last executing test programs: 2m29.042713486s ago: executing program 1 (id=545): read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x800) r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r1, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40004) 2m28.85665397s ago: executing program 1 (id=550): setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4, 0xffffffff, 0xfffffff8, 0xfffffffc}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000200)=0x8, 0x4) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) 2m26.434523136s ago: executing program 1 (id=554): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) 2m25.682939763s ago: executing program 1 (id=565): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r2, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) 2m24.568093679s ago: executing program 1 (id=569): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x14, 0x34}}}, 0x1e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PTP_CLOCK_GETCAPS(r1, 0x80503d01, &(0x7f0000000280)) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) io_cancel(0x0, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000340)=0x1) accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000200)) write(r2, &(0x7f0000000180)="2b358091c9f5c221fc70f894", 0xc) 2m24.448221431s ago: executing program 1 (id=572): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x183081, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x8c01, 0x0) close(r2) socketpair(0x1, 0x1, 0x1, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}}) 2m9.399887898s ago: executing program 32 (id=572): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x183081, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x8c01, 0x0) close(r2) socketpair(0x1, 0x1, 0x1, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}}) 2m1.213437077s ago: executing program 4 (id=713): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="10000000", @ANYRES32=0x0, @ANYRES32], 0x48) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x401, @any, 0x9000, 0x1}, 0xe) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000007740)={0x0, 0x0, &(0x7f0000007700)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a50000000090a01040000000000000000000000070900020073797a30000000000c000b400100000000000002080005400000001508000a40000000000900010073797a30000000000800034000000090"], 0x78}, 0x1, 0x0, 0x0, 0x10}, 0x20000840) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x80001000, 0x0, 0x0, 0x0, 0x0, 0x0) 2m0.301862688s ago: executing program 4 (id=722): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x40, r1, 0x1, 0x70bd2c, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x6}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) 2m0.146665542s ago: executing program 4 (id=725): socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="00000000040000090000000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r1, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7002091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYRES16=r4, @ANYBLOB], 0x24}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(0x0, r5) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, 0x0, 0x24004052) sendmsg$NLBL_CALIPSO_C_ADD(r3, 0x0, 0x20000010) syz_genetlink_get_family_id$nl802154(0x0, r5) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, 0x0, 0x0) 1m59.654768623s ago: executing program 4 (id=732): r0 = socket(0x8, 0x2, 0x0) setsockopt(r0, 0xea, 0x42000004, 0x0, 0x0) 1m59.490933006s ago: executing program 4 (id=735): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) pwritev2(r1, 0x0, 0x0, 0x5, 0x9, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x1a0}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 1m58.435559651s ago: executing program 4 (id=745): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000002f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580)=[@rights={{0x18, 0x1, 0x1, [r3, r3]}}], 0x18, 0x40800}}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001700)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [r1, r0]}}, @rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x20, 0x1, 0x1, [r0, r1, r1, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r1, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee00}}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x118, 0x40005}}, {{&(0x7f0000001d40)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000032c0)=[{&(0x7f0000001dc0)}, {0x0}, {0x0}, {&(0x7f00000022c0)}], 0x4, &(0x7f00000036c0)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70, 0x20000010}}, {{&(0x7f0000003740)=@abs={0x0, 0x0, 0x4e20}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40}}, {{&(0x7f0000005740)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40000}}], 0x4, 0x4008880) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r8, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0x1, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r12, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 1m43.195588442s ago: executing program 33 (id=745): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000002f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580)=[@rights={{0x18, 0x1, 0x1, [r3, r3]}}], 0x18, 0x40800}}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001700)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [r1, r0]}}, @rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x20, 0x1, 0x1, [r0, r1, r1, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r1, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee00}}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x118, 0x40005}}, {{&(0x7f0000001d40)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000032c0)=[{&(0x7f0000001dc0)}, {0x0}, {0x0}, {&(0x7f00000022c0)}], 0x4, &(0x7f00000036c0)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70, 0x20000010}}, {{&(0x7f0000003740)=@abs={0x0, 0x0, 0x4e20}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40}}, {{&(0x7f0000005740)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40000}}], 0x4, 0x4008880) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r8, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0x1, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r12, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 3.834144202s ago: executing program 5 (id=1432): sync() sync() sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffff9) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x400c000}, 0xee) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 3.46145968s ago: executing program 5 (id=1434): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x1, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x31, &(0x7f0000000480)=0x4, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48095}, 0x4000014) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setreuid(0x0, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0xc, 0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x5}, [], {0x4, 0x2}, [{0x8, 0x1}, {}], {0x10, 0x6}, {0x20, 0x2}}, 0x34, 0x3) 2.553052962s ago: executing program 5 (id=1443): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000340)="00000000000000000000000005004d5ce760", 0x12, 0x24004095, &(0x7f00000001c0)={0x11, 0x88a8, r2, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) 2.358818396s ago: executing program 0 (id=1445): sync() sync() sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffff9) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x400c000}, 0xee) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 2.309815427s ago: executing program 3 (id=1446): r0 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="01154e0001000011221e4455892f", 0xe, 0x4044015, &(0x7f0000000040)={0x11, 0x18, r1, 0x0, 0x0, 0x0, @local}, 0x14) 2.070846713s ago: executing program 3 (id=1449): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000df100bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7b"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0xe, 0x0, &(0x7f0000000200)="1d5ff8317ca952a2ba4bfee0f003", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6}, 0x50) 1.965511565s ago: executing program 5 (id=1451): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}}, 0x58}}, 0x0) 1.948132035s ago: executing program 0 (id=1452): fsopen(&(0x7f0000000240)='ntfs3\x00', 0x1) 1.900760776s ago: executing program 3 (id=1453): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x1, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x31, &(0x7f0000000480)=0x4, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48095}, 0x4000014) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setreuid(0x0, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0xc, 0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x5}, [], {0x4, 0x2}, [{0x8, 0x1}, {}], {0x10, 0x6}, {0x20, 0x2}}, 0x34, 0x3) 1.900356656s ago: executing program 2 (id=1454): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000d080)={0x24, 0x36, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r0}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 1.702790141s ago: executing program 5 (id=1456): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000004380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f0000006e80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2082) statx(0xffffffffffffff9c, &(0x7f0000002180)='./file0/file0/file0\x00', 0x2000, 0x7ff, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002040)='./file0/file0/file0\x00', 0x0) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x11812410, 0x0, 0x200, 0x81}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000000000)="03684a7b99a4fde940f3ec0d105ea2c8267323117153aa4a4f099c3835a607cd5cbd77b83cc33d13bbb6c6bcae59db739af84a4b5d34bffc145f3cc27ed3d4f9d9b3103699a1e1cc4ddfb6c1afd07ddfc18e358cd62649479724ce867fefc0a15041bee9f6084842fb982d5c2cf1488d668b741c64f0a6fd2643e729ac5a56462a6b64d5a0a751fda4fadf63ba0dc2fd14ecbf546918db77095545b41ab170e5d6e8ec8bf9ce9b8d53b832e90c701fe52af7999f8fd509577ead1be27891ada8564167f2c7d2eea1c1c9c65d8e151c58ddee43ec34e74d330ec50cbbb2bb21892c7ca995066e3cbea8a69d94dc6bcef5f3c0ef630e774d092ea58627f3e09c66a9c7d1abcf4f8f8af87f4269df288aca9bbf758275ce9695256e764d185a91a7570fca3aab16c75ecaff6b8dda371c3226d6ec6e55c5c4d8cfc5c33892bacc956a3613bcfa849da1b5e070a7911d7488b3e628d9339718e8b821f1bb5d5c45f0316bb563d0a442801412dfd5a4d61ca657e04d6686f7d5863d57954400aeee8e79be8f3cc4cbb3d4b91269df039c3d3543e500b90a2bdc6eb60cc7afab7b5187d88fbd76e6212ea29e872b73f925287bdc808b4a4f8ec7f8aa08bc90b29e217c3eef69d8deae4141f4f9bd110b7bde9320e7b45f422e9a6111bcaf99c9911e46e219d3bab477926bd5d2e78d4cd0eca133c232b1e863fd7799dbf609f3670b323e5518e8f4bd36e9b3da2c68a28eaec9cac688b4dd0b73adc24a8c7acc264399b7facbc2f43e8e40b6cae9f8e956d1dbfe259f12bae75ad362c354050ffdd6e954f2d7615fafce888bd6f672a81c9fd4318caba765069c0a425e898bf7611b77f0fe61c27d318159dba42f011900246c64557d27b77aef928ab04a147baca37863cf998a2ac30b903c0314449ddb218887c309ec7184c8c733f5d4e7b2d79516e9531c9a5becf8294d6ccd777f285b13160e1c949d3069c6c66c0daa62bac679bc9b69825398d1c290d765e882fa2c8708b20ccec885ab6785dc22696b61c109ff84bc5407932c3e5bf12069a68b8e3333a26d3dd390ef9bc01b86013fbcb5c28a1f4d2b8084f1502fccc4027a124c3629d8f4a8befd14b597cebda5f94f36050a31b95087cbac347788a71a90e87f2187fae600aa42719c05c2859cb30ae0fd58a7bba681f7a6027a00583071def2c9a94456e5d9acb9fd2d11fdea524582489c02377bf7f590948985c769b3822cb6366681d79113c6a6c752f2475caba77b7b2e8f293d7fd9b991f63e254c98dec94f4f3def4fee9cdb56ff3ba7fe6a718cbe9a7f04710e257ea8a49d6605266048fc122d4f3173d4b04b3e282bd3c5198d7fcb72ec38e0b07dd8a541b2807e601e5a0a01f07a281e0e1a261c65977088a54597efd0997c59647aeebb2605a89705eeff3ec780e302e24b23a0cbe4f81367c3f118545f01328d22eb8e802667389143166a9db9477c9b58eb5c76a19b8f8b2692b0d356003f08ae54dfc820d8e357ecbf91fb7e212cbef1262171abaf2f613a5bb59b783cad476fec50d16ca0ac13c08a59a3097e6e3fde700a4b987d10311fc22d4aa210956cd859799f78010e4c0f25b715876aa253df15009490f71be3b0022875161f537c70b14bdb9e2d87a5a11b414a1198533c7de6fc4d22228133bc26b19d9f1e7627b14c72e3c39d3fa2186a42e50a0d1867dc312f94c7209d51475ed4aa80b2ccb0557a40422bf7317de2fdf3296727723a2d23babd5e23f7c3edf4942bb485b95a122e6aba41b8f80f684f84605462448d5a4fd66dfe9bbf80590b9999b4780d4f4f189a20f4400b2975df85b584c8c8f9fa3095f13aede1f52dac98be358b0a0d72bed4df71cd23973e326179580268c4e5d1be4b2ae2e1e2dba913998faa6088af128fc8fd3ae26203a898882b67d86d63f6ee8f8e216337330db6d928facf9d0ca273845ee5b33a0a136aeb48b7c52d3b95fe73efaf06197ec8753ee0349f19db8730917d0f18a2de9602d3b887bc583ff64dfee67e2bdf4d5cc1c341b89acd3dd5176d2c15ec2a77120b8a49591ca438ae36c52845e5dca550e539da9ba2a2eda49be316f3d6d4b7c83666bd4759940347c29dedd273adac722630a940e104316b4806553ded47132be4e31a50600f5a4dd56825b245b7aae853f56f79e0ec31f7b5db945ee3bb92865acb0d8828598e77446ee50ecd8bf5e7ccbd963445a09e3be215709b0b3bff2e9d12e6549924338f236b4ff973682e2e03fbf6b167e3b3a0f8c3f3c1e8d0e21a71937c918cabab50dd74c011a1a5531cfcf88a5df5fa58f17715f7c7b3a64d9dab6f20a596288969191420ed71daccbae7c1ec88bf74811b5e1f4bd306f3d810c4f3600df2903ffdf8db40ac7153fd93327a1065cf2c4590c8ba9f9391eb6aa600cb42aff8793e4721afeb3d470beda45dad9adfc6f4fdb24eafc63792f5015c656ca37cee82b7ee382bda31d786d6e03d4c8611c4ca464e2360ca747815c9eebd38c8fc7d5eea2db96b29d771a96dc5c884029077125bcc31980564555d21ecce5d0388e1bc1e618c7dfb31b02b1a6730db7eda387dd4ceb96f65178bb088e81133e5086f73c458f84139685ef930945a51979faeab539e4964244709dcb8b38f575d3a3ec1328a0df65fb34241db7cb3250b8ae0dbc44670d2b5cc3a1785d8d281c05256ef2beee3b202d8bce053e55ce1fb2bb208e65d488ae24484b00c2e343fc3544ca546406688022db6e29ceca9539ec095a2a2cfc5f516230f75fc961c5de1e8d33222331f57db02cac5f9208029c6114d041bb1cc7f959f77511f5790a564600c018afc253e5ecd5010bd769b45a04296ca09e87fb63bf3d3b51dd8b3f6d4426a03c0944d09dff654c5718ab1fef063caba34029be6811502e8bb785011dd1e34b0c192915adeeb40faad0725a8f9a62acf61b944a271d20567f350cdee22d76e3cc5966ba742d9c43823af19ba74c60da0df0c5f4e7e26af7224147774a1f8ae09f929066e1769ffb3c40ba9fed13d2670b9e865a155426ed5c83648c0ad34e46f5308b455e0835730fe529668b606f3f52b0d04534d0e14bc0ff0f742359550e6980ac9978455adb3de0f292af12a3700453e035a49eafe98fc0d7f26e42a6c41f380448607b7c96291f98fa6bbd7e32c249a49171f8fa81762a490a1ce5c39d66d35c6ed6c0679440c06197c2e24d48e1de81c711164c02820816afb5393d3d6c801c3c062ac46d1494f52c45ca36faf94894eec9d71e1be6c7256f4aee8dc080156b28623c821ef8d1826ebf0a41332620f42589270e142561374c825e828e2bd9ae41fd34959db48319d54ffe7a1b58ae8f7361cbaee8e26e0e7e1b7f125f8cd99788825efd01c38ec987904190a0ad52bc20cd36cc7209f9269ac87b2fa44d2456661d3056d893cf912c69ae6b2b83d0c781a6d6c33df1910867b71257ab74e244e3ebbac07445069418fe2e440a384e16feedf8e3165676e67866430eb6a8a5334620d8c2cda15b0328bb0c50630886353f95241cf4f3b647a4ff812c70e1b074c4befdc70fbfdbf868bcc81652034b5bfa831f1b686724046dcd17ac91ace83711e9ec7465d14c9d508bce93676a58ef7dae37221436865ad34ac2fd691e3b3e12aee6736dbdeec9b1c05fcedf8b9ced547259a1a40471ebe8b4bfda69d2f884da025e2809fb9f159150bbcb331ca3c502012a7fe76b4fc2771976aeb624ad7f2d72c707f5f19d8ded84581ac5afa697ff99d27d88c9588fe769839c9cc9d6786a0f814667527c53b6253b1825bfe17e7d734d96d61da0ae7349d0922774fa9b4baf332a4568e32cafa417ec659c4ad72cd656a1e2c59c8dee38890ed3acd8b4f8657de41f670106c38c38ba1a553f0f589a57c61f5105d70e0c0953459383cb9337ca972cda1d2cd3056eb07f21c1f5b995a04997fecf501bb201c67fd2afe4d44fedea595969b6b3706087b0f59d2ddbb099d60436a94f0ba33282b29f6e914fe92add4b33cf70b680b905cfa2b2ccb00b9967f99806e8d69783fd35a2d7fbb424e9fde2647609aecb0208bc3864bf95f05e50ba12123edaca8de927b338dfcb3cc597947c606c08315061a7fec98c48f480e2febd26fcc8dc12289aeb0adefa2c2be1766a5bc74ef1aab6c2cdbdfbf1810d956bc889c8e614b7b933ff6e336bb208db5b592775fe71c3ebfad5f47e0d074e1c0cb36761481ec677794f23c3698bd35875719f242e3fc939bc3668f9723f31effe189dabdf4ebbed073eab952c88f13059eee22230bc7724d7266b15726a0b0898cdd274e3e56d0a356166b5d16456249e9e92e84e39f61c0ecdf99ec2cd230440c03fd21cf68f27306628d35ea47367775f39d20a07f3959b38d49e3674061fc1018b647047ad39f77027878badd29927c5806f95aebde5f070fed28ed34052550678d3c6b677a3b5a46f76a98264c42206bf62caa95df5437092b68e025ee9ce2ad733b6db3ec97fd33cdc3b2f77ee90dd86d8bd289ae1a437c86f4153ddcff5e846347bfecc1499bb42980e4fa91790faee1b1991dfead5d7c460348631f0469b2b9e8f65207a00985511e0c41f441d9a3154f5a0298c172fd7135d4bf95c11cdf1769db1cc55f392aec309037599327a7c53c10a56d1ace8ad19186a2fc75dfa9d657c114eae99c1c1a6b4a58440718bea82290bd1c2a67048938c381648ea2b2c7110d748c9c8d782f20430b1427b51d7036e55b0997c6f75717db67a82c88d3647ee036b49392f0467d6010b32f9de3e5e79ef082c5bb975d11d2bf76a97f7159c11a7753db8a065d3126ccda9abbebd2c54374e389942c24b27435868fadb45bb060d3c1084b211e2afa8dfaa2d8dab8dc47fe10e6c32afece7c4976176a7c66d704125c0948c238c843b41b0246be1f50f8e07884cfe7ae8885ca06339a339c8d5978b079e0eb78facfa1dc67ca70733dfefc6c868ca149e0661b70e0134870a3107c8c46711fed14f892d6fc66d95306838688f13b19e904416a8d161cc33527878b38ad10b1c08db21457b2075608be7300d39748e4fcebe02b190f3e8ed32a0ef734b11ca43a21f5f809bba795f5aa0ea01050021d0f5213620af5b08fda6421a42b7c82804a20a6ef6d471babf76f46538327f943476d1d109a3f0dc531233d6f93d8dc27f4745735085f92adf63d617b373fba24f289035710e69eb80da12d36e8eaec22620ffaabadfb824bd5fc309a2c74959505856b5b890bba8f22bc571a9d87e93ba3b9aba6dcf26f7076c0c2e271641835ea25fd49d96c69d4fb8bb8731bd2cbc75146aed10d269f9060462339cde8830b535920be3dbf143eace0f1ea9469b95a64fbd7e5057eb880d4422cbf97cfc3f7140251d4923580ca2113f345cf24a66499ceffd2e39dc4fd74cf448638962957b409f0d218c165c13ffe107aa1dd1d9a02092cd46cf2b353dd2d2ca7b8a7ae8eda0ee18bba269bbffed0c7d400497aee4da0896cf6329d76ccea098fbef9075412d1c2a3644cf0f202b884303d204314ae92c56217b2feb5e7c1e15a99fbdd655fb8f6bbc3ab1259bf03b2ee17c5b7e9443695177ec5040eeff3fc36ceafe143393d76a3d735cfe6c9b632e52dbe64dc1265961e8a27ee9f76c0add9e0581e474d7678214f5b64c932903715befc6b766611f1d7e495573b9a3e009cfcb0ffef7ac57c3561badbfa41c119e541180aa2364de61a601699cd1bf3de01d15794b728e1444efd6ffa1e57d95489c8df91fbc057b66dd6d9f3a01b19f36bc99f0b54ed1f9905067dd1608bce47f5ff1981a25184aacd39e331d8ff3dfa7c012d7e667a69249cb4803b23f7eeaab8ed29c69ba3d2a1b88821ffefc5825650c53b6364f38e0a178312f5d29d5375423cceabc8e1c4e51a566ba3f9b176b858c8860440ff8ebdde725640d2dff6b9160bb69f188755b0ff766b410704cda4c33e1ae2c73b5799a00d2f55de73109728b350302b64df2ce3eaf2e0c6561009b60c2701ac493076305e97ed20c3b42f40b2bc7f13bba4ab8181e2085b07930c6f5579205dff696902be824e65ddc774e886e8d261fe74712a31e406b0f7725b4559d7ad0f27a1a870261aa5bb8a720e7c89ba933770d48821416de070df1abcc6eee1147c20bda090d940aeee2bd48c0f3d94675d9b9cf1a62ba50e31a7af0714dd8325d5fb7142e88c4d22ddb8f0278ee6ba88e361524e291b6d000f6523ad4188b021da9ef4a634ed09eb2002b9c726746c9ffc32f261edb448106aa1e2daaed865255fd1d296fedbbb2de3f7c1f15935e52006492b632ad125aa1e000c9d71bdb945792668e16b26122a3fd7cba1a40db8083068c5c48fd2aaa621c87d9f5621bba442fc26839030dbe4e37fda4046d6503bb03e0f928de25d4cd4e2a40ec93c9021dfcbb25f6e2c943cc85eba8123340d6364949581e8c8c2913d59dafe4297672c0b9e7418485f00cbcf672a588904beb3c074bebf339815b91c7c374ceed5a701e1ade8f5d87ca536120116307ac259577a8e12958425317c482d2c7089bf3d83e12318d1526107a050f3c094492de7255b22e18ca2ff261b3ed197f2f8e67b71b1c5a6a04b99158b58e9baad75201aabe13254617d0de0a9073af62491c67fc18d1ccbf7686a85a99b39e9d7d9c85a0777e47c9fd0e10c932c20f13ef287b44b9b706ec818aa0c48a10caac58a9b8355e84bc820698c2501f0c12e1b67df701cfcbe72dc47a2c87d43753ebfdb24cc838507e241d9fcd3d4955a373209ccda903a3ffced05e4232f2cca9bba197fdba8a9357cb1d6da6d9b4095027dc03e17d59ebc2d358e171da0044df102b193c79390ebcb58023b40c621df71e064b0056bfcf1eaee1eca85357cd1ac78feaa54bbbd85596977ba85003ea60d8685f4e3b756e4f81453077396590fa214f672929e81569442023667b798c24e06ee20dbf64cfccb51b2bca4e2a5b0df137bb37ab3e2854dc7e1b879866a72a5809b563596cc9fd3e53abdbccfd5dbc60662252ddc5c290d72230d79b7504b40fdb45ded2f02e926652c1e04ea4c1c488025ad1098adeebe98e385ab1caec4b9eb4d3bbd5ef3ddf1fd0d72784604a989558fd37f6d4fee20609090b3331e254fec98414a2c54589ee01c9429b7cb574b9167efede1d966a227bf2a8e422f38680d77d3c555cf1117e7d7e804ad730c36a78b7846473d6481bd0839bd3e6982ed47246c370a90b76e5b88de202346fb20b8b6b5ecb6a90b8478d17b175a1821df75b48ecc34866fe5c8960bf64d5ff92831bb9357474bec65e0dd1699b0f0340ee5ac5e9e9d3df66edca20201371fc21ad80aacd49c6b0abcfee9c876c15edcfccde823b55b61cb7b254487ef8c8781a22043f4adaf25df34580a6b3904fd014b50c59fa90eff75fa5fd32aaec9aa10df8a2b9b824952e475c964533942bbe30f4167a11fc15d548e0a31f911030569722f0c67e79e90483f6f0bee1c7f80face1a1b0f940c891be688cb16394f6c07fd29b5f248c211d1f76ec1292755d8bd963e191b3a8851472fbbd2cb732f4fd9fef3a8fb29aea097328173fdeaf56fa2279e86fb954306b040c960d0b601b3a741c96cf1f0bd1172f848585cb3b57d7d2e2a84914526f5a6f9895cf5aa4425b4dbf9f59037756a0321bba204a737e36277e86fd268f6047921f4f8fab69dfee137c07874f12f89084e7117e2c9221690a27f880f17d08d56f9dbc96ffef3920b55fb773dde72e1ba35f3e0c9872e339508281426ab04941df4885f7e0293149f1642c2573e2b6594b8fd953ae2468cf917cdaa0692cf461e3628860935def39af78af5e1540147ab1c70c3ab7f7c76abea0d8541feb43e632d7a2cc7bef15a4700304048ecf135968d0a9644ce899aad05b186a2224bab3836248cc6137472203ebceb29b3e87610df12417ee722f309c54b2e65591d8b929440f3ec43ee9ff8f7b7710668e4312610d1591303d5270394da0ab61e4515af5215dc81137f0dc90f951972731f8d98ceb8b4ea38da7d8dc153ccbae5068781eaf9a4a7b11b4319090261b61aa65a8536292eb5392020eb285b2db07f81e7f764d65037050f1e3748593474c6c1dc11cfcb56e1c916157280098a437265e1c682cbfed717e7275bc6c3bb6c6ef7f0f9fdd19ef82ff2c82284c3a061f57b21d3705aff97710108a7d1217a7ea3feda021d20f1fdca94bbef67e0aeaa3db6ccc2d060f7b33707fe19cb2d0232f1239373bb38e666cbbbf3a697c6d0e957ec6730f56034440e789a7a37304d09eb742f21019a77c608cf578162a55d0aea113c051b110b5281ed8b6638d2b31604e965cb019f2f106bc4e96d1313c70612f1ff18afdce7926270dd242c49cc53792f160d1e143e04d7eb3ca40828b153fac466bc53a084281987b47b806a4ef668859eb9035ef68e9c20bd6bb790fdf6f921569b4e97fae5b7edc761b4944c1d6d90f4df40bc3203ed838d4c61cdeb7a9bbb68d59b2cc00125eecaf06b759ac1b9dd68028225d0a60efa499e4436962362727011eef6cc55962dd4ffe2fd3892907e837045883cc9ba8892ab265a31924f3055d4dee68feff05d9f10ebdf1e8c1c1e7001b5b02a7fe26b9c0641e054ae37854187fb1bb6e9fae05b09e85a1e0e14bc801f2d8b9a178a9a72b147e137e0d83192664a88a3aca4fb6a4f0c5787b20c31bc5975dfbc8bcff8987573bd14b1ca434d93452e67ed01c60be99e535bb3f848888d224520b61cfc1de2d6b2ebef9f24674c31aada52784a0b7b60f351653c71d546cf951e6b4a0d917ac6afd0a713f41833f9f74a3a7d3c19b523299666da2b48676ca7aafebadef05b3bbf4b6b62834046f51d3d4582fb4c9de27a3f5e992853368e4f17f9dba27c8c4438307fc7405f53fb27cc81c1521452a1a5edb0cabdf7a73b1cab0675b619fd5a0fadb7147776e74695c042d9d8bfda045bcef7542b42249f34c7590605d0201a762390f2fee5f3cdb488426609c663c9fc4dc2a5277f3f589a14e6dcc202dfcd89bb148a368ff1792d230c19934143d2c260dbdfb334af863b856e415febd22fba01c568d8f48dba6d92f493cd1164a376f006d55db609cc2c9532a9f56da3b06e3db2a05f797eed57892e2fb677541324bcd763cf4669e7a871e322d0cc6e21befe3c767976f058dbe7a059d673c94c7ac5d49178bf19d32907b6fe66a92cc8ea30a858da43f74354390d6e97021da50812c59a78915e5b33221531bfa054c594ce3a2300e5a7d712773181901dfcf6922e980566fa62b1f2b669a27fbecce29e9be6d22058463e350163f33d18ce92a72d1b470857b6a37998aec5672521a8f0d66ab2bd01de516036ec47d1f63b95b437dc6d5a0168189d5a963cb0a80a9a5f20b03515396e3525f0ab13b0c1e5dd051b4c930da6d57ab6f7dd94ab3e689e0355af0b34871296152a76cce170d7b14d471ee4d9daa93de4ed755f30d45344f724288c17e4b22583158f1305ff55fecf7d526e207fa609886e14c9a168bf364b049409f63590f18a5515de8c1fd8c5a9710b6e33d2ecd01466b799f14be787612b8f17df0c05483a16097c0a504880249e28f1e067663c640a550a8c7ad9d090f7b2e902c5c20936869a5f3d3a014817f90babf847b43cf67ec23f120ae4abc63a418d1d99f359fc2c33a5bb34e1f5780576111a88c5ede834bc41e498548ddd128f9e884f4cd3e1bf1aaa1204079ce74e709306f38f2d6859128fc35d3a74c534ff1dccadfc8fe41f1be9510349af8710eb6d2dbc758be12b65622dad1cf48abc2fc409f5ed6a3af8d0b6548643c46dfba9db4e5827475e6e317c9c018a4dd5de391cc9cca85ec527537e26949e5091baca4f0b563d4c3969f15115e5ccdeb9e40788fe12f9d32d9488a70ae53b819726e4483ea6bbcb76f99775ca5e4f93c76edae462c08d596209f985aa55ef5e786701edcee8d831dd6dc0fee9ad01b6bdd63e886a5e55bdc593390c81e18dfd8c685b81306bad6b7a19a86b2bab5cbf4754708422e99f8f2497d798b3db565e709bcbba4c376c1c60b22b994fe8fdcb25215d505511cc1927f6a35344023d5da0a3ac0830e6aa80f5f7f0d94a67c99c6b22717078aecba2a599daa2acc054cda25e3965172e5fef464ec19aa71de5e84b6de30cc673fbab8c441ea37bfb3fc321a504371bc0996702e9be38db762e339ad7ad66dc2caa887e4ab60272d7963f85b14c941d31e545b85c640427302efe7142f0e0897a8c623ce57da213fbc2d1f90677142fd48cafca0b2934e572833ed6473218d0513dd1f6ecc578e5a1109ddae552b3be0cfe7246d7682a59fe9ae783a0f318d1800d5c466c80c5fd3facd0340f455f081068dd2cda5cda744018d902217152b6c05d37c090f8348b0471053152c2a4570fbab3f6dc30c8e49a63b88a00b3aac75180a633692e35ea976821694e133eb8bb4d31237d002fce1dd2ce55528dafcef2f0e00690562d144bb0e19576ce6ab72deac22067d8edac916b1b07e4eb57ff0b885b1b79f37dcf88135eedc17ffd948b61e4df4985033bcf891dd5b1448c8668947a271d93d03ce31216810a6bb45a6c5a12e290d97a60ad4b5c7384cf19421ac1ca64d346b50771e0b50e5caf1d9dfe056e8da247aa502ff04c8e29ca810a1d3ec7a89bc17dba2936f03a80228171f7999b3f2768617970efe57b14011c80666ac4999a568ebef74e2ca14df0ff6f0fcd47c538be96aaca1e65b53b98447101e49672b48167c0afc1afffe669b0f9718bd3305805c292db9738740b362564e4691cbdf061db1ed3f9db1f8bed82939f835d14f46818e3eb4e25f7a8d77d9d0d7913c45d8a81115c1a5e37b1d3bd1b7b5e6afaaefc81d9700bf83506fbf15457bc0f59f7008cc803efdcb6d39e388f6b28e80d47134265cc5438804b12d50e61a489da829dca05792d2ac182ba747331e88a7118f7dd38067f7d38f37be362260effacbc33863bb47aeebbadeae648a1090718266eedd2ed5a2c23f168759198aa92b2ac45c2a68ff212f29260e641a38541b066d39df4e95cd1c8e7e6ffae1b8017e6f629db3910b07496c8a81e4e66ac2321fd9e7ebfecf5bf6e922d7a79fb710a2d42dad1916c9b186c2c50c818fdb1afa19be867d943ee98f732fe3a01364281c0f6d0eb64a278721dc7bff5316256b0f4251abbd9b8ba7c7c12a3bf02a1fbc9ca94b965588fbc82343d07df8e06eaa5ed2137fec129351d80a9048a7d78b31ffaf2e388864a763c4af7aa53000e0bb2eb8ac0e4272cbb79dc6a7d65890f125c523c7cfddacdedbe87938aca915c92c807dab26be7d748827d4e3188676312ef1ac8460b29e8e715f4075e33104ce82e6785aadf17a7cf82d2a705e9f2d0fd25810ba33d76e54b48eda3effc01f37c89db38af81922fadc8c3361fe74ed51eac5e4437108106ffdedb339b406c082d62a8bf718989846d23f966e1ea39103010f767b3a6f0a0a2041b1dafcb787e69ffad75ed2a0081b92a4136ad5ae557c55a4b6219a390103428181ab36f329ad182a92957495c", 0x2000, &(0x7f0000006dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004480)={0x90, 0x0, 0x6, {0x3, 0x0, 0x7fffffff, 0x1fffffffffffd, 0x400, 0xc, {0x6, 0x9, 0x8, 0x1, 0x1, 0x4, 0x8, 0x123, 0xdab5, 0xa000, 0xfffffffe, r2, r3, 0x6, 0xffff}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.702385671s ago: executing program 0 (id=1457): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113140000000000bf1000000000000025000200091b00003d030000000000008701000000000000bc26000000000000bf67000000000000340300000ee600f0670200000f00000016030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) 1.691508001s ago: executing program 2 (id=1458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x3}, [@IFLA_TXQLEN={0x8, 0xd, 0x1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x6}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfe, {0x0, 0x0, 0x0, r6, {0xffe0}, {0xffff, 0xffff}, {0xe, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dd}, 0x4000080) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x2, 0x2, 0x7fff5ffe}]}) close_range(r7, 0xffffffffffffffff, 0x200000000000000) 1.656120822s ago: executing program 6 (id=1459): setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 1.074826455s ago: executing program 6 (id=1460): syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x5}, @hci_rp_le_read_num_supported_adv_sets={{0x36}, {0x8, 0x6}}}}, 0x8) 1.071269786s ago: executing program 2 (id=1461): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7020000080000001823", @ANYRES32, @ANYBLOB="00000000040000090000000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r1, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7002091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) 984.163777ms ago: executing program 3 (id=1462): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000340)="00000000000000000000000005004d5ce760", 0x12, 0x24004095, &(0x7f00000001c0)={0x11, 0x88a8, r2, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) 945.685958ms ago: executing program 6 (id=1463): sync() sync() sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffff9) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, 0x0, 0x1, 0x0, 0x0, 0x400c000}, 0xee) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 866.82917ms ago: executing program 2 (id=1464): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000df100bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7b"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0xe, 0x0, &(0x7f0000000200)="1d5ff8317ca952a2ba4bfee0f003", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6}, 0x50) 804.853902ms ago: executing program 0 (id=1465): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xfffffbb4, 0x5, 0x5, 0x6e0, 0x5}, 0x64}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x40) close(0xffffffffffffffff) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0x0, r5, 0x18}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005004024c10200000002125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 746.986193ms ago: executing program 5 (id=1466): socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) r1 = socket(0x2, 0x3, 0x6) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000010880)={&(0x7f00000007c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) syz_emit_ethernet(0x3a, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x2, 0x21, 0x2c, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote, {[@timestamp_addr={0x44, 0x4, 0xf7, 0x1, 0x8}]}}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x2, 0x0, 0xe7}}}}}}, 0x0) 594.877426ms ago: executing program 2 (id=1467): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) 457.96484ms ago: executing program 2 (id=1468): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = syz_clone(0x82020000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r2) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) syz_open_procfs(r1, &(0x7f0000000040)='environ\x00') syz_usb_connect$cdc_ecm(0x5, 0x4d, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x6, 0x40, 0x81, "", [{{0x9, 0x4, 0x0, 0xfc, 0x2, 0x2, 0x6, 0x0, 0x14, {{0x5}, {0x5, 0x24, 0x0, 0x3ff}, {0xd, 0x24, 0xf, 0x1, 0x0, 0xe, 0x0, 0x9}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0x1, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x4, 0x1, 0x8}}}}}]}}]}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 399.450251ms ago: executing program 3 (id=1469): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001fc0), 0x2, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000002000)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x7}}, 0x10) 396.304091ms ago: executing program 0 (id=1470): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x38, 0x68, 0x401, 0x0, 0x25dfdbfc, {}, [@NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x4}]}]}, 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000006800010500000000000000000a00000000000000080001000100000008000500", @ANYRES32=0x1, @ANYBLOB], 0x38}}, 0x0) 375.982731ms ago: executing program 6 (id=1471): syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_req={{0x17, 0x1, 0x8}, {0xe6, 0xfffe, 0x5, 0x4}}}}, 0x15) 213.294826ms ago: executing program 3 (id=1472): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000880)=@NCI_OP_NFCEE_DISCOVER_NTF={0x2, 0x1, 0x3, 0x0, 0x5, {0x1, 0x9, "189bcc"}}, 0x8) write$nci(r0, &(0x7f0000000300)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x0, 0x2, 0x0, 0x1}, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffff5f}]}, 0x24}}, 0x0) write$nci(r0, &(0x7f0000000300)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) 212.561926ms ago: executing program 0 (id=1473): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x1, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x31, &(0x7f0000000480)=0x4, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48095}, 0x4000014) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setreuid(0x0, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(0xffffffffffffffff, 0xc0506107, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0xc, 0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x5}, [], {0x4, 0x2}, [{0x8, 0x1}, {}], {0x10, 0x6}, {0x20, 0x2}}, 0x34, 0x3) 146.860307ms ago: executing program 6 (id=1474): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182300", @ANYRES32, @ANYBLOB="00000000040000090000000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r1, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7002091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) 0s ago: executing program 6 (id=1475): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x45) write$FUSE_LSEEK(r0, &(0x7f0000002700)={0x18, 0x0, 0x0, {0xfff}}, 0x18) kernel console output (not intermixed with test programs): 44] do_el0_svc+0x5c/0x134 [ 80.813406][ T5344] el0_svc+0x58/0x128 [ 80.813411][ T5344] el0t_64_sync_handler+0x84/0xf0 [ 80.813417][ T5344] el0t_64_sync+0x18c/0x190 [ 81.066704][ T5353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.341'. [ 81.097254][ T5353] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.097406][ T5353] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.223109][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 81.387598][ T5364] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 81.538795][ T5370] loop1: detected capacity change from 0 to 1024 [ 81.540500][ T5370] EXT4-fs: Ignoring removed bh option [ 81.573780][ T5374] FAULT_INJECTION: forcing a failure. [ 81.573780][ T5374] name failslab, interval 1, probability 0, space 0, times 0 [ 81.590814][ T5374] CPU: 0 PID: 5374 Comm: syz.3.350 Not tainted syzkaller #0 [ 81.592164][ T5374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 81.593980][ T5374] Call trace: [ 81.594614][ T5374] dump_backtrace+0x1c4/0x1f0 [ 81.595531][ T5374] show_stack+0x2c/0x3c [ 81.596334][ T5374] __dump_stack+0x30/0x40 [ 81.597217][ T5374] dump_stack_lvl+0xf4/0x15c [ 81.598125][ T5374] dump_stack+0x1c/0x5c [ 81.598932][ T5374] should_fail_ex+0x3cc/0x524 [ 81.599841][ T5374] __should_failslab+0xc0/0x11c [ 81.600813][ T5374] should_failslab+0x10/0x28 [ 81.601716][ T5374] kmem_cache_alloc+0x88/0x310 [ 81.602659][ T5374] getname_flags+0xb8/0x458 [ 81.603532][ T5374] __arm64_sys_mkdirat+0x80/0xa8 [ 81.604474][ T5374] invoke_syscall+0x98/0x290 [ 81.605363][ T5374] el0_svc_common+0x13c/0x258 [ 81.606256][ T5374] do_el0_svc+0x5c/0x134 [ 81.607102][ T5374] el0_svc+0x58/0x128 [ 81.607899][ T5374] el0t_64_sync_handler+0x84/0xf0 [ 81.608892][ T5374] el0t_64_sync+0x18c/0x190 [ 81.649986][ T5370] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 81.683561][ T5370] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 3: comm syz.1.348: lblock 3 mapped to illegal pblock 3 (length 3) [ 81.708595][ T5370] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 81.720531][ T5370] EXT4-fs (loop1): This should not happen!! Data will be lost [ 81.720531][ T5370] [ 81.775245][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 81.910642][ T4796] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:8: lblock 8 mapped to illegal pblock 8 (length 8) [ 81.921331][ T4796] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 81.923581][ T4796] EXT4-fs (loop1): This should not happen!! Data will be lost [ 81.923581][ T4796] [ 82.150923][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 82.153324][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 82.173471][ T5391] loop4: detected capacity change from 0 to 1024 [ 82.216256][ T5391] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 82.233694][ T5391] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 82.241175][ T5391] EXT4-fs (loop4): orphan cleanup on readonly fs [ 82.255655][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 82.263630][ T5391] EXT4-fs error (device loop4): ext4_read_inode_bitmap:168: comm syz.4.355: Inode bitmap for bg 0 marked uninitialized [ 82.280244][ T5391] EXT4-fs (loop4): Remounting filesystem read-only [ 82.292682][ T5391] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 82.358126][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 82.737905][ T5407] capability: warning: `syz.4.361' uses 32-bit capabilities (legacy support in use) [ 84.582908][ T5407] sched: RT throttling activated [ 84.588278][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 85.215078][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 85.268645][ T5417] loop3: detected capacity change from 0 to 1024 [ 85.270922][ T5416] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 85.281679][ T5417] EXT4-fs: Ignoring removed bh option [ 85.336819][ T5417] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 85.362205][ T5417] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: block 3: comm syz.3.364: lblock 3 mapped to illegal pblock 3 (length 3) [ 85.371814][ T5424] FAULT_INJECTION: forcing a failure. [ 85.371814][ T5424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 85.374153][ T5424] CPU: 0 PID: 5424 Comm: syz.4.367 Not tainted syzkaller #0 [ 85.375627][ T5424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 85.377519][ T5424] Call trace: [ 85.378103][ T5424] dump_backtrace+0x1c4/0x1f0 [ 85.378973][ T5424] show_stack+0x2c/0x3c [ 85.379716][ T5424] __dump_stack+0x30/0x40 [ 85.380490][ T5424] dump_stack_lvl+0xf4/0x15c [ 85.381381][ T5424] dump_stack+0x1c/0x5c [ 85.382171][ T5424] should_fail_ex+0x3cc/0x524 [ 85.383024][ T5424] should_fail+0x14/0x24 [ 85.383801][ T5424] should_fail_usercopy+0x20/0x30 [ 85.384755][ T5424] __arm64_sys_openat2+0x190/0x3b0 [ 85.385755][ T5424] invoke_syscall+0x98/0x290 [ 85.386594][ T5424] el0_svc_common+0x13c/0x258 [ 85.387479][ T5424] do_el0_svc+0x5c/0x134 [ 85.388223][ T5424] el0_svc+0x58/0x128 [ 85.388979][ T5424] el0t_64_sync_handler+0x84/0xf0 [ 85.389928][ T5424] el0t_64_sync+0x18c/0x190 [ 85.411420][ T5417] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 85.419702][ T5427] loop2: detected capacity change from 0 to 256 [ 85.424020][ T5417] EXT4-fs (loop3): This should not happen!! Data will be lost [ 85.424020][ T5417] [ 85.539045][ T4796] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:8: lblock 8 mapped to illegal pblock 8 (length 8) [ 85.542420][ T4796] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 85.544610][ T4796] EXT4-fs (loop3): This should not happen!! Data will be lost [ 85.544610][ T4796] [ 85.629097][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 85.638226][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 85.907891][ T5436] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 87.595187][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 87.596764][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 88.657757][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 88.853830][ T5460] loop2: detected capacity change from 0 to 1024 [ 88.863424][ T5460] EXT4-fs: Ignoring removed bh option [ 88.873586][ T5463] loop0: detected capacity change from 0 to 1024 [ 88.888357][ T5463] EXT4-fs: Ignoring removed bh option [ 88.889785][ T5460] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 88.914737][ T5463] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 88.923191][ T5469] loop4: detected capacity change from 0 to 256 [ 88.942726][ T5460] EXT4-fs error (device loop2): ext4_free_blocks:6220: comm syz.2.381: Freeing blocks not in datazone - block = 0, count = 16 [ 88.958044][ T5463] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: block 3: comm syz.0.382: lblock 3 mapped to illegal pblock 3 (length 3) [ 88.972326][ T5463] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 88.984672][ T5463] EXT4-fs (loop0): This should not happen!! Data will be lost [ 88.984672][ T5463] [ 88.987648][ T5466] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 89.028499][ T4796] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 28 [ 89.043077][ T4796] EXT4-fs (loop2): This should not happen!! Data will be lost [ 89.043077][ T4796] [ 89.054680][ T4796] EXT4-fs (loop2): Total free blocks count 0 [ 89.060793][ T4796] EXT4-fs (loop2): Free/Dirty block details [ 89.064404][ T4796] EXT4-fs (loop2): free_blocks=16 [ 89.073931][ T4796] EXT4-fs (loop2): dirty_blocks=16 [ 89.078860][ T4581] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:7: lblock 8 mapped to illegal pblock 8 (length 8) [ 89.084203][ T4796] EXT4-fs (loop2): Block reservation details [ 89.090165][ T4796] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 89.091420][ T4581] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 89.100558][ T4338] EXT4-fs (loop2): unmounting filesystem. [ 89.111765][ T4581] EXT4-fs (loop0): This should not happen!! Data will be lost [ 89.111765][ T4581] [ 89.128965][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 89.211310][ T5477] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 89.434427][ T5487] device syzkaller0 entered promiscuous mode [ 89.482245][ T5489] loop4: detected capacity change from 0 to 1024 [ 89.521427][ T5489] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 89.622995][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 89.702156][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 89.716766][ T5499] netlink: 16 bytes leftover after parsing attributes in process `syz.4.395'. [ 89.735307][ T5499] netlink: 132 bytes leftover after parsing attributes in process `syz.4.395'. [ 89.796151][ T5502] loop0: detected capacity change from 0 to 1024 [ 89.820772][ T5502] EXT4-fs: Ignoring removed bh option [ 89.824429][ T5504] loop1: detected capacity change from 0 to 256 [ 89.867780][ T5502] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 89.936982][ T5510] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 89.961055][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 90.096609][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 90.153963][ T5523] netlink: 'syz.2.404': attribute type 29 has an invalid length. [ 90.174652][ T5523] netlink: 'syz.2.404': attribute type 29 has an invalid length. [ 90.189529][ T5521] loop3: detected capacity change from 0 to 1024 [ 90.196414][ T5523] netlink: 'syz.2.404': attribute type 29 has an invalid length. [ 90.231783][ T5521] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 90.241804][ T5523] netlink: 'syz.2.404': attribute type 29 has an invalid length. [ 90.243574][ T5523] netlink: 'syz.2.404': attribute type 29 has an invalid length. [ 90.320500][ T5533] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 90.322213][ T5533] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 90.339587][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 90.542410][ T5543] loop2: detected capacity change from 0 to 164 [ 90.655337][ T4413] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 90.661159][ T5549] loop4: detected capacity change from 0 to 1024 [ 90.683715][ T5549] EXT4-fs: Ignoring removed bh option [ 90.714031][ T5549] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 90.842582][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 90.873736][ T5524] loop1: detected capacity change from 0 to 512 [ 90.898367][ T5524] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.406: iget: bad i_size value: 38620345925642 [ 90.911069][ T5524] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.406: couldn't read orphan inode 15 (err -117) [ 90.931537][ T5524] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 91.058591][ T5524] EXT4-fs (loop1): unmounting filesystem. [ 91.133993][ T5566] rock: directory entry would overflow storage [ 91.135241][ T5566] rock: sig=0x4f50, size=4, remaining=3 [ 91.136222][ T5566] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 91.846602][ T5585] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 91.890412][ T5589] EXT4-fs: Ignoring removed bh option [ 91.934442][ T5589] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 91.972099][ T5585] mmap: syz.3.427 (5585) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 92.068361][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 92.110110][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 92.690196][ T5608] net_ratelimit: 3 callbacks suppressed [ 92.690212][ T5608] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 92.694777][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 92.880795][ T5615] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 92.886708][ T5615] System zones: 1-12 [ 92.912436][ T5615] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.437: missing EA_INODE flag [ 92.922148][ T5615] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.437: error while reading EA inode 12 err=-117 [ 92.943254][ T5615] EXT4-fs (loop3): 1 orphan inode deleted [ 92.950130][ T5615] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 93.208625][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 93.389064][ T5626] device syzkaller0 entered promiscuous mode [ 93.670459][ T5640] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 93.672069][ T5640] System zones: 1-12 [ 93.684457][ T5640] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #12: comm syz.1.446: missing EA_INODE flag [ 93.703914][ T5640] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.446: error while reading EA inode 12 err=-117 [ 93.724097][ T5640] EXT4-fs (loop1): 1 orphan inode deleted [ 93.733681][ T5640] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 93.933664][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 93.944083][ T5649] set_capacity_and_notify: 4 callbacks suppressed [ 93.944092][ T5649] loop3: detected capacity change from 0 to 164 [ 94.043180][ T5651] loop1: detected capacity change from 0 to 256 [ 94.105370][ T5653] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 94.518296][ T5673] rock: directory entry would overflow storage [ 94.538979][ T5673] rock: sig=0x4f50, size=4, remaining=3 [ 94.550012][ T5673] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 95.153996][ T5678] loop3: detected capacity change from 0 to 8 [ 101.447157][ T5682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.461'. [ 101.567866][ T5690] loop1: detected capacity change from 0 to 512 [ 101.582970][ T5688] loop3: detected capacity change from 0 to 256 [ 101.593025][ T5690] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 101.603015][ T5690] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 101.609237][ T5693] loop2: detected capacity change from 0 to 512 [ 101.634582][ T5690] EXT4-fs (loop1): 1 truncate cleaned up [ 101.646887][ T5690] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 101.653131][ T5693] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 101.751774][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 101.781575][ T4338] EXT4-fs (loop2): unmounting filesystem. [ 101.873326][ T5709] loop1: detected capacity change from 0 to 128 [ 102.003540][ T5717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.473'. [ 104.615346][ T5732] loop1: detected capacity change from 0 to 256 [ 104.644742][ T5735] loop3: detected capacity change from 0 to 1764 [ 104.670926][ T5734] A link change request failed with some changes committed already. Interface team_slave_1 may have been left with an inconsistent configuration, please check. [ 104.918893][ T5749] loop1: detected capacity change from 0 to 1024 [ 104.920662][ T5749] EXT4-fs: Ignoring removed bh option [ 105.051104][ T5749] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 107.116570][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 107.406302][ T5767] netlink: 24 bytes leftover after parsing attributes in process `syz.3.493'. [ 107.435776][ T5767] netlink: 24 bytes leftover after parsing attributes in process `syz.3.493'. [ 107.646832][ T5779] netlink: 8 bytes leftover after parsing attributes in process `syz.4.499'. [ 107.694569][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.696184][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.090650][ T5787] device syzkaller0 entered promiscuous mode [ 108.169717][ T5794] loop4: detected capacity change from 0 to 512 [ 108.202490][ T27] audit: type=1326 audit(364.172:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5796 comm="syz.0.507" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9f1792a8 code=0x7ffc0000 [ 108.209932][ T5794] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 108.222162][ T27] audit: type=1326 audit(364.192:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5796 comm="syz.0.507" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=13 compat=0 ip=0xffff9f1792a8 code=0x7ffc0000 [ 108.246640][ T27] audit: type=1326 audit(364.202:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5796 comm="syz.0.507" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9f1792a8 code=0x7ffc0000 [ 108.301370][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 108.357623][ T5802] device lo entered promiscuous mode [ 108.379465][ T5802] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 108.391939][ T5804] netlink: 24 bytes leftover after parsing attributes in process `syz.4.509'. [ 108.411627][ T5804] netlink: 24 bytes leftover after parsing attributes in process `syz.4.509'. [ 108.594182][ T5808] loop0: detected capacity change from 0 to 1024 [ 108.627617][ T5808] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 108.714583][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 108.850909][ T5825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.517'. [ 108.901037][ T5827] device syzkaller0 entered promiscuous mode [ 109.262446][ T5848] loop4: detected capacity change from 0 to 512 [ 109.284805][ T5848] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 109.300038][ T5848] System zones: 1-12 [ 109.308512][ T5848] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #12: comm syz.4.529: missing EA_INODE flag [ 109.328680][ T5848] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.529: error while reading EA inode 12 err=-117 [ 109.342119][ T5848] EXT4-fs (loop4): 1 orphan inode deleted [ 109.350636][ T5855] netlink: 12 bytes leftover after parsing attributes in process `syz.1.532'. [ 109.352622][ T5848] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 109.453944][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 111.961967][ T5868] loop1: detected capacity change from 0 to 512 [ 111.994593][ T5868] EXT4-fs: Ignoring removed mblk_io_submit option [ 112.051240][ T5868] EXT4-fs error (device loop1): ext4_iget_extra_inode:4763: inode #15: comm syz.1.537: corrupted in-inode xattr [ 112.059434][ T5868] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.537: couldn't read orphan inode 15 (err -117) [ 112.071339][ T5868] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 112.224829][ T4335] EXT4-fs (loop1): unmounting filesystem. [ 112.280637][ T5886] FAULT_INJECTION: forcing a failure. [ 112.280637][ T5886] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 112.304222][ T5886] CPU: 0 PID: 5886 Comm: syz.0.544 Not tainted syzkaller #0 [ 112.305691][ T5886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 112.307589][ T5886] Call trace: [ 112.308224][ T5886] dump_backtrace+0x1c4/0x1f0 [ 112.309143][ T5886] show_stack+0x2c/0x3c [ 112.309950][ T5886] __dump_stack+0x30/0x40 [ 112.310821][ T5886] dump_stack_lvl+0xf4/0x15c [ 112.311724][ T5886] dump_stack+0x1c/0x5c [ 112.312489][ T5886] should_fail_ex+0x3cc/0x524 [ 112.313339][ T5886] should_fail+0x14/0x24 [ 112.314160][ T5886] should_fail_usercopy+0x20/0x30 [ 112.315127][ T5886] copyout+0x2c/0x148 [ 112.315922][ T5886] _copy_to_iter+0x418/0xeac [ 112.316836][ T5886] get_random_bytes_user+0x18c/0x31c [ 112.317889][ T5886] __arm64_sys_getrandom+0x170/0x27c [ 112.318915][ T5886] invoke_syscall+0x98/0x290 [ 112.319773][ T5886] el0_svc_common+0x13c/0x258 [ 112.320673][ T5886] do_el0_svc+0x5c/0x134 [ 112.321492][ T5886] el0_svc+0x58/0x128 [ 112.322252][ T5886] el0t_64_sync_handler+0x84/0xf0 [ 112.323224][ T5886] el0t_64_sync+0x18c/0x190 [ 112.328196][ T5888] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 112.333335][ T5888] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.335355][ T5888] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.399632][ T5895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.548'. [ 112.413297][ T5895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.548'. [ 114.822003][ T5905] loop3: detected capacity change from 0 to 512 [ 114.840248][ T5905] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 114.848289][ T5905] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: comm syz.3.553: inode #131072: comm syz.3.553: iget: illegal inode # [ 114.849887][ T5905] EXT4-fs (loop3): Remounting filesystem read-only [ 114.849906][ T5905] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.553: error while reading EA inode 131072 err=-117 [ 114.850110][ T5905] EXT4-fs (loop3): Remounting filesystem read-only [ 114.850184][ T5905] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2805: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 114.850223][ T5905] EXT4-fs (loop3): 1 truncate cleaned up [ 114.850240][ T5905] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 114.942128][ T5915] netlink: 4 bytes leftover after parsing attributes in process `syz.2.555'. [ 114.994373][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 115.212776][ T5920] tipc: Started in network mode [ 115.221819][ T5920] tipc: Node identity 3afdd70ed949, cluster identity 4711 [ 115.230353][ T5920] tipc: Enabled bearer , priority 0 [ 115.340333][ T5920] device syzkaller0 entered promiscuous mode [ 115.349779][ T5920] tipc: Resetting bearer [ 115.399257][ T5919] tipc: Resetting bearer [ 115.642820][ T5942] IPv6: addrconf: prefix option has invalid lifetime [ 117.063365][ T5975] loop2: detected capacity change from 0 to 512 [ 123.966662][ T5919] tipc: Disabling bearer [ 123.972347][ T294] tipc: Node number set to 3820279566 [ 124.004670][ T6003] device syzkaller0 entered promiscuous mode [ 124.098929][ T6010] loop0: detected capacity change from 0 to 512 [ 124.111014][ T6010] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 124.303980][ T4508] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 125.935641][ T2066] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.274652][ T4334] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 132.278215][ T4339] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 132.280481][ T4334] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 132.283968][ T4334] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 132.289613][ T4339] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 132.291564][ T4339] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 132.990136][ T6106] chnl_net:caif_netlink_parms(): no params data found [ 133.122878][ T6106] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.152238][ T6106] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.174550][ T6106] device bridge_slave_0 entered promiscuous mode [ 133.199592][ T6106] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.200927][ T6106] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.231244][ T6106] device bridge_slave_1 entered promiscuous mode [ 133.312268][ T6106] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.335855][ T6106] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.411741][ T6106] team0: Port device team_slave_0 added [ 133.413953][ T6106] team0: Port device team_slave_1 added [ 133.431905][ T6148] FAULT_INJECTION: forcing a failure. [ 133.431905][ T6148] name fail_futex, interval 1, probability 0, space 0, times 0 [ 133.434223][ T6148] CPU: 0 PID: 6148 Comm: syz.4.630 Not tainted syzkaller #0 [ 133.435569][ T6148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 133.437414][ T6148] Call trace: [ 133.438046][ T6148] dump_backtrace+0x1c4/0x1f0 [ 133.438936][ T6148] show_stack+0x2c/0x3c [ 133.439752][ T6148] __dump_stack+0x30/0x40 [ 133.440568][ T6148] dump_stack_lvl+0xf4/0x15c [ 133.441435][ T6148] dump_stack+0x1c/0x5c [ 133.442341][ T6148] should_fail_ex+0x3cc/0x524 [ 133.443306][ T6148] should_fail+0x14/0x24 [ 133.444160][ T6148] should_fail_futex+0x48/0x5c [ 133.445112][ T6148] futex_lock_pi_atomic+0x100/0xa78 [ 133.446193][ T6148] futex_lock_pi+0x1dc/0x7cc [ 133.447123][ T6148] do_futex+0x1d0/0x340 [ 133.447974][ T6148] __arm64_sys_futex+0x390/0x414 [ 133.448963][ T6148] invoke_syscall+0x98/0x290 [ 133.449843][ T6148] el0_svc_common+0x13c/0x258 [ 133.450664][ T6148] do_el0_svc+0x5c/0x134 [ 133.451456][ T6148] el0_svc+0x58/0x128 [ 133.452196][ T6148] el0t_64_sync_handler+0x84/0xf0 [ 133.453174][ T6148] el0t_64_sync+0x18c/0x190 [ 133.510606][ T6106] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 133.511893][ T6106] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 133.550801][ T6106] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.569229][ T6106] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.570650][ T6106] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 133.611587][ T6106] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 133.707289][ T6106] device hsr_slave_0 entered promiscuous mode [ 133.738166][ T6106] device hsr_slave_1 entered promiscuous mode [ 133.765111][ T6106] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 133.777996][ T6106] Cannot create hsr debugfs directory [ 133.921985][ T6171] loop3: detected capacity change from 0 to 512 [ 133.933321][ T6171] EXT4-fs: Ignoring removed mblk_io_submit option [ 133.971251][ T6171] EXT4-fs error (device loop3): ext4_iget_extra_inode:4763: inode #15: comm syz.3.640: corrupted in-inode xattr [ 133.988327][ T6171] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.640: couldn't read orphan inode 15 (err -117) [ 134.009164][ T6171] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 134.068721][ T6177] loop2: detected capacity change from 0 to 256 [ 134.083997][ T6178] loop0: detected capacity change from 0 to 512 [ 134.090514][ T6177] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 134.106477][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 134.109381][ T6178] EXT4-fs error (device loop0): ext4_orphan_get:1409: inode #15: comm syz.0.642: inode has both inline data and extents flags [ 134.112272][ T6177] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 134.131309][ T6178] EXT4-fs error (device loop0): ext4_orphan_get:1414: comm syz.0.642: couldn't read orphan inode 15 (err -117) [ 134.146897][ T6178] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 134.234696][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 134.237054][ T6106] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 134.293542][ T6106] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 134.319341][ T6106] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 134.335218][ T4339] Bluetooth: hci5: command 0x0409 tx timeout [ 134.356282][ T6106] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 134.403727][ T6186] device syzkaller0 entered promiscuous mode [ 134.641382][ T6106] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.702506][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 134.705872][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.718592][ T6106] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.790764][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 134.793144][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.805708][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.807164][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.820098][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 134.837754][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.849862][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.851183][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.871199][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.882197][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 134.900722][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.920903][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.948333][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.971192][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.991103][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 135.001517][ T6210] FAULT_INJECTION: forcing a failure. [ 135.001517][ T6210] name fail_futex, interval 1, probability 0, space 0, times 0 [ 135.003997][ T6210] CPU: 0 PID: 6210 Comm: syz.3.656 Not tainted syzkaller #0 [ 135.005253][ T6210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 135.007159][ T6210] Call trace: [ 135.007866][ T6210] dump_backtrace+0x1c4/0x1f0 [ 135.008924][ T6210] show_stack+0x2c/0x3c [ 135.009867][ T6210] __dump_stack+0x30/0x40 [ 135.010818][ T6210] dump_stack_lvl+0xf4/0x15c [ 135.011743][ T6210] dump_stack+0x1c/0x5c [ 135.012636][ T6210] should_fail_ex+0x3cc/0x524 [ 135.013694][ T6210] should_fail+0x14/0x24 [ 135.014610][ T6210] should_fail_futex+0x48/0x5c [ 135.015648][ T6210] futex_lock_pi_atomic+0x100/0xa78 [ 135.016726][ T6210] futex_lock_pi+0x1dc/0x7cc [ 135.017600][ T6210] do_futex+0x1d0/0x340 [ 135.018415][ T6210] __arm64_sys_futex+0x390/0x414 [ 135.019399][ T6210] invoke_syscall+0x98/0x290 [ 135.020261][ T6210] el0_svc_common+0x13c/0x258 [ 135.021199][ T6210] do_el0_svc+0x5c/0x134 [ 135.022031][ T6210] el0_svc+0x58/0x128 [ 135.022828][ T6210] el0t_64_sync_handler+0x84/0xf0 [ 135.023827][ T6210] el0t_64_sync+0x18c/0x190 [ 135.031976][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 135.052027][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 135.061858][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 135.073333][ T6106] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 135.096350][ T6106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 135.125094][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 135.128842][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 135.164059][ T6213] FAULT_INJECTION: forcing a failure. [ 135.164059][ T6213] name failslab, interval 1, probability 0, space 0, times 0 [ 135.166836][ T6213] CPU: 0 PID: 6213 Comm: syz.0.657 Not tainted syzkaller #0 [ 135.168175][ T6213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 135.170427][ T6213] Call trace: [ 135.171056][ T6213] dump_backtrace+0x1c4/0x1f0 [ 135.171924][ T6213] show_stack+0x2c/0x3c [ 135.172674][ T6213] __dump_stack+0x30/0x40 [ 135.173480][ T6213] dump_stack_lvl+0xf4/0x15c [ 135.174357][ T6213] dump_stack+0x1c/0x5c [ 135.175136][ T6213] should_fail_ex+0x3cc/0x524 [ 135.176043][ T6213] __should_failslab+0xc0/0x11c [ 135.176952][ T6213] should_failslab+0x10/0x28 [ 135.177953][ T6213] __kmem_cache_alloc_node+0x7c/0x318 [ 135.179087][ T6213] __kmalloc_node_track_caller+0xb8/0x174 [ 135.180229][ T6213] kmemdup+0x5c/0x98 [ 135.181022][ T6213] sctp_addr_wq_mgmt+0x280/0x5fc [ 135.182026][ T6213] sctp_inet6addr_event+0x46c/0x610 [ 135.183079][ T6213] atomic_notifier_call_chain+0x178/0x2a4 [ 135.184223][ T6213] inet6addr_notifier_call_chain+0x30/0x40 [ 135.185370][ T6213] ipv6_add_addr+0xa90/0xd74 [ 135.186350][ T6213] inet6_addr_add+0x388/0x844 [ 135.187264][ T6213] addrconf_add_ifaddr+0x1f8/0x298 [ 135.188195][ T6213] inet6_ioctl+0x154/0x378 [ 135.189031][ T6213] sock_do_ioctl+0x100/0x258 [ 135.189882][ T6213] sock_ioctl+0x234/0x828 [ 135.190816][ T6213] __arm64_sys_ioctl+0x14c/0x1c8 [ 135.191897][ T6213] invoke_syscall+0x98/0x290 [ 135.192896][ T6213] el0_svc_common+0x13c/0x258 [ 135.193882][ T6213] do_el0_svc+0x5c/0x134 [ 135.194749][ T6213] el0_svc+0x58/0x128 [ 135.195577][ T6213] el0t_64_sync_handler+0x84/0xf0 [ 135.196610][ T6213] el0t_64_sync+0x18c/0x190 [ 135.386755][ T6224] loop2: detected capacity change from 0 to 2048 [ 135.447446][ T6224] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 135.549153][ T4338] EXT4-fs (loop2): unmounting filesystem. [ 135.575592][ T6106] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.601156][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 135.602923][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 135.681883][ T6242] loop4: detected capacity change from 0 to 512 [ 135.709428][ T6242] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 135.719412][ T6242] System zones: 1-12 [ 135.736806][ T6242] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #12: comm syz.4.666: missing EA_INODE flag [ 135.754658][ T6242] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.666: error while reading EA inode 12 err=-117 [ 135.778656][ T6242] EXT4-fs (loop4): 1 orphan inode deleted [ 135.786969][ T6242] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 135.927517][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 135.950206][ T6252] loop3: detected capacity change from 0 to 164 [ 136.275955][ T6260] rock: directory entry would overflow storage [ 136.277102][ T6260] rock: sig=0x4f50, size=4, remaining=3 [ 136.278055][ T6260] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 136.415600][ T4339] Bluetooth: hci5: command 0x041b tx timeout [ 136.464161][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 136.468099][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 136.512431][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 136.527535][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 136.540468][ T6106] device veth0_vlan entered promiscuous mode [ 136.548252][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 136.556826][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 136.569587][ T6106] device veth1_vlan entered promiscuous mode [ 136.631491][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 136.633738][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 136.643319][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 136.652574][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 136.668665][ T6106] device veth0_macvtap entered promiscuous mode [ 136.681270][ T6106] device veth1_macvtap entered promiscuous mode [ 136.783000][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.801060][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.812133][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.830815][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.847778][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.861281][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.872213][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.882224][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.898007][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.926544][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.948267][ T6106] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 136.952831][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 136.954778][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 136.963960][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 136.992306][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 137.023336][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.025908][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.031769][ T6279] FAULT_INJECTION: forcing a failure. [ 137.031769][ T6279] name fail_futex, interval 1, probability 0, space 0, times 0 [ 137.034064][ T6279] CPU: 0 PID: 6279 Comm: syz.4.679 Not tainted syzkaller #0 [ 137.035401][ T6279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 137.037342][ T6279] Call trace: [ 137.037970][ T6279] dump_backtrace+0x1c4/0x1f0 [ 137.038933][ T6279] show_stack+0x2c/0x3c [ 137.039739][ T6279] __dump_stack+0x30/0x40 [ 137.040583][ T6279] dump_stack_lvl+0xf4/0x15c [ 137.041453][ T6279] dump_stack+0x1c/0x5c [ 137.042210][ T6279] should_fail_ex+0x3cc/0x524 [ 137.043082][ T6279] should_fail+0x14/0x24 [ 137.043889][ T6279] should_fail_futex+0x48/0x5c [ 137.044773][ T6279] futex_lock_pi_atomic+0x100/0xa78 [ 137.045751][ T6279] futex_lock_pi+0x1dc/0x7cc [ 137.046638][ T6279] do_futex+0x1d0/0x340 [ 137.047422][ T6279] __arm64_sys_futex+0x390/0x414 [ 137.048361][ T6279] invoke_syscall+0x98/0x290 [ 137.049225][ T6279] el0_svc_common+0x13c/0x258 [ 137.050103][ T6279] do_el0_svc+0x5c/0x134 [ 137.050905][ T6279] el0_svc+0x58/0x128 [ 137.051659][ T6279] el0t_64_sync_handler+0x84/0xf0 [ 137.052604][ T6279] el0t_64_sync+0x18c/0x190 [ 137.064709][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.072500][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.074476][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.105464][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.118116][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.120014][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.121772][ T6106] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.145768][ T6106] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.161741][ T6106] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.164640][ T6273] device syzkaller0 entered promiscuous mode [ 137.169214][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 137.171253][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 137.179741][ T27] audit: type=1326 audit(393.152:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.187895][ T27] audit: type=1326 audit(393.162:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.205683][ T27] audit: type=1326 audit(393.162:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.222770][ T27] audit: type=1326 audit(393.162:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=146 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.250394][ T27] audit: type=1326 audit(393.162:9): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.265986][ T27] audit: type=1326 audit(393.162:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.270531][ T27] audit: type=1326 audit(393.162:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6284 comm="syz.2.682" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 137.288565][ T6106] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.290891][ T6106] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.292708][ T6106] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.294514][ T6106] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.437849][ T5948] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.439561][ T5948] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.441230][ T1614] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 137.482643][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.484357][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.489438][ T1614] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 137.611043][ T6293] loop5: detected capacity change from 0 to 512 [ 137.846709][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 137.924604][ T6299] loop4: detected capacity change from 0 to 164 [ 138.248270][ T6300] rock: directory entry would overflow storage [ 138.249565][ T6300] rock: sig=0x4f50, size=4, remaining=3 [ 138.250603][ T6300] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 138.417179][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.495321][ T4339] Bluetooth: hci5: command 0x040f tx timeout [ 138.580600][ T6314] device syzkaller0 entered promiscuous mode [ 138.630136][ T6316] loop5: detected capacity change from 0 to 1024 [ 138.671952][ T6316] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #3: block 2: comm syz.5.695: lblock 2 mapped to illegal pblock 2 (length 1) [ 138.694487][ T6316] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 138.704416][ T6316] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #3: block 48: comm syz.5.695: lblock 0 mapped to illegal pblock 48 (length 1) [ 138.723082][ T6316] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 138.735785][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.739823][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.742620][ T6316] EXT4-fs error (device loop5): ext4_acquire_dquot:6841: comm syz.5.695: Failed to acquire dquot type 0 [ 138.806089][ T6316] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 138.812039][ T6316] EXT4-fs error (device loop5): ext4_evict_inode:281: inode #11: comm syz.5.695: mark_inode_dirty error [ 138.845059][ T6316] EXT4-fs warning (device loop5): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 138.847052][ T6316] EXT4-fs (loop5): 1 orphan inode deleted [ 138.848068][ T6316] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 138.871307][ T1614] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 138.874497][ T1614] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 138.892314][ T1614] EXT4-fs error (device loop5): ext4_release_dquot:6877: comm kworker/u4:5: Failed to release dquot type 0 [ 138.996156][ T6106] EXT4-fs (loop5): unmounting filesystem. [ 138.997311][ T6106] EXT4-fs error (device loop5): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 139.030265][ T6106] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 139.051336][ T6106] EXT4-fs error (device loop5): ext4_quota_off:7147: inode #3: comm syz-executor: mark_inode_dirty error [ 139.432307][ T6339] netlink: 32 bytes leftover after parsing attributes in process `syz.0.704'. [ 139.455647][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 139.535252][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 139.669810][ T6346] loop0: detected capacity change from 0 to 164 [ 139.820134][ T6351] rock: directory entry would overflow storage [ 139.821332][ T6351] rock: sig=0x4f50, size=4, remaining=3 [ 139.822219][ T6351] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 139.858560][ T6350] device syzkaller0 entered promiscuous mode [ 140.437134][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 140.514955][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 140.575223][ T4336] Bluetooth: hci5: command 0x0419 tx timeout [ 140.979176][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 141.459828][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 141.713385][ T6401] device syzkaller0 entered promiscuous mode [ 141.926280][ T6417] FAULT_INJECTION: forcing a failure. [ 141.926280][ T6417] name failslab, interval 1, probability 0, space 0, times 0 [ 141.944417][ T6417] CPU: 0 PID: 6417 Comm: syz.4.735 Not tainted syzkaller #0 [ 141.945956][ T6417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 141.948099][ T6417] Call trace: [ 141.948775][ T6417] dump_backtrace+0x1c4/0x1f0 [ 141.949801][ T6417] show_stack+0x2c/0x3c [ 141.950697][ T6417] __dump_stack+0x30/0x40 [ 141.951502][ T6417] dump_stack_lvl+0xf4/0x15c [ 141.952402][ T6417] dump_stack+0x1c/0x5c [ 141.953196][ T6417] should_fail_ex+0x3cc/0x524 [ 141.954070][ T6417] __should_failslab+0xc0/0x11c [ 141.954992][ T6417] should_failslab+0x10/0x28 [ 141.955885][ T6417] kmem_cache_alloc_node+0x8c/0x344 [ 141.956891][ T6417] alloc_vmap_area+0x13c/0x169c [ 141.957836][ T6417] __get_vm_area_node+0x178/0x31c [ 141.958789][ T6417] __vmalloc_node_range+0x1d4/0xe70 [ 141.959811][ T6417] vzalloc+0x9c/0xd4 [ 141.960590][ T6417] xt_counters_alloc+0x50/0x60 [ 141.961521][ T6417] __do_replace+0xa8/0x93c [ 141.962389][ T6417] do_ip6t_set_ctl+0x8e8/0xb84 [ 141.963312][ T6417] nf_setsockopt+0x260/0x280 [ 141.964202][ T6417] ipv6_setsockopt+0x168/0x1a0 [ 141.965056][ T6417] udpv6_setsockopt+0xa8/0xc0 [ 141.965944][ T6417] sock_common_setsockopt+0xb0/0xcc [ 141.966896][ T6417] __sys_setsockopt+0x2fc/0x50c [ 141.967794][ T6417] __arm64_sys_setsockopt+0xc0/0xdc [ 141.968803][ T6417] invoke_syscall+0x98/0x290 [ 141.969658][ T6417] el0_svc_common+0x13c/0x258 [ 141.970509][ T6417] do_el0_svc+0x5c/0x134 [ 141.971256][ T6417] el0_svc+0x58/0x128 [ 141.971977][ T6417] el0t_64_sync_handler+0x84/0xf0 [ 141.972899][ T6417] el0t_64_sync+0x18c/0x190 [ 142.182931][ T6430] loop0: detected capacity change from 0 to 512 [ 142.204418][ T6417] syz.4.735: vmalloc error: size 64, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0 [ 142.241714][ T6417] CPU: 0 PID: 6417 Comm: syz.4.735 Not tainted syzkaller #0 [ 142.243011][ T6417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 142.244821][ T6417] Call trace: [ 142.245466][ T6417] dump_backtrace+0x1c4/0x1f0 [ 142.246356][ T6417] show_stack+0x2c/0x3c [ 142.247117][ T6417] __dump_stack+0x30/0x40 [ 142.247954][ T6417] dump_stack_lvl+0xf4/0x15c [ 142.248825][ T6417] dump_stack+0x1c/0x5c [ 142.249613][ T6417] warn_alloc+0x214/0x324 [ 142.250456][ T6417] __vmalloc_node_range+0x24c/0xe70 [ 142.251451][ T6417] vzalloc+0x9c/0xd4 [ 142.252165][ T6417] xt_counters_alloc+0x50/0x60 [ 142.253029][ T6417] __do_replace+0xa8/0x93c [ 142.253841][ T6417] do_ip6t_set_ctl+0x8e8/0xb84 [ 142.254733][ T6417] nf_setsockopt+0x260/0x280 [ 142.255582][ T6417] ipv6_setsockopt+0x168/0x1a0 [ 142.256462][ T6417] udpv6_setsockopt+0xa8/0xc0 [ 142.257363][ T6417] sock_common_setsockopt+0xb0/0xcc [ 142.258359][ T6417] __sys_setsockopt+0x2fc/0x50c [ 142.259238][ T6417] __arm64_sys_setsockopt+0xc0/0xdc [ 142.260231][ T6417] invoke_syscall+0x98/0x290 [ 142.261101][ T6417] el0_svc_common+0x13c/0x258 [ 142.262097][ T6417] do_el0_svc+0x5c/0x134 [ 142.263051][ T6417] el0_svc+0x58/0x128 [ 142.263934][ T6417] el0t_64_sync_handler+0x84/0xf0 [ 142.265060][ T6417] el0t_64_sync+0x18c/0x190 [ 142.439733][ T6417] Mem-Info: [ 142.444047][ T6417] active_anon:15485 inactive_anon:0 isolated_anon:0 [ 142.444047][ T6417] active_file:16537 inactive_file:2119 isolated_file:0 [ 142.444047][ T6417] unevictable:768 dirty:85 writeback:0 [ 142.444047][ T6417] slab_reclaimable:19111 slab_unreclaimable:96083 [ 142.444047][ T6417] mapped:30658 shmem:11549 pagetables:729 [ 142.444047][ T6417] sec_pagetables:0 bounce:0 [ 142.444047][ T6417] kernel_misc_reclaimable:0 [ 142.444047][ T6417] free:1424884 free_pcp:1006 free_cma:7360 [ 142.511950][ T6417] Node 0 active_anon:62044kB inactive_anon:0kB active_file:66148kB inactive_file:8476kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:117068kB dirty:340kB writeback:0kB shmem:46196kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:8512kB pagetables:2916kB sec_pagetables:0kB all_unreclaimable? no [ 142.554159][ T6417] Node 0 DMA free:3076864kB boost:0kB min:20660kB low:25824kB high:30988kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:29440kB [ 142.593049][ T6417] lowmem_reserve[]: 0 0 3550 3550 3550 [ 142.599807][ T6417] Node 0 Normal free:2622176kB boost:0kB min:24392kB low:30488kB high:36584kB reserved_highatomic:0KB active_anon:61940kB inactive_anon:0kB active_file:66148kB inactive_file:8476kB unevictable:3072kB writepending:340kB present:5242880kB managed:3639740kB mlocked:0kB bounce:0kB free_pcp:4740kB local_pcp:4740kB free_cma:0kB [ 142.633889][ T6417] lowmem_reserve[]: 0 0 0 0 0 [ 142.661123][ T6417] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 0*2048kB 751*4096kB (MC) = 3076864kB [ 142.677526][ T6417] Node 0 Normal: 2*4kB (ME) 1*8kB (U) 1*16kB (M) 2*32kB (UM) 130*64kB (UME) 26*128kB (UE) 13*256kB (UM) 2*512kB (UE) 3*1024kB (UM) 1*2048kB (M) 635*4096kB (M) = 2622176kB [ 142.699702][ T6417] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 142.718933][ T6417] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 142.724570][ T6417] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 142.740190][ T6417] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 142.751529][ T6417] 30205 total pagecache pages [ 142.752452][ T6417] 0 pages in swap cache [ 142.758977][ T6417] Free swap = 124996kB [ 142.773057][ T6417] Total swap = 124996kB [ 142.779982][ T6417] 2097152 pages RAM [ 142.780774][ T6417] 0 pages HighMem/MovableOnly [ 142.791244][ T6417] 417169 pages reserved [ 142.797373][ T6417] 8192 pages cma reserved [ 142.798259][ T6417] 0 pages hwpoisoned [ 143.123014][ T6463] loop5: detected capacity change from 0 to 512 [ 143.135171][ C0] net_ratelimit: 8 callbacks suppressed [ 143.135185][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 143.150060][ T6463] EXT4-fs error (device loop5): ext4_get_journal_inode:5762: comm syz.5.746: inode #1792: comm syz.5.746: iget: illegal inode # [ 143.176187][ T6463] EXT4-fs (loop5): Remounting filesystem read-only [ 143.183018][ T6463] EXT4-fs (loop5): no journal found [ 143.195838][ T6463] EXT4-fs (loop5): can't get journal size [ 143.211039][ T6463] EXT4-fs (loop5): warning: mounting fs with errors, running e2fsck is recommended [ 143.239251][ T6463] EXT4-fs (loop5): Errors on filesystem, clearing orphan list. [ 143.250781][ T6463] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 143.455369][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 143.533028][ T6106] EXT4-fs (loop5): unmounting filesystem. [ 144.495250][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 144.496895][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 145.535071][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.575089][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 147.535338][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 147.615076][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 148.335480][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 148.655042][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.694996][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.940655][ T6470] device syzkaller0 entered promiscuous mode [ 150.154100][ T6508] loop3: detected capacity change from 0 to 164 [ 150.256005][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 150.258958][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 150.299890][ T6511] rock: directory entry would overflow storage [ 150.301106][ T6511] rock: sig=0x4f50, size=4, remaining=3 [ 150.302029][ T6511] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 150.735058][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 151.537992][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 151.775041][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 152.175100][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 152.815056][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 153.323846][ T6547] netlink: 'syz.2.770': attribute type 29 has an invalid length. [ 153.615461][ T4336] Bluetooth: hci4: command 0x0406 tx timeout [ 153.616583][ T4336] Bluetooth: hci3: command 0x0406 tx timeout [ 153.617756][ T4336] Bluetooth: hci0: command 0x0406 tx timeout [ 153.618819][ T4336] Bluetooth: hci1: command 0x0406 tx timeout [ 153.855047][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 154.575081][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 154.895053][ T14] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 155.935047][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.975020][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 157.615052][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 158.016580][ T4381] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 158.031429][ T6547] netlink: 'syz.2.770': attribute type 29 has an invalid length. [ 158.480431][ T4336] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 158.487744][ T4336] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 158.490081][ T4336] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 158.499153][ T4336] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 158.500818][ T4336] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 158.502269][ T4336] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 158.591507][ T6571] device syzkaller0 entered promiscuous mode [ 158.664760][ T6582] netlink: 'syz.2.783': attribute type 29 has an invalid length. [ 158.760342][ T6582] netlink: 'syz.2.783': attribute type 29 has an invalid length. [ 158.820790][ T6585] netlink: 'syz.2.783': attribute type 29 has an invalid length. [ 158.822815][ T6582] netlink: 'syz.2.783': attribute type 29 has an invalid length. [ 159.055128][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 159.171597][ T6599] FAULT_INJECTION: forcing a failure. [ 159.171597][ T6599] name failslab, interval 1, probability 0, space 0, times 0 [ 159.181608][ T6599] CPU: 0 PID: 6599 Comm: syz.2.788 Not tainted syzkaller #0 [ 159.183129][ T6599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 159.185154][ T6599] Call trace: [ 159.185779][ T6599] dump_backtrace+0x1c4/0x1f0 [ 159.186650][ T6599] show_stack+0x2c/0x3c [ 159.187407][ T6599] __dump_stack+0x30/0x40 [ 159.188182][ T6599] dump_stack_lvl+0xf4/0x15c [ 159.189003][ T6599] dump_stack+0x1c/0x5c [ 159.189743][ T6599] should_fail_ex+0x3cc/0x524 [ 159.190590][ T6599] __should_failslab+0xc0/0x11c [ 159.191442][ T6599] should_failslab+0x10/0x28 [ 159.192285][ T6599] __kmem_cache_alloc_node+0x7c/0x318 [ 159.193317][ T6599] kmalloc_trace+0x48/0x94 [ 159.194106][ T6599] sctp_inet6addr_event+0x2f8/0x610 [ 159.195042][ T6599] atomic_notifier_call_chain+0x178/0x2a4 [ 159.196129][ T6599] inet6addr_notifier_call_chain+0x30/0x40 [ 159.197256][ T6599] ipv6_add_addr+0xa90/0xd74 [ 159.198098][ T6599] inet6_addr_add+0x388/0x844 [ 159.198930][ T6599] addrconf_add_ifaddr+0x1f8/0x298 [ 159.199868][ T6599] inet6_ioctl+0x154/0x378 [ 159.200694][ T6599] sock_do_ioctl+0x100/0x258 [ 159.201582][ T6599] sock_ioctl+0x234/0x828 [ 159.202456][ T6599] __arm64_sys_ioctl+0x14c/0x1c8 [ 159.203355][ T6599] invoke_syscall+0x98/0x290 [ 159.204349][ T6599] el0_svc_common+0x13c/0x258 [ 159.205248][ T6599] do_el0_svc+0x5c/0x134 [ 159.206064][ T6599] el0_svc+0x58/0x128 [ 159.206810][ T6599] el0t_64_sync_handler+0x84/0xf0 [ 159.207752][ T6599] el0t_64_sync+0x18c/0x190 [ 159.461664][ T6574] chnl_net:caif_netlink_parms(): no params data found [ 159.609709][ T6574] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.619149][ T6574] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.628671][ T6574] device bridge_slave_0 entered promiscuous mode [ 159.649664][ T6574] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.659351][ T6574] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.677563][ T6574] device bridge_slave_1 entered promiscuous mode [ 159.769695][ T6574] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 159.809320][ T6574] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 159.859391][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 159.900505][ T6574] team0: Port device team_slave_0 added [ 159.934826][ T6574] team0: Port device team_slave_1 added [ 160.040254][ T6574] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 160.049574][ T6574] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.083253][ T6574] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 160.095308][ T294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 160.140617][ T6574] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 160.141941][ T6574] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.256181][ T6574] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 160.366721][ T6574] device hsr_slave_0 entered promiscuous mode [ 160.386484][ T6574] device hsr_slave_1 entered promiscuous mode [ 160.415216][ T6574] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 160.417819][ T6574] Cannot create hsr debugfs directory [ 160.542989][ T6647] xt_hashlimit: size too large, truncated to 1048576 [ 160.755004][ T4336] Bluetooth: hci2: command 0x0409 tx timeout [ 160.757830][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.066004][ T6574] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 161.125481][ T6574] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 161.135806][ T4376] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.150031][ T6574] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 161.183039][ T6574] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 161.524130][ T6667] loop5: detected capacity change from 0 to 512 [ 161.532867][ T6574] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.603265][ T6667] EXT4-fs warning (device loop5): dx_probe:833: inode #2: comm syz.5.814: Unrecognised inode hash code 255 [ 161.627085][ T6667] EXT4-fs warning (device loop5): dx_probe:966: inode #2: comm syz.5.814: Corrupt directory, running e2fsck is recommended [ 161.643038][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 161.647153][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 161.650367][ T6574] 8021q: adding VLAN 0 to HW filter on device team0 [ 161.659243][ T6667] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -117 [ 161.660786][ T6667] EXT4-fs error (device loop5): ext4_iget_extra_inode:4763: inode #15: comm syz.5.814: corrupted in-inode xattr [ 161.682307][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 161.684286][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 161.712492][ T6667] EXT4-fs error (device loop5): ext4_orphan_get:1414: comm syz.5.814: couldn't read orphan inode 15 (err -117) [ 161.717373][ T1597] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.718788][ T1597] bridge0: port 1(bridge_slave_0) entered forwarding state [ 161.727394][ T6667] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 161.733152][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 161.756784][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 161.782567][ T1597] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.783899][ T1597] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.788944][ T6667] EXT4-fs error (device loop5): __ext4_remount:6650: comm syz.5.814: Abort forced by user [ 161.790999][ T6667] EXT4-fs (loop5): Remounting filesystem read-only [ 161.792124][ T6667] EXT4-fs (loop5): re-mounted. Quota mode: writeback. [ 161.793749][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 161.809039][ T6667] EXT4-fs warning (device loop5): dx_probe:833: inode #2: comm syz.5.814: Unrecognised inode hash code 255 [ 161.811326][ T6667] EXT4-fs warning (device loop5): dx_probe:966: inode #2: comm syz.5.814: Corrupt directory, running e2fsck is recommended [ 161.831873][ T6680] loop3: detected capacity change from 0 to 256 [ 161.838244][ T6679] loop2: detected capacity change from 0 to 164 [ 161.841586][ T6667] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.843198][ T6667] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.844728][ T6667] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.946351][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 161.948144][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 161.959331][ T6667] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 161.987869][ T6682] rock: directory entry would overflow storage [ 161.989035][ T6682] rock: sig=0x4f50, size=4, remaining=3 [ 161.990063][ T6682] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 162.034620][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 162.037162][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 162.059029][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 162.072502][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 162.092821][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 162.100811][ T6106] EXT4-fs (loop5): unmounting filesystem. [ 162.106226][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 162.130237][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 162.211067][ T6574] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 162.223590][ T6574] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 162.237478][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 162.239384][ T869] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 162.780368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 162.782190][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 162.804639][ T6574] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 162.815323][ T4336] Bluetooth: hci2: command 0x041b tx timeout [ 163.444427][ T6724] device syzkaller0 entered promiscuous mode [ 164.895198][ T4336] Bluetooth: hci2: command 0x040f tx timeout [ 166.157780][ T6784] loop5: detected capacity change from 0 to 164 [ 166.304265][ T6785] rock: directory entry would overflow storage [ 166.305597][ T6785] rock: sig=0x4f50, size=4, remaining=3 [ 166.306623][ T6785] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 166.723450][ T6789] netlink: 'syz.0.854': attribute type 29 has an invalid length. [ 166.975095][ T4336] Bluetooth: hci2: command 0x0419 tx timeout [ 171.422122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 171.424024][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 171.442738][ T6789] netlink: 'syz.0.854': attribute type 29 has an invalid length. [ 171.454174][ T6797] device lo entered promiscuous mode [ 171.471117][ T6797] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 171.486124][ T6574] device veth0_vlan entered promiscuous mode [ 171.489412][ T6574] device veth1_vlan entered promiscuous mode [ 171.504640][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 171.510363][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 171.529066][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 171.537042][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 171.556340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 171.573245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 171.614315][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 171.621045][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 171.660399][ T6574] device veth0_macvtap entered promiscuous mode [ 171.663308][ T6574] device veth1_macvtap entered promiscuous mode [ 171.719772][ T6808] loop5: detected capacity change from 0 to 7 [ 171.726577][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.739048][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.741059][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.746155][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.750428][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.752098][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.761301][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.769200][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.770891][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.778892][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.786504][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.792090][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.793891][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.802393][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.811141][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.815485][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.817386][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.829967][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.830006][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.830017][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.830050][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.830055][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.837712][ T6574] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.838882][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.838908][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.845736][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 171.846186][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 171.846463][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 171.846707][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 171.848329][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.848353][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.850004][ T6808] ldm_validate_partition_table(): Disk read failed. [ 171.852872][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.852897][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.859385][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.859410][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.862935][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.862950][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.862958][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.862967][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.862976][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.862984][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.862991][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.862997][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.863004][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.863009][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.863016][ T6574] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.863021][ T6574] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.866242][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 171.866263][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 171.866516][ T6808] Dev loop5: unable to read RDB block 0 [ 171.866848][ T6808] loop5: unable to read partition table [ 171.866918][ T6808] loop5: partition table beyond EOD, truncated [ 171.866937][ T6808] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 171.880906][ T6574] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.909104][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 171.909538][ T5948] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 171.911515][ T6574] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.911581][ T6574] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.911598][ T6574] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.911613][ T6574] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.084166][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.084182][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.084355][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 172.168269][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.168288][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.168444][ T1597] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 172.232381][ T6819] FAULT_INJECTION: forcing a failure. [ 172.232381][ T6819] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 172.232401][ T6819] CPU: 0 PID: 6819 Comm: syz.5.864 Not tainted syzkaller #0 [ 172.232409][ T6819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 172.232414][ T6819] Call trace: [ 172.232417][ T6819] dump_backtrace+0x1c4/0x1f0 [ 172.232430][ T6819] show_stack+0x2c/0x3c [ 172.232435][ T6819] __dump_stack+0x30/0x40 [ 172.232441][ T6819] dump_stack_lvl+0xf4/0x15c [ 172.232446][ T6819] dump_stack+0x1c/0x5c [ 172.232450][ T6819] should_fail_ex+0x3cc/0x524 [ 172.232460][ T6819] should_fail_alloc_page+0x74/0xb8 [ 172.232466][ T6819] prepare_alloc_pages+0x1b8/0x4f0 [ 172.232471][ T6819] __alloc_pages+0x134/0x544 [ 172.232476][ T6819] alloc_pages+0x434/0x6fc [ 172.232481][ T6819] get_zeroed_page+0x20/0x8c [ 172.232486][ T6819] rds_cong_from_addr+0x10c/0x34c [ 172.232493][ T6819] rds_cong_get_maps+0x30/0xb4 [ 172.232498][ T6819] __rds_conn_create+0x840/0x1944 [ 172.232503][ T6819] rds_conn_create_outgoing+0x60/0x7c [ 172.232509][ T6819] rds_sendmsg+0xcac/0x191c [ 172.232516][ T6819] ____sys_sendmsg+0x588/0x90c [ 172.232527][ T6819] __sys_sendmsg+0x288/0x374 [ 172.232536][ T6819] __arm64_sys_sendmsg+0x80/0x94 [ 172.232541][ T6819] invoke_syscall+0x98/0x290 [ 172.232550][ T6819] el0_svc_common+0x13c/0x258 [ 172.232565][ T6819] do_el0_svc+0x5c/0x134 [ 172.232574][ T6819] el0_svc+0x58/0x128 [ 172.232580][ T6819] el0t_64_sync_handler+0x84/0xf0 [ 172.232585][ T6819] el0t_64_sync+0x18c/0x190 [ 172.370035][ T6823] netlink: 'syz.5.865': attribute type 29 has an invalid length. [ 172.377199][ T6823] netlink: 'syz.5.865': attribute type 29 has an invalid length. [ 172.379261][ T6823] netlink: 'syz.5.865': attribute type 29 has an invalid length. [ 172.379446][ T6823] netlink: 'syz.5.865': attribute type 29 has an invalid length. [ 172.379638][ T6823] netlink: 'syz.5.865': attribute type 29 has an invalid length. [ 173.067493][ T6862] netlink: 'syz.3.877': attribute type 29 has an invalid length. [ 173.077444][ T6862] netlink: 'syz.3.877': attribute type 29 has an invalid length. [ 173.088372][ T6862] netlink: 'syz.3.877': attribute type 29 has an invalid length. [ 173.097697][ T6862] netlink: 'syz.3.877': attribute type 29 has an invalid length. [ 173.107367][ T6862] netlink: 'syz.3.877': attribute type 29 has an invalid length. [ 175.786070][ T6828] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 176.216599][ T6911] netlink: 68 bytes leftover after parsing attributes in process `syz.0.889'. [ 179.124018][ T6952] netlink: 68 bytes leftover after parsing attributes in process `syz.3.906'. [ 179.310820][ T6967] loop0: detected capacity change from 0 to 512 [ 180.229871][ T6967] EXT4-fs error (device loop0): ext4_iget_extra_inode:4763: inode #15: comm syz.0.914: corrupted in-inode xattr [ 180.241265][ T6967] EXT4-fs error (device loop0): ext4_orphan_get:1414: comm syz.0.914: couldn't read orphan inode 15 (err -117) [ 180.249218][ T6967] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 180.308282][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 180.393968][ T6982] netlink: 'syz.0.919': attribute type 29 has an invalid length. [ 180.423064][ T6982] netlink: 'syz.0.919': attribute type 29 has an invalid length. [ 180.429583][ T6982] netlink: 'syz.0.919': attribute type 29 has an invalid length. [ 180.433524][ T6982] netlink: 'syz.0.919': attribute type 29 has an invalid length. [ 180.442566][ T6982] netlink: 'syz.0.919': attribute type 29 has an invalid length. [ 180.529368][ T6989] netlink: 68 bytes leftover after parsing attributes in process `syz.6.922'. [ 180.534129][ T6989] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.535799][ T6989] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.904693][ T7008] device syzkaller0 entered promiscuous mode [ 181.106376][ T7013] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 181.108392][ T7013] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 181.110797][ T7013] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 181.112639][ T7013] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 181.114803][ T7013] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 181.261309][ T7020] netlink: 68 bytes leftover after parsing attributes in process `syz.6.936'. [ 181.458222][ T7033] FAULT_INJECTION: forcing a failure. [ 181.458222][ T7033] name failslab, interval 1, probability 0, space 0, times 0 [ 181.464480][ T7033] CPU: 0 PID: 7033 Comm: syz.6.941 Not tainted syzkaller #0 [ 181.465863][ T7033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 181.467659][ T7033] Call trace: [ 181.468249][ T7033] dump_backtrace+0x1c4/0x1f0 [ 181.469181][ T7033] show_stack+0x2c/0x3c [ 181.470026][ T7033] __dump_stack+0x30/0x40 [ 181.470863][ T7033] dump_stack_lvl+0xf4/0x15c [ 181.471744][ T7033] dump_stack+0x1c/0x5c [ 181.472500][ T7033] should_fail_ex+0x3cc/0x524 [ 181.473387][ T7033] __should_failslab+0xc0/0x11c [ 181.474324][ T7033] should_failslab+0x10/0x28 [ 181.475212][ T7033] __kmem_cache_alloc_node+0x7c/0x318 [ 181.476255][ T7033] kmalloc_trace+0x48/0x94 [ 181.477147][ T7033] rds_loop_conn_alloc+0x8c/0x214 [ 181.478091][ T7033] __rds_conn_create+0x11f0/0x1944 [ 181.479088][ T7033] rds_conn_create_outgoing+0x60/0x7c [ 181.480099][ T7033] rds_sendmsg+0xcac/0x191c [ 181.480929][ T7033] ____sys_sendmsg+0x588/0x90c [ 181.481813][ T7033] __sys_sendmsg+0x288/0x374 [ 181.482667][ T7033] __arm64_sys_sendmsg+0x80/0x94 [ 181.483626][ T7033] invoke_syscall+0x98/0x290 [ 181.484443][ T7033] el0_svc_common+0x13c/0x258 [ 181.485335][ T7033] do_el0_svc+0x5c/0x134 [ 181.486140][ T7033] el0_svc+0x58/0x128 [ 181.486910][ T7033] el0t_64_sync_handler+0x84/0xf0 [ 181.487837][ T7033] el0t_64_sync+0x18c/0x190 [ 181.601637][ T7036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.942'. [ 182.805270][ T6945] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 184.445188][ T7056] loop0: detected capacity change from 0 to 1024 [ 184.446886][ T7056] EXT4-fs: Ignoring removed bh option [ 184.517108][ T7056] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 184.723964][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 184.751771][ T7075] 8021q: adding VLAN 0 to HW filter on device bond1 [ 187.184114][ T7091] loop3: detected capacity change from 0 to 128 [ 187.201018][ T7091] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 187.224308][ T7095] loop6: detected capacity change from 0 to 256 [ 187.231931][ T7091] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 187.257154][ T7095] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 187.377404][ T2066] ieee802154 phy0 wpan0: encryption failed: -22 [ 187.382421][ T7091] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 187.399222][ T7091] FAT-fs (loop3): Filesystem has been set read-only [ 187.414391][ T7088] FAULT_INJECTION: forcing a failure. [ 187.414391][ T7088] name failslab, interval 1, probability 0, space 0, times 0 [ 187.435072][ T7088] CPU: 0 PID: 7088 Comm: syz.5.961 Not tainted syzkaller #0 [ 187.436507][ T7088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 187.438477][ T7088] Call trace: [ 187.439189][ T7088] dump_backtrace+0x1c4/0x1f0 [ 187.440061][ T7088] show_stack+0x2c/0x3c [ 187.440840][ T7088] __dump_stack+0x30/0x40 [ 187.441736][ T7088] dump_stack_lvl+0xf4/0x15c [ 187.442611][ T7088] dump_stack+0x1c/0x5c [ 187.443405][ T7088] should_fail_ex+0x3cc/0x524 [ 187.444338][ T7088] __should_failslab+0xc0/0x11c [ 187.445291][ T7088] should_failslab+0x10/0x28 [ 187.446194][ T7088] __kmem_cache_alloc_node+0x7c/0x318 [ 187.447209][ T7088] __kmalloc+0xc4/0x180 [ 187.447970][ T7088] pfkey_add+0xf98/0x22f8 [ 187.448910][ T7088] pfkey_sendmsg+0xb20/0xe10 [ 187.449799][ T7088] ____sys_sendmsg+0x588/0x90c [ 187.450719][ T7088] __sys_sendmsg+0x288/0x374 [ 187.451622][ T7088] __arm64_sys_sendmsg+0x80/0x94 [ 187.452549][ T7088] invoke_syscall+0x98/0x290 [ 187.453465][ T7088] el0_svc_common+0x13c/0x258 [ 187.454319][ T7088] do_el0_svc+0x5c/0x134 [ 187.455106][ T7088] el0_svc+0x58/0x128 [ 187.455896][ T7088] el0t_64_sync_handler+0x84/0xf0 [ 187.456933][ T7088] el0t_64_sync+0x18c/0x190 [ 187.480915][ T7105] validate_nla: 1 callbacks suppressed [ 187.480928][ T7105] netlink: 'syz.6.966': attribute type 29 has an invalid length. [ 187.498435][ T7105] netlink: 'syz.6.966': attribute type 29 has an invalid length. [ 187.510505][ T7105] netlink: 'syz.6.966': attribute type 29 has an invalid length. [ 187.522550][ T7105] netlink: 'syz.6.966': attribute type 29 has an invalid length. [ 187.534506][ T7105] netlink: 'syz.6.966': attribute type 29 has an invalid length. [ 187.547920][ T27] audit: type=1326 audit(443.522:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.559170][ T27] audit: type=1326 audit(443.532:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.581398][ T27] audit: type=1326 audit(443.532:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.624473][ T27] audit: type=1326 audit(443.532:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=233 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.684917][ T27] audit: type=1326 audit(443.532:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.688979][ T27] audit: type=1326 audit(443.532:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.693214][ T27] audit: type=1326 audit(443.532:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.731208][ T7110] pim6reg: tun_chr_ioctl cmd 1074025677 [ 187.749473][ T7110] pim6reg: linktype set to 32 [ 187.788303][ T27] audit: type=1326 audit(443.532:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.2.967" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff8ad792a8 code=0x7ffc0000 [ 187.888133][ T7117] loop3: detected capacity change from 0 to 512 [ 187.987738][ T7117] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 187.996020][ T7117] EXT4-fs (loop3): orphan cleanup on readonly fs [ 189.810696][ T7117] Quota error (device loop3): find_block_dqentry: Quota for id 0 referenced but not present [ 189.812934][ T7117] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 189.814504][ T7117] EXT4-fs error (device loop3): ext4_acquire_dquot:6841: comm syz.3.972: Failed to acquire dquot type 1 [ 189.817087][ T7121] FAULT_INJECTION: forcing a failure. [ 189.817087][ T7121] name fail_futex, interval 1, probability 0, space 0, times 0 [ 189.819343][ T7121] CPU: 0 PID: 7121 Comm: syz.6.974 Not tainted syzkaller #0 [ 189.820619][ T7121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 189.822468][ T7121] Call trace: [ 189.823074][ T7121] dump_backtrace+0x1c4/0x1f0 [ 189.823933][ T7121] show_stack+0x2c/0x3c [ 189.824688][ T7121] __dump_stack+0x30/0x40 [ 189.825510][ T7121] dump_stack_lvl+0xf4/0x15c [ 189.826408][ T7121] dump_stack+0x1c/0x5c [ 189.827190][ T7121] should_fail_ex+0x3cc/0x524 [ 189.828066][ T7121] should_fail+0x14/0x24 [ 189.828865][ T7121] get_futex_key+0x904/0xfb0 [ 189.829726][ T7121] futex_wake+0x10c/0x458 [ 189.830485][ T7121] do_futex+0x2c4/0x340 [ 189.831235][ T7121] __arm64_sys_futex+0x390/0x414 [ 189.832128][ T7121] invoke_syscall+0x98/0x290 [ 189.832978][ T7121] el0_svc_common+0x13c/0x258 [ 189.833813][ T7121] do_el0_svc+0x5c/0x134 [ 189.834605][ T7121] el0_svc+0x58/0x128 [ 189.835360][ T7121] el0t_64_sync_handler+0x84/0xf0 [ 189.836314][ T7121] el0t_64_sync+0x18c/0x190 [ 190.260548][ T7117] EXT4-fs (loop3): Remounting filesystem read-only [ 190.272769][ T7126] netlink: 'syz.2.975': attribute type 1 has an invalid length. [ 190.282705][ T7117] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.972: bg 0: block 40: padding at end of block bitmap is not set [ 190.301139][ T7117] EXT4-fs (loop3): Remounting filesystem read-only [ 190.317807][ T7117] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 190.323588][ T7126] 8021q: adding VLAN 0 to HW filter on device bond1 [ 190.355835][ T7117] EXT4-fs (loop3): Remounting filesystem read-only [ 190.357602][ T7117] EXT4-fs (loop3): 1 truncate cleaned up [ 190.358798][ T7117] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 190.554248][ T7139] netlink: 'syz.5.980': attribute type 29 has an invalid length. [ 190.572392][ T7139] netlink: 'syz.5.980': attribute type 29 has an invalid length. [ 190.583918][ T7139] netlink: 'syz.5.980': attribute type 29 has an invalid length. [ 191.477877][ T7144] netlink: 'syz.5.980': attribute type 29 has an invalid length. [ 191.492249][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 191.826733][ T7162] FAULT_INJECTION: forcing a failure. [ 191.826733][ T7162] name failslab, interval 1, probability 0, space 0, times 0 [ 191.829365][ T7162] CPU: 0 PID: 7162 Comm: syz.3.986 Not tainted syzkaller #0 [ 191.830644][ T7162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 191.832283][ T7162] Call trace: [ 191.832803][ T7162] dump_backtrace+0x1c4/0x1f0 [ 191.833565][ T7162] show_stack+0x2c/0x3c [ 191.834270][ T7162] __dump_stack+0x30/0x40 [ 191.835036][ T7162] dump_stack_lvl+0xf4/0x15c [ 191.835874][ T7162] dump_stack+0x1c/0x5c [ 191.836656][ T7162] should_fail_ex+0x3cc/0x524 [ 191.837490][ T7162] __should_failslab+0xc0/0x11c [ 191.838397][ T7162] should_failslab+0x10/0x28 [ 191.839226][ T7162] kmem_cache_alloc+0x88/0x310 [ 191.840074][ T7162] skb_clone+0x194/0x308 [ 191.840884][ T7162] packet_rcv+0x4c0/0x1084 [ 191.841725][ T7162] dev_queue_xmit_nit+0x4bc/0x9c0 [ 191.842670][ T7162] dev_hard_start_xmit+0xf8/0x8c8 [ 191.843605][ T7162] __dev_queue_xmit+0x1590/0x3154 [ 191.844549][ T7162] __netlink_deliver_tap+0x468/0x6d8 [ 191.845554][ T7162] netlink_deliver_tap+0x1ac/0x1b0 [ 191.846498][ T7162] netlink_unicast+0x5e0/0x80c [ 191.847399][ T7162] netlink_sendmsg+0x6f0/0x9d8 [ 191.848280][ T7162] ____sys_sendmsg+0x588/0x90c [ 191.849152][ T7162] __sys_sendmsg+0x288/0x374 [ 191.850019][ T7162] __arm64_sys_sendmsg+0x80/0x94 [ 191.850964][ T7162] invoke_syscall+0x98/0x290 [ 191.851846][ T7162] el0_svc_common+0x13c/0x258 [ 191.852748][ T7162] do_el0_svc+0x5c/0x134 [ 191.853515][ T7162] el0_svc+0x58/0x128 [ 191.854244][ T7162] el0t_64_sync_handler+0x84/0xf0 [ 191.855143][ T7162] el0t_64_sync+0x18c/0x190 [ 194.662152][ T7174] validate_nla: 1 callbacks suppressed [ 194.662169][ T7174] netlink: 'syz.2.991': attribute type 1 has an invalid length. [ 194.692814][ T7174] 8021q: adding VLAN 0 to HW filter on device bond2 [ 194.705464][ T7181] netlink: 'syz.3.994': attribute type 29 has an invalid length. [ 194.918003][ T11] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.938350][ T7183] loop6: detected capacity change from 0 to 512 [ 194.946560][ T7181] netlink: 'syz.3.994': attribute type 29 has an invalid length. [ 194.948234][ T7184] netlink: 'syz.3.994': attribute type 29 has an invalid length. [ 194.951165][ T7185] netlink: 'syz.3.994': attribute type 29 has an invalid length. [ 194.965862][ T7190] netlink: 'syz.3.994': attribute type 29 has an invalid length. [ 195.043653][ T7183] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 195.119140][ T11] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.126859][ T7183] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8802c01c, mo2=0002] [ 195.170896][ T7183] EXT4-fs (loop6): orphan cleanup on readonly fs [ 195.224751][ T7183] EXT4-fs error (device loop6): ext4_orphan_get:1409: inode #13: comm syz.6.992: iget: bad i_size value: 12154761577498 [ 195.279137][ T11] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.308588][ T7183] EXT4-fs error (device loop6): ext4_orphan_get:1414: comm syz.6.992: couldn't read orphan inode 13 (err -117) [ 195.361810][ T7183] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 195.429300][ T7203] loop5: detected capacity change from 0 to 128 [ 195.436816][ T11] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.464431][ T7203] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 195.644628][ T6106] EXT4-fs (loop5): unmounting filesystem. [ 196.691629][ T7222] netlink: 'syz.5.1004': attribute type 15 has an invalid length. [ 197.181915][ T7228] netlink: 'syz.0.1007': attribute type 1 has an invalid length. [ 197.226360][ T7228] 8021q: adding VLAN 0 to HW filter on device bond1 [ 197.261709][ T7231] netlink: 'syz.5.1008': attribute type 29 has an invalid length. [ 197.488999][ T7231] netlink: 'syz.5.1008': attribute type 29 has an invalid length. [ 197.587484][ T7242] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1012'. [ 197.694650][ T6574] EXT4-fs (loop6): unmounting filesystem. [ 197.761001][ T7250] loop6: detected capacity change from 0 to 512 [ 197.774837][ T7250] EXT4-fs: Ignoring removed oldalloc option [ 197.792494][ T7250] EXT4-fs error (device loop6): ext4_orphan_get:1435: comm syz.6.1014: bad orphan inode 15 [ 197.802329][ T7250] ext4_test_bit(bit=14, block=5) = 0 [ 197.804615][ T7250] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 197.848936][ T7250] EXT4-fs (loop6): unmounting filesystem. [ 197.910629][ T7258] loop6: detected capacity change from 0 to 512 [ 197.922096][ T7258] EXT4-fs: Ignoring removed i_version option [ 197.929913][ T7258] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 197.948799][ T7258] EXT4-fs error (device loop6): ext4_orphan_get:1409: inode #15: comm syz.6.1017: iget: bogus i_mode (160) [ 197.951642][ T7258] EXT4-fs error (device loop6): ext4_orphan_get:1414: comm syz.6.1017: couldn't read orphan inode 15 (err -117) [ 197.962333][ T7258] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 198.033547][ T6574] EXT4-fs (loop6): unmounting filesystem. [ 198.153446][ T7197] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 198.177111][ T7207] netlink: 256 bytes leftover after parsing attributes in process `syz.2.996'. [ 198.329225][ T7271] loop3: detected capacity change from 0 to 128 [ 198.387851][ T11] device hsr_slave_0 left promiscuous mode [ 198.405298][ T11] device hsr_slave_1 left promiscuous mode [ 198.478400][ T7275] loop0: detected capacity change from 0 to 128 [ 198.485380][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 198.486855][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 198.509975][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 198.519479][ T7275] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 198.524482][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 198.551857][ T11] device bridge_slave_1 left promiscuous mode [ 198.554159][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.611542][ T11] device bridge_slave_0 left promiscuous mode [ 198.613063][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.699622][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 198.735707][ T11] device veth1_macvtap left promiscuous mode [ 198.737603][ T11] device veth0_macvtap left promiscuous mode [ 198.738894][ T11] device veth1_vlan left promiscuous mode [ 198.742422][ T11] device veth0_vlan left promiscuous mode [ 198.820002][ T7286] loop6: detected capacity change from 0 to 128 [ 198.856643][ T7286] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 199.439859][ T6574] EXT4-fs (loop6): unmounting filesystem. [ 200.082292][ T7321] validate_nla: 3 callbacks suppressed [ 200.082306][ T7321] netlink: 'syz.5.1040': attribute type 29 has an invalid length. [ 201.099861][ T11] team0 (unregistering): Port device team_slave_1 removed [ 201.205063][ C0] vcan0: j1939_tp_rxtimer: 0x00000000aa40675f: rx timeout, send abort [ 201.211978][ C0] vcan0: j1939_xtp_rx_abort_one: 0x0000000043d7c430: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 201.246914][ T11] team0 (unregistering): Port device team_slave_0 removed [ 201.366057][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 201.526067][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 201.708717][ C0] vcan0: j1939_tp_rxtimer: 0x00000000aa40675f: abort rx timeout. Force session deactivation [ 202.254759][ T7295] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 202.657059][ T11] bond0 (unregistering): Released all slaves [ 202.860671][ T7318] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1038'. [ 203.029376][ T7321] netlink: 'syz.5.1040': attribute type 29 has an invalid length. [ 203.433684][ T7352] FAULT_INJECTION: forcing a failure. [ 203.433684][ T7352] name failslab, interval 1, probability 0, space 0, times 0 [ 203.460060][ T7352] CPU: 0 PID: 7352 Comm: syz.3.1049 Not tainted syzkaller #0 [ 203.461576][ T7352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 203.463609][ T7352] Call trace: [ 203.464285][ T7352] dump_backtrace+0x1c4/0x1f0 [ 203.465227][ T7352] show_stack+0x2c/0x3c [ 203.466104][ T7352] __dump_stack+0x30/0x40 [ 203.466970][ T7352] dump_stack_lvl+0xf4/0x15c [ 203.467963][ T7352] dump_stack+0x1c/0x5c [ 203.468748][ T7352] should_fail_ex+0x3cc/0x524 [ 203.469735][ T7352] __should_failslab+0xc0/0x11c [ 203.470752][ T7352] should_failslab+0x10/0x28 [ 203.471623][ T7352] __kmem_cache_alloc_node+0x7c/0x318 [ 203.472666][ T7352] __kmalloc_node+0xc8/0x184 [ 203.473563][ T7352] kvmalloc_node+0x88/0x1d4 [ 203.474412][ T7352] bpf_test_run_xdp_live+0x178/0x1610 [ 203.475440][ T7352] bpf_prog_test_run_xdp+0x618/0xd10 [ 203.476468][ T7352] bpf_prog_test_run+0x2dc/0x36c [ 203.477429][ T7352] __sys_bpf+0x504/0x660 [ 203.478244][ T7352] __arm64_sys_bpf+0x80/0x98 [ 203.479113][ T7352] invoke_syscall+0x98/0x290 [ 203.480098][ T7352] el0_svc_common+0x13c/0x258 [ 203.481032][ T7352] do_el0_svc+0x5c/0x134 [ 203.481881][ T7352] el0_svc+0x58/0x128 [ 203.482766][ T7352] el0t_64_sync_handler+0x84/0xf0 [ 203.483883][ T7352] el0t_64_sync+0x18c/0x190 [ 203.657602][ T7359] FAULT_INJECTION: forcing a failure. [ 203.657602][ T7359] name failslab, interval 1, probability 0, space 0, times 0 [ 203.677835][ T7359] CPU: 0 PID: 7359 Comm: syz.2.1051 Not tainted syzkaller #0 [ 203.679278][ T7359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 203.681115][ T7359] Call trace: [ 203.681851][ T7359] dump_backtrace+0x1c4/0x1f0 [ 203.682905][ T7359] show_stack+0x2c/0x3c [ 203.683753][ T7359] __dump_stack+0x30/0x40 [ 203.684526][ T7359] dump_stack_lvl+0xf4/0x15c [ 203.685486][ T7359] dump_stack+0x1c/0x5c [ 203.686375][ T7359] should_fail_ex+0x3cc/0x524 [ 203.687380][ T7359] __should_failslab+0xc0/0x11c [ 203.688407][ T7359] should_failslab+0x10/0x28 [ 203.689395][ T7359] __kmem_cache_alloc_node+0x7c/0x318 [ 203.690565][ T7359] __kmalloc+0xc4/0x180 [ 203.691363][ T7359] __list_lru_init+0xa4/0x50c [ 203.692240][ T7359] alloc_super+0x66c/0x840 [ 203.693120][ T7359] sget_fc+0x28c/0x658 [ 203.693903][ T7359] get_tree_nodev+0x3c/0x16c [ 203.694771][ T7359] shmem_get_tree+0x28/0x38 [ 203.695626][ T7359] vfs_get_tree+0x90/0x278 [ 203.696497][ T7359] do_new_mount+0x228/0x804 [ 203.697340][ T7359] path_mount+0x5ac/0xe6c [ 203.698136][ T7359] __arm64_sys_mount+0x4a0/0x5a0 [ 203.699066][ T7359] invoke_syscall+0x98/0x290 [ 203.699947][ T7359] el0_svc_common+0x13c/0x258 [ 203.700835][ T7359] do_el0_svc+0x5c/0x134 [ 203.701692][ T7359] el0_svc+0x58/0x128 [ 203.702488][ T7359] el0t_64_sync_handler+0x84/0xf0 [ 203.703513][ T7359] el0t_64_sync+0x18c/0x190 [ 203.718779][ T7364] random: crng reseeded on system resumption [ 203.761228][ T7365] FAULT_INJECTION: forcing a failure. [ 203.761228][ T7365] name failslab, interval 1, probability 0, space 0, times 0 [ 203.763452][ T7365] CPU: 0 PID: 7365 Comm: syz.6.1053 Not tainted syzkaller #0 [ 203.764749][ T7365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 203.766618][ T7365] Call trace: [ 203.767205][ T7365] dump_backtrace+0x1c4/0x1f0 [ 203.768075][ T7365] show_stack+0x2c/0x3c [ 203.768845][ T7365] __dump_stack+0x30/0x40 [ 203.769676][ T7365] dump_stack_lvl+0xf4/0x15c [ 203.770574][ T7365] dump_stack+0x1c/0x5c [ 203.771397][ T7365] should_fail_ex+0x3cc/0x524 [ 203.772315][ T7365] __should_failslab+0xc0/0x11c [ 203.773280][ T7365] should_failslab+0x10/0x28 [ 203.774168][ T7365] kmem_cache_alloc+0x88/0x310 [ 203.775072][ T7365] __build_skb+0x34/0x334 [ 203.775897][ T7365] build_skb+0x30/0x198 [ 203.776704][ T7365] __tun_build_skb+0x44/0x23c [ 203.777582][ T7365] tun_get_user+0x16a0/0x32a8 [ 203.778461][ T7365] tun_chr_write_iter+0xfc/0x200 [ 203.779389][ T7365] vfs_write+0x3c8/0x7c8 [ 203.780217][ T7365] ksys_write+0x12c/0x228 [ 203.781038][ T7365] __arm64_sys_write+0x7c/0x90 [ 203.781907][ T7365] invoke_syscall+0x98/0x290 [ 203.782786][ T7365] el0_svc_common+0x13c/0x258 [ 203.783711][ T7365] do_el0_svc+0x5c/0x134 [ 203.784529][ T7365] el0_svc+0x58/0x128 [ 203.785283][ T7365] el0t_64_sync_handler+0x84/0xf0 [ 203.786188][ T7365] el0t_64_sync+0x18c/0x190 [ 203.914354][ T7371] loop3: detected capacity change from 0 to 512 [ 204.036386][ T7371] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 204.169648][ T7380] FAULT_INJECTION: forcing a failure. [ 204.169648][ T7380] name failslab, interval 1, probability 0, space 0, times 0 [ 204.172123][ T7380] CPU: 0 PID: 7380 Comm: syz.2.1056 Not tainted syzkaller #0 [ 204.173452][ T7380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 204.175295][ T7380] Call trace: [ 204.175968][ T7380] dump_backtrace+0x1c4/0x1f0 [ 204.176899][ T7380] show_stack+0x2c/0x3c [ 204.177688][ T7380] __dump_stack+0x30/0x40 [ 204.178497][ T7380] dump_stack_lvl+0xf4/0x15c [ 204.179363][ T7380] dump_stack+0x1c/0x5c [ 204.180146][ T7380] should_fail_ex+0x3cc/0x524 [ 204.181032][ T7380] __should_failslab+0xc0/0x11c [ 204.181947][ T7380] should_failslab+0x10/0x28 [ 204.182798][ T7380] __kmem_cache_alloc_node+0x7c/0x318 [ 204.183799][ T7380] kmalloc_trace+0x48/0x94 [ 204.184678][ T7380] snd_seq_oss_readq_new+0x58/0x22c [ 204.185677][ T7380] snd_seq_oss_open+0x660/0xca4 [ 204.186632][ T7380] odev_open+0x84/0xbc [ 204.187443][ T7380] soundcore_open+0x2f8/0x47c [ 204.188383][ T7380] chrdev_open+0x3d0/0x51c [ 204.189288][ T7380] do_dentry_open+0x738/0xf8c [ 204.190210][ T7380] vfs_open+0x7c/0x90 [ 204.191000][ T7380] path_openat+0x1fc0/0x27a0 [ 204.191913][ T7380] do_filp_open+0x198/0x38c [ 204.192815][ T7380] do_sys_openat2+0x134/0x3fc [ 204.193697][ T7380] __arm64_sys_openat+0x11c/0x150 [ 204.194657][ T7380] invoke_syscall+0x98/0x290 [ 204.195504][ T7380] el0_svc_common+0x13c/0x258 [ 204.196354][ T7380] do_el0_svc+0x5c/0x134 [ 204.197175][ T7380] el0_svc+0x58/0x128 [ 204.197959][ T7380] el0t_64_sync_handler+0x84/0xf0 [ 204.198932][ T7380] el0t_64_sync+0x18c/0x190 [ 204.370634][ T4332] EXT4-fs (loop3): unmounting filesystem. [ 204.403998][ T7385] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1057'. [ 205.086100][ T7409] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1061'. [ 205.410310][ T7423] netlink: 'syz.3.1067': attribute type 1 has an invalid length. [ 205.474304][ T7423] 8021q: adding VLAN 0 to HW filter on device bond1 [ 207.695912][ T7434] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1070'. [ 208.297460][ T7453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.318558][ T7453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.600941][ T7469] netlink: 'syz.2.1081': attribute type 1 has an invalid length. [ 208.637501][ T7469] 8021q: adding VLAN 0 to HW filter on device bond3 [ 209.269463][ T7495] device syzkaller0 entered promiscuous mode [ 209.399764][ T7501] FAULT_INJECTION: forcing a failure. [ 209.399764][ T7501] name fail_futex, interval 1, probability 0, space 0, times 0 [ 209.424101][ T7501] CPU: 0 PID: 7501 Comm: syz.0.1090 Not tainted syzkaller #0 [ 209.425510][ T7501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 209.427393][ T7501] Call trace: [ 209.428015][ T7501] dump_backtrace+0x1c4/0x1f0 [ 209.428927][ T7501] show_stack+0x2c/0x3c [ 209.429730][ T7501] __dump_stack+0x30/0x40 [ 209.430539][ T7501] dump_stack_lvl+0xf4/0x15c [ 209.431374][ T7501] dump_stack+0x1c/0x5c [ 209.432115][ T7501] should_fail_ex+0x3cc/0x524 [ 209.432947][ T7501] should_fail+0x14/0x24 [ 209.433734][ T7501] get_futex_key+0x904/0xfb0 [ 209.434611][ T7501] futex_wake+0x10c/0x458 [ 209.435440][ T7501] do_futex+0x2c4/0x340 [ 209.436342][ T7501] __arm64_sys_futex+0x390/0x414 [ 209.437412][ T7501] invoke_syscall+0x98/0x290 [ 209.438312][ T7501] el0_svc_common+0x13c/0x258 [ 209.439236][ T7501] do_el0_svc+0x5c/0x134 [ 209.440101][ T7501] el0_svc+0x58/0x128 [ 209.440905][ T7501] el0t_64_sync_handler+0x84/0xf0 [ 209.441877][ T7501] el0t_64_sync+0x18c/0x190 [ 209.916946][ T11] nci: nci_rx_work: unknown MT 0x1 [ 210.287537][ T7547] 0: reclassify loop, rule prio 0, protocol 03 [ 210.643101][ T7553] loop0: detected capacity change from 0 to 512 [ 210.670640][ T7553] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 210.694480][ T4329] EXT4-fs (loop0): unmounting filesystem. [ 211.035429][ T7573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.037358][ T7573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.212774][ T7583] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.214413][ T7583] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.801655][ T7520] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 213.193931][ T7608] ftl_cs: FTL header not found. [ 213.301173][ T7608] block2mtd: mtd1: [./dev/loop0] erase_size = 0KiB [6] [ 213.734273][ T7645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.750538][ T7645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.978410][ T7656] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1140'. [ 214.106414][ T7664] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1142'. [ 214.889227][ T7701] device syzkaller0 entered promiscuous mode [ 216.619718][ T7737] netlink: 'syz.6.1167': attribute type 1 has an invalid length. [ 216.621735][ T7639] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 216.750193][ T7737] 8021q: adding VLAN 0 to HW filter on device bond2 [ 217.111893][ T7756] device syzkaller0 entered promiscuous mode [ 217.428808][ T7772] FAULT_INJECTION: forcing a failure. [ 217.428808][ T7772] name failslab, interval 1, probability 0, space 0, times 0 [ 217.443970][ T7772] CPU: 0 PID: 7772 Comm: syz.2.1178 Not tainted syzkaller #0 [ 217.445514][ T7772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 217.447382][ T7772] Call trace: [ 217.447993][ T7772] dump_backtrace+0x1c4/0x1f0 [ 217.448855][ T7772] show_stack+0x2c/0x3c [ 217.449649][ T7772] __dump_stack+0x30/0x40 [ 217.450479][ T7772] dump_stack_lvl+0xf4/0x15c [ 217.451363][ T7772] dump_stack+0x1c/0x5c [ 217.452165][ T7772] should_fail_ex+0x3cc/0x524 [ 217.453095][ T7772] __should_failslab+0xc0/0x11c [ 217.454063][ T7772] should_failslab+0x10/0x28 [ 217.454975][ T7772] __kmem_cache_alloc_node+0x7c/0x318 [ 217.456023][ T7772] kmalloc_trace+0x48/0x94 [ 217.456873][ T7772] rds_loop_conn_alloc+0x8c/0x214 [ 217.457857][ T7772] __rds_conn_create+0x11f0/0x1944 [ 217.458852][ T7772] rds_conn_create_outgoing+0x60/0x7c [ 217.459848][ T7772] rds_sendmsg+0xcac/0x191c [ 217.460709][ T7772] ____sys_sendmsg+0x588/0x90c [ 217.461625][ T7772] __sys_sendmsg+0x288/0x374 [ 217.462524][ T7772] __arm64_sys_sendmsg+0x80/0x94 [ 217.463465][ T7772] invoke_syscall+0x98/0x290 [ 217.464364][ T7772] el0_svc_common+0x13c/0x258 [ 217.465249][ T7772] do_el0_svc+0x5c/0x134 [ 217.466064][ T7772] el0_svc+0x58/0x128 [ 217.466793][ T7772] el0t_64_sync_handler+0x84/0xf0 [ 217.467747][ T7772] el0t_64_sync+0x18c/0x190 [ 217.608793][ T7780] loop5: detected capacity change from 0 to 128 [ 217.636991][ T7780] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 217.664355][ T7780] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 217.827496][ T7793] loop2: detected capacity change from 0 to 512 [ 217.844454][ T7780] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 217.861932][ T7780] FAT-fs (loop5): Filesystem has been set read-only [ 217.874134][ T7793] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 218.045824][ T4338] EXT4-fs (loop2): unmounting filesystem. [ 218.442847][ T7815] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1190'. [ 219.648812][ T7846] device syzkaller0 entered promiscuous mode [ 219.889511][ T7855] device syzkaller0 entered promiscuous mode [ 220.262547][ T7875] device syzkaller0 entered promiscuous mode [ 220.645067][ T7782] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 220.731379][ T7895] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1225'. [ 220.733144][ T7898] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1226'. [ 220.883265][ T7904] device syzkaller0 entered promiscuous mode [ 221.106055][ T7919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1234'. [ 221.113419][ T7917] device syzkaller0 entered promiscuous mode [ 221.357242][ T7929] device syzkaller1 entered promiscuous mode [ 221.417663][ T7937] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1241'. [ 222.367333][ T7978] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1255'. [ 222.731299][ T7997] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1260'. [ 223.494107][ T8026] netlink: 80 bytes leftover after parsing attributes in process `syz.3.1269'. [ 225.675099][ T8038] FAULT_INJECTION: forcing a failure. [ 225.675099][ T8038] name fail_futex, interval 1, probability 0, space 0, times 0 [ 225.974977][ T8038] CPU: 0 PID: 8038 Comm: syz.3.1275 Not tainted syzkaller #0 [ 225.976464][ T8038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 225.978283][ T8038] Call trace: [ 225.978810][ T8038] dump_backtrace+0x1c4/0x1f0 [ 225.979699][ T8038] show_stack+0x2c/0x3c [ 225.980487][ T8038] __dump_stack+0x30/0x40 [ 225.981295][ T8038] dump_stack_lvl+0xf4/0x15c [ 225.982167][ T8038] dump_stack+0x1c/0x5c [ 225.982932][ T8038] should_fail_ex+0x3cc/0x524 [ 225.983808][ T8038] should_fail+0x14/0x24 [ 225.984630][ T8038] get_futex_key+0x904/0xfb0 [ 225.985499][ T8038] futex_wait_setup+0xbc/0x320 [ 225.986370][ T8038] futex_wait+0x164/0x424 [ 225.987218][ T8038] do_futex+0x2e8/0x340 [ 225.988024][ T8038] __arm64_sys_futex+0x390/0x414 [ 225.988991][ T8038] invoke_syscall+0x98/0x290 [ 225.989854][ T8038] el0_svc_common+0x13c/0x258 [ 225.990761][ T8038] do_el0_svc+0x5c/0x134 [ 225.991595][ T8038] el0_svc+0x58/0x128 [ 225.992375][ T8038] el0t_64_sync_handler+0x84/0xf0 [ 225.993290][ T8038] el0t_64_sync+0x18c/0x190 [ 226.314832][ T8050] IPv6: ADDRCONF(NETDEV_CHANGE): sl0: link becomes ready [ 226.392697][ T8060] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1279'. [ 226.574119][ T8070] nfs: Unknown parameter 'ntext' [ 226.786788][ T8077] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1286'. [ 226.788745][ T8078] lo speed is unknown, defaulting to 1000 [ 226.829172][ T8078] lo speed is unknown, defaulting to 1000 [ 226.837673][ T8078] lo speed is unknown, defaulting to 1000 [ 226.907514][ T8078] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 226.952400][ T8078] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 226.956353][ T8080] lo speed is unknown, defaulting to 1000 [ 227.100190][ T8078] lo speed is unknown, defaulting to 1000 [ 227.122218][ T8078] lo speed is unknown, defaulting to 1000 [ 227.140421][ T8078] lo speed is unknown, defaulting to 1000 [ 227.153431][ T8078] lo speed is unknown, defaulting to 1000 [ 227.168096][ T8078] lo speed is unknown, defaulting to 1000 [ 227.179250][ T8078] lo speed is unknown, defaulting to 1000 [ 227.219241][ T8093] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1291'. [ 227.250395][ T8093] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1291'. [ 227.286523][ T8093] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 227.396485][ T8098] FAULT_INJECTION: forcing a failure. [ 227.396485][ T8098] name fail_futex, interval 1, probability 0, space 0, times 0 [ 227.413581][ T8098] CPU: 0 PID: 8098 Comm: syz.6.1293 Not tainted syzkaller #0 [ 227.415014][ T8098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 227.417051][ T8098] Call trace: [ 227.417688][ T8098] dump_backtrace+0x1c4/0x1f0 [ 227.418583][ T8098] show_stack+0x2c/0x3c [ 227.419384][ T8098] __dump_stack+0x30/0x40 [ 227.420232][ T8098] dump_stack_lvl+0xf4/0x15c [ 227.421080][ T8098] dump_stack+0x1c/0x5c [ 227.421817][ T8098] should_fail_ex+0x3cc/0x524 [ 227.422702][ T8098] should_fail+0x14/0x24 [ 227.423547][ T8098] get_futex_key+0x904/0xfb0 [ 227.424366][ T8098] futex_wait_setup+0xbc/0x320 [ 227.425182][ T8098] futex_wait+0x164/0x424 [ 227.425943][ T8098] do_futex+0x2e8/0x340 [ 227.426678][ T8098] __arm64_sys_futex+0x390/0x414 [ 227.427577][ T8098] invoke_syscall+0x98/0x290 [ 227.428388][ T8098] el0_svc_common+0x13c/0x258 [ 227.429203][ T8098] do_el0_svc+0x5c/0x134 [ 227.429952][ T8098] el0_svc+0x58/0x128 [ 227.430659][ T8098] el0t_64_sync_handler+0x84/0xf0 [ 227.431523][ T8098] el0t_64_sync+0x18c/0x190 [ 227.508030][ T8093] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 227.631719][ T8107] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1296'. [ 227.884165][ T8119] device syzkaller0 entered promiscuous mode [ 228.114069][ T8123] lo speed is unknown, defaulting to 1000 [ 228.431643][ T8135] 8021q: adding VLAN 0 to HW filter on device bond2 [ 228.506052][ T8142] netlink: 628 bytes leftover after parsing attributes in process `syz.6.1307'. [ 228.520568][ T8135] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1305'. [ 228.528279][ T8135] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1305'. [ 228.630028][ T8147] FAULT_INJECTION: forcing a failure. [ 228.630028][ T8147] name failslab, interval 1, probability 0, space 0, times 0 [ 228.643127][ T8135] 8021q: adding VLAN 0 to HW filter on device bond0 [ 228.670965][ T8147] CPU: 0 PID: 8147 Comm: syz.2.1308 Not tainted syzkaller #0 [ 228.672353][ T8147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 228.674378][ T8147] Call trace: [ 228.675057][ T8147] dump_backtrace+0x1c4/0x1f0 [ 228.676035][ T8147] show_stack+0x2c/0x3c [ 228.676910][ T8147] __dump_stack+0x30/0x40 [ 228.677742][ T8147] dump_stack_lvl+0xf4/0x15c [ 228.678595][ T8147] dump_stack+0x1c/0x5c [ 228.679374][ T8147] should_fail_ex+0x3cc/0x524 [ 228.680379][ T8147] __should_failslab+0xc0/0x11c [ 228.681328][ T8147] should_failslab+0x10/0x28 [ 228.682303][ T8147] __kmem_cache_alloc_node+0x7c/0x318 [ 228.683439][ T8147] __kmalloc_node+0xc8/0x184 [ 228.684361][ T8147] kvmalloc_node+0x88/0x1d4 [ 228.685277][ T8147] rhashtable_init+0x3b0/0xa10 [ 228.686156][ T8147] rhltable_init+0x28/0x80 [ 228.686988][ T8147] nf_tables_newtable+0x558/0x115c [ 228.687957][ T8147] nfnetlink_rcv+0xc7c/0x1c54 [ 228.688820][ T8147] netlink_unicast+0x5fc/0x80c [ 228.689733][ T8147] netlink_sendmsg+0x6f0/0x9d8 [ 228.690620][ T8147] ____sys_sendmsg+0x588/0x90c [ 228.691505][ T8147] __sys_sendmsg+0x288/0x374 [ 228.692351][ T8147] __arm64_sys_sendmsg+0x80/0x94 [ 228.693290][ T8147] invoke_syscall+0x98/0x290 [ 228.694152][ T8147] el0_svc_common+0x13c/0x258 [ 228.695158][ T8147] do_el0_svc+0x5c/0x134 [ 228.696061][ T8147] el0_svc+0x58/0x128 [ 228.696905][ T8147] el0t_64_sync_handler+0x84/0xf0 [ 228.697949][ T8147] el0t_64_sync+0x18c/0x190 [ 228.711900][ T8135] bond2: (slave bond0): making interface the new active one [ 228.762986][ T8135] bond2: (slave bond0): Enslaving as an active interface with an up link [ 228.800701][ T8141] netlink: 'syz.0.1305': attribute type 4 has an invalid length. [ 228.802146][ T8141] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1305'. [ 228.841702][ T8141] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 228.872953][ T4796] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 229.040959][ T8166] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1311'. [ 229.420315][ T8179] device syzkaller0 entered promiscuous mode [ 229.588638][ T8185] lo speed is unknown, defaulting to 1000 [ 229.803365][ T8197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.843526][ T8197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.229709][ T8212] device syzkaller0 entered promiscuous mode [ 230.779918][ T8231] lo speed is unknown, defaulting to 1000 [ 231.110870][ T8246] FAULT_INJECTION: forcing a failure. [ 231.110870][ T8246] name failslab, interval 1, probability 0, space 0, times 0 [ 231.123660][ T8246] CPU: 0 PID: 8246 Comm: syz.5.1341 Not tainted syzkaller #0 [ 231.125037][ T8246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 231.126885][ T8246] Call trace: [ 231.127472][ T8246] dump_backtrace+0x1c4/0x1f0 [ 231.128314][ T8246] show_stack+0x2c/0x3c [ 231.129103][ T8246] __dump_stack+0x30/0x40 [ 231.129916][ T8246] dump_stack_lvl+0xf4/0x15c [ 231.130787][ T8246] dump_stack+0x1c/0x5c [ 231.131568][ T8246] should_fail_ex+0x3cc/0x524 [ 231.132425][ T8246] __should_failslab+0xc0/0x11c [ 231.133346][ T8246] should_failslab+0x10/0x28 [ 231.134193][ T8246] __kmem_cache_alloc_node+0x7c/0x318 [ 231.135194][ T8246] __kmalloc+0xc4/0x180 [ 231.135970][ T8246] nla_strdup+0x98/0x140 [ 231.136772][ T8246] nf_tables_newtable+0x3ec/0x115c [ 231.137767][ T8246] nfnetlink_rcv+0xc7c/0x1c54 [ 231.138690][ T8246] netlink_unicast+0x5fc/0x80c [ 231.139605][ T8246] netlink_sendmsg+0x6f0/0x9d8 [ 231.140521][ T8246] ____sys_sendmsg+0x588/0x90c [ 231.141398][ T8246] __sys_sendmsg+0x288/0x374 [ 231.142248][ T8246] __arm64_sys_sendmsg+0x80/0x94 [ 231.143191][ T8246] invoke_syscall+0x98/0x290 [ 231.144086][ T8246] el0_svc_common+0x13c/0x258 [ 231.144954][ T8246] do_el0_svc+0x5c/0x134 [ 231.145770][ T8246] el0_svc+0x58/0x128 [ 231.146562][ T8246] el0t_64_sync_handler+0x84/0xf0 [ 231.147543][ T8246] el0t_64_sync+0x18c/0x190 [ 231.196429][ T8248] device syzkaller0 entered promiscuous mode [ 231.668783][ T8267] device syzkaller0 entered promiscuous mode [ 231.678801][ T8270] __nla_validate_parse: 3 callbacks suppressed [ 231.678820][ T8270] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1351'. [ 232.775109][ T8198] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 239.583308][ T8292] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1355'. [ 239.808831][ T8327] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1360'. [ 240.162601][ T8343] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1365'. [ 240.191404][ T8345] jffs2: notice: (8345) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 240.491618][ T8345] overlayfs: failed to resolve './bus': -2 [ 240.754092][ T8375] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1370'. [ 244.470487][ T8433] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1387'. [ 246.072455][ T8452] device syzkaller0 entered promiscuous mode [ 247.633749][ T8484] binder: BINDER_SET_CONTEXT_MGR already set [ 247.647718][ T8484] binder: 8480:8484 ioctl 4018620d 20000040 returned -16 [ 247.651778][ T8484] binder: tried to use weak ref as strong ref [ 247.654287][ T8484] binder: 8480:8484 Acquire 1 refcount change on invalid ref 0 ret -22 [ 247.663315][ T8484] binder: 8480:8484 got transaction to invalid handle, 1 [ 247.671954][ T8484] binder: 8484:8480 cannot find target node [ 247.674281][ T8484] binder: 8480:8484 transaction call to 0:0 failed 3/29201/-22, size 120-24 line 3062 [ 247.681713][ T294] binder: undelivered TRANSACTION_ERROR: 29201 [ 248.815998][ T2066] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.322478][ T8493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1403'. [ 255.493688][ T8499] device syzkaller0 entered promiscuous mode [ 256.015352][ T4339] Bluetooth: hci5: command 0x0406 tx timeout [ 256.307270][ T8554] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1417'. [ 256.933086][ T8580] device syzkaller0 entered promiscuous mode [ 257.080543][ T8583] FAULT_INJECTION: forcing a failure. [ 257.080543][ T8583] name failslab, interval 1, probability 0, space 0, times 0 [ 257.083207][ T8583] CPU: 0 PID: 8583 Comm: syz.6.1425 Not tainted syzkaller #0 [ 257.084536][ T8583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 257.086495][ T8583] Call trace: [ 257.087090][ T8583] dump_backtrace+0x1c4/0x1f0 [ 257.087953][ T8583] show_stack+0x2c/0x3c [ 257.088848][ T8583] __dump_stack+0x30/0x40 [ 257.089788][ T8583] dump_stack_lvl+0xf4/0x15c [ 257.090762][ T8583] dump_stack+0x1c/0x5c [ 257.091689][ T8583] should_fail_ex+0x3cc/0x524 [ 257.092723][ T8583] __should_failslab+0xc0/0x11c [ 257.093713][ T8583] should_failslab+0x10/0x28 [ 257.094659][ T8583] __kmem_cache_alloc_node+0x7c/0x318 [ 257.095709][ T8583] kmalloc_trace+0x48/0x94 [ 257.096571][ T8583] percpu_ref_init+0xc8/0x2f0 [ 257.097482][ T8583] ioctx_alloc+0x228/0x734 [ 257.098317][ T8583] __arm64_sys_io_setup+0x134/0x30c [ 257.099292][ T8583] invoke_syscall+0x98/0x290 [ 257.100160][ T8583] el0_svc_common+0x13c/0x258 [ 257.101047][ T8583] do_el0_svc+0x5c/0x134 [ 257.101857][ T8583] el0_svc+0x58/0x128 [ 257.102625][ T8583] el0t_64_sync_handler+0x84/0xf0 [ 257.103605][ T8583] el0t_64_sync+0x18c/0x190 [ 257.119529][ T8587] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1426'. [ 257.323280][ T8599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.339490][ T8599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.635192][ T8621] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1432'. [ 258.240060][ T8644] device syzkaller0 entered promiscuous mode [ 258.543375][ T8656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.552996][ T8656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.777456][ T8525] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 259.092418][ T8679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1445'. [ 259.803151][ T8718] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.804701][ T8718] bridge0: port 2(bridge_slave_1) entered listening state [ 259.806972][ T8718] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.808372][ T8718] bridge0: port 1(bridge_slave_0) entered listening state [ 259.907884][ T8718] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 259.919914][ T8722] FAULT_INJECTION: forcing a failure. [ 259.919914][ T8722] name failslab, interval 1, probability 0, space 0, times 0 [ 259.927978][ T8722] CPU: 0 PID: 8722 Comm: syz.6.1459 Not tainted syzkaller #0 [ 259.929409][ T8722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 259.931309][ T8722] Call trace: [ 259.931905][ T8722] dump_backtrace+0x1c4/0x1f0 [ 259.932787][ T8722] show_stack+0x2c/0x3c [ 259.933529][ T8722] __dump_stack+0x30/0x40 [ 259.934316][ T8722] dump_stack_lvl+0xf4/0x15c [ 259.935166][ T8722] dump_stack+0x1c/0x5c [ 259.935934][ T8722] should_fail_ex+0x3cc/0x524 [ 259.936802][ T8722] __should_failslab+0xc0/0x11c [ 259.937740][ T8722] should_failslab+0x10/0x28 [ 259.938612][ T8722] kmem_cache_alloc+0x88/0x310 [ 259.939499][ T8722] __kernfs_new_node+0xec/0x5fc [ 259.940417][ T8722] kernfs_new_node+0x120/0x230 [ 259.941334][ T8722] kernfs_create_link+0x98/0x1e4 [ 259.942272][ T8722] sysfs_do_create_link_sd+0x8c/0x120 [ 259.943229][ T8722] sysfs_create_link+0x74/0x94 [ 259.944076][ T8722] device_add+0x744/0xe4c [ 259.944875][ T8722] netdev_register_kobject+0x170/0x2f4 [ 259.945871][ T8722] register_netdevice+0xf28/0x1650 [ 259.946806][ T8722] tun_set_iff+0x624/0xb84 [ 259.947636][ T8722] __tun_chr_ioctl+0x780/0x1dac [ 259.948531][ T8722] tun_chr_ioctl+0x38/0x4c [ 259.949362][ T8722] __arm64_sys_ioctl+0x14c/0x1c8 [ 259.950286][ T8722] invoke_syscall+0x98/0x290 [ 259.951089][ T8722] el0_svc_common+0x13c/0x258 [ 259.951932][ T8722] do_el0_svc+0x5c/0x134 [ 259.952682][ T8722] el0_svc+0x58/0x128 [ 259.953431][ T8722] el0t_64_sync_handler+0x84/0xf0 [ 259.954324][ T8722] el0t_64_sync+0x18c/0x190 [ 260.616413][ T8755] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1463'. [ 260.991604][ T4336] Bluetooth: Wrong link type (-22) [ 261.059821][ T8771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.080949][ T8771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.289031][ T8789] [ 261.289570][ T8789] ====================================================== [ 261.290978][ T8789] WARNING: possible circular locking dependency detected [ 261.292254][ T8789] syzkaller #0 Not tainted [ 261.293066][ T8789] ------------------------------------------------------ [ 261.294352][ T8789] syz.3.1472/8789 is trying to acquire lock: [ 261.295429][ T8789] ffff0000cd4e4350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_start_poll+0x71c/0xaa0 [ 261.297181][ T8789] [ 261.297181][ T8789] but task is already holding lock: [ 261.298529][ T8789] ffff0000cd4e0528 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1a0/0x2f4 [ 261.300479][ T8789] [ 261.300479][ T8789] which lock already depends on the new lock. [ 261.300479][ T8789] [ 261.302370][ T8789] [ 261.302370][ T8789] the existing dependency chain (in reverse order) is: [ 261.303933][ T8789] [ 261.303933][ T8789] -> #3 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 261.305467][ T8789] __mutex_lock_common+0x1a0/0x1f3c [ 261.306492][ T8789] mutex_lock_nested+0x38/0x44 [ 261.307420][ T8789] nfc_urelease_event_work+0x108/0x2b8 [ 261.308460][ T8789] process_one_work+0x7e4/0x13bc [ 261.309450][ T8789] worker_thread+0x8cc/0xfe8 [ 261.310374][ T8789] kthread+0x254/0x2e0 [ 261.311201][ T8789] ret_from_fork+0x10/0x20 [ 261.312115][ T8789] [ 261.312115][ T8789] -> #2 (nfc_devlist_mutex){+.+.}-{3:3}: [ 261.313537][ T8789] __mutex_lock_common+0x1a0/0x1f3c [ 261.314581][ T8789] mutex_lock_nested+0x38/0x44 [ 261.315559][ T8789] nfc_register_device+0x48/0x300 [ 261.316539][ T8789] nci_register_device+0x6b8/0x7e4 [ 261.317537][ T8789] virtual_ncidev_open+0x6c/0xd8 [ 261.318527][ T8789] misc_open+0x310/0x388 [ 261.319393][ T8789] chrdev_open+0x3d0/0x51c [ 261.320294][ T8789] do_dentry_open+0x738/0xf8c [ 261.321224][ T8789] vfs_open+0x7c/0x90 [ 261.322037][ T8789] path_openat+0x1fc0/0x27a0 [ 261.323009][ T8789] do_filp_open+0x198/0x38c [ 261.323984][ T8789] do_sys_openat2+0x134/0x3fc [ 261.324911][ T8789] __arm64_sys_openat+0x11c/0x150 [ 261.325902][ T8789] invoke_syscall+0x98/0x290 [ 261.326830][ T8789] el0_svc_common+0x13c/0x258 [ 261.327814][ T8789] do_el0_svc+0x5c/0x134 [ 261.328726][ T8789] el0_svc+0x58/0x128 [ 261.329571][ T8789] el0t_64_sync_handler+0x84/0xf0 [ 261.330529][ T8789] el0t_64_sync+0x18c/0x190 [ 261.331438][ T8789] [ 261.331438][ T8789] -> #1 (nci_mutex){+.+.}-{3:3}: [ 261.332709][ T8789] __mutex_lock_common+0x1a0/0x1f3c [ 261.333751][ T8789] mutex_lock_nested+0x38/0x44 [ 261.334671][ T8789] virtual_nci_close+0x28/0x58 [ 261.335635][ T8789] nci_dev_up+0x704/0xaa0 [ 261.336557][ T8789] nfc_dev_up+0x138/0x2e0 [ 261.337477][ T8789] nfc_genl_dev_up+0x98/0xdc [ 261.338458][ T8789] genl_family_rcv_msg_doit+0x210/0x308 [ 261.339541][ T8789] genl_rcv_msg+0x424/0x600 [ 261.340462][ T8789] netlink_rcv_skb+0x220/0x3ec [ 261.341428][ T8789] genl_rcv+0x38/0x50 [ 261.342268][ T8789] netlink_unicast+0x5fc/0x80c [ 261.343228][ T8789] netlink_sendmsg+0x6f0/0x9d8 [ 261.344208][ T8789] ____sys_sendmsg+0x588/0x90c [ 261.345195][ T8789] __sys_sendmsg+0x288/0x374 [ 261.346145][ T8789] __arm64_sys_sendmsg+0x80/0x94 [ 261.347256][ T8789] invoke_syscall+0x98/0x290 [ 261.348192][ T8789] el0_svc_common+0x13c/0x258 [ 261.349109][ T8789] do_el0_svc+0x5c/0x134 [ 261.350049][ T8789] el0_svc+0x58/0x128 [ 261.350872][ T8789] el0t_64_sync_handler+0x84/0xf0 [ 261.351866][ T8789] el0t_64_sync+0x18c/0x190 [ 261.352805][ T8789] [ 261.352805][ T8789] -> #0 (&ndev->req_lock){+.+.}-{3:3}: [ 261.354164][ T8789] __lock_acquire+0x2808/0x6634 [ 261.355157][ T8789] lock_acquire+0x20c/0x638 [ 261.356119][ T8789] __mutex_lock_common+0x1a0/0x1f3c [ 261.357209][ T8789] mutex_lock_nested+0x38/0x44 [ 261.358145][ T8789] nci_start_poll+0x71c/0xaa0 [ 261.359089][ T8789] nfc_start_poll+0x124/0x284 [ 261.360110][ T8789] nfc_genl_start_poll+0x1b0/0x2f4 [ 261.361090][ T8789] genl_family_rcv_msg_doit+0x210/0x308 [ 261.362157][ T8789] genl_rcv_msg+0x424/0x600 [ 261.363044][ T8789] netlink_rcv_skb+0x220/0x3ec [ 261.364002][ T8789] genl_rcv+0x38/0x50 [ 261.364799][ T8789] netlink_unicast+0x5fc/0x80c [ 261.365788][ T8789] netlink_sendmsg+0x6f0/0x9d8 [ 261.366768][ T8789] ____sys_sendmsg+0x588/0x90c [ 261.367738][ T8789] __sys_sendmsg+0x288/0x374 [ 261.368700][ T8789] __arm64_sys_sendmsg+0x80/0x94 [ 261.369728][ T8789] invoke_syscall+0x98/0x290 [ 261.370651][ T8789] el0_svc_common+0x13c/0x258 [ 261.371603][ T8789] do_el0_svc+0x5c/0x134 [ 261.372447][ T8789] el0_svc+0x58/0x128 [ 261.373305][ T8789] el0t_64_sync_handler+0x84/0xf0 [ 261.374344][ T8789] el0t_64_sync+0x18c/0x190 [ 261.375263][ T8789] [ 261.375263][ T8789] other info that might help us debug this: [ 261.375263][ T8789] [ 261.377045][ T8789] Chain exists of: [ 261.377045][ T8789] &ndev->req_lock --> nfc_devlist_mutex --> &genl_data->genl_data_mutex [ 261.377045][ T8789] [ 261.379694][ T8789] Possible unsafe locking scenario: [ 261.379694][ T8789] [ 261.381085][ T8789] CPU0 CPU1 [ 261.382060][ T8789] ---- ---- [ 261.383036][ T8789] lock(&genl_data->genl_data_mutex); [ 261.384018][ T8789] lock(nfc_devlist_mutex); [ 261.385275][ T8789] lock(&genl_data->genl_data_mutex); [ 261.386715][ T8789] lock(&ndev->req_lock); [ 261.387565][ T8789] [ 261.387565][ T8789] *** DEADLOCK *** [ 261.387565][ T8789] [ 261.388998][ T8789] 4 locks held by syz.3.1472/8789: [ 261.389918][ T8789] #0: ffff800017a82770 (cb_lock){++++}-{3:3}, at: genl_rcv+0x28/0x50 [ 261.391427][ T8789] #1: ffff800017a82588 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0xec/0x600 [ 261.393143][ T8789] #2: ffff0000cd4e0528 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1a0/0x2f4 [ 261.395296][ T8789] #3: ffff0000cd4e0100 (&dev->mutex){....}-{3:3}, at: nfc_start_poll+0x5c/0x284 [ 261.397009][ T8789] [ 261.397009][ T8789] stack backtrace: [ 261.398070][ T8789] CPU: 0 PID: 8789 Comm: syz.3.1472 Not tainted syzkaller #0 [ 261.399418][ T8789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 261.401335][ T8789] Call trace: [ 261.401927][ T8789] dump_backtrace+0x1c4/0x1f0 [ 261.402810][ T8789] show_stack+0x2c/0x3c [ 261.403585][ T8789] __dump_stack+0x30/0x40 [ 261.404393][ T8789] dump_stack_lvl+0xf4/0x15c [ 261.405211][ T8789] dump_stack+0x1c/0x5c [ 261.405967][ T8789] print_circular_bug+0x148/0x1b0 [ 261.406876][ T8789] check_noncircular+0x264/0x2f8 [ 261.407761][ T8789] __lock_acquire+0x2808/0x6634 [ 261.408702][ T8789] lock_acquire+0x20c/0x638 [ 261.409576][ T8789] __mutex_lock_common+0x1a0/0x1f3c [ 261.410593][ T8789] mutex_lock_nested+0x38/0x44 [ 261.411442][ T8789] nci_start_poll+0x71c/0xaa0 [ 261.412256][ T8789] nfc_start_poll+0x124/0x284 [ 261.413151][ T8789] nfc_genl_start_poll+0x1b0/0x2f4 [ 261.414109][ T8789] genl_family_rcv_msg_doit+0x210/0x308 [ 261.415114][ T8789] genl_rcv_msg+0x424/0x600 [ 261.415990][ T8789] netlink_rcv_skb+0x220/0x3ec [ 261.416923][ T8789] genl_rcv+0x38/0x50 [ 261.417708][ T8789] netlink_unicast+0x5fc/0x80c [ 261.418613][ T8789] netlink_sendmsg+0x6f0/0x9d8 [ 261.419543][ T8789] ____sys_sendmsg+0x588/0x90c [ 261.420449][ T8789] __sys_sendmsg+0x288/0x374 [ 261.421340][ T8789] __arm64_sys_sendmsg+0x80/0x94 [ 261.422318][ T8789] invoke_syscall+0x98/0x290 [ 261.423188][ T8789] el0_svc_common+0x13c/0x258 [ 261.424086][ T8789] do_el0_svc+0x5c/0x134 [ 261.424905][ T8789] el0_svc+0x58/0x128 [ 261.425660][ T8789] el0t_64_sync_handler+0x84/0xf0 [ 261.426628][ T8789] el0t_64_sync+0x18c/0x190 [ 264.119916][ T8789] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 264.125421][ T8781] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512