node identity 06c03e416681, cluster identity 4711 [ 122.801484][ T5269] tipc: Enabled bearer , priority 0 [ 122.810162][ T5271] tipc: Disabling bearer [ 123.170910][ T5281] loop5: detected capacity change from 0 to 512 [ 123.219514][ T5281] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 123.375947][ T5281] EXT4-fs (loop5): 1 truncate cleaned up [ 123.387958][ T5281] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 123.475454][ T4734] EXT4-fs (loop5): unmounting filesystem. [ 126.287755][ T4289] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 126.315794][ T4289] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 126.324547][ T4289] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 126.345894][ T4289] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 126.363392][ T4289] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 126.371957][ T4289] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 127.150568][ T5307] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.158212][ T5307] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.161498][ T5307] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.196071][ T5307] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.460354][ T4289] Bluetooth: hci1: command 0x0409 tx timeout [ 128.499567][ T5348] fuse: Bad value for 'fd' [ 129.369750][ T5307] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.379703][ T5307] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.388948][ T5307] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.405405][ T5307] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.522679][ T5357] net_ratelimit: 10 callbacks suppressed [ 129.522693][ T5357] ip_tables: iptables: counters copy to user failed while replacing table [ 130.455542][ T5366] loop5: detected capacity change from 0 to 4096 [ 130.540756][ T4289] Bluetooth: hci1: command 0x041b tx timeout [ 130.664961][ T5378] loop6: detected capacity change from 0 to 256 [ 130.706439][ T5378] ======================================================= [ 130.706439][ T5378] WARNING: The mand mount option has been deprecated and [ 130.706439][ T5378] and is ignored by this kernel. Remove the mand [ 130.706439][ T5378] option from the mount to silence this warning. [ 130.706439][ T5378] ======================================================= [ 130.727222][ T4536] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.826923][ T5378] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 130.886043][ T5378] exFAT-fs (loop6): Medium has reported failures. Some data may be lost. [ 130.976125][ T5378] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 130.980498][ T5366] EXT4-fs: Ignoring removed orlov option [ 131.022996][ T5366] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 131.037944][ T4536] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.044040][ T5366] EXT4-fs (loop5): Test dummy encryption mode enabled [ 131.053759][ T5378] exFAT-fs (loop6): failed to load alloc-bitmap [ 131.070554][ T5378] exFAT-fs (loop6): failed to recognize exfat type [ 131.097140][ T5366] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 131.249273][ T4536] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.503268][ T5400] loop6: detected capacity change from 0 to 16 [ 131.503294][ T4536] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.537748][ T5400] erofs: (device loop6): mounted with root inode @ nid 36. [ 131.606135][ T4289] erofs: (device loop6): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[9000] [ 131.655068][ T5400] erofs: (device loop6): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 131.681803][ T5366] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 131.711425][ T26] audit: type=1800 audit(1790181937.850:10): pid=5400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.243" name="file2" dev="loop6" ino=89 res=0 errno=0 [ 131.748384][ T5324] chnl_net:caif_netlink_parms(): no params data found [ 131.829211][ T5407] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 132.621917][ T4289] Bluetooth: hci1: command 0x040f tx timeout [ 132.702817][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.709169][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.870267][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 132.890264][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.900259][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.910264][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.920257][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.930251][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.940257][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 132.950257][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 133.474374][ T5366] fscrypt (loop5): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 133.871419][ T5324] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.905668][ T5324] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.940836][ T5324] device bridge_slave_0 entered promiscuous mode [ 133.978363][ T4734] EXT4-fs (loop5): unmounting filesystem. [ 134.007516][ T5324] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.041348][ T5324] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.102048][ T5324] device bridge_slave_1 entered promiscuous mode [ 134.317345][ T5324] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 134.399415][ T5324] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 134.533067][ T5324] team0: Port device team_slave_0 added [ 134.602911][ T5324] team0: Port device team_slave_1 added [ 134.700561][ T4289] Bluetooth: hci1: command 0x0419 tx timeout [ 134.853289][ T5324] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 134.868112][ T5324] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.900661][ T5324] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 134.980493][ T5459] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 135.409525][ T5324] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 135.467636][ T5324] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.617374][ T5324] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 135.698811][ T5465] loop1: detected capacity change from 0 to 164 [ 135.806098][ T5463] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 135.896401][ T5324] device hsr_slave_0 entered promiscuous mode [ 136.027711][ T5324] device hsr_slave_1 entered promiscuous mode [ 136.255590][ T5475] rock: directory entry would overflow storage [ 136.262180][ T5475] rock: sig=0x4f50, size=4, remaining=3 [ 136.267785][ T5475] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 136.754295][ T5473] loop5: detected capacity change from 0 to 256 [ 136.802582][ T4711] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 137.056444][ T5488] loop6: detected capacity change from 0 to 512 [ 137.314237][ T5488] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 137.360921][ T5488] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 137.980631][ T3600] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 138.169740][ T5507] netlink: 4 bytes leftover after parsing attributes in process `syz.4.261'. [ 138.198752][ T4812] EXT4-fs (loop6): unmounting filesystem. [ 138.212616][ T3600] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 138.234586][ T3600] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.339949][ T4536] device hsr_slave_0 left promiscuous mode [ 138.374109][ T4536] device hsr_slave_1 left promiscuous mode [ 138.385617][ T4536] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 138.403510][ T4536] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 138.422159][ T4536] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 138.441007][ T4536] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 138.462963][ T4536] device bridge_slave_1 left promiscuous mode [ 138.469727][ T3600] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 138.469750][ T4536] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.518339][ T4536] device bridge_slave_0 left promiscuous mode [ 138.537554][ T4536] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.604651][ T4536] device veth1_macvtap left promiscuous mode [ 138.615413][ T4536] device veth0_macvtap left promiscuous mode [ 138.632119][ T4536] device veth1_vlan left promiscuous mode [ 138.650977][ T4536] device veth0_vlan left promiscuous mode [ 139.186983][ T3600] usb 2-1: USB disconnect, device number 6 [ 140.909189][ T5543] loop6: detected capacity change from 0 to 512 [ 141.026991][ T5543] EXT4-fs error (device loop6): __ext4_fill_super:5465: inode #2: comm syz.6.271: iget: bogus i_mode (4000) [ 141.060404][ T5543] EXT4-fs (loop6): get root inode failed [ 141.066165][ T5543] EXT4-fs (loop6): mount failed [ 142.441125][ T4536] team0 (unregistering): Port device team_slave_1 removed [ 142.525717][ T4536] team0 (unregistering): Port device team_slave_0 removed [ 142.620982][ T4536] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 142.800645][ T4536] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 143.834301][ T4536] bond0 (unregistering): Released all slaves [ 143.957380][ T5324] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 144.015096][ T5324] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 144.033381][ T5324] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 144.080834][ T5324] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 144.399109][ T5606] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (52285443328 ns). Using initial count to start timer. [ 144.892905][ T5618] bio_check_eod: 21 callbacks suppressed [ 144.892951][ T5618] syz.5.287: attempt to access beyond end of device [ 144.892951][ T5618] nbd5: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 144.912068][ T5618] gfs2: error 10 reading superblock [ 148.851549][ T5614] device sit1 entered promiscuous mode [ 148.890013][ T5626] netlink: 4 bytes leftover after parsing attributes in process `syz.5.291'. [ 149.947512][ T5633] sched: RT throttling activated [ 149.967115][ T5324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.490158][ T4418] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 150.499420][ T4418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 150.525905][ T5324] 8021q: adding VLAN 0 to HW filter on device team0 [ 150.560113][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 150.625834][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 150.654569][ T4975] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.661765][ T4975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.745883][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 151.624276][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 151.680910][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 151.689448][ T4975] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.696632][ T4975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.706568][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 151.718574][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 151.729775][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 151.739484][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 151.748624][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 151.801251][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 151.822162][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 151.877705][ T5324] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 151.912569][ T5324] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 151.944057][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 151.961066][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 151.985800][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 152.045261][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 152.101159][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 152.259443][ T5665] tipc: Enabling of bearer rejected, failed to enable media [ 153.640287][ T130] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 153.753978][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 153.769908][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 153.830304][ T130] usb 2-1: Using ep0 maxpacket: 8 [ 153.852672][ T130] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 153.959173][ T130] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.010594][ T5324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.342020][ T130] pvrusb2: Hardware description: Terratec Grabster AV400 [ 154.357677][ T130] pvrusb2: ********** [ 154.472193][ T130] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 154.482888][ T130] pvrusb2: Important functionality might not be entirely working. [ 154.490962][ T130] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 154.502617][ T130] pvrusb2: ********** [ 154.513207][ T2312] pvrusb2: Invalid write control endpoint [ 154.748556][ T5685] pvrusb2: Invalid write control endpoint [ 154.756985][ T5706] device syzkaller0 entered promiscuous mode [ 154.777969][ T130] usb 2-1: USB disconnect, device number 7 [ 154.786220][ T2312] pvrusb2: Invalid write control endpoint [ 154.803682][ T2312] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 154.856444][ T2312] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 154.870986][ T2312] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 154.890322][ T2312] pvrusb2: Device being rendered inoperable [ 154.920332][ T2312] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 154.927898][ T2312] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 154.969402][ T2312] pvrusb2: Attached sub-driver cx25840 [ 155.008406][ T2312] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 155.042002][ T2312] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 155.385935][ T5732] Bluetooth: MGMT ver 1.22 [ 155.442072][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 155.461184][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 155.521317][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 155.540810][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 155.571816][ T5324] device veth0_vlan entered promiscuous mode [ 155.591431][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 155.599847][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 155.625469][ T5324] device veth1_vlan entered promiscuous mode [ 155.700160][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 155.713442][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 155.754163][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 155.781079][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 155.819458][ T5324] device veth0_macvtap entered promiscuous mode [ 155.861543][ T5324] device veth1_macvtap entered promiscuous mode [ 155.890937][ T5324] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.930382][ T5324] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 155.960365][ T5324] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.980593][ T5324] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 156.002535][ T5324] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 156.038336][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 156.046847][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 156.059855][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 156.081291][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 156.122107][ T5324] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 156.145871][ T5324] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 156.160566][ T5324] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 156.180354][ T5324] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 156.202831][ T5324] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 156.219682][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 156.234125][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 157.405125][ T5324] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.424341][ T5324] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.454673][ T5324] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.474046][ T5324] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.658601][ T4975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.702073][ T4975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.724208][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 157.801701][ T4446] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.809565][ T4446] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.871403][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 159.291591][ T5787] fuse: Unknown parameter 'group_i' [ 159.328102][ T5789] device syzkaller0 entered promiscuous mode [ 163.569320][ T5833] loop6: detected capacity change from 0 to 8192 [ 163.576442][ T5849] loop7: detected capacity change from 0 to 16 [ 163.607982][ T5833] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 163.645794][ T5849] erofs: (device loop7): mounted with root inode @ nid 36. [ 163.650266][ T5833] REISERFS (device loop6): found reiserfs format "3.5" with non-standard journal [ 163.690408][ T5833] REISERFS (device loop6): using ordered data mode [ 163.696973][ T5833] reiserfs: using flush barriers [ 163.712119][ T5833] REISERFS (device loop6): journal params: device loop6, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 163.729122][ T5833] REISERFS (device loop6): checking transaction log (loop6) [ 163.760108][ T5833] REISERFS (device loop6): Using rupasov hash to sort names [ 163.769645][ T5833] REISERFS (device loop6): using 3.5.x disk format [ 163.796378][ T5833] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 163.969797][ T5833] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.090637][ T4431] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 164.157352][ T5833] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.322007][ T4431] usb 8-1: New USB device found, idVendor=1235, idProduct=8203, bcdDevice= 0.40 [ 164.340178][ T5833] REISERFS warning (device loop6): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2) [ 164.407277][ T4431] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.523261][ T4431] usb 8-1: Product: syz [ 164.560255][ T5833] REISERFS (device loop6): Created .reiserfs_priv - reserved for xattr storage. [ 164.590809][ T4431] usb 8-1: Manufacturer: syz [ 164.629854][ T4431] usb 8-1: SerialNumber: syz [ 164.917373][ T5862] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.930928][ T5862] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.942400][ T5862] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.967326][ T5862] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.979223][ T5862] REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP [ 164.990555][ T5862] REISERFS warning (device loop6): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2) [ 165.127161][ T4431] usb 8-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 165.163322][ T4431] usb 8-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8203); report any issues to g@b4.vu [ 165.219086][ T4431] usb 8-1: Error initialising Scarlett Gen 2 Mixer Driver: -22 [ 165.335505][ T4431] snd-usb-audio: probe of 8-1:1.0 failed with error -22 [ 165.425732][ T26] audit: type=1800 audit(1790181971.560:11): pid=5864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.341" name=08 dev="sda1" ino=2055 res=0 errno=0 [ 165.504365][ T4431] usb 8-1: USB disconnect, device number 2 [ 165.542362][ T4711] udevd[4711]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 169.824512][ T5895] kvm [5894]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x20 [ 170.018306][ T5904] gadgetfs: bound to dummy_udc driver [ 170.330556][ T4363] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 170.368132][ C1] gadgetfs: connected [ 170.379880][ T4363] gadgetfs: disconnected [ 170.660923][ C1] gadgetfs: connected [ 170.666669][ T4363] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 170.686840][ T4363] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.757204][ T5901] gadgetfs: suspended from state 3 [ 170.763079][ T5901] gadgetfs: disconnected [ 170.838003][ T4363] usb 1-1: can't set config #1, error -71 [ 170.880948][ T4363] usb 1-1: USB disconnect, device number 2 [ 171.141713][ T26] audit: type=1800 audit(1790181977.280:12): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.352" name="attr_allow_any_host" dev="configfs" ino=42135 res=0 errno=0 [ 171.173007][ T5908] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 171.190275][ T26] audit: type=1800 audit(1790181977.300:13): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.352" name="addr_trtype" dev="configfs" ino=42141 res=0 errno=0 [ 171.269131][ T26] audit: type=1800 audit(1790181977.300:14): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.352" name="addr_traddr" dev="configfs" ino=42142 res=0 errno=0 [ 171.271638][ T4282] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 171.309091][ T4282] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 171.333244][ T4282] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 171.376751][ T4282] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 171.384678][ T4282] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 171.395777][ T4282] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 171.606142][ T26] audit: type=1800 audit(1790181977.300:15): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.352" name="addr_trsvcid" dev="configfs" ino=42143 res=0 errno=0 [ 172.195113][ T26] audit: type=1800 audit(1790181977.310:16): pid=5908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.352" name="addr_adrfam" dev="configfs" ino=42144 res=0 errno=0 [ 173.227172][ T5910] chnl_net:caif_netlink_parms(): no params data found [ 173.500140][ T5910] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.625326][ T5910] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.661238][ T4282] Bluetooth: hci5: command 0x0409 tx timeout [ 173.712606][ T5910] device bridge_slave_0 entered promiscuous mode [ 173.772942][ T5910] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.802516][ T5910] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.819593][ T5952] ieee802154 phy0 wpan0: encryption failed: -22 [ 173.845530][ T5910] device bridge_slave_1 entered promiscuous mode [ 173.910001][ T5910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 173.930913][ T5956] device syzkaller0 entered promiscuous mode [ 173.949147][ T5952] HTB: quantum of class FFF10000 is small. Consider r2q change. [ 173.965656][ T5910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.080945][ T5910] team0: Port device team_slave_0 added [ 174.111303][ T5910] team0: Port device team_slave_1 added [ 174.202345][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.209362][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.321704][ T5910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.357209][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.380397][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.106517][ T5910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.132790][ T5977] device syzkaller0 entered promiscuous mode [ 175.236475][ T5980] file system registered [ 175.274409][ T5980] unloading [ 175.343562][ T5910] device hsr_slave_0 entered promiscuous mode [ 175.374620][ T5910] device hsr_slave_1 entered promiscuous mode [ 175.391624][ T5910] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 175.425287][ T5910] Cannot create hsr debugfs directory [ 176.450551][ T4282] Bluetooth: hci5: command 0x041b tx timeout [ 176.739194][ T5995] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 176.767156][ T5995] CIFS: Attempting to mount \\127.0.0.1\share [ 176.775713][ T5995] CIFS: VFS: No username specified [ 178.460544][ T4289] Bluetooth: hci5: command 0x040f tx timeout [ 178.494473][ T5910] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 178.599906][ T5910] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 178.653422][ T5910] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 178.677332][ T5910] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 178.895934][ T5910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 179.060683][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 179.080933][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 179.114492][ T5910] 8021q: adding VLAN 0 to HW filter on device team0 [ 179.148270][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 179.173711][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 179.221678][ T4449] bridge0: port 1(bridge_slave_0) entered blocking state [ 179.228852][ T4449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.396591][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 180.434298][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 180.453366][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 180.483608][ T4422] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.490800][ T4422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.540444][ T4289] Bluetooth: hci5: command 0x0419 tx timeout [ 180.585424][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 180.713739][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 180.917736][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 181.383570][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 181.562363][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 181.592802][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 181.632786][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 181.659333][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 181.697793][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 181.718021][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 181.746639][ T4422] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 181.778935][ T5910] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 182.448394][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 182.468969][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 182.493566][ T5910] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 182.580584][ T14] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 183.810260][ T14] usb 8-1: Using ep0 maxpacket: 8 [ 183.816940][ T14] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 183.851848][ T14] usb 8-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 183.890278][ T14] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.898332][ T14] usb 8-1: Product: syz [ 183.960324][ T14] usb 8-1: Manufacturer: syz [ 183.964995][ T14] usb 8-1: SerialNumber: syz [ 184.008873][ T14] usb 8-1: config 0 descriptor?? [ 184.027073][ T14] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 185.100415][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 185.131450][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 185.210123][ T5910] device veth0_vlan entered promiscuous mode [ 185.232388][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 185.243173][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 185.265974][ T5910] device veth1_vlan entered promiscuous mode [ 185.295695][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 185.324870][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 185.358754][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 185.412805][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 185.457905][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 185.467131][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 185.512806][ T5910] device veth0_macvtap entered promiscuous mode [ 185.530911][ T5910] device veth1_macvtap entered promiscuous mode [ 185.553304][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 185.570741][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.590769][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 185.610245][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.630272][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 185.647910][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.662091][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 185.670639][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 185.680896][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 185.690961][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 185.701682][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 185.716945][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 185.728274][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.743722][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 185.761704][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.780294][ T5910] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 185.795433][ T5910] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 185.828858][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 185.841085][ T5910] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.849898][ T5910] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.859508][ T5910] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.869225][ T5910] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.882024][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 185.891901][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 185.980482][ T4282] Bluetooth: hci0: command 0x0406 tx timeout [ 185.986538][ T4282] Bluetooth: hci3: command 0x0406 tx timeout [ 186.233990][ T4975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 186.261991][ T4975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.455490][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 186.589929][ T4975] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 186.611254][ T4975] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.669366][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 186.777566][ T14] gspca_zc3xx: i2c_w status error d4 [ 187.618650][ T6110] "syz.1.388" (6110) uses obsolete ecb(arc4) skcipher [ 187.861346][ T14] gspca_zc3xx: reg_r err -110 [ 188.490278][ T14] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 188.496626][ T14] gspca_zc3xx: probe of 8-1:0.0 failed with error -110 [ 188.586013][ T14] usb 8-1: USB disconnect, device number 3 [ 193.832760][ T6175] loop8: detected capacity change from 0 to 512 [ 193.855552][ T6175] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 193.910900][ T6175] EXT4-fs (loop8): 1 truncate cleaned up [ 193.916674][ T6175] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 194.150874][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.157236][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.466067][ T6183] EXT4-fs (loop8): unmounting filesystem. [ 194.779067][ T6198] overlayfs: failed to clone upperpath [ 195.107716][ T6186] sctp: failed to load transform for md5: -2 [ 195.281118][ T4289] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 195.306036][ T4289] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 195.315623][ T4289] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 195.324873][ T4289] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 195.332493][ T4289] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 195.339768][ T4289] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 196.647030][ T6209] mmap: syz.1.407 (6209) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 197.452407][ T4289] Bluetooth: hci6: command 0x0409 tx timeout [ 198.623696][ T6192] chnl_net:caif_netlink_parms(): no params data found [ 198.802574][ T6192] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.825198][ T6192] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.855821][ T6192] device bridge_slave_0 entered promiscuous mode [ 198.906623][ T6192] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.929960][ T6192] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.119532][ T6192] device bridge_slave_1 entered promiscuous mode [ 199.149069][ T6192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.160826][ T6192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.500427][ T4289] Bluetooth: hci6: command 0x041b tx timeout [ 199.985429][ T6192] team0: Port device team_slave_0 added [ 200.031280][ T6192] team0: Port device team_slave_1 added [ 200.075561][ T6192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 200.092945][ T6192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 200.790497][ T6192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 200.847124][ T6192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 200.906386][ T6192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 201.240292][ T6192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 201.392732][ T6192] device hsr_slave_0 entered promiscuous mode [ 201.404796][ T6192] device hsr_slave_1 entered promiscuous mode [ 201.414069][ T6192] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 201.440619][ T6192] Cannot create hsr debugfs directory [ 201.580416][ T4289] Bluetooth: hci6: command 0x040f tx timeout [ 201.780884][ T6265] [ 201.783252][ T6265] ====================================================== [ 201.790292][ T6265] WARNING: possible circular locking dependency detected [ 201.791133][ T6267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.419'. [ 201.797315][ T6265] syzkaller #0 Not tainted [ 201.797326][ T6265] ------------------------------------------------------ [ 201.797332][ T6265] syz.7.417/6265 is trying to acquire lock: [ 201.797341][ T6265] ffff888148cfdfb0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 201.807132][ T6267] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 201.810485][ T6265] (&sb->s_type->i_mutex_key#23){++++}-{3:3}, at: configfs_depend_item_unlocked+0x14f/0x430 [ 201.810538][ T6265] [ 201.810538][ T6265] but task is already holding lock: [ 201.851964][ T6265] ffffffff8d805a08 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf5/0x550 [ 201.861216][ T6265] [ 201.861216][ T6265] which lock already depends on the new lock. [ 201.861216][ T6265] [ 201.871629][ T6265] [ 201.871629][ T6265] the existing dependency chain (in reverse order) is: [ 201.880652][ T6265] [ 201.880652][ T6265] -> #3 (tpg_instances_lock){+.+.}-{3:3}: [ 201.888578][ T6265] __mutex_lock+0x12d/0xae0 [ 201.893621][ T6265] tcm_alloc_inst+0x61/0x190 [ 201.898752][ T6265] usb_get_function_instance+0xd9/0x2e0 [ 201.904831][ T6265] function_make+0x118/0x350 [ 201.909962][ T6265] configfs_mkdir+0x511/0x9e0 [ 201.915173][ T6265] vfs_mkdir+0x386/0x570 [ 201.919942][ T6265] do_mkdirat+0x1d8/0x440 [ 201.924795][ T6265] __x64_sys_mkdirat+0x85/0x90 [ 201.930093][ T6265] do_syscall_64+0x4c/0xa0 [ 201.935046][ T6265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 201.941481][ T6265] [ 201.941481][ T6265] -> #2 (func_lock){+.+.}-{3:3}: [ 201.948620][ T6265] __mutex_lock+0x12d/0xae0 [ 201.953658][ T6265] usb_get_function_instance+0x2a/0x2e0 [ 201.959745][ T6265] function_make+0x118/0x350 [ 201.964874][ T6265] configfs_mkdir+0x511/0x9e0 [ 201.970096][ T6265] vfs_mkdir+0x386/0x570 [ 201.974872][ T6265] do_mkdirat+0x1d8/0x440 [ 201.979735][ T6265] __x64_sys_mkdirat+0x85/0x90 [ 201.985032][ T6265] do_syscall_64+0x4c/0xa0 [ 201.989978][ T6265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 201.996456][ T6265] [ 201.996456][ T6265] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 202.004723][ T6265] __mutex_lock+0x12d/0xae0 [ 202.009767][ T6265] configfs_rmdir+0x638/0x980 [ 202.014979][ T6265] vfs_rmdir+0x34e/0x4a0 [ 202.019764][ T6265] do_rmdir+0x29a/0x5c0 [ 202.024419][ T6265] __x64_sys_rmdir+0x45/0x50 [ 202.029511][ T6265] do_syscall_64+0x4c/0xa0 [ 202.034430][ T6265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 202.040838][ T6265] [ 202.040838][ T6265] -> #0 (&sb->s_type->i_mutex_key#23){++++}-{3:3}: [ 202.049547][ T6265] __lock_acquire+0x2d18/0x7c40 [ 202.054933][ T6265] lock_acquire+0x1bb/0x4a0 [ 202.059945][ T6265] down_write+0x36/0x60 [ 202.064606][ T6265] configfs_depend_item_unlocked+0x14f/0x430 [ 202.071110][ T6265] usbg_make_tpg+0x1dd/0x550 [ 202.076216][ T6265] target_fabric_make_tpg+0xa0/0x6d0 [ 202.082022][ T6265] configfs_mkdir+0x511/0x9e0 [ 202.087205][ T6265] vfs_mkdir+0x386/0x570 [ 202.091959][ T6265] do_mkdirat+0x1d8/0x440 [ 202.096809][ T6265] __x64_sys_mkdirat+0x85/0x90 [ 202.102076][ T6265] do_syscall_64+0x4c/0xa0 [ 202.106995][ T6265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 202.113400][ T6265] [ 202.113400][ T6265] other info that might help us debug this: [ 202.113400][ T6265] [ 202.123627][ T6265] Chain exists of: [ 202.123627][ T6265] &sb->s_type->i_mutex_key#23 --> func_lock --> tpg_instances_lock [ 202.123627][ T6265] [ 202.137424][ T6265] Possible unsafe locking scenario: [ 202.137424][ T6265] [ 202.144884][ T6265] CPU0 CPU1 [ 202.150253][ T6265] ---- ---- [ 202.155600][ T6265] lock(tpg_instances_lock); [ 202.160266][ T6265] lock(func_lock); [ 202.166659][ T6265] lock(tpg_instances_lock); [ 202.173835][ T6265] lock(&sb->s_type->i_mutex_key#23); [ 202.179291][ T6265] [ 202.179291][ T6265] *** DEADLOCK *** [ 202.179291][ T6265] [ 202.187444][ T6265] 4 locks held by syz.7.417/6265: [ 202.192449][ T6265] #0: ffff8880185bc460 (sb_writers#15){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 202.201652][ T6265] #1: ffff8880508eb900 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20b/0x450 [ 202.212431][ T6265] #2: ffffffff8d4ea290 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b5/0x9e0 [ 202.222147][ T6265] #3: ffffffff8d805a08 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf5/0x550 [ 202.231777][ T6265] [ 202.231777][ T6265] stack backtrace: [ 202.237653][ T6265] CPU: 1 PID: 6265 Comm: syz.7.417 Not tainted syzkaller #0 [ 202.244917][ T6265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 202.254981][ T6265] Call Trace: [ 202.258262][ T6265] [ 202.261182][ T6265] dump_stack_lvl+0x188/0x24e [ 202.265849][ T6265] ? load_image+0x410/0x410 [ 202.270343][ T6265] ? show_regs_print_info+0x12/0x12 [ 202.275537][ T6265] ? print_circular_bug+0x12b/0x1a0 [ 202.280723][ T6265] check_noncircular+0x296/0x330 [ 202.285663][ T6265] ? look_up_lock_class+0x75/0x140 [ 202.290774][ T6265] ? add_chain_block+0x9b0/0x9b0 [ 202.295760][ T6265] ? lockdep_lock+0xf1/0x1f0 [ 202.300340][ T6265] ? _find_first_zero_bit+0xd2/0x100 [ 202.305612][ T6265] __lock_acquire+0x2d18/0x7c40 [ 202.310470][ T6265] ? __kernel_text_address+0x9/0x30 [ 202.315658][ T6265] ? verify_lock_unused+0x140/0x140 [ 202.320843][ T6265] ? __mutex_trylock_common+0x15c/0x260 [ 202.326398][ T6265] lock_acquire+0x1bb/0x4a0 [ 202.330904][ T6265] ? configfs_depend_item_unlocked+0x14f/0x430 [ 202.337048][ T6265] ? __might_sleep+0xd0/0xd0 [ 202.341637][ T6265] ? read_lock_is_recursive+0x10/0x10 [ 202.347012][ T6265] ? __mutex_trylock_common+0x15c/0x260 [ 202.352544][ T6265] ? usbg_make_tpg+0xf5/0x550 [ 202.357226][ T6265] ? mutex_lock_nested+0x10/0x10 [ 202.362149][ T6265] down_write+0x36/0x60 [ 202.366307][ T6265] ? configfs_depend_item_unlocked+0x14f/0x430 [ 202.372465][ T6265] configfs_depend_item_unlocked+0x14f/0x430 [ 202.378433][ T6265] usbg_make_tpg+0x1dd/0x550 [ 202.383020][ T6265] ? snprintf+0xe5/0x140 [ 202.387253][ T6265] ? usbg_drop_tport+0x20/0x20 [ 202.392018][ T6265] ? vscnprintf+0x80/0x80 [ 202.396359][ T6265] ? __kmem_cache_alloc_node+0x19d/0x270 [ 202.401990][ T6265] target_fabric_make_tpg+0xa0/0x6d0 [ 202.407261][ T6265] ? target_fabric_release_wwn+0xa0/0xa0 [ 202.412888][ T6265] configfs_mkdir+0x511/0x9e0 [ 202.417552][ T6265] vfs_mkdir+0x386/0x570 [ 202.421792][ T6265] do_mkdirat+0x1d8/0x440 [ 202.426113][ T6265] ? vfs_mkdir+0x570/0x570 [ 202.430521][ T6265] __x64_sys_mkdirat+0x85/0x90 [ 202.435292][ T6265] do_syscall_64+0x4c/0xa0 [ 202.439699][ T6265] ? clear_bhb_loop+0x60/0xb0 [ 202.444374][ T6265] ? clear_bhb_loop+0x60/0xb0 [ 202.449074][ T6265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 202.454972][ T6265] RIP: 0033:0x7ff0a139e159 [ 202.459397][ T6265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.478994][ T6265] RSP: 002b:00007ff0a21c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 202.487397][ T6265] RAX: ffffffffffffffda RBX: 00007ff0a1625fa0 RCX: 00007ff0a139e159 [ 202.495359][ T6265] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 202.503312][ T6265] RBP: 00007ff0a143506b R08: 0000000000000000 R09: 0000000000000000 [ 202.511266][ T6265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.519217][ T6265] R13: 00007ff0a1626038 R14: 00007ff0a1625fa0 R15: 00007ffe3652a858 [ 202.527174][ T6265] [ 202.613333][ T6267] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 203.115797][ T4449] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.174645][ T4449] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.252876][ T4449] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.336383][ T4449] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.100370][ T4449] device hsr_slave_0 left promiscuous mode [ 204.106780][ T4449] device hsr_slave_1 left promiscuous mode [ 204.115214][ T4449] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 204.122682][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 204.133820][ T4449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 204.141457][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 204.149065][ T4449] device bridge_slave_1 left promiscuous mode [ 204.157215][ T4449] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.165530][ T4449] device bridge_slave_0 left promiscuous mode [ 204.173607][ T4449] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.187676][ T4449] device veth1_macvtap left promiscuous mode [ 204.195533][ T4449] device veth0_macvtap left promiscuous mode [ 204.201898][ T4449] device veth1_vlan left promiscuous mode [ 204.207693][ T4449] device veth0_vlan left promiscuous mode [ 204.413447][ T4449] team0 (unregistering): Port device team_slave_1 removed [ 204.445233][ T4449] team0 (unregistering): Port device team_slave_0 removed [ 204.475763][ T4449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 204.500061][ T4449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 204.540455][ T4449] bond0 (unregistering): Released all slaves [ 204.975155][ T4449] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.012997][ T4449] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.074586][ T4449] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.113600][ T4449] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.394007][ T4449] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.444132][ T4449] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.484779][ T4449] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.534549][ T4449] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.407584][ T4449] device hsr_slave_0 left promiscuous mode [ 206.415123][ T4449] device hsr_slave_1 left promiscuous mode [ 206.421680][ T4449] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 206.429106][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 206.437683][ T4449] device bridge_slave_1 left promiscuous mode [ 206.444243][ T4449] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.453081][ T4449] device bridge_slave_0 left promiscuous mode [ 206.459287][ T4449] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.471845][ T4449] device hsr_slave_0 left promiscuous mode [ 206.478066][ T4449] device hsr_slave_1 left promiscuous mode [ 206.484956][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 206.492780][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 206.500151][ T4449] device bridge_slave_1 left promiscuous mode [ 206.506487][ T4449] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.514490][ T4449] device bridge_slave_0 left promiscuous mode [ 206.520848][ T4449] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.530739][ T4449] device hsr_slave_0 left promiscuous mode [ 206.536810][ T4449] device hsr_slave_1 left promiscuous mode [ 206.543244][ T4449] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 206.550749][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 206.558207][ T4449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 206.565837][ T4449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 206.573354][ T4449] device bridge_slave_1 left promiscuous mode [ 206.579514][ T4449] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.587734][ T4449] device bridge_slave_0 left promiscuous mode [ 206.594073][ T4449] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.603813][ T4449] device veth1_macvtap left promiscuous mode [ 206.609825][ T4449] device veth0_macvtap left promiscuous mode [ 206.615965][ T4449] device veth1_vlan left promiscuous mode [ 206.621832][ T4449] device veth0_vlan left promiscuous mode [ 206.628079][ T4449] device veth1_macvtap left promiscuous mode [ 206.634279][ T4449] device veth0_macvtap left promiscuous mode [ 206.640428][ T4449] device veth1_vlan left promiscuous mode [ 206.646179][ T4449] device veth0_vlan left promiscuous mode [ 206.793006][ T4449] team0 (unregistering): Port device team_slave_1 removed [ 206.814823][ T4449] team0 (unregistering): Port device team_slave_0 removed [ 206.826166][ T4449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 206.849832][ T4449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 206.890016][ T4449] bond0 (unregistering): Released all slaves [ 206.962595][ T4449] team0 (unregistering): Port device team_slave_1 removed [ 206.988182][ T4449] team0 (unregistering): Port device team_slave_0 removed [ 207.011195][ T4449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 207.035353][ T4449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 207.068800][ T4449] bond0 (unregistering): Released all slaves [ 207.175845][ T4449] team0 (unregistering): Port device team_slave_1 removed [ 207.187472][ T4449] team0 (unregistering): Port device team_slave_0 removed [ 207.212875][ T4449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 207.238743][ T4449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 207.278816][ T4449] bond0 (unregistering): Released all slaves [ 211.580292][ T4289] Bluetooth: hci4: command 0x0406 tx timeout