last executing test programs: 13m38.177736871s ago: executing program 4 (id=679): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6745208e00103aff00000000000100000000000000130000ff0200000000000000000000000000018b009078000700430000000000000000"], 0x0) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000540)=0x5, 0x4) pipe(0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000640)=ANY=[@ANYRESHEX=0x0], 0x50) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000006c0), 0x4) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x0, 0x0, 0xfffffffffffffd09, 0x0, 0x0, 0x1000003, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x50) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000b80)={0x2, 0x9, 0x6, 0x3, 0x2, 0x0, 0x70bd28, 0x25dfdbff}, 0x10}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0x10, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7ff}, [@map_idx={0x18, 0x5, 0x5, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0xa, 0x5, 0x4, 0x0, 0x1}, @jmp={0x5, 0x1, 0x0, 0x3, 0x0, 0x30}]}, &(0x7f0000000340)='syzkaller\x00', 0x100, 0x0, 0x0, 0x40f00, 0x14, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x5, 0x8001, 0x1}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x13, 0x4, 0x0, &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 13m32.206610066s ago: executing program 4 (id=688): r0 = openat$vsock(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000e40), r0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4040, &(0x7f00000015c0)=ANY=[], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir") sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x80042, 0x0) r1 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r3, r4, 0x25, 0x4, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x40) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00', @ANYRES16=r5, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b0000190007"], 0x7c}}, 0x4) syz_mount_image$cramfs(&(0x7f0000000240), &(0x7f00000006c0)='./file1\x00', 0x8080, &(0x7f0000000c40)=ANY=[], 0xfe, 0x14f, &(0x7f0000000ac0)="$eJzszjFLclEcx/Hf4d5HfSqToMCCTGjokph2w5qiNBKE7ELh0lJgNxIUI6Gcwoi2hqDVwQqaxLdgWYulEPYmWpwdi+M1Imhp/32Wy/mec/7nri42NXiBExe6VrKZg0MzlzN3vRtGPLr5Xq2GZbcB6PzYt87fh4F9+VWB9ikg86MT2EulzZlkNi3X7TCgAYj0Y1n2oGxDQJ9sw9bZWVj3tUmgNmI1/Zc212tjKhBxWU3O+7gGpuQ8O4BU2rRbv4d80VcpP6836jH/9N24gvOYb+Jfb++re8wLPTp6O+BWkDCfbhAR8t5boO5/DVTKrWYjvmYsAdD1eQEUgqGW8dKIhQqXULftR8CWAAS+37HB7VETDpwJ4Ko7q/0gnABqpY6RGVwo9d53HCteQOSLyR1Frv8DigYBIiIiIiIiIiIiIiIiIiKiv/oMAAD//2BhXwk=") 13m29.323797752s ago: executing program 4 (id=692): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0xcf) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x420008bf) utime(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) syz_open_procfs$namespace(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) keyctl$join(0x1, 0x0) keyctl$session_to_parent(0x12) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000002100050125bd70000000000002000000", @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x4004800}, 0x40000) write$UHID_INPUT(r1, 0x0, 0x0) 13m24.498025081s ago: executing program 0 (id=712): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x5, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1c0000", @ANYRES32=0x0, @ANYBLOB], 0x38}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) syz_init_net_socket$x25(0x9, 0x5, 0x0) r6 = socket(0x1d, 0x3, 0x1) getsockopt$kcm_KCM_RECV_DISABLE(r6, 0x65, 0x10, 0x0, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newtfilter={0x24, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x4}, {}, {0x4, 0xfff3}}}, 0x24}}, 0x24040084) 13m23.159783361s ago: executing program 0 (id=704): syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, 0x0, 0x0) connect$inet(r4, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_SNDBIT(r7, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(r7, 0x5501) write$uinput_user_dev(r6, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x101, 0x3, 0x6, 0xffff, 0x9, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0x4, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x0, 0xf, 0xa33, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x4570f01f, 0x9, 0x7, 0x0, 0x5, 0xb6, 0x1, 0x7fe, 0x7fff, 0x2, 0x1000002, 0x8], [0x2, 0x1, 0x10000, 0x7, 0xb66, 0x2, 0x5, 0x80000001, 0x8000001, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x6, 0x8, 0x5, 0xcc, 0x6, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0x80, 0x2, 0x81, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x3, 0x6, 0x525ba681, 0x4f74, 0x1, 0x1, 0x1, 0x8, 0x100, 0x6, 0x12000, 0x1306, 0x100008b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x7, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x1, 0x2, 0x1002, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x7, 0x47, 0x7, 0x0, 0x11, 0x3, 0x1, 0x5, 0x7, 0x8000, 0x3ff, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x7f, 0x10003, 0x10, 0x4e26, 0x6, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x800, 0x10010001, 0xffffbffd, 0xa, 0x79a, 0x40, 0x9, 0x4, 0xc421, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x4, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x4f, 0x78d, 0x4, 0x1, 0xffffb029, 0xfffffff8, 0x0, 0x7, 0x6, 0x101, 0x1, 0x7, 0x4, 0x0, 0xb, 0x400, 0x8, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x2000005]}, 0x45c) 13m20.313180196s ago: executing program 4 (id=709): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6745208e00103aff00000000000100000000000000130000ff0200000000000000000000000000018b009078000700430000000000000000"], 0x0) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000540)=0x5, 0x4) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000640)=ANY=[@ANYRESHEX=0x0], 0x50) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000006c0), 0x4) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x0, 0x0, 0xfffffffffffffd09, 0x0, 0x0, 0x1000003, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x50) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000b80)={0x2, 0x9, 0x6, 0x3, 0x2, 0x0, 0x70bd28, 0x25dfdbff}, 0x10}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0x10, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7ff}, [@map_idx={0x18, 0x5, 0x5, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0xa, 0x5, 0x4, 0x0, 0x1}, @jmp={0x5, 0x1, 0x0, 0x3, 0x0, 0x30}]}, &(0x7f0000000340)='syzkaller\x00', 0x100, 0x0, 0x0, 0x40f00, 0x14, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x5, 0x8001, 0x1}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x13, 0x4, 0x0, &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 13m18.296997902s ago: executing program 4 (id=713): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) pread64(0xffffffffffffffff, &(0x7f0000000180)=""/43, 0xfd8a, 0x3c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, &(0x7f0000003740)) r4 = socket(0x2, 0x80805, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000380)) chdir(&(0x7f00000003c0)='./bus\x00') socket$alg(0x26, 0x5, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000001540)=""/4100, 0x1004) sendmmsg$inet(r4, &(0x7f0000004840)=[{{&(0x7f0000000200)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000940)=[{&(0x7f0000000480)="c034f4f9eb149a9cb491d01aa2feba2527af3a855a0cc59137b111ff61d19b667a836d174a3f8347bdb7782233820ea5394bdba02ae6ad1dd4cc351bec2b2dd1bd6c06ee10ac942f98c6c3ca0552b985743bad30aa7550ead3fdbda5003831", 0x5f}, {&(0x7f0000000540)="fd7746b7827b11950deaee1beb6296512918a6655e96fe7bed3a479d0323926b825b24e2790b51e6e9adad", 0x2b}, {&(0x7f0000000680)}, {0x0}, {&(0x7f00000007c0)="f4852b24132e639391cafb3883d15cb179", 0x11}], 0x5, &(0x7f0000000a80)=[@ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0xd4f}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6cc}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4f}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}], 0x80}}, {{0x0, 0x0, &(0x7f0000003640)=[{0x0}, {0x0}, {&(0x7f0000001300)="156f36971a685ba594f340", 0xb}, {&(0x7f0000001340)}, {&(0x7f0000001400)}], 0x5, &(0x7f00000036c0)}}, {{0x0, 0x0, &(0x7f0000004780), 0x0, &(0x7f00000047c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x140000}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x80}}], 0x48}}], 0x3, 0x48000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000340)={{{@in=@local, @in6=@mcast1}}, {{@in=@initdev}, 0x0, @in6=@ipv4={""/10, ""/2, @dev}}}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x9}, 0xc) 13m17.362781703s ago: executing program 0 (id=716): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port1\x00', 0x62, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2, 0xfe}) fsopen(0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x20000, 0x42) close_range(r5, 0xffffffffffffffff, 0x4) socket$inet6(0xa, 0x80002, 0x0) 13m16.078853002s ago: executing program 0 (id=719): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x14, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000005000000000000008000000018000000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095", @ANYRES64=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000075"], 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000200)='./file0\x00', 0x2000001, &(0x7f0000000340)=ANY=[], 0x2, 0x19e, &(0x7f0000000440)="$eJzs0LFrE2EYx/Hv875vkotQNVUcKtiAxfNKpbkrOjgFJ4UcOLgIBg3p2RavSnoZbGkxixSk2n9BB8FRBJ1EFJyLg+CgdekmzVAcnCRyzVvBv8H3s/zueY7jvfc3n3WyEvB7b7VNnX2aw3xCMMC4DHdKDfONnX/Y3BwGl+y8YfOFzbFseeVOK02TperFKpV/FsDPaqkCf1eZ4YSiLNSRL3ur7ZbcihnUWVSzMZUGk4/RTTrBE8bMCMdvohn4G1xRdMRvwJHprsd0trxybmGxNZfMJXejaObCA2q18/n/p0ntNRI8EsVT1ghiSjHlYI1Ck4db5hBTggTzaluL6VNssrmlz56e6qOCXQYI7/0+pW+miLrGGbwb+YXKHBOeoWMmGhxVGG4vpEntMnJVvZLQfDa/Cgqvp7XXvpfOrl9Xed912fUk3KHgh0STITN5NYzygfVterZUdr4zLm/zUw56NfvvXtrpJKd4XuR+q9tdCovwUfyYqAdRBUYYLYCKmcgP5J39xgZfDx4cx3Ecx3Ecx3Gc/8CfAAAA//9mvlp1") r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/failslab/cache-filter\x00', 0x1, 0x0) write(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000380)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x19, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x803}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x372efe22}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 13m14.621743925s ago: executing program 4 (id=720): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0xcf) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x420008bf) utime(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) syz_open_procfs$namespace(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) keyctl$join(0x1, 0x0) keyctl$session_to_parent(0x12) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000002100050125bd70000000000002000000", @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x4004800}, 0x40000) write$UHID_INPUT(r1, 0x0, 0x0) 13m10.751530693s ago: executing program 0 (id=726): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee0598", 0xa8, 0x840, 0x0, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 12m59.515559608s ago: executing program 0 (id=742): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) bind$inet6(r3, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port1\x00', 0x62, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2, 0xfe}) fsopen(0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x20000, 0x42) close_range(r5, 0xffffffffffffffff, 0x4) socket$inet6(0xa, 0x80002, 0x0) 12m59.483553178s ago: executing program 32 (id=720): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0xcf) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x420008bf) utime(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) syz_open_procfs$namespace(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) keyctl$join(0x1, 0x0) keyctl$session_to_parent(0x12) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000002100050125bd70000000000002000000", @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x4004800}, 0x40000) write$UHID_INPUT(r1, 0x0, 0x0) 12m58.99277309s ago: executing program 33 (id=742): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) bind$inet6(r3, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port1\x00', 0x62, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2, 0xfe}) fsopen(0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x20000, 0x42) close_range(r5, 0xffffffffffffffff, 0x4) socket$inet6(0xa, 0x80002, 0x0) 14.534629635s ago: executing program 3 (id=2234): keyctl$set_reqkey_keyring(0xe, 0x5) r0 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$set_timeout(0xf, r0, 0x2) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0x200, 0x2, 0x8, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0xfffffffffffffffe, 0x100, 0x0, 0x0, 0x80009, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4, 0x0, 0x3, 0x2, 0x0, 0x1, 0x0, 0x7, 0x1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$can_bcm(0x1d, 0x2, 0x2) sendmmsg(r4, 0x0, 0x0, 0x200040a0) sendmsg$inet6(0xffffffffffffffff, 0x0, 0xc000) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e24, 0x5, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x9, 0x8, 0x99}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r6, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000280)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000480)={r7, &(0x7f0000000500), 0x0}, 0x20) setresuid(0x0, 0x0, 0xffffffffffffffff) keyctl$get_security(0x11, r0, 0x0, 0x0) request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='q\xa9', 0x0) 13.163633328s ago: executing program 3 (id=2239): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) 11.985539467s ago: executing program 6 (id=2241): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{&(0x7f0000001b00)=@x25, 0x80, &(0x7f0000001980)=[{&(0x7f00000005c0)=""/160, 0xa0}, {&(0x7f0000000680)=""/224, 0xe0}, {&(0x7f0000000780)=""/9, 0x9}, {&(0x7f00000007c0)=""/54, 0x36}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000001900)=""/68, 0x44}], 0x6, &(0x7f0000001a00)=""/126, 0x7e}, 0x7fff}, {{&(0x7f0000001c40)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001cc0)=""/106, 0x6a}, {&(0x7f0000001d40)=""/88, 0x58}, {&(0x7f0000001dc0)}, {&(0x7f0000001e00)=""/75, 0x4b}], 0x4, &(0x7f0000001ec0)=""/119, 0x77}, 0x6e}, {{&(0x7f0000001f40)=@sco={0x1f, @none}, 0x80, &(0x7f0000002040)=[{&(0x7f0000001fc0)=""/66, 0x42}], 0x1, &(0x7f0000002080)=""/75, 0x4b}, 0x18b}], 0x3, 0x10062, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYRESOCT, @ANYBLOB="b9054c79d199a222ef7d0733352d6cfb42fec2a3cd519eb3abbdd4a6f7344f68705fb5c25589a6820941184b5d7aa28b53a3a8d9db4821ce1f8aafb63c3d86b142ac437d3430f2bc1c7f1f03592ce674303bc6d0f822025ce287b98bb1d0279fee00004d78aaffc0692aabff1835b47e78a7f85c40", @ANYBLOB="fab0817dbcb5f31a2c001280110001006272696467655f736c617665000000001400058005000500010000000500040001000000140003006272696467655f736c6176655f300000"], 0x60}}, 0x4040) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900038073797a3200000000140000001100014707a082b178795ad1"], 0x7c}, 0x1, 0x0, 0x0, 0x25}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) connect$inet6(r3, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r8, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="640000000007010100000000000000000200000a0900010073797a3100000140000069ff0800084000006dcb0800014000008001080001400000010008000240fffffffe0c000640000000000000f42a0c0002400000128c00000000", @ANYRESHEX=0x0], 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x20004020) setsockopt$sock_int(r2, 0x1, 0x2f, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) r9 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f00000008c0), 0x43) 10.953179032s ago: executing program 3 (id=2245): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 9.477543539s ago: executing program 6 (id=2250): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) 9.02445532s ago: executing program 5 (id=2251): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) syz_emit_vhci(0x0, 0x17) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xa}, @hci_rp_user_confirm_reply={{0x90}, {0x3}}}}, 0xd) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000580)={0xffffffffffffffff, 0x0, 0x100, 0x0, 0x9, 0x0, &(0x7f0000000540)=0x5}) socket$inet(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x4, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x3) write$binfmt_aout(r5, &(0x7f0000002140)=ANY=[], 0xff2e) r6 = socket(0x840000000002, 0x3, 0x100) connect$inet(r6, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000380)=@gettaction={0x14, 0x32, 0x200, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20088000}, 0x80) sendmmsg$inet(r6, 0x0, 0x0, 0x0) setsockopt$inet_int(r6, 0x0, 0x15, 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) write$UHID_INPUT(r8, &(0x7f00000009c0)={0xf, {"a2e3ad214fc752f90b5e09094bf70e0dd038e7ff7fc6e5539b1b48078b089b3b0838721a0890e0878f0e1ac6e7049b3d6c959b4c9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d07420736cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e2c5070000179c6f30e065cd5b91cd0ae17d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3bb469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918070000003f0000000c558cdc0a3621c56cea8d20fa911afe40db6ebe8cac64289fd3da232f1b5dbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860421c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2f09000000000000007747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847354b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d27c9a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d483d4675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516ab68032f88c042ffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d95f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f06f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9d1a3d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdfa1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442748af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d8224fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d784cfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0xb29}}, 0x1006) 7.913019137s ago: executing program 5 (id=2252): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x50440, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b01, 0x0) read(r2, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) chdir(0x0) prlimit64(0x0, 0x3, &(0x7f0000000200)={0x8, 0x100}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r6 = syz_io_uring_setup(0x126b, &(0x7f0000000640)={0x0, 0x200072db, 0x0, 0x8001, 0x27f}, &(0x7f00000006c0)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000500)=0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r6, 0x2, 0x0, 0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000440)={0x2e, 0x41, 0x0, r5, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000340)=@any_dev={0x3, 0xc5e, 0x0, 0x0, 0x1000, 0x8000, 0x0, 0x0, 0x10}}}, &(0x7f00000004c0)) sched_setscheduler(0x0, 0x0, &(0x7f0000000240)=0x7) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) sync() sync() sync() ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'netpci0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x5, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0x7}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0xae0, 0x7fffffff, 0xd03, 0x8, 0x20076f1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008851}, 0x0) 7.77806771s ago: executing program 1 (id=2253): socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000140), 0xfc, 0x560, &(0x7f00000008c0)="$eJzs3d9rW1UcAPDvTdut+6HtYAz1QQp7cDKXrq0/JvgwH0WHA33XkGRlNF1Gk461Dtwe3IsvMgQRB6Lvvvs4/Af8KwY6GDKKPuwlctObLluTNu3StVs+H7jtOffe9Jxv7v2enpubkAAG1kT6IxfxakR8l0SMtW0bjmzjxOp+Kw+uFdMliUbjs3+SSLJ1rf2T7PehrPJKRPzxTcTJ3Pp2a0vLc4VKpbyQ1Sfr85cna0vLpy7OF2bLs+VL0zMzZ96ZmX7/vXf7Fuub5//78dM7H5359vjKD7/dO3IribNxONvWHsdTuN5emYiJ7DkZibNP7DjVh8b2kmS3O8C2DGV5PhLpGDAWQ1nWd9QYe5ZdA3bY12laAwMqkf8woFrzgNa1fZ+ug58b9z9cvQBaH//w6msjMdq8Njq4kjx2ZZRe7473of20jd//vn0rXaJ/r0MAbOr6jYg4PTy8fvxLsvFv+073sM+TbRj/4Nm5k85/3uo0/8mtzX+iw/znUIfc3Y7N8z93rw/NdJXO/z7oOP9du2k1PpTVXmrO+UaSCxcr5XRsezkiTsTI/rS+wf2cL3MrdxvdNrbP/9Ilbb81F8z6cW94/+OPKRXqhacKus39GxGvdZz/JmvHP+lw/NPn43yPbRwr336927bN499ZjV8i3uh4/B/d0Uo2vj852TwfJltnxXr/3jz2Z7f2dzv+9Pgf3Dj+8aT9fm1t6238PPqw3G3bds//fcnnzfK+bN3VQr2+MBWxL/lk/frpR49t1Vv7p/GfOL7x+Nfp/D+QJnaP8d88erN919Gtxb+z0vhLWzr+Wy/c/firn7q139vxf7tZOpGt6WX867WDT/PcAQAAAAAAwF6Ti4jDkeTya+VcLp9ffX/H0TiYq1Rr9ZMXqouXStH8rOx4jORad7rH2t4PMZW9H7ZVn36iPhMRRyLi+6EDzXq+WK2Udjt4AAAAAAAAAAAAAAAAAAAA2CMORYx2+vx/6q+h3e4dsOM2+Mpv4AXXPf+zLf34pidgT/L/HwaX/IfBJf9hcMl/GFzyHwaX/IfBJf9hcG0l/389t4MdAQAAAAAAAAAAAAAAAAAAAAAAAAAAgBfD+XPn0qWx8uBaMa2XriwtzlWvnCqVa3P5+cVivlhduJyfrVZnK+V8sTq/2d+rVKuXp6Zj8epkvVyrT9aWlr+Yry5eethYVR55JlEBAAAAAAAAAAAAAAAAAADA86W2tDxXqFTKCwoK2yoM741uKPS5sNsjEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA88n8AAAD//75iP7A=") sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000840) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa000000}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3163, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r4}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x14, &(0x7f0000001740)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$FBIO_WAITFORVSYNC(r7, 0x40044620, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0x37db, 0xf423b, 0xfffffffffffffffc, 0x0, 0x0, 0x9, 0xfffffffffffffffc, 0x1, 0x3, 0x80000, 0x7ff, 0x0, 0x0, 0xfffffffffffffffd, 0x2, 0xf11b, 0x1, 0x8, 0x0, 0x0, 0x2, 0xb17, 0xffffffffffffffff, 0x5c43, 0x1, 0x6}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r8, 0x400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r9, &(0x7f0000000000), 0xd) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0xe, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x1}, [@generic={0x71, 0x0, 0x1, 0x43}]}, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) 6.57123758s ago: executing program 1 (id=2255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) 6.336978135s ago: executing program 6 (id=2256): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xe}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[], 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0x541b, 0x0) r4 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0xff4c) setsockopt$inet6_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000080)=0x1, 0x4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x15c, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@loopback, {0x0, 0x192, 0x6, 0x3, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0xf, 0x81, 0x9, 0x100}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}}], 0x1, 0x20080058) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x511001, 0x488) 5.919739326s ago: executing program 2 (id=2257): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0xff4c) 5.911185236s ago: executing program 5 (id=2258): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00"/12], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x3, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x4f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="8fae493e"], 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x400c044) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000080)={@empty, @initdev}, &(0x7f00000000c0)=0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ptrace$peekuser(0x3, r1, 0x1) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @empty}, &(0x7f0000000100)=0x10) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r6, 0x9) r7 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r7, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r5, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 5.870497047s ago: executing program 3 (id=2259): mkdirat(0xffffffffffffff9c, &(0x7f00000000a0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000a0)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) futex_waitv(&(0x7f0000005a00)=[{0x7, &(0x7f0000000000)=0x7, 0x2}], 0x1, 0x0, 0x0, 0x0) futex(&(0x7f0000000000)=0x2, 0x1, 0x0, 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000000000000000000000000007110cb000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x36, 0x0, 0x0, 0x10, 0x573}, 0x94) rmdir(&(0x7f0000000000)='./config/usb_gadget/g1/functions/gser.usb0\x00') symlink(&(0x7f0000000100)='./config\x00', &(0x7f0000000140)='./config\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x202, @private2={0xfc, 0x2, '\x00', 0xff}, 0x4ac2d78a}}, 0x0, 0x0, 0x34, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x9) socket$inet(0x2, 0x1, 0x100) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x40, @empty, 0xfffffff9}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000880)=0x3, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) shutdown(r0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyGS0\x00', 0x2, 0x166) ioctl$TCXONC(r1, 0x540a, 0x2) 4.987328958s ago: executing program 6 (id=2260): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x15c, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@loopback, {0x0, 0x192, 0x6, 0x3, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0xf, 0x81, 0x9, 0x100}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 4.91387723s ago: executing program 2 (id=2261): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 4.08115898s ago: executing program 5 (id=2262): syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x100, 0x103100) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f00000000c0)=""/114) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0xffffffff, 0x0, 0xff000000], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'netpci0\x00', 'bridge_slave_1\x00', {}, {0xff}, 0x21, 0x3, 0x5, 0x5}, 0x0, 0x298, 0x2b8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x1, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x6, 0x4, 0x0, 'syz0\x00'}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5a8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x38011, r2, 0x0) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') fspick(0xffffffffffffff9c, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1) read(r2, &(0x7f00000000c0)=""/163, 0xd0140f23) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) socket$key(0xf, 0x3, 0x2) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[], 0x48) splice(r4, 0x0, r6, 0x0, 0x7, 0x100000000000000d) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0x0, 0x2]}}) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_buf(r9, 0x1, 0x3c, &(0x7f0000001440)=""/132, &(0x7f0000001500)=0x84) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$LOOP_SET_CAPACITY(r7, 0x4c07) 3.957620574s ago: executing program 2 (id=2263): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000002480), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000024c0)={0x2f, {0x7, 0x80000001, 0xffcb, 0xffffffff, 0x6, 0x7}}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x2a, 0xfffffffffffffffc) r1 = add_key(0x0, &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) r4 = openat2(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x4cb0b75bff2949f, 0x22}, 0x18) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000400)=0x1) r5 = socket$kcm(0x2b, 0x1, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r7 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000500)={r6, r8, 0x7, 0x0, @val=@perf_event={0x9}}, 0x18) socket$can_raw(0x1d, 0x3, 0x1) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0x17, 0x0, 0x0) sendmsg$inet(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) close(r5) request_key(&(0x7f0000000440)='id_legacy\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f00000004c0)='(.#$-@\x00', r1) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r10, 0xffffffffffffffff}) close(0x3) ioctl$SW_SYNC_IOC_INC(r3, 0x40045701, &(0x7f00000000c0)=0x402) ioctl$SYNC_IOC_FILE_INFO(r11, 0xc0383e04, 0x0) add_key$user(&(0x7f0000000000), &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)="09c67c60c138be389f8614c9179974dd3e3e31a6442cb8f2e4a85adb3e7152df80b7e6b296e8c6640c045d97442fed57b668a72b7a21e231882e2b9bc907e197afb117483d8bb59270e6218ddcb8c5c28b99b5cf12a167f2981eb6d3a0264180c195cb4adbe987e86073b8d22c2478541654ce8eb89062f86c0e310d0620df7c956c1675b9f89197b8ccfa05f9e20645c6f8e41aba8e8cd217df764e44738b48320bc7d0d75f8ca47a35f4b3c9c5aee00d4e40abb98042a0867976bd283999ce7e3edc3ee6555914dd6b8241e9", 0xcd, r1) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r12, 0x29, 0x36, 0x0, 0x8) 3.939365934s ago: executing program 3 (id=2264): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) 3.865160076s ago: executing program 6 (id=2265): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x20000010) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3e8) syslog(0x2, &(0x7f00000010c0)=""/2, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x28004044, &(0x7f0000000140)={0xa, 0x4001, 0xfffc, @loopback, 0xfffffffd}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0x1fffffffffffffcd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) open_tree(0xffffffffffffffff, 0x0, 0x0) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r5, r5, r5}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, 0x0) preadv(r3, &(0x7f00000001c0), 0x0, 0x400, 0x20000000) capset(0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)=0x2) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b00)=@ipv6_newrule={0x30, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x0, 0x80}, [@FRA_DST={0x14, 0x1, @mcast2}]}, 0x30}}, 0x0) syslog(0x2, &(0x7f0000001140)=""/53, 0x35) 3.736167519s ago: executing program 1 (id=2266): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) 3.655110601s ago: executing program 2 (id=2267): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x455, 0x0, r5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x400) pselect6(0x40, &(0x7f0000000300)={0x0, 0x4000000000000000, 0x0, 0x1, 0x0, 0xfffffffffffffffd}, &(0x7f0000000240)={0x18, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x800000000, 0x8000000000000}, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) write(r6, &(0x7f0000001000), 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="02000000000a"}) 2.762331743s ago: executing program 5 (id=2268): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x50440, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b01, 0x0) read(r2, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) chdir(0x0) r5 = getpid() r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r7 = syz_io_uring_setup(0x126b, &(0x7f0000000640)={0x0, 0x200072db, 0x0, 0x8001, 0x27f}, &(0x7f00000006c0)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000500)=0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0x2, 0x0, 0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000440)={0x2e, 0x41, 0x0, r6, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000340)=@any_dev={0x3, 0xc5e, 0x0, 0x0, 0x1000, 0x8000, 0x0, 0x0, 0x10}}}, &(0x7f00000004c0)) sched_setscheduler(r5, 0x0, &(0x7f0000000240)=0x7) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) sync() sync() sync() ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'netpci0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x5, 0x25dfdc01, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0x7}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0xae0, 0x7fffffff, 0xd03, 0x8, 0x20076f1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008851}, 0x0) 2.45833737s ago: executing program 3 (id=2269): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 2.03916887s ago: executing program 2 (id=2270): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xe}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[], 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0x541b, 0x0) r4 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0xff4c) setsockopt$inet6_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000080)=0x1, 0x4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x15c, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@loopback, {0x0, 0x192, 0x6, 0x3, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0xf, 0x81, 0x9, 0x100}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}}], 0x1, 0x20080058) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x511001, 0x488) 1.480900284s ago: executing program 1 (id=2271): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0xff4c) 1.001322246s ago: executing program 2 (id=2272): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read(r0, &(0x7f0000000300)=""/96, 0x60) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) setfsgid(0xee00) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x439, 0x0, 0xfffffffb, {0x0, 0x0, 0x0, 0x0, 0x640b1}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000540)={0x80000000, &(0x7f0000000440), 0x0}) fsopen(&(0x7f00000002c0)='jffs2\x00', 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="3801000010000100fefff7ff00010000e0000001000000000000000000000000e0000002000000000000000000003730e3ccd3f7aaa877550000000107144e2300", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000ffffac1e0001000000000000000092010000000000003affffffffffffff00000000000000001c250800000000000200000000000000f8ffffffffffffff7c232e0e00000000090000000000000000000000000000001f00000002000000feffffffffffffff02000000fcffffffff0f00002abd700004350000020001000000000000000000480003006465666c61746500"/219], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x448d0}, 0x1000) socket$nl_xfrm(0x10, 0x3, 0x6) 964.027516ms ago: executing program 6 (id=2273): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 651.261954ms ago: executing program 1 (id=2274): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000080)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}}], 0x1, 0x20080058) 132.248227ms ago: executing program 1 (id=2275): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_dbroot\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r0, &(0x7f0000000400), 0x0) close(r0) mkdir(&(0x7f0000000500)='./my_dbroot/alua\x00', 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000700)='./my_dbroot/alua/usb_gadget/naa.1234567890abcdef+1\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000900)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000a00)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000b00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000c00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r1, &(0x7f0000001000)='rd_pages=8', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000001200)='1', 0x1) close(r2) mkdir(&(0x7f0000001300)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000001400)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') mkdir(0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_write_md\x00', 0x1, 0x0) write(r3, &(0x7f0000001700)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000001800)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) 0s ago: executing program 5 (id=2276): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000000)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0x2, 0x9, 0x0, 0xe3, 0x5, 0x7, 0x5, 0x3, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r4, 0x0, 0x5e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x14000) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x3, 0x1, 0x4, 0x2, {0xa, 0x4e23, 0xb911, @empty, 0x5}}}, 0x3a) write$dsp(r6, &(0x7f0000000040)='F', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000040)=0xf) poll(&(0x7f0000000040)=[{r6, 0x258}], 0x1, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_uring_setup(0x2a55, &(0x7f0000000200)={0x0, 0x622c, 0x800, 0x0, 0x5d}) kernel console output (not intermixed with test programs): (i_pos 52) [ 272.503207][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.511880][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.567193][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.575932][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.584464][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.592976][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.601447][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.609993][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.618496][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.627097][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.635650][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.644160][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.653819][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.662400][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.670887][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.679421][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.687927][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.696445][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.704941][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.713442][ T5823] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 272.724228][ T5823] syz.0.350 (5823) used greatest stack depth: 20240 bytes left [ 272.738429][ T27] audit: type=1800 audit(1785567779.140:2): pid=5823 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.350" name="file1" dev="loop0" ino=1048608 res=0 errno=0 [ 273.105288][ T5831] can0: slcan on ttyS3. [ 273.862678][ T5826] can0 (unregistered): slcan off ttyS3. [ 274.275369][ T5837] loop0: detected capacity change from 0 to 4096 [ 278.318293][ T5869] 9pnet_fd: Insufficient options for proto=fd [ 279.846049][ T5882] can0: slcan on ttyS3. [ 280.404079][ T5875] can0 (unregistered): slcan off ttyS3. [ 280.639692][ T5886] netlink: 12 bytes leftover after parsing attributes in process `syz.2.365'. [ 281.233132][ T5893] netlink: 12 bytes leftover after parsing attributes in process `syz.3.367'. [ 281.978987][ T5901] netlink: 12 bytes leftover after parsing attributes in process `syz.1.378'. [ 289.729133][ T5972] loop0: detected capacity change from 0 to 128 [ 289.841068][ T5972] loop0: detected capacity change from 0 to 512 [ 289.888035][ T5972] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 289.936975][ T5972] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 289.985927][ T5972] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 290.130231][ T5972] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:477: comm syz.0.389: Invalid block bitmap block 0 in block_group 0 [ 290.225071][ T5972] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 290.422577][ T5972] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #11: comm syz.0.389: attempt to clear invalid blocks 983261 len 1 [ 290.479619][ T5972] EXT4-fs error (device loop0): __ext4_get_inode_loc:4520: comm syz.0.389: Invalid inode table block 0 in block_group 0 [ 290.561462][ T5972] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 290.622088][ T5972] EXT4-fs error (device loop0) in ext4_orphan_del:303: Corrupt filesystem [ 290.674570][ T5972] EXT4-fs error (device loop0): __ext4_get_inode_loc:4520: comm syz.0.389: Invalid inode table block 0 in block_group 0 [ 290.710521][ T5972] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 290.723094][ T5972] EXT4-fs error (device loop0): ext4_truncate:4325: inode #11: comm syz.0.389: mark_inode_dirty error [ 290.745189][ T5972] EXT4-fs error (device loop0) in ext4_process_orphan:345: Corrupt filesystem [ 290.765120][ T5972] EXT4-fs error (device loop0): __ext4_get_inode_loc:4520: comm syz.0.389: Invalid inode table block 0 in block_group 0 [ 290.799858][ T5972] EXT4-fs (loop0): 1 truncate cleaned up [ 290.808372][ T5972] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 291.199074][ T5983] netlink: 20 bytes leftover after parsing attributes in process `syz.0.389'. [ 291.807547][ T4278] EXT4-fs (loop0): unmounting filesystem. [ 297.695159][ T6070] loop2: detected capacity change from 0 to 128 [ 299.076879][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.085878][ T6076] FAT-fs (loop2): Filesystem has been set read-only [ 299.092929][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.101588][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.110237][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.118892][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.127642][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.136282][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.144933][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.153664][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.162517][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.171141][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.179816][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.188490][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.197100][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.205753][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.214403][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.223097][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.231904][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.240726][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.249397][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.258165][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.266860][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.275531][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.284179][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.292840][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.301485][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.310158][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.318987][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.327659][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.336278][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.344919][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.353612][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.362268][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.370890][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.379563][ T6076] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 299.389691][ T27] audit: type=1800 audit(1785567805.800:3): pid=6076 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.414" name="file1" dev="loop2" ino=1048609 res=0 errno=0 [ 299.507011][ T6076] syz.2.414 (6076) used greatest stack depth: 19520 bytes left [ 299.684690][ T6087] netlink: 12 bytes leftover after parsing attributes in process `syz.0.417'. [ 300.722669][ T6099] netlink: 12 bytes leftover after parsing attributes in process `syz.1.418'. [ 300.758455][ T6098] snd_dummy snd_dummy.0: control 6:65278:-4:syz0:-259 is already present [ 303.332989][ T6113] 9pnet_fd: Insufficient options for proto=fd [ 305.239913][ T6131] loop4: detected capacity change from 0 to 256 [ 305.314611][ T6131] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 305.450191][ T27] audit: type=1800 audit(1785567811.860:4): pid=6131 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.431" name="file2" dev="loop4" ino=1048610 res=0 errno=0 [ 306.062426][ T27] audit: type=1800 audit(1785567812.460:5): pid=6142 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.431" name="file2" dev="loop4" ino=1048610 res=0 errno=0 [ 308.468354][ T6162] 9pnet_fd: Insufficient options for proto=fd [ 308.525681][ T6156] netlink: 12 bytes leftover after parsing attributes in process `syz.2.433'. [ 310.483871][ T6172] netlink: 12 bytes leftover after parsing attributes in process `syz.4.440'. [ 311.508597][ T6190] loop3: detected capacity change from 0 to 512 [ 312.901646][ T6190] EXT4-fs (loop3): 1 truncate cleaned up [ 312.901776][ T6190] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 313.234357][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 314.071172][ T6222] 9pnet_fd: Insufficient options for proto=fd [ 315.523647][ T6242] netlink: 12 bytes leftover after parsing attributes in process `syz.4.453'. [ 315.585232][ T6243] netlink: 12 bytes leftover after parsing attributes in process `syz.3.454'. [ 317.890841][ T6264] loop2: detected capacity change from 0 to 64 [ 317.959536][ T6264] MINIX-fs: mounting file system with errors, running fsck is recommended [ 319.339832][ T6282] netlink: 12 bytes leftover after parsing attributes in process `syz.1.472'. [ 319.354872][ T6285] loop3: detected capacity change from 0 to 256 [ 319.380128][ T6285] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 319.643035][ T27] audit: type=1800 audit(1785567826.060:6): pid=6285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.463" name="file2" dev="loop3" ino=1048611 res=0 errno=0 [ 319.890580][ T6290] 9pnet_fd: Insufficient options for proto=fd [ 320.143861][ T27] audit: type=1800 audit(1785567826.510:7): pid=6293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.463" name="file2" dev="loop3" ino=1048611 res=0 errno=0 [ 321.340416][ T6304] loop3: detected capacity change from 0 to 128 [ 321.525317][ T6306] netlink: 12 bytes leftover after parsing attributes in process `syz.4.466'. [ 321.730142][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.738906][ T6310] FAT-fs (loop3): Filesystem has been set read-only [ 321.746565][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.755760][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.764499][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.773099][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.790871][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.799589][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.808218][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.817199][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.827936][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.836630][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.845256][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.853876][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.862515][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.871126][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.879778][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.888423][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.897238][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.906670][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.915307][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.924515][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.933135][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.941740][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.950442][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.959111][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.967771][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.976654][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.986376][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 321.995058][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.003707][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.012376][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.021029][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.029683][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.038304][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.046949][ T6310] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 322.178467][ T27] audit: type=1800 audit(1785567828.560:8): pid=6310 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.465" name="file1" dev="loop3" ino=1048612 res=0 errno=0 [ 322.376997][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.383478][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 323.024513][ T6324] netlink: 12 bytes leftover after parsing attributes in process `syz.1.484'. [ 325.063617][ T6341] 9pnet_fd: Insufficient options for proto=fd [ 326.238411][ T6346] loop0: detected capacity change from 0 to 256 [ 326.516520][ T6346] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 326.732928][ T4277] Bluetooth: hci5: command 0x1003 tx timeout [ 326.732958][ T4287] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 326.941155][ T27] audit: type=1800 audit(1785567833.350:9): pid=6346 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.479" name="file2" dev="loop0" ino=1048613 res=0 errno=0 [ 327.736755][ T27] audit: type=1800 audit(1785567833.730:10): pid=6352 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.479" name="file2" dev="loop0" ino=1048613 res=0 errno=0 [ 330.904457][ T6363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.485'. [ 331.444841][ T6365] netlink: 12 bytes leftover after parsing attributes in process `syz.3.486'. [ 335.336162][ T6396] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 339.754601][ T6429] netlink: 12 bytes leftover after parsing attributes in process `syz.2.500'. [ 344.626486][ T6450] loop4: detected capacity change from 0 to 128 [ 344.833418][ T6450] loop4: detected capacity change from 0 to 512 [ 345.010127][ T6450] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 345.158905][ T6450] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 345.506846][ T6450] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:477: comm syz.4.507: Invalid block bitmap block 0 in block_group 0 [ 345.646061][ T6450] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 345.678321][ T6450] EXT4-fs error (device loop4): ext4_clear_blocks:883: inode #11: comm syz.4.507: attempt to clear invalid blocks 983261 len 1 [ 346.592370][ T6450] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.507: Invalid inode table block 0 in block_group 0 [ 346.622893][ T6450] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 346.656833][ T6450] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 346.796803][ T6450] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.507: Invalid inode table block 0 in block_group 0 [ 346.841821][ T6450] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 346.869280][ T6450] EXT4-fs error (device loop4): ext4_truncate:4325: inode #11: comm syz.4.507: mark_inode_dirty error [ 346.900285][ T6450] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 346.976138][ T6450] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.507: Invalid inode table block 0 in block_group 0 [ 347.008881][ T6450] EXT4-fs (loop4): 1 truncate cleaned up [ 347.027238][ T6450] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 347.268734][ T6469] can0: slcan on ttyS3. [ 347.962820][ T4288] EXT4-fs (loop4): unmounting filesystem. [ 347.994605][ T6466] can0 (unregistered): slcan off ttyS3. [ 348.434086][ T6479] loop2: detected capacity change from 0 to 256 [ 348.455838][ T6479] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 348.504776][ T27] audit: type=1800 audit(1785567854.910:11): pid=6479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.517" name="file2" dev="loop2" ino=1048614 res=0 errno=0 [ 348.992373][ T27] audit: type=1800 audit(1785567855.370:12): pid=6487 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.517" name="file2" dev="loop2" ino=1048614 res=0 errno=0 [ 349.128476][ T6490] can0: slcan on ttyS3. [ 349.414430][ T6492] netlink: 12 bytes leftover after parsing attributes in process `syz.4.515'. [ 349.955437][ T6483] can0 (unregistered): slcan off ttyS3. [ 355.273765][ T6544] netlink: 68 bytes leftover after parsing attributes in process `syz.2.528'. [ 360.716786][ T6594] syz.4.538 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 360.732325][ T6594] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 366.043605][ T6619] netlink: 12 bytes leftover after parsing attributes in process `syz.4.543'. [ 366.235550][ T6620] loop0: detected capacity change from 0 to 64 [ 366.287911][ T6620] MINIX-fs: mounting file system with errors, running fsck is recommended [ 374.989127][ T6697] netlink: 12 bytes leftover after parsing attributes in process `syz.3.562'. [ 383.776846][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 383.783290][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 386.056454][ T6772] netlink: 44 bytes leftover after parsing attributes in process `syz.0.572'. [ 387.375214][ T6780] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 391.959926][ T6798] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 396.926408][ T6838] netlink: 44 bytes leftover after parsing attributes in process `syz.3.597'. [ 397.923112][ T6843] netlink: 12 bytes leftover after parsing attributes in process `syz.1.590'. [ 399.998078][ T6857] loop2: detected capacity change from 0 to 8192 [ 400.505110][ T27] audit: type=1800 audit(1785567906.920:13): pid=6857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.602" name="bus" dev="loop2" ino=1048616 res=0 errno=0 [ 403.405305][ T6885] loop3: detected capacity change from 0 to 64 [ 403.481529][ T6885] MINIX-fs: mounting file system with errors, running fsck is recommended [ 406.521464][ T6898] netlink: 44 bytes leftover after parsing attributes in process `syz.0.610'. [ 410.260609][ T6929] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 411.686993][ T6944] netlink: 12 bytes leftover after parsing attributes in process `syz.2.621'. [ 414.994230][ T22] Process accounting resumed [ 417.426236][ T6989] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 418.178092][ T6993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.633'. [ 419.310148][ T4287] Bluetooth: hci0: Malformed LE Event: 0x1d [ 425.120295][ T7035] ip6t_srh: unknown srh match flags FF3F [ 435.932403][ T4277] Bluetooth: hci5: command 0x1003 tx timeout [ 435.940421][ T4287] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 438.537738][ T7121] fuse: Unknown parameter '0x0000000000000009' [ 443.781071][ T4287] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 443.791171][ T4287] Bluetooth: hci0: Injecting HCI hardware error event [ 443.801350][ T4277] Bluetooth: hci0: hardware error 0x00 [ 445.214757][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.221373][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 446.023829][ T6920] Process accounting resumed [ 446.172494][ T4277] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 446.573247][ T7180] loop2: detected capacity change from 0 to 512 [ 446.630318][ T7180] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 446.684401][ T7180] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 446.727781][ T7180] EXT4-fs (loop2): 1 truncate cleaned up [ 446.753162][ T7180] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 449.821202][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 450.746990][ T7206] ip6t_srh: unknown srh match flags FF3F [ 453.810097][ T7222] loop4: detected capacity change from 0 to 2048 [ 453.872245][ T7222] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 453.929148][ T27] audit: type=1800 audit(1785567969.333:14): pid=7220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.688" name="bus" dev="loop4" ino=1367 res=0 errno=0 [ 455.570646][ T7242] netlink: 12 bytes leftover after parsing attributes in process `syz.1.693'. [ 462.020883][ T7358] netlink: 12 bytes leftover after parsing attributes in process `syz.1.706'. [ 462.140378][ T7360] input: syz0 as /devices/virtual/input/input9 [ 463.657399][ T7368] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 470.173391][ T7414] loop0: detected capacity change from 0 to 8 [ 470.339006][ T7414] squashfs: Unknown parameter '' [ 472.718376][ T7425] netlink: 12 bytes leftover after parsing attributes in process `syz.2.724'. [ 476.367398][ T7458] capability: warning: `syz.1.732' uses deprecated v2 capabilities in a way that may be insecure [ 476.564522][ T7459] futex_wake_op: syz.1.732 tries to shift op by 144; fix this program [ 477.615533][ T7470] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 481.293023][ T4753] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.396888][ T7480] netlink: 12 bytes leftover after parsing attributes in process `syz.1.737'. [ 483.935738][ T4753] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.245045][ T4753] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.396718][ T4753] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.588351][ T7507] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 486.658137][ T4287] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 486.677672][ T4285] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 486.691217][ T4287] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 486.699588][ T4285] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 486.707360][ T4287] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 486.715166][ T4285] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 488.125189][ T4287] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 488.144809][ T4287] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 488.156533][ T4287] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 488.178869][ T4287] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 488.186728][ T4287] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 488.194509][ T4287] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 488.277854][ T7538] netlink: 12 bytes leftover after parsing attributes in process `syz.2.749'. [ 488.657521][ T7510] chnl_net:caif_netlink_parms(): no params data found [ 488.732343][ T4277] Bluetooth: hci2: command 0x0409 tx timeout [ 490.435566][ T4277] Bluetooth: hci5: command 0x0409 tx timeout [ 490.812360][ T4277] Bluetooth: hci2: command 0x041b tx timeout [ 491.156281][ T7554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.759'. [ 491.232487][ T4753] device hsr_slave_0 left promiscuous mode [ 491.299957][ T4753] device hsr_slave_1 left promiscuous mode [ 491.319179][ T4753] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 491.342584][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 491.679047][ T4753] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 491.686987][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 491.698429][ T4753] device bridge_slave_1 left promiscuous mode [ 491.794595][ T4753] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.019421][ T4753] device bridge_slave_0 left promiscuous mode [ 492.171929][ T4753] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.370547][ T4753] device veth1_macvtap left promiscuous mode [ 492.377681][ T4753] device veth0_macvtap left promiscuous mode [ 492.536921][ T4277] Bluetooth: hci5: command 0x041b tx timeout [ 492.537098][ T4753] device veth1_vlan left promiscuous mode [ 493.740624][ T4277] Bluetooth: hci2: command 0x040f tx timeout [ 494.022707][ T4753] device veth0_vlan left promiscuous mode [ 494.663441][ T4277] Bluetooth: hci5: command 0x040f tx timeout [ 495.823455][ T4287] Bluetooth: hci2: command 0x0419 tx timeout [ 496.732343][ T4277] Bluetooth: hci5: command 0x0419 tx timeout [ 498.092727][ T4753] team0 (unregistering): Port device team_slave_1 removed [ 498.146104][ T4753] team0 (unregistering): Port device team_slave_0 removed [ 498.207311][ T4753] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 498.283101][ T4753] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 498.743265][ T4753] bond0 (unregistering): Released all slaves [ 498.855790][ T7592] netlink: 12 bytes leftover after parsing attributes in process `syz.2.761'. [ 498.928810][ T7510] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.937204][ T7510] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.003421][ T7510] device bridge_slave_0 entered promiscuous mode [ 499.069671][ T7510] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.090105][ T7600] loop1: detected capacity change from 0 to 512 [ 499.096995][ T7510] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.182838][ T7597] loop2: detected capacity change from 0 to 2048 [ 499.217795][ T7510] device bridge_slave_1 entered promiscuous mode [ 499.235147][ T7600] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 499.569895][ T7597] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 499.694045][ T7600] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 499.848661][ T7600] ext4 filesystem being mounted at /147/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 500.055061][ T27] audit: type=1800 audit(1785568015.453:15): pid=7597 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.763" name="bus" dev="loop2" ino=1367 res=0 errno=0 [ 500.506425][ T7510] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 500.860016][ T27] audit: type=1800 audit(1785568016.143:16): pid=7600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.764" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 500.869426][ T7510] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 501.178967][ T7510] team0: Port device team_slave_0 added [ 501.216163][ T7510] team0: Port device team_slave_1 added [ 501.309240][ T7510] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 501.339509][ T7510] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.342348][ T7510] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 502.493425][ T7510] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 502.519904][ T7510] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.701191][ T7510] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 502.773368][ T7533] chnl_net:caif_netlink_parms(): no params data found [ 503.806238][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 503.883308][ T7648] mmap: syz.2.768 (7648) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 504.854765][ T7510] device hsr_slave_0 entered promiscuous mode [ 504.904440][ T7510] device hsr_slave_1 entered promiscuous mode [ 506.002078][ T7666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.771'. [ 506.549517][ T7533] bridge0: port 1(bridge_slave_0) entered blocking state [ 506.586240][ T7533] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.693245][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.707246][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.744554][ T7533] device bridge_slave_0 entered promiscuous mode [ 506.926533][ T7533] bridge0: port 2(bridge_slave_1) entered blocking state [ 507.049371][ T7533] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.213590][ T7533] device bridge_slave_1 entered promiscuous mode [ 507.474438][ T7533] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 507.528630][ T7533] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 507.652552][ T4753] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.755735][ T7510] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 507.816741][ T4753] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.856810][ T7533] team0: Port device team_slave_0 added [ 507.873157][ T7510] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 507.896460][ T7533] team0: Port device team_slave_1 added [ 507.916115][ T7510] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 507.975621][ T4753] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 508.008382][ T7510] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 508.061981][ T7533] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 508.080578][ T7533] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 508.119045][ T7533] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 508.154270][ T4753] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 508.181939][ T7533] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 508.189796][ T7533] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 508.216292][ T7533] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 508.554917][ T7533] device hsr_slave_0 entered promiscuous mode [ 508.690836][ T7533] device hsr_slave_1 entered promiscuous mode [ 508.799046][ T7533] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 508.877932][ T7533] Cannot create hsr debugfs directory [ 509.474513][ T7510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.569614][ T7682] Process accounting resumed [ 509.593551][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 509.642783][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 509.678478][ T7510] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.074518][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 510.526770][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 510.896856][ T7030] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.904141][ T7030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.984371][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 512.181479][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 512.225170][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 512.252782][ T7030] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.260016][ T7030] bridge0: port 2(bridge_slave_1) entered forwarding state [ 512.328156][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 512.351873][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 513.372679][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 513.396127][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 513.599826][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 513.760962][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 514.310778][ T7510] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 514.402294][ T7510] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 514.431494][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 514.673400][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 514.682946][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 514.824541][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 514.855122][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 515.083602][ T7030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 515.571993][ T7802] UBIFS error (pid: 7802): cannot open "ubifs", error -22 [ 516.616071][ T7533] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 517.427893][ T7533] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 517.646212][ T7533] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 520.223513][ T7533] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 520.294288][ T7830] netlink: 12 bytes leftover after parsing attributes in process `syz.2.801'. [ 520.905902][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 520.963443][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 521.236724][ T7510] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 522.639152][ T7533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 524.987761][ T7533] 8021q: adding VLAN 0 to HW filter on device team0 [ 525.052316][ T7879] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 525.400726][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 525.538958][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 525.643479][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 525.687708][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 525.750859][ T7321] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.758171][ T7321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 526.804691][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 526.821165][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 526.834881][ T7321] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.842196][ T7321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 527.255046][ T4753] device hsr_slave_0 left promiscuous mode [ 527.313960][ T4753] device hsr_slave_1 left promiscuous mode [ 527.407784][ T4753] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 527.502903][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 527.623145][ T4753] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 527.630608][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 527.643351][ T4753] device bridge_slave_1 left promiscuous mode [ 527.665218][ T4753] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.677711][ T4753] device bridge_slave_0 left promiscuous mode [ 527.698865][ T4753] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.133339][ T4753] device veth1_macvtap left promiscuous mode [ 529.139435][ T4753] device veth0_macvtap left promiscuous mode [ 529.211127][ T4753] device veth1_vlan left promiscuous mode [ 529.221215][ T4753] device veth0_vlan left promiscuous mode [ 530.453333][ T4753] team0 (unregistering): Port device team_slave_1 removed [ 530.527009][ T4753] team0 (unregistering): Port device team_slave_0 removed [ 530.577799][ T4753] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 530.651966][ T4753] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 530.704242][ T7913] loop3: detected capacity change from 0 to 512 [ 530.736198][ T7913] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 530.845492][ T7913] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 530.871156][ T7913] ext4 filesystem being mounted at /174/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 530.921343][ T27] audit: type=1800 audit(1785568046.323:17): pid=7913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.808" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 531.408337][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 531.462662][ T7924] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input10 [ 533.047249][ T4753] bond0 (unregistering): Released all slaves [ 533.143737][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 533.153505][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 533.195265][ T7898] netlink: 12 bytes leftover after parsing attributes in process `syz.2.805'. [ 533.311495][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 533.330050][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 533.340994][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 533.350650][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 533.376745][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 533.393468][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 533.443089][ T7510] device veth0_vlan entered promiscuous mode [ 533.468852][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 533.485940][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 533.501483][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 533.510277][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 533.519337][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 533.527623][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 533.546443][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 533.560792][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 533.572441][ T7940] loop1: detected capacity change from 0 to 16 [ 533.586989][ T7940] erofs: (device loop1): mounted with root inode @ nid 36. [ 533.616006][ T7533] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 533.680118][ T7533] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 533.694026][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 533.703459][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 533.714202][ T7510] device veth1_vlan entered promiscuous mode [ 533.780710][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 533.814183][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 533.828461][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 533.839420][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 533.877169][ T7510] device veth0_macvtap entered promiscuous mode [ 533.913347][ T7510] device veth1_macvtap entered promiscuous mode [ 533.983947][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.020878][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.053494][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.090659][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.121296][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 534.157221][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.192917][ T7510] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 534.224365][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 534.241731][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 534.271959][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 534.304621][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 534.376234][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 534.420184][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 534.478002][ T7952] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 534.698321][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 534.835245][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 535.102405][ T7510] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 535.309436][ T7510] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 535.439202][ T7510] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 535.712933][ T7510] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 535.765457][ T7510] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 535.832312][ T7510] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 535.905721][ T7510] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 535.951248][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 535.962015][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 536.234405][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 536.325658][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 536.614653][ T7533] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.962511][ T7333] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 536.970407][ T7333] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 537.032398][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 537.109439][ T7306] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 537.123615][ T7306] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 537.132845][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 537.384521][ T7983] UBIFS error (pid: 7983): cannot open "ubifs", error -22 [ 538.027660][ T4287] Bluetooth: hci3: command 0x0406 tx timeout [ 539.306020][ T8001] (syz.5.743,8001,1):ocfs2_fill_super:990 ERROR: superblock probe failed! [ 539.315109][ T8001] (syz.5.743,8001,1):ocfs2_fill_super:1176 ERROR: status = -22 [ 544.722356][ T27] audit: type=1326 audit(1785568060.113:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz.1.827" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd42a19e019 code=0x0 [ 546.135774][ T8057] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 548.294446][ T27] audit: type=1326 audit(1785568062.753:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.830" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x0 [ 549.012578][ T8082] (syz.2.833,8082,1):ocfs2_fill_super:990 ERROR: superblock probe failed! [ 549.021253][ T8082] (syz.2.833,8082,1):ocfs2_fill_super:1176 ERROR: status = -22 [ 551.646146][ T8113] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 552.161562][ T4277] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 552.172096][ T4277] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 552.180832][ T4277] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 552.192965][ T4277] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 552.200808][ T4277] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 552.208545][ T4277] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 552.680787][ T8126] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 553.042568][ T8123] loop1: detected capacity change from 0 to 1024 [ 554.449241][ T4285] Bluetooth: hci4: command 0x0409 tx timeout [ 556.110066][ T7333] hfsplus: b-tree write err: -5, ino 25 [ 556.194059][ T7333] hfsplus: b-tree write err: -5, ino 4 [ 556.199982][ T7333] hfsplus: b-tree write err: -5, ino 2 [ 556.492866][ T4285] Bluetooth: hci4: command 0x041b tx timeout [ 556.934110][ T8114] chnl_net:caif_netlink_parms(): no params data found [ 557.292963][ T8114] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.300756][ T8114] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.316570][ T8114] device bridge_slave_0 entered promiscuous mode [ 557.347816][ T8180] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 557.919416][ T8114] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.932723][ T8114] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.992545][ T8114] device bridge_slave_1 entered promiscuous mode [ 559.066399][ T4285] Bluetooth: hci4: command 0x040f tx timeout [ 560.347170][ T8114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 560.510690][ T8114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 561.261839][ T4285] Bluetooth: hci4: command 0x0419 tx timeout [ 561.530820][ T8114] team0: Port device team_slave_0 added [ 561.558151][ T8114] team0: Port device team_slave_1 added [ 562.619186][ T8114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 562.642164][ T8114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 562.685486][ T8114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 562.699375][ T8114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 562.711420][ T8114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 562.744590][ T8114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 562.917276][ T8114] device hsr_slave_0 entered promiscuous mode [ 562.934322][ T8114] device hsr_slave_1 entered promiscuous mode [ 562.944246][ T8114] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 562.951889][ T8114] Cannot create hsr debugfs directory [ 562.982246][ T4392] device hsr_slave_0 left promiscuous mode [ 562.989462][ T4392] device hsr_slave_1 left promiscuous mode [ 563.005162][ T4392] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 563.041707][ T4392] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 563.060850][ T4392] device bridge_slave_1 left promiscuous mode [ 563.089769][ T4392] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.117849][ T4392] device bridge_slave_0 left promiscuous mode [ 563.132321][ T4392] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.719626][ T4392] team0 (unregistering): Port device team_slave_1 removed [ 565.271427][ T8263] loop2: detected capacity change from 0 to 512 [ 565.280167][ T8263] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 565.544594][ T4392] team0 (unregistering): Port device team_slave_0 removed [ 565.576721][ T8263] EXT4-fs (loop2): 1 truncate cleaned up [ 565.582942][ T8263] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 566.610574][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 566.743671][ T4392] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 566.913815][ T4392] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 567.889690][ T4392] bond0 (unregistering): Released all slaves [ 568.173953][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.183144][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 569.250701][ T8306] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 570.542323][ T8320] loop5: detected capacity change from 0 to 40427 [ 571.428629][ T8320] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 571.437165][ T8320] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 571.533111][ T8320] F2FS-fs (loop5): invalid crc value [ 571.577007][ T8320] F2FS-fs (loop5): Found nat_bits in checkpoint [ 571.655994][ T8320] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 571.663819][ T8320] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 572.435332][ T8342] syz.5.885: attempt to access beyond end of device [ 572.435332][ T8342] loop5: rw=34817, sector=77824, nr_sectors = 32 limit=40427 [ 574.593141][ T8114] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 574.657385][ T8114] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 574.685292][ T8114] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 574.979581][ T8114] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 575.629458][ T8114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 575.654174][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 575.663214][ T7321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 575.675011][ T8114] 8021q: adding VLAN 0 to HW filter on device team0 [ 575.807149][ T7316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 576.726299][ T7316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 576.736290][ T7316] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.743510][ T7316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.028595][ T7316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 577.950237][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 577.969492][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 577.996392][ T8400] loop1: detected capacity change from 0 to 128 [ 578.003745][ T7333] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.010913][ T7333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 578.078696][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 578.096365][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 578.149016][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 578.201193][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 579.008794][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 579.098048][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 579.136540][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 579.239148][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 579.713609][ T8114] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 579.887808][ T8114] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 580.079353][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 580.140138][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 580.507414][ T7333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 582.106407][ T8440] loop2: detected capacity change from 0 to 1764 [ 583.436420][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 583.460895][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 583.504080][ T8114] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.211621][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 588.228913][ T7323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 588.537386][ T8523] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 589.476377][ T8518] loop3: detected capacity change from 0 to 512 [ 589.485011][ T8518] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 589.665521][ T8518] EXT4-fs (loop3): 1 truncate cleaned up [ 589.671266][ T8518] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 590.014546][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 590.030650][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 590.042197][ T8114] device veth0_vlan entered promiscuous mode [ 590.179525][ T8114] device veth1_vlan entered promiscuous mode [ 590.592416][ T27] audit: type=1800 audit(1785568105.953:20): pid=8531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.922" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 590.752781][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 590.865741][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 590.905942][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 591.232880][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 591.241708][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 591.292359][ T8114] device veth0_macvtap entered promiscuous mode [ 591.319357][ T8114] device veth1_macvtap entered promiscuous mode [ 591.420715][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 591.451915][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 592.407308][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 592.533372][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 592.599239][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 592.851876][ T8559] 9pnet_fd: Insufficient options for proto=fd [ 593.602164][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.612080][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 593.740931][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 593.835749][ T8114] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 593.903646][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.693804][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.729645][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.761734][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.805529][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.840321][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.876136][ T8114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 594.906106][ T8114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.953552][ T8114] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 594.973277][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 594.989464][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 595.014818][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 595.039975][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 595.128661][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 595.163167][ T7306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 595.196274][ T8114] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.219071][ T8114] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.241688][ T8114] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.254253][ T8114] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.222917][ T7306] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.230817][ T7306] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.311254][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 596.331328][ T7327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.366584][ T7327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.401513][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 599.995185][ T8626] 9pnet_fd: Insufficient options for proto=fd [ 600.235656][ T8628] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 601.086747][ T8647] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 605.925040][ T8687] 9pnet_fd: Insufficient options for proto=fd [ 605.935351][ T8691] 9pnet_fd: Insufficient options for proto=fd [ 610.115596][ T8739] 9pnet_fd: Insufficient options for proto=fd [ 610.790393][ T8745] 9pnet_fd: Insufficient options for proto=fd [ 611.266070][ T4287] Bluetooth: hci2: command 0x0406 tx timeout [ 615.160916][ T8793] 9pnet_fd: Insufficient options for proto=fd [ 616.212348][ T8803] 9pnet_fd: Insufficient options for proto=fd [ 621.351708][ T8856] 9pnet_fd: Insufficient options for proto=fd [ 622.413896][ T8868] 9pnet_fd: Insufficient options for proto=fd [ 629.641353][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.647810][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 633.491897][ T8969] 9pnet_fd: Insufficient options for proto=fd [ 638.347042][ T9026] 9pnet_fd: Insufficient options for proto=fd [ 642.876110][ T9074] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 644.115670][ T9082] 9pnet_fd: Insufficient options for proto=fd [ 646.423769][ T9109] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1051'. [ 649.867850][ T9141] 9pnet_fd: Insufficient options for proto=fd [ 652.419199][ T9170] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1065'. [ 655.483333][ T9209] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 658.469990][ T9235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1078'. [ 661.859428][ T9292] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1091'. [ 665.410226][ T9328] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 668.142532][ T9351] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 668.775524][ T9361] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1105'. [ 674.039518][ T9406] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1115'. [ 677.694493][ T4287] Bluetooth: hci4: command 0x0406 tx timeout [ 678.611199][ T9451] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 680.397314][ T9472] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1130'. [ 686.624164][ T9554] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1149'. [ 687.535818][ T9560] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 688.488940][ T9568] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 691.299919][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.306386][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.918559][ T9614] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 694.940746][ T9644] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 703.407129][ T9710] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 708.343772][ T9761] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 709.512694][ T9770] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 710.664758][ T9782] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 711.436549][ T9784] loop6: detected capacity change from 0 to 128 [ 714.443817][ T9813] device veth1_macvtap left promiscuous mode [ 715.249964][ T9819] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 716.330095][ T9834] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 721.210694][ T9893] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 726.217326][ T9962] device veth1_macvtap left promiscuous mode [ 733.281773][T10024] loop3: detected capacity change from 0 to 1024 [ 733.786208][T10024] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 736.425816][T10055] loop2: detected capacity change from 0 to 128 [ 737.909084][T10055] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 738.100780][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 740.722481][T10091] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 740.779428][T10085] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 741.176434][T10098] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1260'. [ 742.449601][T10114] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 744.443730][T10129] futex_wake_op: syz.1.1265 tries to shift op by 36; fix this program [ 744.559573][T10129] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1265'. [ 745.774742][T10132] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 746.516744][T10152] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 747.368166][T10158] futex_wake_op: syz.2.1274 tries to shift op by 144; fix this program [ 747.407290][T10158] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1274'. [ 750.203642][T10178] loop6: detected capacity change from 0 to 1024 [ 751.295518][ T7323] hfsplus: b-tree write err: -5, ino 25 [ 751.301351][ T7323] hfsplus: b-tree write err: -5, ino 4 [ 751.343254][ T7323] hfsplus: b-tree write err: -5, ino 2 [ 751.815838][T10194] loop6: detected capacity change from 0 to 32768 [ 752.415040][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.421588][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.293005][ T4753] read_mapping_page failed! [ 753.393493][ T4753] ERROR: (device loop6): txCommit: [ 753.393493][ T4753] [ 753.698494][ T4753] jfs_write_inode: jfs_commit_inode failed! [ 754.412115][T10225] xt_CT: You must specify a L4 protocol and not use inversions on it [ 755.565370][T10240] netlink: 72 bytes leftover after parsing attributes in process `syz.6.1286'. [ 756.325785][T10242] device veth1_macvtap left promiscuous mode [ 758.149070][T10265] loop5: detected capacity change from 0 to 128 [ 758.712185][T10265] FAT-fs (loop5): Directory bread(block 414) failed [ 758.719621][T10265] FAT-fs (loop5): Directory bread(block 415) failed [ 758.760349][T10265] FAT-fs (loop5): Directory bread(block 416) failed [ 758.767886][T10265] FAT-fs (loop5): Directory bread(block 417) failed [ 758.778488][T10265] FAT-fs (loop5): Directory bread(block 418) failed [ 758.788728][T10265] FAT-fs (loop5): Directory bread(block 419) failed [ 758.804977][T10265] FAT-fs (loop5): Directory bread(block 420) failed [ 759.319152][T10265] FAT-fs (loop5): Directory bread(block 421) failed [ 759.901933][T10282] FAT-fs (loop5): Directory bread(block 414) failed [ 759.909321][T10282] FAT-fs (loop5): Directory bread(block 415) failed [ 760.453306][T10284] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 762.564835][ T3656] libceph: connect (1)[c::]:6789 error -101 [ 762.975731][ T3656] libceph: mon0 (1)[c::]:6789 connect error [ 763.089127][T10285] ceph: No mds server is up or the cluster is laggy [ 763.254794][ T3656] libceph: connect (1)[c::]:6789 error -101 [ 763.260902][ T3656] libceph: mon0 (1)[c::]:6789 connect error [ 766.390058][T10328] device veth1_macvtap left promiscuous mode [ 767.262483][T10346] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 768.158110][T10351] loop6: detected capacity change from 0 to 512 [ 768.205224][T10351] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 768.908511][T10351] EXT4-fs (loop6): 1 truncate cleaned up [ 768.915539][T10351] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 773.153327][ T8114] EXT4-fs (loop6): unmounting filesystem. [ 773.353727][T10390] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1318'. [ 777.607423][T10433] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[7510] was attempted by " [ 778.133877][T10426] tty tty1: ldisc open failed (-12), clearing slot 0 [ 781.647396][T10469] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1331'. [ 784.324059][T10506] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 787.995888][T10533] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1346'. [ 788.250570][T10535] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1346'. [ 789.505245][T10552] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 790.964892][T10569] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 792.287216][T10585] loop1: detected capacity change from 0 to 1024 [ 792.533096][T10587] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[4276] was attempted by " [ 793.117558][ T27] audit: type=1326 audit(1785568308.523:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.046809][ T27] audit: type=1326 audit(1785568308.523:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.246791][ T27] audit: type=1326 audit(1785568308.523:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.324544][ T27] audit: type=1326 audit(1785568308.523:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.434693][ T27] audit: type=1326 audit(1785568308.523:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.520110][ T27] audit: type=1326 audit(1785568308.523:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.626497][ T27] audit: type=1326 audit(1785568308.523:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 794.761034][ T27] audit: type=1326 audit(1785568308.523:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 795.046048][T10613] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 795.999836][T10615] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1362'. [ 796.156273][ T27] audit: type=1326 audit(1785568308.523:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 796.268577][ T27] audit: type=1326 audit(1785568308.523:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10580 comm="syz.1.1358" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7fd42a19e019 code=0x7ffc0000 [ 799.588137][T10687] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 800.124896][T10694] xt_CT: You must specify a L4 protocol and not use inversions on it [ 801.160176][T10701] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 801.799649][T10702] netlink: 756 bytes leftover after parsing attributes in process `syz.2.1379'. [ 803.178988][T10703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1380'. [ 803.796016][T10720] block device autoloading is deprecated and will be removed. [ 806.634622][T10763] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 809.520613][T10785] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 812.845884][T10831] loop2: detected capacity change from 0 to 4096 [ 813.979987][T10847] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 813.987761][T10847] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 814.043968][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.060000][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 814.938149][T10847] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 818.626328][T10892] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 823.056566][T10907] syz.5.1422 uses obsolete (PF_INET,SOCK_PACKET) [ 823.456936][T10917] hub 1-0:1.0: USB hub found [ 823.465990][T10917] hub 1-0:1.0: 1 port detected [ 826.350662][T10949] input: syz1 as /devices/virtual/input/input11 [ 832.634165][T10996] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 834.675788][T11004] vivid-000: kernel_thread() failed [ 834.966322][T11014] loop5: detected capacity change from 0 to 64 [ 835.292988][T11021] Cannot find add_set index 0 as target [ 835.413777][T11023] syz.5.1442: attempt to access beyond end of device [ 835.413777][T11023] loop5: rw=0, sector=1024, nr_sectors = 2 limit=64 [ 835.427923][T11023] Buffer I/O error on dev loop5, logical block 512, async page read [ 835.436564][T11023] syz.5.1442: attempt to access beyond end of device [ 835.436564][T11023] loop5: rw=0, sector=113152, nr_sectors = 2 limit=64 [ 835.450030][T11023] Buffer I/O error on dev loop5, logical block 56576, async page read [ 838.021488][T11058] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 838.730169][T11053] comedi comedi0: 8255: I/O port conflict (0x5,4) [ 838.737534][T11053] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffffc,4) [ 838.745611][T11053] comedi comedi0: 8255: I/O port conflict (0x5,4) [ 838.752335][T11053] comedi comedi0: 8255: I/O port conflict (0x4,4) [ 838.759639][T11053] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffff7,4) [ 838.768578][T11053] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffff8,4) [ 838.776635][T11053] comedi comedi0: 8255: I/O port conflict (0x2,4) [ 838.800529][T11053] comedi comedi0: 8255: I/O port conflict (0xfffffffffffffffc,4) [ 838.808828][T11053] comedi comedi0: 8255: I/O port conflict (0xc3,4) [ 838.815844][T11053] comedi comedi0: 8255: I/O port conflict (0x1000007,4) [ 838.823160][T11053] comedi comedi0: 8255: I/O port conflict (0x1,4) [ 838.829973][T11053] comedi comedi0: 8255: I/O port conflict (0x10003,4) [ 838.837216][T11053] comedi comedi0: 8255: I/O port conflict (0x801000,4) [ 838.844551][T11053] comedi comedi0: 8255: I/O port conflict (0x7fffffff,4) [ 838.852080][T11053] comedi comedi0: 8255: I/O port conflict (0x3ff,4) [ 838.860593][T11053] comedi comedi0: 8255: I/O port conflict (0x1001010,4) [ 838.867975][T11053] comedi comedi0: 8255: I/O port conflict (0x1ff,4) [ 838.874954][T11053] comedi comedi0: 8255: I/O port conflict (0x8,4) [ 838.881744][T11053] comedi comedi0: 8255: I/O port conflict (0x3,4) [ 838.889008][T11053] comedi comedi0: 8255: I/O port conflict (0x8001,4) [ 838.896116][T11053] comedi comedi0: 8255: I/O port conflict (0x7,4) [ 840.668397][T11053] comedi comedi0: 8255: I/O port conflict (0x3ff,4) [ 842.098163][T11053] comedi comedi0: 8255: I/O port conflict (0x5,4) [ 842.107867][T11053] comedi comedi0: 8255: I/O port conflict (0x6,4) [ 842.171975][T11053] comedi comedi0: 8255: I/O port conflict (0x3,4) [ 842.182142][T11053] comedi comedi0: 8255: I/O port conflict (0xfffd,4) [ 842.278860][T11052] syz.6.1449 (11052) used greatest stack depth: 18128 bytes left [ 845.546608][T11115] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 846.573124][T11122] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 850.552344][T11139] loop2: detected capacity change from 0 to 64 [ 851.376719][T11140] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1464'. [ 851.607652][T11141] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1464'. [ 851.900250][T11139] hfs: bad catalog namelength [ 851.906391][T11139] hfs: get root inode failed [ 853.665197][T11160] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 854.046553][T11163] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 854.162428][ T9814] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 854.582112][ T9814] usb 2-1: Using ep0 maxpacket: 8 [ 854.611732][ T9814] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 854.678616][T11170] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 855.344890][ T9814] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 855.355159][ T9814] usb 2-1: config 0 has no interface number 0 [ 855.438010][ T9814] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 855.452165][T11174] loop6: detected capacity change from 0 to 256 [ 855.462591][T11174] exfat: Deprecated parameter 'utf8' [ 855.468305][T11174] exfat: Deprecated parameter 'utf8' [ 855.496203][T11174] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xf5acca1d, utbl_chksum : 0xe619d30d) [ 856.895489][ T9814] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.123234][ T9814] usb 2-1: Product: syz [ 857.229869][T11176] I/O error, dev loop3, sector 2 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 857.241567][T11176] hfsplus: unable to find HFS+ superblock [ 857.267636][ T9814] usb 2-1: Manufacturer: syz [ 857.315246][T11176] loop3: detected capacity change from 0 to 128 [ 857.356373][T11176] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 857.423128][ T9814] usb 2-1: SerialNumber: syz [ 858.159874][ T9814] usb 2-1: config 0 descriptor?? [ 858.921340][ T9814] usb 2-1: can't set config #0, error -71 [ 859.129632][ T9814] usb 2-1: USB disconnect, device number 2 [ 860.214727][T11185] ALSA: mixer_oss: invalid OSS volume '' [ 860.280724][T11185] ALSA: mixer_oss: invalid OSS volume '°#é¡ÙQ?ÊãxôGG-ÕBï~Ö ' [ 865.327705][T11224] loop1: detected capacity change from 0 to 32768 [ 865.390282][T11224] loop2: detected capacity change from 0 to 32768 [ 865.477386][T11227] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 866.031658][T11224] md: loop0 has zero or unknown size, marking faulty! [ 866.103812][T11224] md: error, md_import_device() returned -22 [ 866.425027][T11224] md/raid:md0: not clean -- starting background reconstruction [ 866.450206][T11224] md/raid:md0: invalid chunk size 0 [ 866.475454][T11224] md: pers->run() failed ... [ 866.566657][T11234] IPv6: syztnl0: Disabled Multicast RS [ 868.799703][T11253] binder: 11251:11253 ioctl 400c620e 200000003b00 returned -22 [ 868.807458][T11253] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1492'. [ 870.725575][T11260] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 873.158891][T11281] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 874.421964][T11286] NILFS (nullb0): couldn't find nilfs on the device [ 875.295377][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.301910][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 876.420590][T11315] mtrr: base(0x10000000) is not aligned on a size(0x0000) boundary [ 877.447758][T11321] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1506'. [ 879.421956][T11321] team0 (unregistering): Port device team_slave_0 removed [ 879.449953][T11321] team0 (unregistering): Port device team_slave_1 removed [ 879.815304][T11337] loop1: detected capacity change from 0 to 4096 [ 879.942892][T11337] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 880.074200][T11347] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 880.780366][T11337] ntfs3: loop1: Failed to load $BadClus. [ 884.036455][T11370] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1519'. [ 884.048359][T11370] 9pnet_virtio: no channels available for device syz [ 884.116577][T11374] loop5: detected capacity change from 0 to 1024 [ 884.126258][T11374] hfsplus: unable to parse mount options [ 886.327982][T11388] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1526'. [ 886.397744][T11392] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 887.295345][T11388] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1526'. [ 890.935610][T11429] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 891.393298][T11433] 9pnet_fd: Insufficient options for proto=fd [ 892.093720][T11439] overlayfs: fs on './cgroup' does not support file handles, falling back to index=off,nfs_export=off. [ 892.175724][T11439] overlayfs: fs on './cgroup' does not support file handles, falling back to xino=off. [ 892.651188][T11455] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 896.995188][T11496] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1547'. [ 898.835836][T11505] loop3: detected capacity change from 0 to 32768 [ 898.969224][T11514] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 899.619946][T11505] XFS (loop3): Mounting V5 Filesystem [ 899.876952][T11505] XFS (loop3): Ending clean mount [ 899.898288][T11505] XFS (loop3): Quotacheck needed: Please wait. [ 900.861715][T11505] XFS (loop3): Quotacheck: Done. [ 901.472202][ T27] kauditd_printk_skb: 58 callbacks suppressed [ 901.472222][ T27] audit: type=1800 audit(1785568672.634:89): pid=11537 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1550" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop3" ino=4429 res=0 errno=0 [ 901.763130][ T4284] XFS (loop3): Unmounting Filesystem [ 905.833788][T11570] xt_CT: You must specify a L4 protocol and not use inversions on it [ 907.208966][T11589] loop5: detected capacity change from 0 to 8 [ 907.303433][T11589] SQUASHFS error: lzo decompression failed, data probably corrupt [ 907.312673][T11589] SQUASHFS error: Failed to read block 0x91: -5 [ 907.318991][T11589] SQUASHFS error: Unable to read metadata cache entry [8f] [ 907.326503][T11589] SQUASHFS error: Unable to read inode 0x11f [ 907.622455][T11576] device syzkaller0 entered promiscuous mode [ 908.264182][T11602] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 909.097519][T11613] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 910.197416][T11622] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1577'. [ 911.251031][ T6891] Process accounting resumed [ 912.107621][T11622] team0 (unregistering): Port device team_slave_0 removed [ 912.193095][T11622] team0 (unregistering): Port device team_slave_1 removed [ 914.761593][T11653] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 914.803552][T11652] loop5: detected capacity change from 0 to 8 [ 914.825465][T11652] SQUASHFS error: Unable to read directory block [631:26] [ 915.345682][T11663] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 915.539051][T11670] loop5: detected capacity change from 0 to 8192 [ 916.695755][T11682] use of bytesused == 0 is deprecated and will be removed in the future, [ 916.871611][T11682] use the actual size instead. [ 917.905726][T10918] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 918.011684][T11692] afs: Bad value for 'source' [ 918.118498][T11692] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1592'. [ 918.164208][T10918] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 918.235928][T10918] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 918.274772][T10918] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 918.310312][T10918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.356025][T11682] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 918.583930][T11704] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1596'. [ 918.696370][T11704] input: syz0 as /devices/virtual/input/input12 [ 918.847139][ T3656] usb 6-1: USB disconnect, device number 2 [ 919.171378][T11711] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 920.291779][T11716] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 928.419624][T11751] loop3: detected capacity change from 0 to 1024 [ 928.492304][T11751] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 928.597882][T11761] loop6: detected capacity change from 0 to 8 [ 928.707441][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 932.522445][T11784] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 937.033141][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 937.039670][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 939.861898][T11830] xt_connbytes: Forcing CT accounting to be enabled [ 940.420755][T11833] Attempt to restore checkpoint with obsolete wellknown handles [ 941.339883][T11840] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 944.775273][ T4287] Bluetooth: hci4: command 0x0405 tx timeout [ 944.938159][ T4316] Process accounting resumed [ 944.952641][T11875] 9pnet_fd: Insufficient options for proto=fd [ 944.961392][T11875] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 949.100138][T11910] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 956.261349][T11942] loop3: detected capacity change from 0 to 8192 [ 962.494207][T11976] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.504123][T11976] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.512959][T11976] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.521718][T11976] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.553632][T11976] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 962.563114][T11976] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 962.572426][T11976] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 962.581433][T11976] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 964.214410][T11988] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 965.369457][T11995] loop1: detected capacity change from 0 to 512 [ 965.383366][T11995] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 965.420257][T11995] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802e028, mo2=0002] [ 965.432571][T11995] System zones: 0-2, 18-18, 34-35 [ 965.476861][T11995] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 965.489862][T11995] ext4 filesystem being mounted at /324/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 966.564420][T12014] libceph: secret too big 32 [ 967.072264][ T27] audit: type=1800 audit(1785568735.784:90): pid=12011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1662" name="bus" dev="loop1" ino=19 res=0 errno=0 [ 967.092680][ C1] vkms_vblank_simulate: vblank timer overrun [ 967.221778][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 967.713671][T11997] Process accounting resumed [ 969.016378][T12038] loop3: detected capacity change from 0 to 1024 [ 970.024067][T12038] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 970.725703][T12038] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 971.336902][T12058] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 971.735293][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 971.954784][T12061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1676'. [ 973.293826][T12066] input: syz0 as /devices/virtual/input/input14 [ 976.173587][T12087] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1680'. [ 982.253365][ T4320] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 982.676795][T12143] Process accounting resumed [ 982.800540][ T4320] usb 6-1: Using ep0 maxpacket: 32 [ 983.305988][ T4320] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 983.411375][ T4320] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 983.433447][ T4320] usb 6-1: config 0 interface 0 has no altsetting 0 [ 983.456989][ T4320] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 983.731295][ T4320] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.409443][ T4320] usb 6-1: Product: syz [ 984.413731][ T4320] usb 6-1: Manufacturer: syz [ 984.418491][ T4320] usb 6-1: SerialNumber: syz [ 984.427715][ T4320] usb 6-1: config 0 descriptor?? [ 984.557523][ T4320] gs_usb 6-1:0.0: Required endpoints not found [ 984.634645][ T4320] usb 6-1: USB disconnect, device number 3 [ 985.047576][T12179] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 986.425602][T12183] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 987.029900][T12189] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1695'. [ 987.040238][T12189] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1695'. [ 990.311074][T12210] input: syz1 as /devices/virtual/input/input15 [ 991.500421][T12227] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 991.773805][T12230] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 992.486595][T12237] loop3: detected capacity change from 0 to 2048 [ 992.581336][T12237] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 992.590662][T12237] ext4 filesystem being mounted at /370/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 993.404180][T12249] loop5: detected capacity change from 0 to 1764 [ 993.654607][T12250] can0: slcan on ttyS3. [ 994.925969][ T7819] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 995.199489][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 995.238030][T12250] can0 (unregistered): slcan off ttyS3. [ 996.268018][T12279] loop5: detected capacity change from 0 to 512 [ 996.287275][T12279] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 996.371658][T12279] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802e028, mo2=0002] [ 996.392314][T12279] System zones: 0-2, 18-18, 34-35 [ 996.428356][T12279] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 996.482644][T12279] ext4 filesystem being mounted at /188/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 996.835535][T12292] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 996.845724][T12289] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 997.147478][ T27] audit: type=1800 audit(1785568763.649:91): pid=12295 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1725" name="bus" dev="loop5" ino=19 res=0 errno=0 [ 997.670133][ T7510] EXT4-fs (loop5): unmounting filesystem. [ 998.883974][T12311] loop5: detected capacity change from 0 to 1024 [ 999.183589][T12311] EXT4-fs error (device loop5): ext4_ext_check_inode:520: inode #11: comm syz.5.1730: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 1, max 65535(4), depth 65535(65535) [ 999.210221][T12311] EXT4-fs error (device loop5): ext4_orphan_get:1410: comm syz.5.1730: couldn't read orphan inode 11 (err -117) [ 999.224092][T12311] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 999.630136][ T7510] EXT4-fs (loop5): unmounting filesystem. [ 999.923686][T12325] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1000.627083][T12333] Bluetooth: MGMT ver 1.22 [ 1004.106879][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 1004.113287][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 1004.217590][T12334] loop1: detected capacity change from 0 to 32768 [ 1005.504462][T12350] libceph: secret too big 32 [ 1007.132362][T12355] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1744'. [ 1007.755516][T12363] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1008.347136][T12372] Cannot find set identified by id 0 to match [ 1010.526403][T12390] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1012.003563][T12397] block device autoloading is deprecated and will be removed. [ 1014.009861][ T27] audit: type=1107 audit(1785568778.661:92): pid=12409 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='f‹lPH]‰€x»ôµî®@' [ 1016.891435][T12446] loop6: detected capacity change from 0 to 1024 [ 1017.193345][T12450] Mass Storage Function, version: 2009/09/11 [ 1017.238132][T12450] LUN: removable file: (no medium) [ 1017.358787][ T27] audit: type=1800 audit(1785568782.297:93): pid=12449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1764" name="cdrom" dev="configfs" ino=59970 res=0 errno=0 [ 1017.414183][T12456] Bluetooth: MGMT ver 1.22 [ 1018.347123][T12456] hfsplus: xattr searching failed [ 1018.457581][T12457] hfsplus: xattr searching failed [ 1018.780798][ T4320] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1018.997786][ T4320] usb 2-1: Using ep0 maxpacket: 32 [ 1019.012366][ T4320] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1019.026566][T12470] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1019.427945][T12471] can0: slcan on ttyS3. [ 1019.481387][ T4320] usb 2-1: New USB device found, idVendor=046d, idProduct=c227, bcdDevice= 0.00 [ 1019.515493][ T4320] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1019.565639][ T4320] usb 2-1: config 0 descriptor?? [ 1020.997618][ T4320] usbhid 2-1:0.0: can't add hid device: -71 [ 1021.007785][ T4320] usbhid: probe of 2-1:0.0 failed with error -71 [ 1021.029247][ T4320] usb 2-1: USB disconnect, device number 3 [ 1021.052060][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.058915][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.068798][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.082332][T12479] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1021.098977][T12479] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1021.136483][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.145686][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.155020][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.162726][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1021.173294][T12479] wlan0 speed is unknown, defaulting to 1000 [ 1022.802585][T12471] can0 (unregistered): slcan off ttyS3. [ 1023.071715][T12492] loop1: detected capacity change from 0 to 2048 [ 1023.369322][T12492] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 1023.421781][T12492] ext4 filesystem being mounted at /343/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1025.535088][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 1025.665207][T12507] overlayfs: missing 'lowerdir' [ 1027.944888][T12519] bridge0: port 3(syz_tun) entered blocking state [ 1027.964218][T12519] bridge0: port 3(syz_tun) entered disabled state [ 1028.071733][T12519] device syz_tun entered promiscuous mode [ 1028.090000][T12519] bridge0: port 3(syz_tun) entered blocking state [ 1028.097389][T12519] bridge0: port 3(syz_tun) entered forwarding state [ 1029.723987][T12528] device syz_tun entered promiscuous mode [ 1033.029996][T12544] loop3: detected capacity change from 0 to 512 [ 1033.070028][T12544] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 1033.112241][T12544] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802e01c, mo2=0002] [ 1033.122207][T12544] System zones: 1-12 [ 1033.127539][T12544] EXT4-fs (loop3): orphan cleanup on readonly fs [ 1033.155513][T12544] EXT4-fs error (device loop3): ext4_clear_blocks:883: inode #11: comm syz.3.1772: attempt to clear invalid blocks 1024 len 1 [ 1033.258079][T12544] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.1772: bg 0: block 361: padding at end of block bitmap is not set [ 1033.301557][T12544] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 1033.325818][T12544] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1772: invalid indirect mapped block 1811939328 (level 0) [ 1033.498908][T12544] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1772: invalid indirect mapped block 2 (level 2) [ 1033.563747][T12544] EXT4-fs (loop3): 1 truncate cleaned up [ 1033.569546][T12544] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1033.655542][T12553] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1033.965169][T12556] loop5: detected capacity change from 0 to 2048 [ 1034.003579][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 1034.035901][T12556] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1034.091388][T12556] ext4 filesystem being mounted at /204/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1035.048442][T12568] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1787'. [ 1035.450204][T12571] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1035.560572][ T7510] EXT4-fs (loop5): unmounting filesystem. [ 1036.276076][T12585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1791'. [ 1036.286518][T12585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1791'. [ 1042.743447][T12616] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1049.612975][T12663] sctp: failed to load transform for md5: -4 [ 1050.903982][T12677] Process accounting resumed [ 1051.083485][T12686] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 1051.090861][T12686] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1051.131131][T12689] ALSA: mixer_oss: invalid OSS volume 'SPEA9¦KŸsË â¢+ñI2KER' [ 1051.152770][T12686] vhci_hcd vhci_hcd.0: Device attached [ 1051.336272][T12685] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1051.771064][ T4320] usb 36-1: SetAddress Request (2) to port 0 [ 1051.795915][ T4320] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1051.971183][T12687] vhci_hcd: connection reset by peer [ 1052.010737][ T4394] vhci_hcd: stop threads [ 1052.108819][ T4394] vhci_hcd: release socket [ 1052.378801][ T4394] vhci_hcd: disconnect device [ 1054.414053][ T27] audit: type=1800 audit(1785568816.492:94): pid=12707 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1820" name="local" dev="configfs" ino=61178 res=0 errno=0 [ 1054.500164][T12708] loop3: detected capacity change from 0 to 4096 [ 1054.621621][ T27] audit: type=1800 audit(1785568816.547:95): pid=12707 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1820" name="scan_secs" dev="configfs" ino=61180 res=0 errno=0 [ 1054.788872][T12708] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 1055.795289][T12730] device veth0_macvtap left promiscuous mode [ 1055.890303][T12735] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1057.414148][T12730] device veth0_macvtap entered promiscuous mode [ 1057.420366][ T4320] usb 36-1: device descriptor read/8, error -110 [ 1057.916530][ T4320] usb usb36-port1: attempt power cycle [ 1060.347619][ T4320] usb usb36-port1: unable to enumerate USB device [ 1060.466839][T12781] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1831'. [ 1060.476195][T12781] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1831'. [ 1061.895393][ T6920] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1062.032609][T12799] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1062.120816][ T6920] usb 4-1: Using ep0 maxpacket: 16 [ 1062.128518][ T6920] usb 4-1: config 111 has too many interfaces: 116, using maximum allowed: 32 [ 1062.150223][ T6920] usb 4-1: config 111 has an invalid descriptor of length 47, skipping remainder of the config [ 1062.193410][ T6920] usb 4-1: config 111 has 0 interfaces, different from the descriptor's value: 116 [ 1062.213617][ T6920] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1062.231830][ T6920] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1062.249880][ T6920] usb 4-1: Product: syz [ 1062.260173][ T6920] usb 4-1: Manufacturer: syz [ 1062.277070][ T6920] usb 4-1: SerialNumber: syz [ 1062.478880][T12809] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1062.564839][ T6920] usb 4-1: USB disconnect, device number 2 [ 1064.717813][ T4287] Bluetooth: hci2: unexpected subevent 0x0e length: 32 > 15 [ 1065.893090][T12843] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1845'. [ 1067.966055][T12860] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1848'. [ 1069.561822][T12882] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1070.168010][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 1070.174808][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 1072.090203][T12903] device syz_tun entered promiscuous mode [ 1072.945826][T12906] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1073.535250][T12917] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1074.926658][T12922] atomic_op ffff888057b36198 conn xmit_atomic 0000000000000000 [ 1077.482834][T12943] loop6: detected capacity change from 0 to 131072 [ 1077.497582][T12943] F2FS-fs (loop6): invalid crc value [ 1077.907632][T12943] F2FS-fs (loop6): Found nat_bits in checkpoint [ 1077.953136][T12943] F2FS-fs (loop6): Cannot turn on quotas: -2 on 2 [ 1077.974975][T12943] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 1078.298791][T12954] F2FS-fs (loop6): sanity_check_inode: inode (ino=4) has corrupted i_extra_isize: 65535, max: 36 [ 1080.149535][T12974] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1080.633385][T12981] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1081.870961][T12995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1877'. [ 1084.611217][T13013] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1087.834980][T13040] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1087.939009][T13041] overlayfs: missing 'lowerdir' [ 1090.799152][T13051] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1889'. [ 1094.107480][T13085] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1095.576652][T13103] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1095.701958][T13107] loop5: detected capacity change from 0 to 1024 [ 1098.101542][T13118] loop5: detected capacity change from 0 to 512 [ 1098.136316][T13118] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 1098.963632][T13127] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1901'. [ 1099.160461][T13118] EXT4-fs error (device loop5): ext4_orphan_get:1405: inode #17: comm syz.5.1900: inode has both inline data and extents flags [ 1099.913036][T13118] EXT4-fs error (device loop5): ext4_orphan_get:1410: comm syz.5.1900: couldn't read orphan inode 17 (err -117) [ 1099.944813][T13118] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1100.012642][T13116] EXT4-fs error (device loop5): ext4_validate_block_bitmap:438: comm syz.5.1900: bg 0: block 65: padding at end of block bitmap is not set [ 1100.035928][T13116] Quota error (device loop5): write_blk: dquota write failed [ 1100.044370][T13116] Quota error (device loop5): qtree_write_dquot: Error -117 occurred while creating quota [ 1100.054798][T13116] EXT4-fs error (device loop5): ext4_acquire_dquot:6841: comm syz.5.1900: Failed to acquire dquot type 0 [ 1100.461933][ T7510] EXT4-fs (loop5): unmounting filesystem. [ 1100.616230][T13140] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1103.210009][T13158] loop3: detected capacity change from 0 to 8 [ 1106.664293][T13186] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1107.350538][T13189] SET target dimension over the limit! [ 1107.954052][T13193] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1917'. [ 1108.989456][T13193] bridge0: port 3(syz_tun) entered disabled state [ 1109.105626][T13193] device syz_tun left promiscuous mode [ 1109.113285][T13193] bridge0: port 3(syz_tun) entered disabled state [ 1109.568820][T13213] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1110.082022][T13217] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1110.779700][T13220] netlink: 236 bytes leftover after parsing attributes in process `syz.1.1924'. [ 1111.694244][T13229] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1913'. [ 1113.333064][T13251] binder: 13247:13251 unknown command 32 [ 1113.338930][T13251] binder: 13247:13251 ioctl c0306201 2000000001c0 returned -22 [ 1114.674830][T13256] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1929'. [ 1115.052134][ T5379] wlan0 speed is unknown, defaulting to 1000 [ 1117.789843][T13299] loop3: detected capacity change from 0 to 1024 [ 1117.837912][T13299] EXT4-fs (loop3): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 1117.847567][T13299] EXT4-fs (loop3): Couldn't mount because of unsupported optional features (40000) [ 1118.058150][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1118.096775][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 1118.265887][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 1118.317207][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 1118.370661][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 1118.397381][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 1118.408044][T13300] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 1119.185698][T13310] loop3: detected capacity change from 0 to 1024 [ 1119.193611][T13310] hfsplus: unable to find HFS+ superblock [ 1120.628965][T13036] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1122.131103][T13329] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1122.279357][T13339] loop5: detected capacity change from 0 to 8 [ 1123.552186][T13350] overlayfs: missing 'lowerdir' [ 1123.980603][T13333] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1128.048319][T13393] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1959'. [ 1129.080397][T13401] loop5: detected capacity change from 0 to 256 [ 1129.324926][T13404] SET target dimension over the limit! [ 1129.727695][T13036] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1134.664953][T13459] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1134.931870][T13458] overlayfs: missing 'lowerdir' [ 1135.475906][T13470] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1976'. [ 1135.518556][T13470] loop3: detected capacity change from 0 to 512 [ 1135.529341][T13470] ext4: Unknown parameter 'nouser_xattr' [ 1137.085114][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 1137.878995][T13494] tmpfs: Unknown parameter 'quota' [ 1141.240022][T13524] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1142.413385][T13538] netlink: 236 bytes leftover after parsing attributes in process `syz.5.1990'. [ 1145.739713][T13569] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 1145.760619][T13569] cramfs: wrong magic [ 1148.222416][T13594] netlink: 'syz.1.2003': attribute type 3 has an invalid length. [ 1149.404966][T13610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2006'. [ 1150.217047][ T27] audit: type=1326 audit(1785568904.887:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13599 comm="syz.3.2004" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa204d9e019 code=0x0 [ 1156.375780][T13658] UBIFS error (pid: 13658): cannot open "(null)", error -22 [ 1156.508846][T13661] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2021'. [ 1158.394326][T13684] netlink: 'syz.5.2024': attribute type 5 has an invalid length. [ 1158.402203][T13684] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2024'. [ 1158.429738][T13684] debugfs: Directory ' j¦!ÐÕ(á=|èl'rŒý00000000000000000003' with parent 'ieee80211' already present! [ 1161.329889][T13696] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1164.582672][T13737] fuse: Unknown parameter '0x000000000000000900000000000000000000' [ 1165.008818][T13738] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1165.264277][T13740] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2034'. [ 1165.614547][T13742] ieee802154 phy1 wpan1: encryption failed: -22 [ 1168.485520][T13769] loop6: detected capacity change from 0 to 512 [ 1170.122301][T13786] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2050'. [ 1170.584665][T13791] netlink: 'syz.1.2051': attribute type 5 has an invalid length. [ 1170.592621][T13791] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2051'. [ 1170.619507][T13791] debugfs: Directory ' j¦!ÐÕ(á=|èl'rŒý00000000000000000003' with parent 'ieee80211' already present! [ 1173.623192][T13824] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1173.660806][T13827] ieee802154 phy1 wpan1: encryption failed: -22 [ 1176.508101][T13832] fuse: Bad value for 'fd' [ 1176.851773][T13835] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1177.855266][T13845] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1179.132546][T13860] netlink: 'syz.6.2065': attribute type 5 has an invalid length. [ 1179.140459][T13860] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2065'. [ 1179.164742][T13860] debugfs: Directory ' j¦!ÐÕ(á=|èl'rŒý00000000000000000003' with parent 'ieee80211' already present! [ 1182.380392][T13881] loop6: detected capacity change from 0 to 512 [ 1182.549491][T13881] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 1182.580265][T13881] ext4 filesystem being mounted at /217/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1184.382065][ T8114] EXT4-fs (loop6): unmounting filesystem. [ 1186.815146][T13921] netlink: 'syz.2.2081': attribute type 5 has an invalid length. [ 1186.823236][T13921] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2081'. [ 1186.845456][T13921] sysfs: cannot create duplicate filename '/class/ieee80211/ j¦!ÐÕ(á=|èl'rŒý00000000000000000003' [ 1186.856395][T13921] CPU: 0 PID: 13921 Comm: syz.2.2081 Not tainted syzkaller #0 [ 1186.863912][T13921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1186.874020][T13921] Call Trace: [ 1186.877341][T13921] [ 1186.880313][T13921] dump_stack_lvl+0x188/0x24e [ 1186.885117][T13921] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1186.890890][T13921] ? show_regs_print_info+0x12/0x12 [ 1186.896140][T13921] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1186.901846][T13921] sysfs_warn_dup+0x8a/0xa0 [ 1186.906424][T13921] sysfs_do_create_link_sd+0xc0/0x110 [ 1186.911853][T13921] device_add+0x83b/0x1050 [ 1186.916424][T13921] wiphy_register+0x1d8b/0x2aa0 [ 1186.921457][T13921] ? cfg80211_event_work+0x40/0x40 [ 1186.926619][T13921] ? minstrel_ht_alloc+0x894/0xa20 [ 1186.931849][T13921] ? ieee80211_init_rate_ctrl_alg+0x276/0x5e0 [ 1186.938002][T13921] ? ieee80211_init_rate_ctrl_alg+0x55e/0x5e0 [ 1186.944154][T13921] ieee80211_register_hw+0x2d48/0x39f0 [ 1186.949748][T13921] ? ieee80211_register_hw+0xee1/0x39f0 [ 1186.955341][T13921] ? ieee80211_register_hw+0xee1/0x39f0 [ 1186.960949][T13921] ? ieee80211_tasklet_handler+0x20/0x20 [ 1186.966633][T13921] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1186.972594][T13921] ? __debug_object_init+0xed/0x440 [ 1186.977848][T13921] ? memset+0x1e/0x40 [ 1186.981889][T13921] ? __hrtimer_init+0x189/0x270 [ 1186.986819][T13921] mac80211_hwsim_new_radio+0x2927/0x4cd0 [ 1186.992716][T13921] ? memcpy+0x3c/0x60 [ 1186.996757][T13921] hwsim_new_radio_nl+0xab7/0xc90 [ 1187.001852][T13921] genl_family_rcv_msg_doit+0x22f/0x350 [ 1187.007517][T13921] ? end_current_label_crit_section+0x170/0x170 [ 1187.013846][T13921] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 1187.019795][T13921] ? bpf_lsm_capable+0x5/0x10 [ 1187.024521][T13921] ? security_capable+0x85/0xb0 [ 1187.029440][T13921] genl_rcv_msg+0x601/0x790 [ 1187.034000][T13921] ? genl_bind+0x360/0x360 [ 1187.038458][T13921] ? hwsim_tx_info_frame_received_nl+0xe30/0xe30 [ 1187.044859][T13921] netlink_rcv_skb+0x1ef/0x440 [ 1187.049767][T13921] ? genl_bind+0x360/0x360 [ 1187.054227][T13921] ? netlink_ack+0x1160/0x1160 [ 1187.059104][T13921] ? down_read+0x1a8/0x2d0 [ 1187.063569][T13921] genl_rcv+0x24/0x40 [ 1187.067591][T13921] netlink_unicast+0x7ad/0x920 [ 1187.072416][T13921] netlink_sendmsg+0x8ad/0xbd0 [ 1187.077283][T13921] ? netlink_getsockopt+0x550/0x550 [ 1187.082539][T13921] ? apparmor_socket_sendmsg+0x16c/0x330 [ 1187.088252][T13921] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1187.093586][T13921] ? security_socket_sendmsg+0x7c/0xa0 [ 1187.099094][T13921] ? netlink_getsockopt+0x550/0x550 [ 1187.104386][T13921] ____sys_sendmsg+0x5ed/0x9a0 [ 1187.109351][T13921] ? __sys_sendmsg_sock+0x30/0x30 [ 1187.114428][T13921] ? __import_iovec+0x306/0x510 [ 1187.119355][T13921] ? import_iovec+0x6f/0xa0 [ 1187.123919][T13921] ___sys_sendmsg+0x2a2/0x360 [ 1187.128659][T13921] ? __sys_sendmsg+0x2a0/0x2a0 [ 1187.133526][T13921] __se_sys_sendmsg+0x1c3/0x2b0 [ 1187.138431][T13921] ? __x64_sys_sendmsg+0x80/0x80 [ 1187.143438][T13921] ? lockdep_hardirqs_on+0x94/0x140 [ 1187.148706][T13921] do_syscall_64+0x4c/0xa0 [ 1187.153183][T13921] ? clear_bhb_loop+0x60/0xb0 [ 1187.157906][T13921] ? clear_bhb_loop+0x60/0xb0 [ 1187.162634][T13921] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1187.168601][T13921] RIP: 0033:0x7fae88f9e019 [ 1187.173063][T13921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1187.192721][T13921] RSP: 002b:00007fae871d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1187.201203][T13921] RAX: ffffffffffffffda RBX: 00007fae89226180 RCX: 00007fae88f9e019 [ 1187.209214][T13921] RDX: 0000000024000094 RSI: 0000200000000100 RDI: 0000000000000003 [ 1187.217231][T13921] RBP: 00007fae8903500c R08: 0000000000000000 R09: 0000000000000000 [ 1187.225249][T13921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1187.233259][T13921] R13: 00007fae89226218 R14: 00007fae89226180 R15: 00007ffe4401c5b8 [ 1187.241329][T13921] [ 1187.685891][T13922] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 1187.696976][T13922] cramfs: wrong magic [ 1187.711597][T13922] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2074'. [ 1187.728394][T13922] bridge0: port 2(bridge_slave_1) entered disabled state [ 1187.735714][T13922] bridge0: port 1(bridge_slave_0) entered disabled state [ 1191.912684][T13958] loop6: detected capacity change from 0 to 512 [ 1195.820388][T13974] 0x000000000007-0x000000020000 : "" [ 1195.867869][T13974] ftl_cs: FTL header corrupt! [ 1199.272069][T13987] fuse: Unknown parameter '0x000000000000000900000000000000000000' [ 1201.788667][T14030] bridge0: port 3(erspan0) entered blocking state [ 1201.795298][T14030] bridge0: port 3(erspan0) entered disabled state [ 1201.803169][T14030] device erspan0 entered promiscuous mode [ 1201.811565][T14030] bridge0: port 3(erspan0) entered blocking state [ 1201.818203][T14030] bridge0: port 3(erspan0) entered forwarding state [ 1201.830174][T14030] device erspan0 left promiscuous mode [ 1201.835921][T14030] bridge0: port 3(erspan0) entered disabled state [ 1201.982679][T14031] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2113'. [ 1201.991898][T14031] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2113'. [ 1203.024750][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 1208.554979][T14082] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2125'. [ 1208.564079][T14082] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2125'. [ 1209.682180][T14103] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1209.695639][T14100] IPVS: stopping master sync thread 14103 ... [ 1209.805258][T14107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2130'. [ 1210.095250][T14110] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1214.577059][T14153] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1219.657030][T14169] device bond1 entered promiscuous mode [ 1219.688165][T14169] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1219.976854][T14196] lo speed is unknown, defaulting to 1000 [ 1219.984646][T14196] lo speed is unknown, defaulting to 1000 [ 1219.992861][T14196] lo speed is unknown, defaulting to 1000 [ 1220.009084][T14196] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1220.052477][T14196] lo speed is unknown, defaulting to 1000 [ 1220.081056][T14196] lo speed is unknown, defaulting to 1000 [ 1220.113783][T14196] lo speed is unknown, defaulting to 1000 [ 1220.120332][T14196] lo speed is unknown, defaulting to 1000 [ 1220.126857][T14196] lo speed is unknown, defaulting to 1000 [ 1220.473098][T14203] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1220.733697][T14204] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2157'. [ 1221.916681][T14221] futex_wake_op: syz.2.2162 tries to shift op by 144; fix this program [ 1222.584325][T14217] loop3: detected capacity change from 0 to 4096 [ 1222.811011][T14217] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 1224.144623][T14247] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1229.193741][ T4753] rpcbind: server 127.0.0.1 not responding, timed out [ 1229.440841][T14310] netlink: 'syz.2.2181': attribute type 2 has an invalid length. [ 1230.308750][T14322] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1230.980410][T14332] loop3: detected capacity change from 0 to 1024 [ 1230.993088][T14332] EXT4-fs: Ignoring removed bh option [ 1231.059896][T14332] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a80ec028, mo2=0002] [ 1231.068146][T14332] System zones: 0-1, 3-12 [ 1231.352007][T14332] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 1232.384327][T14357] futex_wake_op: syz.5.2192 tries to shift op by 144; fix this program [ 1232.424261][T14355] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1232.433064][T14355] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1233.369115][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 1234.444924][T14371] loop3: detected capacity change from 0 to 1024 [ 1234.536902][T14371] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1235.588317][ T27] audit: type=1800 audit(1786093784.081:97): pid=14387 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2195" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 1236.180280][ T4284] EXT4-fs (loop3): unmounting filesystem. [ 1236.315514][T14394] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1236.985572][T14402] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1238.244580][T14424] syz.3.2209 sent an empty control message without MSG_MORE. [ 1240.327394][T14418] device bond1 entered promiscuous mode [ 1240.334977][T14418] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1240.678434][T14442] futex_wake_op: syz.3.2212 tries to shift op by 144; fix this program [ 1240.695760][T14442] loop3: detected capacity change from 0 to 256 [ 1240.744635][T14442] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 1240.772115][ T27] audit: type=1800 audit(1786093789.012:98): pid=14442 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2212" name="file1" dev="loop3" ino=1048706 res=0 errno=0 [ 1240.792188][ C1] vkms_vblank_simulate: vblank timer overrun [ 1240.814562][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.814562][T14442] loop3: rw=0, sector=184, nr_sectors = 120 limit=256 [ 1240.836086][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.836086][T14442] loop3: rw=524288, sector=664, nr_sectors = 256 limit=256 [ 1240.853086][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.853086][T14442] loop3: rw=524288, sector=920, nr_sectors = 256 limit=256 [ 1240.867570][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.867570][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.881220][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.881220][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.894519][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.894519][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.907798][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.907798][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.921100][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.921100][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.934382][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.934382][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1240.947671][T14442] syz.3.2212: attempt to access beyond end of device [ 1240.947671][T14442] loop3: rw=0, sector=664, nr_sectors = 8 limit=256 [ 1241.972410][T14450] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1243.688568][T14470] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1244.687631][T14481] trusted_key: encrypted_key: insufficient parameters specified [ 1249.772797][T14527] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1249.926327][T14533] futex_wake_op: syz.3.2234 tries to shift op by 144; fix this program [ 1251.016574][T14545] loop6: detected capacity change from 0 to 1024 [ 1251.075536][T14545] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 1252.072083][ T8114] EXT4-fs (loop6): unmounting filesystem. [ 1253.341413][T14568] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2241'. [ 1253.895257][T14571] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2241'. [ 1254.474408][T14583] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1254.870097][T14585] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1259.144443][T14629] printk: console [ttyGS0] disabled [ 1259.935045][T14642] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1263.089481][T14681] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1263.831778][T14692] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2272'. [ 1263.846264][T14696] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1264.006516][T14699] [ 1264.008927][T14699] ====================================================== [ 1264.015989][T14699] WARNING: possible circular locking dependency detected [ 1264.023057][T14699] syzkaller #0 Not tainted [ 1264.027506][T14699] ------------------------------------------------------ [ 1264.034576][T14699] syz.1.2275/14699 is trying to acquire lock: [ 1264.040677][T14699] ffff88802311f900 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_depend_item_unlocked+0x14f/0x430 [ 1264.052275][T14699] [ 1264.052275][T14699] but task is already holding lock: [ 1264.059676][T14699] ffff888058a8fd20 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x144/0x580 [ 1264.068889][T14699] [ 1264.068889][T14699] which lock already depends on the new lock. [ 1264.068889][T14699] [ 1264.079333][T14699] [ 1264.079333][T14699] the existing dependency chain (in reverse order) is: [ 1264.088396][T14699] [ 1264.088396][T14699] -> #2 (&opts->dep_lock){+.+.}-{3:3}: [ 1264.096105][T14699] __mutex_lock+0x12d/0xae0 [ 1264.101200][T14699] tcm_set_name+0x26/0x90 [ 1264.106105][T14699] function_make+0x195/0x350 [ 1264.111350][T14699] configfs_mkdir+0x511/0x9e0 [ 1264.116696][T14699] vfs_mkdir+0x386/0x570 [ 1264.121505][T14699] do_mkdirat+0x1d8/0x440 [ 1264.126401][T14699] __x64_sys_mkdir+0x6a/0x80 [ 1264.131638][T14699] do_syscall_64+0x4c/0xa0 [ 1264.136626][T14699] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1264.143102][T14699] [ 1264.143102][T14699] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 1264.151420][T14699] __mutex_lock+0x12d/0xae0 [ 1264.156506][T14699] uvcg_streaming_header_allow_link+0x6d/0x4a0 [ 1264.163323][T14699] configfs_symlink+0x5a4/0x13c0 [ 1264.168827][T14699] vfs_symlink+0x245/0x3d0 [ 1264.173822][T14699] do_symlinkat+0x1b6/0x400 [ 1264.178899][T14699] __x64_sys_symlinkat+0x95/0xa0 [ 1264.184404][T14699] do_syscall_64+0x4c/0xa0 [ 1264.189396][T14699] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1264.195871][T14699] [ 1264.195871][T14699] -> #0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 1264.204627][T14699] __lock_acquire+0x2d18/0x7c40 [ 1264.210049][T14699] lock_acquire+0x1bb/0x4a0 [ 1264.215127][T14699] down_write+0x36/0x60 [ 1264.219850][T14699] configfs_depend_item_unlocked+0x14f/0x430 [ 1264.226416][T14699] usbg_make_tpg+0x1f3/0x580 [ 1264.231610][T14699] target_fabric_make_tpg+0xa0/0x6d0 [ 1264.237571][T14699] configfs_mkdir+0x511/0x9e0 [ 1264.242821][T14699] vfs_mkdir+0x386/0x570 [ 1264.247634][T14699] do_mkdirat+0x1d8/0x440 [ 1264.252563][T14699] __x64_sys_mkdir+0x6a/0x80 [ 1264.257723][T14699] do_syscall_64+0x4c/0xa0 [ 1264.262750][T14699] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1264.269222][T14699] [ 1264.269222][T14699] other info that might help us debug this: [ 1264.269222][T14699] [ 1264.279490][T14699] Chain exists of: [ 1264.279490][T14699] &sb->s_type->i_mutex_key#21 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 1264.279490][T14699] [ 1264.294289][T14699] Possible unsafe locking scenario: [ 1264.294289][T14699] [ 1264.301783][T14699] CPU0 CPU1 [ 1264.307200][T14699] ---- ---- [ 1264.312609][T14699] lock(&opts->dep_lock); [ 1264.317072][T14699] lock(gadget_subsys.su_mutex); [ 1264.324694][T14699] lock(&opts->dep_lock); [ 1264.331783][T14699] lock(&sb->s_type->i_mutex_key#21); [ 1264.337322][T14699] [ 1264.337322][T14699] *** DEADLOCK *** [ 1264.337322][T14699] [ 1264.345499][T14699] 5 locks held by syz.1.2275/14699: [ 1264.350731][T14699] #0: ffff8880197a0460 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 1264.360049][T14699] #1: ffff8880457ddaa0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20b/0x450 [ 1264.370974][T14699] #2: ffffffff8d4e96b0 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b5/0x9e0 [ 1264.380817][T14699] #3: ffffffff8d8089e8 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf4/0x580 [ 1264.390580][T14699] #4: ffff888058a8fd20 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x144/0x580 [ 1264.400148][T14699] [ 1264.400148][T14699] stack backtrace: [ 1264.406079][T14699] CPU: 1 PID: 14699 Comm: syz.1.2275 Not tainted syzkaller #0 [ 1264.413586][T14699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1264.423686][T14699] Call Trace: [ 1264.427007][T14699] [ 1264.429976][T14699] dump_stack_lvl+0x188/0x24e [ 1264.434712][T14699] ? load_image+0x410/0x410 [ 1264.439298][T14699] ? show_regs_print_info+0x12/0x12 [ 1264.444566][T14699] ? print_circular_bug+0x12b/0x1a0 [ 1264.449826][T14699] check_noncircular+0x296/0x330 [ 1264.454839][T14699] ? add_chain_block+0x9b0/0x9b0 [ 1264.459839][T14699] ? lockdep_lock+0xf1/0x1f0 [ 1264.464493][T14699] ? _find_first_zero_bit+0xd2/0x100 [ 1264.469840][T14699] __lock_acquire+0x2d18/0x7c40 [ 1264.474760][T14699] ? __kernel_text_address+0x9/0x30 [ 1264.480014][T14699] ? verify_lock_unused+0x140/0x140 [ 1264.485275][T14699] ? __mutex_trylock_common+0x15c/0x260 [ 1264.490875][T14699] lock_acquire+0x1bb/0x4a0 [ 1264.495445][T14699] ? configfs_depend_item_unlocked+0x14f/0x430 [ 1264.501672][T14699] ? __might_sleep+0xd0/0xd0 [ 1264.506359][T14699] ? read_lock_is_recursive+0x10/0x10 [ 1264.511824][T14699] ? __mutex_trylock_common+0x15c/0x260 [ 1264.517434][T14699] ? usbg_make_tpg+0x144/0x580 [ 1264.522251][T14699] ? mutex_lock_nested+0x10/0x10 [ 1264.527255][T14699] down_write+0x36/0x60 [ 1264.531459][T14699] ? configfs_depend_item_unlocked+0x14f/0x430 [ 1264.537673][T14699] configfs_depend_item_unlocked+0x14f/0x430 [ 1264.543765][T14699] usbg_make_tpg+0x1f3/0x580 [ 1264.548434][T14699] ? configfs_mkdir+0x4b5/0x9e0 [ 1264.553353][T14699] ? usbg_drop_tport+0x20/0x20 [ 1264.558181][T14699] ? vscnprintf+0x80/0x80 [ 1264.562593][T14699] ? __kmem_cache_alloc_node+0x19d/0x270 [ 1264.568277][T14699] target_fabric_make_tpg+0xa0/0x6d0 [ 1264.573641][T14699] ? target_fabric_release_wwn+0xa0/0xa0 [ 1264.579324][T14699] configfs_mkdir+0x511/0x9e0 [ 1264.584060][T14699] vfs_mkdir+0x386/0x570 [ 1264.588361][T14699] do_mkdirat+0x1d8/0x440 [ 1264.592738][T14699] ? vfs_mkdir+0x570/0x570 [ 1264.597196][T14699] ? getname_flags+0x206/0x500 [ 1264.602014][T14699] __x64_sys_mkdir+0x6a/0x80 [ 1264.606649][T14699] do_syscall_64+0x4c/0xa0 [ 1264.611129][T14699] ? clear_bhb_loop+0x60/0xb0 [ 1264.615867][T14699] ? clear_bhb_loop+0x60/0xb0 [ 1264.620603][T14699] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1264.626554][T14699] RIP: 0033:0x7fd42a19e019 [ 1264.631065][T14699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1264.650739][T14699] RSP: 002b:00007fd42b01a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 1264.659234][T14699] RAX: ffffffffffffffda RBX: 00007fd42a425fa0 RCX: 00007fd42a19e019 [ 1264.667270][T14699] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000c00 [ 1264.675300][T14699] RBP: 00007fd42a23500c R08: 0000000000000000 R09: 0000000000000000 [ 1264.683322][T14699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1264.691341][T14699] R13: 00007fd42a426038 R14: 00007fd42a425fa0 R15: 00007ffcb5774958 [ 1264.699385][T14699] [ 1264.840803][T14699] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 1269.106611][ T1281] ieee802154 phy1 wpan1: encryption failed: -22