last executing test programs: 5m38.288902861s ago: executing program 0 (id=208): r0 = fsopen(&(0x7f0000000100)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = fanotify_init(0x10, 0x80000) readv(r2, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0xa880, 0x97) fanotify_mark(r2, 0x1, 0x40001019, r3, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) getdents64(r3, &(0x7f0000000140)=""/53, 0x35) 5m37.991335388s ago: executing program 0 (id=209): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x1, 0x0, &(0x7f00000002c0)="b8", 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0x9, 0x0, 0x0, 0x0, 0x10, 0x4, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10004, 0xfffffffe, 0x0, [{0xff, 0x9, 0x87, '\x00', 0x2}, {0x9, 0x6, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x5, 0x6, '\x00', 0xf9}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc, '\x00', 0x80}, {0x7f, 0x1, 0xb, '\x00', 0xb}, {0xbc, 0xd, 0xa, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0x8, '\x00', 0x3}, {0xfe, 0x7, 0x26}, {0xcf, 0x7, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x0, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0xe2, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x5, 0x2, 0x3, '\x00', 0x10}, {0x9, 0x23, 0xf3, '\x00', 0x4}, {0x0, 0x6, 0x4}]}}) 5m36.382086298s ago: executing program 0 (id=221): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='lp', 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x200000000000005e) sendto$inet(r0, &(0x7f00000001c0)='l', 0x1, 0x24008015, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 5m36.116451315s ago: executing program 0 (id=214): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000300)={[{@noauto_da_alloc}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@dioread_lock}, {@norecovery}, {@discard}, {@lazytime}, {@noload}, {@usrquota}, {@noauto_da_alloc}]}, 0xfe, 0x54d, &(0x7f0000000400)="$eJzs3d9rW1UcAPDvTdv96nQdjKE+SGEPTubStfXHBB/mo+hwoO8ztHdlNFlGk461Dtwe3IsvMgQRB+If4LuPw3/Av2KggyGj6IMvkZvedNmatFmXrZn5fOC259x703NPzv2enpOTkACG1mT2oxDxakR8m0Qcajs2GvnByfXz1h5cm8u2JBqNz/5KIsn3tc5P8t/jeeaViPjt64gThc3l1lZWF0vlcrqU56fqlctTtZXVkxcrpYV0Ib00Mzt7+p3Zmfffe7dvdX3z3D8/fHrno9PfHFv7/pd7h28lcSYO5sfa6/EUrrdnJmMyf07G4sxjJ073obBBkuz2BbAjI3mcj0XWBxyKkTzqgf+/ryKiAQypRPzDkGqNA1pz+z7Ng18Y9z9cnwBtrv/o+msjsa85NzqwljwyM8rmuxN9KD8r49c/b9/Ktujf6xAA27p+IyJOjY5u7v+SvP/buVM9nPN4Gfo/eH7uZOOftzqNfwob45/oMP4Z7xC7O7F9/Bfu9aGYrrLx3wcdx78bi1YTI3nupeaYbyy5cLGcZn3byxFxPMb2Zvmt1nNOr91tdDvWPv7Ltqz81lgwv457o3sffcx8qV56mjq3u38j4rWO499ko/2TDu2fPR/neizjaHr79W7Htq//s9X4OeKNju3/cEUr2Xp9cqp5P0y17orN/r559Pdu5e92/bP2P7B1/SeS9vXa2pOX8dO+f9Nux3Z6/+9JPm+m9+T7rpbq9aXpiD3JJ5v3zzx8bCvfOj+r//FjW/d/ne7//RHxRY/1v3nkZtdTB6H955+o/Z88cffjL3/sVn5v7f92M3U839NL/9frBT7NcwcAAAAAAACDphARByMpFDfShUKxuP7+jiNxoFCu1uonLlSXL81H87OyEzFWaK10j7e9H2I6fz9sKz/zWH42Ig5HxHcj+5v54ly1PL/blQcAAAAAAAAAAAAAAAAAAIABMd7l8/+ZP0Z2++qAZ85XfsPw2jb++/FNT8BA8v8fhpf4h+El/mF4iX8YXuIfhpf4h+El/mF4iX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoq3Nnz2ZbY+3BtbksP39lZXmxeuXkfFpbLFaW54pz1aXLxYVqdaGcFueqle3+XrlavTw9E8tXp+pprT5VW1k9X6kuX6qfv1gpLaTn07HnUisAAAAAAAAAAAAAAAAAAAB4sdRWVhdL5XK6JCGxo8ToYFyGRJ8Tu90zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBD/wUAAP//y284sw==") quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x2, 0x0, 0x0, 0x0, 0x4}, 0x94) chdir(&(0x7f00000003c0)='./bus\x00') rename(&(0x7f0000000240)='./file1\x00', &(0x7f0000000280)='./file0\x00') 5m35.424909501s ago: executing program 0 (id=220): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'vxcan1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x20000000) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 5m33.840487951s ago: executing program 0 (id=235): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) recvmsg$inet_nvme(0xffffffffffffffff, 0x0, 0x40000120) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000005c0)={0x0, @in={{0x2, 0x4e21, @multicast1}}}, 0x84) 5m33.387202272s ago: executing program 32 (id=235): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) recvmsg$inet_nvme(0xffffffffffffffff, 0x0, 0x40000120) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000005c0)={0x0, @in={{0x2, 0x4e21, @multicast1}}}, 0x84) 21.477629068s ago: executing program 2 (id=1104): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) syz_open_dev$tty1(0xc, 0x4, 0x1) mkdir(0x0, 0xc) syz_genetlink_get_family_id$fou(&(0x7f0000000140), 0xffffffffffffffff) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) 19.440223758s ago: executing program 2 (id=1106): socket$igmp6(0xa, 0x3, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000180)=ANY=[], 0x0, 0x28, 0xfffffffffffffda8, 0x0, 0x1f00, 0x22, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2c605, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x604, 0x0, 0xa, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df, 0x2e}) readv(r4, &(0x7f0000000b80)=[{&(0x7f0000000240)=""/246, 0x1c}, {0x0}], 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x280}) connect$inet(0xffffffffffffffff, 0x0, 0x0) 16.96016142s ago: executing program 4 (id=1109): fsetxattr(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="757365722e4b9ac6a74ea81e8164cb1a067c73325f"], 0x0, 0x0, 0x1) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, 0x0, 0x0) unshare(0x22020600) socket$inet_mptcp(0x2, 0x1, 0x106) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x4000002, 0x4010, 0xffffffffffffffff, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r1, 0x1000) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x109040, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x8900, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000040), 0x210002, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="63726561746f723d91b212f72c6e6c733d63703433372c6769643d", @ANYRESHEX=0x0, @ANYBLOB="2c747970653dabe89a7a2c6e6f626172726965722c00e749ee745e13f49b1e10072dcea1fd4ab6d517083bae1cf7be18ac381ae3b1da2a704e"], 0x1, 0x5d9, &(0x7f0000000cc0)="$eJzs3U1rXNcdB+DfHY9lywVbSezELQGLGNqmovaMxk3dbuqWUrQIJVDoKgSEPY6Ex0qQJkUJpVXft/0I6UJfoLvsAukiq3bdlbah0L12LvfOHWlsKYoUK5pR/Txw5pxzzz3nnvu/LzN3hJgAz6yFuTQ3UmRh7vX1sr612eltbXYeDstJziVpJM1BlmIlKT5J7mSQ8vVyYT1c8XnbefWzSx9de+vTNwe1Zp2q9RsH9TucjTplNsmZOj+u8e4+9XjFY3t4fRg4GLdHe2wcpftTXrfAJCgG75t7zCQXkpyvPwekvjs0TnZ2x+9IdzkAAAA4pS5tZzvruTjueQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBpUv/+f1GnxrA8m2L4+/9T9bLU5VPt43FPAAAAAAAAAACOwbXtbGc9F4f1R0X1N/9Xqsrl6vVreS9r6WY1N7KexfTTz2raSWZGBppaX+z3V9uH6Dm/b8/5k9lfAAAAAAAAAPg/9fss7P79HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJkGRnBlkVbo8LM+k0UxyPslUud5G8q9h+TT7eNwTAAAAgBNwaTvbWc/FYf1RUT3zv1g995/Pe1lJP8vpp5du7lXfBQye+htbm53e1mbnYZn2jvvj/x5pGtWIGXz3sP+Wr1ZrTOd+lqslN3I376SXe2lUPUtXh/PZf16/K+dU/Kh2yJndq/Nyz/9a55NhporI2Z2ItOq5ldF47uBIHPHoPLmldho73/xc/gpifqHOy/3580THfH7k7Hvx4Egk3/vlv5eWeisPlu6vzU3OLn1JT0aiMxKJl56pSLSqSFzZqS/kZ/lF5jKbN7Ka5fwqi+mnm9n8tCot1udz+TpzcKTuPFZ744tmMlUfl8Fd9GhzeqXqezHL+Xneyb10czs/yK3czu3cynxaaY0c4SuHuOobR7vqr3+7Lkwn+UudT4Yyrs+NxHX0njtTtY0u2Y3S88d/b2x+oy6U2/hDnU+GJyPRHonECwdH4m+Pyte13sqD1aXFdw+5vW/VeXkd/Wmi3iXK8+X58mBVtcfPjrLthX3b2lXb5Z22xp62KzttX3SlTtWf4faONF+1vbRvW6dquzrStt/nLQAm3oXvXJia/s/0P6c/nP7j9NL06+d/cu72uZencvYfZ3/YbJ35ZuPl4u/5ML/Zff4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+vLX3P3iw2Ot1VxUUFJ7Jwm/3bRr3nQn4qt3sP3z35tr7H3x3+eHi2923uyudW+3Oa7far3W+f/P+cq/bGrzudpga52yB47T7pj/umQAAAAAAAAAAAACHdRL/YDDufQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOt4W5NDdSpN260SrrW5udXpmG5d01m0kaSYpfJ8UnyZ0MUmZGhis+bzuvfnbpo2tvffrm7ljN4fqNg/odzkadMpvkTJ0f13h3n3q8YmcPy4BdHwYOxu1/AQAA//96kwu1") write$P9_RGETATTR(r2, &(0x7f00000038c0)={0xa0, 0x19, 0x1, {0xc0, {0x8, 0x3, 0x6}, 0x0, 0x0, 0x0, 0xa9, 0x1, 0x4, 0x6, 0x8000000000000001, 0x8, 0xfff, 0x8, 0x4, 0x6, 0x4d81, 0x2, 0x3000000000, 0x8, 0x2033}}, 0xa0) 15.670937352s ago: executing program 3 (id=1113): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000040)='mnt\x00', 0x40, &(0x7f0000000000)={[{@dioread_lock}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x1986}}]}, 0x0, 0x248, &(0x7f0000000940)="$eJzs3T9oFFkcB/DfzO5eLsly5O6ag4O7g+M47gIh1x3YxEYhICGICCpERGyURIgJdomVjYXWKqlsgtgZrdMEG0Ww8k+K2AgaLAwWWqzsTiLRbDBxN7uS+Xxg2JnZee/3hp3v221mNoDc6omIgYgoRERvRJQiIll/wB/Z0rO6OdO5MBJRqRx8ndSOy7Yza+26I2I6Iv6PiPk0idPFiMm5o0tvH+//+9JE6a8bc0c6W3qSq5aXFg+sXB+6eHvwv8kHj14OJTEQ5U/Oq/mSOvuKScRPO1HsG5EU2z0CtmL4/K0n1dz/HBF/1vJfijSyD+/y+Hfzpfj32mZtr7x6+Gsrxwo0X6VSqn4HTleA3EkjohxJ2hcR2Xqa9vVlv+GfFrrSM2Pj53pPjU2Mnmz3TAU0Szlicd/djjvdn+X/RSHLP7B7VfN/aHj2WXV9pdDu0QCtVM1/7/Gpf0L+IXfkH/JL/iG/5B/yS/4hv+Qf8kv+Ydf4frsN5B/yS/4hv+Qf8mt9/gGAfKl0tPsOZKBd2j3/AAAAAAAAAAAAAAAAAAAAG810LoysLa2qee9qxPLeiCjWq1+o/R/x2qNNu94k1cM+SrJmDTn2e4MdNOjmDt59vZVHuv3wfOfqb8X935rZW3nbLaZGI6YvRER/sbjx+ktWr7+v9+MX3i+daLBAg/Ycbm/997Otq1Wqs2+wkmQr/fXmnzR+qb3Wn3/Km/S5HWffNdgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALfMhAAD//+M2bGo=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$netlink(0x10, 0x3, 0x9) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, 0x0, &(0x7f0000000780)) 14.249416627s ago: executing program 3 (id=1115): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x29, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f00000000c0)=[0x2], &(0x7f0000000580), 0x0, 0x0, 0x2000}) 12.212579177s ago: executing program 1 (id=1118): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r4, &(0x7f0000000100), 0x6) inotify_init() chroot(&(0x7f0000000180)='./file0\x00') socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)) 12.167559468s ago: executing program 2 (id=1119): setns(0xc9, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x2}, 0x1c) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0xa0, 0x4) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) getsockname(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'nat\x00', 0x3, [{}, {}, {}]}, 0x58) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1ff, 0xf806, 0x452, 0x0, 0x1}, 0x14) r1 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x0, 0x0, 0x34]}, 0x0, 0x0, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x36, 0x36, 0x0, 0x0, 0x64]}, 0x0, 0x0, 0xfffffffffffffffe) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r3, &(0x7f0000847fff)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 10.88252082s ago: executing program 1 (id=1120): socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) socket$nl_sock_diag(0x10, 0x3, 0x4) r0 = socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$NILFS_IOCTL_GET_BDESCS(r0, 0xc0186e87, &(0x7f00000003c0)={&(0x7f0000000200)=[{0x7, 0x10001, 0x8, 0x8000000000000001, 0x7f}, {0x1d97, 0xe87a, 0x401, 0x101, 0x2}, {0x7, 0x6, 0x80000001, 0x0, 0x842b}, {0x1000, 0x1, 0xecd, 0x156a, 0x7}, {0x5, 0x40, 0x7fff, 0x1, 0xe}, {0x7, 0x1, 0x4, 0x80, 0x5c}, {0x9, 0x100000000, 0x5, 0x6, 0x6}], 0x7, 0x28, 0x100, 0x4325}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\x96\xa7f\x9ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\x15n\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z\t\x00\x00\x00\x00\x00\x00\x00\x9b\x01\xf9t\xbb\x1er\x04\xdb\xd3\xcd\xfd\xbdnC\xec#]\xbf\xa2\xa2H\x86\x86[8\x05\xfe\xdc\x11\x04\xa1u\x81', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111, 0x6}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 10.296459855s ago: executing program 4 (id=1121): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000005c0), 0x12) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x26020480) io_uring_setup(0x192, &(0x7f0000000380)={0x0, 0xeb2e, 0x80, 0x8000002, 0x3d7}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) mmap(&(0x7f000014f000/0x4000)=nil, 0x4000, 0x3000000, 0x4000010, r4, 0x94eb000) socket$inet_mptcp(0x2, 0x1, 0x106) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 9.794829337s ago: executing program 4 (id=1122): socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000180)=0x4000000000009) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r4, 0x402c542b, &(0x7f0000000080)={0xfffffe01, 0x9, 0xbf3ffe01, 0x8004, 0x7, "202b9809007d0000cd681ec267a000", 0x6, 0xd}) ioctl$TIOCL_PASTESEL(r4, 0x541c, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r5, 0x0) 7.26937522s ago: executing program 3 (id=1123): syz_mount_image$ext4(&(0x7f0000000540)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x22091406, &(0x7f0000000440)={[{@dioread_lock}, {@quota}, {@delalloc}, {@block_validity}, {@nolazytime}, {@nojournal_checksum, 0x2e}, {@abort}, {@grpjquota}, {@barrier_val={'barrier', 0x3d, 0x1f4c}}, {@mblk_io_submit}], [], 0x2c}, 0x84, 0x4ed, &(0x7f0000001e00)="$eJzs3M1vFOUfAPDvTOkLUGjhR37Ki1JFYyPa0oLKwYMaTbhoTPSAx1oqQQoYWhMhRIoxeDT+BerRxMSTF71ooka9qPGqd2NCDBdQE1MzOzPttt3dbrfQCvv5JNM+z8wzL99n5pmd2Wd2AmhbA9mfJKI3In6JiL48u7DAQP7v+tUL439evTCexOzsC38klXLXrl4YL4uW820uMoNpRPp2ErtrrHfq3PmTY5OTE2eL/PD0qdeGp86df/jEqbHjE8cnTo8ePnzo4Mhjj44+0lQcF5eZnsV1bdebZ/bsPPLSe8+Oz8bL332cbW9vMb06jlx/U+ttZCAGYrYwP7ar8vf+VS/9v2VLRHQX6WTDOm8MTeuIiGx3dVbaf190xPzO64tn3prLfLVOGwjcNNln07YlYzuK/+nc5xdwO0q0cWhT5Sd+dv9bDmt5/bHerjyZ/Z2oxH+9GH54Lq+bNLuX7c/v2DvqzP//GuN65pOzfcusvzcijs789X42RM3vIRpImi4JADDni+z656Fa13/pgmubrUUfSn9E7I+I7RHxv4jYEelcmTsi4s4Vrn9gUX7p9c9PG1e4yBXJrv8eL/q2yiGfUsaVzOW2VOLvTF45MTlxoKiTwejszvIjDdbx5dM/v1tv2kDV9V82ZOsvrwWL7fh9Q/fCeY6NTY+tIuQFrlyKJDbUij+Z6wnIamBnROxqYflZnZ148KM9WXrr5qXTl4+/gRvQzzT7YcQD+f6fiUXxl5J8TfX6J4d7YnLiwHB5VCz1/Y+Xn6/Od1alF8Tf01xMPa0GW8OVSxGbah7/RfxlMyj7a6eK/Ne9Ta/j8q/v1L2nWbr/kzg6U12iOP43zldbdvx3JS9W0l3FuDfGpqfPjkR8XoxYMH50fmllviyfxT+4b2H8+X1xmp3j/vmgmG93RGQH8V0RcXdE7C22/Z6IuDci9jWI/9un7nu1cQ21ePzfAFn8xxrt/4j+pLq/voVEx8lvPqu3/ubOf4cqqcFiTPX5r6vOcpvdwNXWHwAAANwK0kofdJIOVT2/XdoRm9LJM1PT+wfi9dPH8r7q/uhMy2+6+qq+Dx0pvhsu86OL8gcjYlvlSaONlfzQ+JnJLesUM5DbXNX+83NBmg4N5dN+q/fQC3D7WFE/WvVDZ598euM3BlhTfq8J7Uv7h/al/UP70v6hfdVq/xcjrq/DpgBrrNXP/8UPDAC3Htf/0L60f2hf2j+0paU/iS9et5KdE1r/yf/k9iOreWPAzU/M9rU+e9SfNLPyBXY0V7h8+0XTS26ucBJRhpM2iKtGItL5MX8Xb5OsjOnMy3Q1v6lrn0iXLfPEcrXRuaJ3YvTUqI29RaI7IppdzsU1q9XyDJF4yyQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBL+zcAAP//knXm/A==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) r3 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r4 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r4, 0x0, 0x300}, &(0x7f0000000840)=ANY=[], 0x0, 0x0) 7.199971262s ago: executing program 4 (id=1124): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x62, 0x30, 0x4, 0x30, 0x52, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3e}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x64, 0x30, 0x64, 0x30, 0x62, 0x30, 0x30, 0x30, 0x34, 0x30, 0x30, 0x35, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566357a2e68bc1629ecff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x64, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x66, 0x30, 0x5, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x42}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x35, 0x66, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x0, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000480), &(0x7f0000000580)={'fscrypt:', @desc2}, &(0x7f00000005c0)={0x0, "41aaa6461c7d9cdfe002a4fdf77ac6a6b897264411411eb3e0e991467601fa7590931ab1575e497fa2974dbe559c8f95118b6680568af90fbd32a6fd249117c5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x31, 0x30, 0x63, 0x34, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66, 0x36, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000780)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30, 0x30, 0x31, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233444d66778899aabbccddefff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556677889c69bbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x8, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x0, 0x30, 0x63, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x39, 0x61, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556c778899aabbccddeeff", 0x3d}, 0x48, r1) add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$link(0x8, r0, r1) 5.776325997s ago: executing program 3 (id=1125): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000e40)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x61, @private0, 0x3}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f00000000c0)={0xa, 0x4ea0, 0x10, @private0, 0x9}, 0x1c, &(0x7f0000000300)=[{0x0}], 0x1}}], 0x2, 0x931766f6319eed40) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000005c0)={0x0, 0x3}, 0x8) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x4004011}, 0x800) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r3, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="38000000480001152dbd3000fedbdf250a008000", @ANYRES32=0x0, @ANYBLOB="050000001400010000000000000000000000000000000001080002"], 0x38}, 0x1, 0x0, 0x0, 0x24004885}, 0x44080) shutdown(r3, 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a00010000000000000000000a0080"], 0x38}, 0x1, 0x0, 0x0, 0x20000805}, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x8, r2}, 0x18) socket$netlink(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0x42, 0x4, 0x12f0, 0xffffffff, 0x98, 0x11c0, 0x11c0, 0xffffffff, 0xffffffff, 0x1258, 0x1258, 0x1258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {}, {}, 0x0, 0x2}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@empty, @remote, 0xff, 0x0, 'veth0_to_batadv\x00', 'team_slave_1\x00'}, 0x287, 0x10e8, 0x1128, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0x4000000000000000}}}, @common=@unspec=@limit={{0x48}, {0xa, 0x7, 0x0, 0x2, 0x0, 0x0, 0x2}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x3, {0x8}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1ff, 0x2, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x1350) 5.375575087s ago: executing program 2 (id=1126): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) r3 = open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000002300)={0x50, 0x0, r2, {0x7, 0x9, 0x0, 0x1030002, 0x0, 0x0, 0x2}}, 0x50) read$FUSE(r1, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r4}, 0x10) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x20080, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x0) dup3(r5, r1, 0x0) close(0x3) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r7, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) r8 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r0, &(0x7f0000000040)={0x80000010}) 5.132636873s ago: executing program 1 (id=1127): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x2) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={0x0}, 0x1, 0x0, 0x0, 0x20000015}, 0x10000884) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setpgid(r1, r1) sendmsg$nl_xfrm(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)=ANY=[@ANYBLOB="d80000001b0001002dbd7000fadbdf250000000000"], 0xd8}, 0x1, 0x0, 0x0, 0xc040}, 0x8010) 4.889536739s ago: executing program 2 (id=1128): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x3) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000240)={r5, @in={{0x2, 0x4e20, @empty}}}, &(0x7f0000000040)=0x84) 3.980376001s ago: executing program 4 (id=1129): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0xd209f6d83486bb56) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x10, &(0x7f00000000c0)="170000000200020000ffbe8c5ee17688a2002b00030100000077fc5ad90200fb6a880000d6c9db0000db15d088bd8b7000000000d9ce9bc7e28db3000200ff01800a0000ebfc0607bdff59100ac45761547a681f009ceeff5acba400001fb700674f00c8e365d00b5033bf79ac2dfc061f15003901dee2000000000062068f5ee50c08af9b1c568302ffff02ff0331", 0x8f) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r4, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000100007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r5, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x2b}, 0x94) 3.961628672s ago: executing program 1 (id=1130): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xa, &(0x7f0000000240)=0x7f, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000400)=0x10, 0x4) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) ioctl$FIBMAP(r1, 0x1, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000002000)="53464f5a05abbf5900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000099e98558e1b79cd70010b52b9b9800"/4093, 0xffd, 0x4) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='./dev/nullb1\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)='zonefs\x00', 0x0, 0x0) 2.319324702s ago: executing program 2 (id=1131): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000f4b000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00007fd000/0x800000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) 1.928511062s ago: executing program 1 (id=1132): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, &(0x7f0000002300), 0x4, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_vhci(0x0, 0x8) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000021c0), 0x181000) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r4, 0xc0a85320, &(0x7f00000007c0)={{0x80}, 'port0\x00', 0x3c, 0x141000, 0xd, 0x0, 0x107, 0x9, 0x5, 0x0, 0x2, 0x1}) close(r4) 1.149479261s ago: executing program 3 (id=1133): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1fe) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, 0x0, 0x0) write(r1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close(r1) unlinkat(r1, 0x0, 0x0) rmdir(0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x4, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.091154713s ago: executing program 4 (id=1134): mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_io_uring_setup(0x363, &(0x7f00000000c0)={0x0, 0xd057, 0x0, 0x3, 0x2b7, 0x0, r0}, 0x0, &(0x7f0000000180), &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f00000000c0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') 195.947035ms ago: executing program 1 (id=1135): gettid() timer_settime(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$SNDCTL_SYNTH_ID(r4, 0xc08c5114, &(0x7f00000007c0)={"736ef48c3a824d91f3ccdfbe20abf96d1a51a1ac257951b43bfd902f21b7", 0xfffffff7, 0x2, 0x401, 0x0, 0x0, 0x7fff, 0x55b4, 0x0, [0x200, 0x8, 0xfffffffe, 0x7, 0x200, 0x4, 0x4, 0xf24, 0x80000001, 0x7d6af4, 0x3, 0x87e5, 0x6, 0x2, 0x3, 0x0, 0x8, 0x80000000, 0x9]}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b29, &(0x7f0000000000)={'wlan0\x00'}) 0s ago: executing program 3 (id=1136): pipe(0x0) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000200)=@req={0x28, &(0x7f0000000140)={'bridge_slave_1\x00', @ifru_map={0x90, 0x2, 0x7f, 0x80, 0x5, 0x62}}}) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0x8, 0xfff1}, {0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x44894) socket(0x2, 0x3, 0x0) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f00000001c0)=@get={0x1, 0x0, 0x8}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00'}) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2020, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x4, 0x0, 0x2, {0xa, 0x4e22, 0x2, @loopback, 0x6}}}, 0x80) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) setsockopt$sock_timeval(r3, 0x1, 0x0, &(0x7f0000000380)={r4, r5/1000+10000}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x3}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) kernel console output (not intermixed with test programs): ding state [ 85.894246][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.976632][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.045967][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.053193][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.069222][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.076381][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.097330][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.134430][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.162207][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.199169][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.237075][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.244368][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.282723][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.289990][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.313458][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.320713][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.339134][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.346401][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.609942][ T5779] Bluetooth: hci3: command tx timeout [ 86.610213][ T5785] Bluetooth: hci1: command tx timeout [ 86.615446][ T5779] Bluetooth: hci0: command tx timeout [ 86.681947][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.699136][ T5779] Bluetooth: hci2: command tx timeout [ 86.841298][ T5773] veth0_vlan: entered promiscuous mode [ 86.868898][ T5773] veth1_vlan: entered promiscuous mode [ 86.970490][ T5773] veth0_macvtap: entered promiscuous mode [ 87.003936][ T5773] veth1_macvtap: entered promiscuous mode [ 87.017212][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.034949][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.101083][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.165537][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.191861][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.205660][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.215248][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.225098][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.262154][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.325922][ T5772] veth0_vlan: entered promiscuous mode [ 87.454165][ T5772] veth1_vlan: entered promiscuous mode [ 87.465916][ T5771] veth0_vlan: entered promiscuous mode [ 87.513353][ T4265] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.543942][ T4265] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.566401][ T5774] veth0_vlan: entered promiscuous mode [ 87.580319][ T5771] veth1_vlan: entered promiscuous mode [ 87.631670][ T3464] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.649447][ T3464] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.666687][ T5774] veth1_vlan: entered promiscuous mode [ 87.694349][ T5772] veth0_macvtap: entered promiscuous mode [ 87.716185][ T5772] veth1_macvtap: entered promiscuous mode [ 87.800467][ T5771] veth0_macvtap: entered promiscuous mode [ 87.824412][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.840732][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.853170][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.869577][ T5771] veth1_macvtap: entered promiscuous mode [ 87.887038][ T5774] veth0_macvtap: entered promiscuous mode [ 87.905210][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.920016][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.932727][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.955954][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.970840][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.981860][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.993881][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.005941][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.023310][ T5774] veth1_macvtap: entered promiscuous mode [ 88.046575][ T5772] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.068321][ T5772] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.077113][ T5772] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.103943][ T5772] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.130711][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.142119][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.152536][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.164445][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.184477][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.246976][ T5771] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.268608][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.277446][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.290173][ T5837] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.307383][ T5771] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.321641][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.336258][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.347359][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.358462][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.371640][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.382885][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.406957][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.452710][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.465328][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.476269][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.486820][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.497175][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.508228][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.519985][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.579677][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.592202][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.602189][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.611712][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.689811][ T5779] Bluetooth: hci1: command tx timeout [ 88.689852][ T5785] Bluetooth: hci0: command tx timeout [ 88.701991][ T5085] Bluetooth: hci3: command tx timeout [ 88.768485][ T5785] Bluetooth: hci2: command tx timeout [ 88.795550][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.820817][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.862936][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.884478][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.034330][ T3509] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.060085][ T3509] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.132564][ T3509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.158449][ T3509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.204414][ T3509] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.228210][ T3509] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.320865][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.362520][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.860058][ T28] audit: type=1800 audit(1788426451.450:2): pid=5847 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6" name="file1" dev="fuse" ino=0 res=0 errno=0 [ 89.929747][ T5861] device-mapper: table: 248:0: thin-pool: Invalid argument count (-EINVAL) [ 89.946334][ T5863] syz.3.10 uses obsolete (PF_INET,SOCK_PACKET) [ 89.958771][ T5861] device-mapper: ioctl: error adding target to table [ 90.133952][ T5869] syz.1.12[5869]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 90.169405][ T5869] loop1: detected capacity change from 0 to 128 [ 90.169515][ T5870] binder: 5868:5870 ioctl 4018620d 0 returned -22 [ 90.723613][ T5888] Illegal XDP return value 4294967294 on prog (id 4) dev syz_tun, expect packet loss! [ 90.770527][ T5785] Bluetooth: hci1: command tx timeout [ 90.776133][ T5085] Bluetooth: hci0: command tx timeout [ 90.776217][ T5779] Bluetooth: hci3: command tx timeout [ 90.848431][ T5779] Bluetooth: hci2: command tx timeout [ 91.567665][ T5913] ip_tables: iptables: counters copy to user failed while replacing table [ 93.255108][ T5939] input: syz0 as /devices/virtual/input/input5 [ 94.027887][ C0] sched: RT throttling activated [ 94.040866][ T788] cfg80211: failed to load regulatory.db [ 94.979052][ T788] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 95.077484][ T5969] FAULT_INJECTION: forcing a failure. [ 95.077484][ T5969] name failslab, interval 1, probability 0, space 0, times 1 [ 95.090586][ T5969] CPU: 1 PID: 5969 Comm: syz.2.47 Not tainted syzkaller #0 [ 95.097862][ T5969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.108036][ T5969] Call Trace: [ 95.111405][ T5969] [ 95.114411][ T5969] dump_stack_lvl+0x18c/0x250 [ 95.119164][ T5969] ? show_regs_print_info+0x20/0x20 [ 95.124431][ T5969] ? load_image+0x420/0x420 [ 95.129011][ T5969] should_fail_ex+0x394/0x4c0 [ 95.133762][ T5969] should_failslab+0x9/0x20 [ 95.138339][ T5969] slab_pre_alloc_hook+0x59/0x300 [ 95.143438][ T5969] ? ip6_pol_route+0x171/0x1230 [ 95.148361][ T5969] kmem_cache_alloc+0x5a/0x2c0 [ 95.153190][ T5969] ? dst_alloc+0x105/0x170 [ 95.157682][ T5969] ? ipv6_sysctl_rtcache_flush+0xf0/0xf0 [ 95.163466][ T5969] dst_alloc+0x105/0x170 [ 95.167781][ T5969] ip6_pol_route+0x94f/0x1230 [ 95.172562][ T5969] ? ip6_pol_route+0x171/0x1230 [ 95.177488][ T5969] ? trace_fib6_table_lookup+0x1b0/0x1b0 [ 95.183202][ T5969] ? __lock_acquire+0x1262/0x7d80 [ 95.188306][ T5969] fib6_rule_lookup+0x35d/0x580 [ 95.193223][ T5969] ? skb_header_pointer+0x120/0x120 [ 95.198489][ T5969] ? fib6_lookup+0x2d0/0x2d0 [ 95.203155][ T5969] ? read_lock_is_recursive+0x20/0x20 [ 95.208611][ T5969] ip6_route_output_flags+0x364/0x5d0 [ 95.214055][ T5969] ? ip6_route_output_flags+0x2e/0x5d0 [ 95.219589][ T5969] ip6_dst_lookup_tail+0x1a5/0x1660 [ 95.224886][ T5969] ? ip6_dst_lookup+0x60/0x60 [ 95.229651][ T5969] ? read_lock_is_recursive+0x20/0x20 [ 95.235096][ T5969] ? debug_objects_fill_pool+0x8b/0x790 [ 95.240765][ T5969] ip6_dst_lookup_flow+0x48/0xe0 [ 95.245786][ T5969] ? ip6_dst_lookup_tail+0x1660/0x1660 [ 95.251325][ T5969] addr_resolve+0x60b/0x1f30 [ 95.255994][ T5969] ? addr_resolve+0x10a/0x1f30 [ 95.260833][ T5969] ? process_one_req+0x540/0x540 [ 95.265874][ T5969] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 95.271929][ T5969] ? __asan_memset+0x22/0x40 [ 95.274258][ T788] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 95.276564][ T5969] ? lockdep_init_map_type+0x9c/0x8e0 [ 95.276625][ T5969] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 95.296738][ T5969] ? _raw_spin_unlock+0x40/0x40 [ 95.301656][ T5969] ? __debug_object_init+0xec/0x450 [ 95.306933][ T5969] rdma_resolve_ip+0x462/0x850 [ 95.311780][ T5969] rdma_resolve_addr+0x6cb/0x20f0 [ 95.315831][ T788] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 95.316855][ T5969] ? cma_check_port+0x980/0x980 [ 95.316889][ T5969] ? rcu_is_watching+0x15/0xb0 [ 95.336761][ T5969] ? trace_contention_end+0x39/0xe0 [ 95.342029][ T5969] ? __mutex_lock+0x30d/0xc80 [ 95.346781][ T5969] ? do_raw_spin_unlock+0x121/0x230 [ 95.347138][ T788] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 95.352041][ T5969] ? __might_fault+0xc6/0x120 [ 95.352067][ T5969] ? __might_fault+0xaa/0x120 [ 95.352098][ T5969] ucma_resolve_ip+0x21f/0x2d0 [ 95.352125][ T5969] ? ucma_bind_ip+0x250/0x250 [ 95.352144][ T5969] ? try_to_wake_up+0x6f5/0x10e0 [ 95.352173][ T5969] ? __might_fault+0xc6/0x120 [ 95.352194][ T5969] ? __might_fault+0xaa/0x120 [ 95.352224][ T5969] ucma_write+0x252/0x2f0 [ 95.352261][ T5969] ? ucma_get_global_nl_info+0x70/0x70 [ 95.352300][ T5969] ? fsnotify_perm+0x5d/0x5e0 [ 95.352326][ T5969] ? security_file_permission+0x79/0xa0 [ 95.352356][ T5969] ? ucma_get_global_nl_info+0x70/0x70 [ 95.352388][ T5969] vfs_write+0x299/0x9a0 [ 95.352426][ T5969] ? file_end_write+0x250/0x250 [ 95.382489][ T788] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 95.385348][ T5969] ? __fget_files+0x28/0x460 [ 95.385389][ T5969] ? __fget_files+0x3fc/0x460 [ 95.403087][ T788] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 95.404635][ T5969] ? __fdget_pos+0x1d8/0x330 [ 95.425706][ T788] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 95.429571][ T5969] ? ksys_write+0x74/0x260 [ 95.429615][ T5969] ksys_write+0x151/0x260 [ 95.441643][ T788] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 95.445209][ T5969] ? __ia32_sys_read+0x90/0x90 [ 95.445258][ T5969] ? lockdep_hardirqs_on+0x98/0x150 [ 95.460662][ T788] usb 1-1: Product: syz [ 95.461005][ T5969] do_syscall_64+0x55/0xb0 [ 95.474351][ T788] usb 1-1: Manufacturer: syz [ 95.474671][ T5969] ? clear_bhb_loop+0x40/0x90 [ 95.519624][ T5969] ? clear_bhb_loop+0x40/0x90 [ 95.524379][ T5969] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.530353][ T5969] RIP: 0033:0x7fbb6879e159 [ 95.534855][ T5969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.554541][ T5969] RSP: 002b:00007fbb69701028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.563033][ T5969] RAX: ffffffffffffffda RBX: 00007fbb68a25fa0 RCX: 00007fbb6879e159 [ 95.571064][ T5969] RDX: 0000000000000048 RSI: 0000200000000180 RDI: 0000000000000004 [ 95.579106][ T5969] RBP: 00007fbb68835024 R08: 0000000000000000 R09: 0000000000000000 [ 95.587143][ T5969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.595178][ T5969] R13: 00007fbb68a26038 R14: 00007fbb68a25fa0 R15: 00007ffe8c31d5f8 [ 95.603227][ T5969] [ 95.617326][ T788] cdc_wdm 1-1:1.0: skipping garbage [ 95.623710][ T788] cdc_wdm 1-1:1.0: skipping garbage [ 95.646176][ T788] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 95.652497][ T788] cdc_wdm 1-1:1.0: Unknown control protocol [ 96.009257][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.016232][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.024119][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.030796][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.038383][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.045055][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.055848][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.062529][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.069922][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.076604][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.083800][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.090468][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.097136][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.103801][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.110391][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.117157][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.123667][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.130384][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.136740][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 96.143424][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 96.154345][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 96.163171][ T788] usb 1-1: USB disconnect, device number 2 [ 97.357261][ T6018] bond1: option arp_interval: invalid value (18446744073709551611) [ 97.365596][ T6018] bond1: option arp_interval: allowed values 0 - 2147483647 [ 97.379411][ T6018] bond1 (unregistering): Released all slaves [ 98.039105][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888030121c00: rx timeout, send abort [ 98.049583][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff888030121c00: 0x0f000: (3) A timeout occurred and this is the connection abort to close the session. [ 98.833033][ T6055] overlayfs: failed to resolve './file0/file0': -5 [ 99.007584][ T6060] netlink: 'syz.0.83': attribute type 1 has an invalid length. [ 100.155172][ T6093] FAULT_INJECTION: forcing a failure. [ 100.155172][ T6093] name failslab, interval 1, probability 0, space 0, times 0 [ 100.197957][ T6093] CPU: 0 PID: 6093 Comm: syz.3.97 Not tainted syzkaller #0 [ 100.205267][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.215428][ T6093] Call Trace: [ 100.218764][ T6093] [ 100.221749][ T6093] dump_stack_lvl+0x18c/0x250 [ 100.226506][ T6093] ? show_regs_print_info+0x20/0x20 [ 100.231779][ T6093] ? load_image+0x420/0x420 [ 100.236345][ T6093] ? __lock_acquire+0x7d80/0x7d80 [ 100.241427][ T6093] ? rcu_is_watching+0x15/0xb0 [ 100.246258][ T6093] ? trace_contention_end+0x39/0xe0 [ 100.251516][ T6093] should_fail_ex+0x394/0x4c0 [ 100.256260][ T6093] should_failslab+0x9/0x20 [ 100.260922][ T6093] slab_pre_alloc_hook+0x59/0x300 [ 100.266057][ T6093] ? kvmalloc_node+0x70/0x180 [ 100.270797][ T6093] ? kvmalloc_node+0x70/0x180 [ 100.275538][ T6093] __kmem_cache_alloc_node+0x53/0x250 [ 100.281119][ T6093] ? kvmalloc_node+0x70/0x180 [ 100.285864][ T6093] __kmalloc_node+0xa6/0x240 [ 100.290527][ T6093] ? security_capable+0x89/0xb0 [ 100.295449][ T6093] kvmalloc_node+0x70/0x180 [ 100.300025][ T6093] __se_sys_setgroups+0xec/0x410 [ 100.305014][ T6093] ? syscall_enter_from_user_mode+0x25/0x80 [ 100.310958][ T6093] ? lockdep_hardirqs_on+0x98/0x150 [ 100.316217][ T6093] do_syscall_64+0x55/0xb0 [ 100.320692][ T6093] ? clear_bhb_loop+0x40/0x90 [ 100.325405][ T6093] ? clear_bhb_loop+0x40/0x90 [ 100.330131][ T6093] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 100.336081][ T6093] RIP: 0033:0x7f7bb5f9e159 [ 100.340543][ T6093] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.360192][ T6093] RSP: 002b:00007f7bb6e0b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 100.368645][ T6093] RAX: ffffffffffffffda RBX: 00007f7bb6225fa0 RCX: 00007f7bb5f9e159 [ 100.376679][ T6093] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 100.384819][ T6093] RBP: 00007f7bb6035024 R08: 0000000000000000 R09: 0000000000000000 [ 100.392853][ T6093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.400863][ T6093] R13: 00007f7bb6226038 R14: 00007f7bb6225fa0 R15: 00007fffca063ca8 [ 100.408888][ T6093] [ 101.336774][ T6117] lo: entered promiscuous mode [ 101.353811][ T6117] netlink: 4 bytes leftover after parsing attributes in process `syz.1.106'. [ 101.378608][ T6117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.510959][ T6117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.666985][ T6116] lo: left promiscuous mode [ 102.382636][ T6142] ip_tables: iptables: counters copy to user failed while replacing table [ 102.432323][ T6144] tipc: Enabling of bearer rejected, failed to enable media [ 102.502539][ T5773] syz-executor (5773) used greatest stack depth: 20904 bytes left [ 102.683619][ T3464] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.727761][ T6151] netlink: 4 bytes leftover after parsing attributes in process `syz.1.117'. [ 102.940537][ T3464] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.190669][ T3464] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.317770][ T3464] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.372655][ T6155] syzkaller0: entered promiscuous mode [ 103.381703][ T6155] syzkaller0: entered allmulticast mode [ 103.900013][ T6164] bond1: option arp_interval: invalid value (18446744073709551611) [ 103.919952][ T6164] bond1: option arp_interval: allowed values 0 - 2147483647 [ 103.941201][ T6164] bond1 (unregistering): Released all slaves [ 104.307770][ T5085] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 104.319078][ T5085] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 104.327328][ T5085] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 104.343296][ T5085] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 104.352505][ T5085] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 104.360436][ T5085] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 104.972920][ T6198] tipc: Started in network mode [ 104.981245][ T6198] tipc: Node identity c29a513d6bf8, cluster identity 4711 [ 104.990985][ T6198] tipc: Enabled bearer , priority 0 [ 105.074160][ T6201] syzkaller0: entered promiscuous mode [ 105.079932][ T6201] syzkaller0: entered allmulticast mode [ 105.086073][ T6201] tipc: Resetting bearer [ 105.156497][ T6196] tipc: Resetting bearer [ 105.955978][ T6212] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 106.465270][ T5085] Bluetooth: hci1: command tx timeout [ 107.127044][ T6196] tipc: Disabling bearer [ 107.212606][ T788] tipc: Node number set to 2841792829 [ 107.221838][ T6218] netlink: 4 bytes leftover after parsing attributes in process `syz.3.132'. [ 107.255768][ T6182] chnl_net:caif_netlink_parms(): no params data found [ 107.803051][ T6238] loop0: detected capacity change from 0 to 256 [ 107.891902][ T6182] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.918962][ T6182] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.930985][ T5781] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 107.941830][ T6182] bridge_slave_0: entered allmulticast mode [ 107.964945][ T6182] bridge_slave_0: entered promiscuous mode [ 107.995166][ T6182] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.018796][ T6182] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.068179][ T6182] bridge_slave_1: entered allmulticast mode [ 108.079416][ T6182] bridge_slave_1: entered promiscuous mode [ 108.162260][ T6247] overlayfs: failed to resolve './file0/file0': -2 [ 108.331751][ T6253] loop0: detected capacity change from 0 to 64 [ 108.352892][ T6182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.414821][ T6182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.533471][ T5085] Bluetooth: hci1: command tx timeout [ 108.589614][ T6182] team0: Port device team_slave_0 added [ 108.678300][ T3464] hsr_slave_0: left promiscuous mode [ 108.712814][ T3464] hsr_slave_1: left promiscuous mode [ 108.724176][ T6264] syz.0.141: attempt to access beyond end of device [ 108.724176][ T6264] loop0: rw=0, sector=171, nr_sectors = 1 limit=64 [ 108.746159][ T3464] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.755953][ T6253] syz.0.141: attempt to access beyond end of device [ 108.755953][ T6253] loop0: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 108.759006][ T6264] Buffer I/O error on dev loop0, logical block 171, async page read [ 108.778109][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 108.795542][ T6253] Buffer I/O error on dev loop0, logical block 161, lost async page write [ 108.813164][ T3464] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.833764][ T6264] syz.0.141: attempt to access beyond end of device [ 108.833764][ T6264] loop0: rw=0, sector=172, nr_sectors = 1 limit=64 [ 108.847145][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.857561][ T6253] syz.0.141: attempt to access beyond end of device [ 108.857561][ T6253] loop0: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 108.873304][ T3464] bridge_slave_1: left allmulticast mode [ 108.881235][ T3464] bridge_slave_1: left promiscuous mode [ 108.888635][ T3464] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.906233][ T6264] Buffer I/O error on dev loop0, logical block 172, async page read [ 108.921172][ T3464] bridge_slave_0: left allmulticast mode [ 108.926906][ T3464] bridge_slave_0: left promiscuous mode [ 108.941042][ T6253] Buffer I/O error on dev loop0, logical block 162, lost async page write [ 108.950100][ T3464] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.959578][ T6253] syz.0.141: attempt to access beyond end of device [ 108.959578][ T6253] loop0: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 108.976507][ T6253] Buffer I/O error on dev loop0, logical block 163, lost async page write [ 108.996686][ T6264] syz.0.141: attempt to access beyond end of device [ 108.996686][ T6264] loop0: rw=0, sector=173, nr_sectors = 1 limit=64 [ 108.999658][ T6253] syz.0.141: attempt to access beyond end of device [ 108.999658][ T6253] loop0: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 109.049387][ T6253] Buffer I/O error on dev loop0, logical block 167, lost async page write [ 109.060600][ T3464] veth1_macvtap: left promiscuous mode [ 109.066648][ T3464] veth0_macvtap: left promiscuous mode [ 109.072508][ T6264] Buffer I/O error on dev loop0, logical block 173, async page read [ 109.084377][ T3464] veth1_vlan: left promiscuous mode [ 109.090370][ T3464] veth0_vlan: left promiscuous mode [ 109.102988][ T6264] syz.0.141: attempt to access beyond end of device [ 109.102988][ T6264] loop0: rw=0, sector=174, nr_sectors = 1 limit=64 [ 109.119887][ T6253] syz.0.141: attempt to access beyond end of device [ 109.119887][ T6253] loop0: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 109.134886][ T6264] Buffer I/O error on dev loop0, logical block 174, async page read [ 109.145162][ T6253] Buffer I/O error on dev loop0, logical block 169, lost async page write [ 109.176044][ T6264] syz.0.141: attempt to access beyond end of device [ 109.176044][ T6264] loop0: rw=0, sector=175, nr_sectors = 1 limit=64 [ 109.204644][ T6253] Buffer I/O error on dev loop0, logical block 179, lost async page write [ 110.052652][ T3464] team0 (unregistering): Port device team_slave_1 removed [ 110.101100][ T3464] team0 (unregistering): Port device team_slave_0 removed [ 110.148731][ T3464] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.199892][ T3464] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.522576][ T3464] bond0 (unregistering): Released all slaves [ 110.605418][ T6182] team0: Port device team_slave_1 added [ 110.611355][ T5085] Bluetooth: hci1: command tx timeout [ 110.755983][ T6182] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.812265][ T6182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 110.889264][ T6182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.918902][ T6182] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.964413][ T6182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 110.996384][ T6182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.174259][ T6182] hsr_slave_0: entered promiscuous mode [ 111.186598][ T6182] hsr_slave_1: entered promiscuous mode [ 111.906890][ T6307] loop3: detected capacity change from 0 to 256 [ 111.985969][ T6165] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 112.454865][ T6182] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 112.485681][ T6182] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 112.505530][ T6182] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 112.527633][ T6182] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 112.688255][ T5085] Bluetooth: hci1: command tx timeout [ 112.819101][ T6182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.891333][ T6182] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.952220][ T3491] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.959479][ T3491] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.976116][ T6315] loop0: detected capacity change from 0 to 32768 [ 112.994155][ T3464] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.001461][ T3464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.887088][ T6182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.025707][ T5085] Bluetooth: hci3: Malformed MSFT vendor event: 0x02 [ 114.113024][ T6182] veth0_vlan: entered promiscuous mode [ 114.193308][ T6182] veth1_vlan: entered promiscuous mode [ 114.311525][ T6182] veth0_macvtap: entered promiscuous mode [ 114.373031][ T6182] veth1_macvtap: entered promiscuous mode [ 114.454387][ T6182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 114.487923][ T6182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.497830][ T6182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 114.538539][ T6182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.557909][ T6182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 114.579747][ T6182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.630720][ T6182] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.678534][ T6182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 114.710778][ T6182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.727972][ T6182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 114.757966][ T6182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.780783][ T6182] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.833252][ T6182] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.877783][ T6182] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.899735][ T6182] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.928765][ T6182] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.239394][ T3491] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.288031][ T3491] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.430719][ T3491] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.458243][ T3491] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.434623][ T6410] syz_tun: entered promiscuous mode [ 116.448704][ T6410] vlan2: entered promiscuous mode [ 118.285982][ T6466] loop2: detected capacity change from 0 to 256 [ 118.417095][ T28] audit: type=1804 audit(1788426485.999:3): pid=6466 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.188" name="/newroot/4/file1/bus" dev="loop2" ino=1048597 res=1 errno=0 [ 118.527988][ T28] audit: type=1804 audit(1788426486.029:4): pid=6466 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.188" name="/newroot/4/file1/bus" dev="loop2" ino=1048597 res=1 errno=0 [ 118.754515][ T6476] netlink: 'syz.1.191': attribute type 1 has an invalid length. [ 118.960727][ T6478] 8021q: adding VLAN 0 to HW filter on device bond2 [ 118.977173][ T6478] bond1: (slave bond2): making interface the new active one [ 118.985716][ T6478] bond1: (slave bond2): Enslaving as an active interface with an up link [ 119.146141][ T6479] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 119.189587][ T6482] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 119.355783][ T6476] netlink: 28 bytes leftover after parsing attributes in process `syz.1.191'. [ 119.411164][ T6476] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.850690][ T6496] process 'syz.3.196' launched './file0' with NULL argv: empty string added [ 120.293728][ T6502] netlink: 32 bytes leftover after parsing attributes in process `syz.0.199'. [ 120.528052][ T5779] Bluetooth: hci2: command 0x0406 tx timeout [ 120.546784][ T6504] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 122.299022][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 123.009443][ T6536] loop3: detected capacity change from 0 to 128 [ 123.036832][ T6536] ======================================================= [ 123.036832][ T6536] WARNING: The mand mount option has been deprecated and [ 123.036832][ T6536] and is ignored by this kernel. Remove the mand [ 123.036832][ T6536] option from the mount to silence this warning. [ 123.036832][ T6536] ======================================================= [ 123.088488][ T6536] EXT4-fs (loop3): Test dummy encryption mode enabled [ 123.119668][ T6536] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 123.149489][ T6536] ext4 filesystem being mounted at /53/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 123.518036][ T6536] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 123.583441][ T6536] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 123.860262][ T6553] loop0: detected capacity change from 0 to 1024 [ 124.012031][ T6553] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 124.197328][ T6553] EXT4-fs warning (device loop0): ext4_update_dynamic_rev:1154: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 124.378603][ T6565] loop2: detected capacity change from 0 to 256 [ 124.466200][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.500710][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.555623][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.591831][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.607777][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.630325][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.645229][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.703313][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 124.731525][ T6568] FAULT_INJECTION: forcing a failure. [ 124.731525][ T6568] name failslab, interval 1, probability 0, space 0, times 0 [ 124.745282][ T6568] CPU: 1 PID: 6568 Comm: syz.2.222 Not tainted syzkaller #0 [ 124.752632][ T6568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.762745][ T6568] Call Trace: [ 124.766054][ T6568] [ 124.769011][ T6568] dump_stack_lvl+0x18c/0x250 [ 124.773744][ T6568] ? show_regs_print_info+0x20/0x20 [ 124.778982][ T6568] ? load_image+0x420/0x420 [ 124.783524][ T6568] ? __might_sleep+0xe0/0xe0 [ 124.788150][ T6568] ? __lock_acquire+0x7d80/0x7d80 [ 124.793212][ T6568] should_fail_ex+0x394/0x4c0 [ 124.797940][ T6568] should_failslab+0x9/0x20 [ 124.802501][ T6568] slab_pre_alloc_hook+0x59/0x300 [ 124.807572][ T6568] ? kvmalloc_node+0x70/0x180 [ 124.812279][ T6568] ? kvmalloc_node+0x70/0x180 [ 124.816985][ T6568] __kmem_cache_alloc_node+0x53/0x250 [ 124.822403][ T6568] ? kvmalloc_node+0x70/0x180 [ 124.827119][ T6568] __kmalloc_node+0xa6/0x240 [ 124.831747][ T6568] kvmalloc_node+0x70/0x180 [ 124.836287][ T6568] ceph_msg_new2+0x162/0x490 [ 124.840935][ T6568] ceph_monc_init+0x60b/0xa70 [ 124.845935][ T6568] ceph_create_client+0x225/0x300 [ 124.851088][ T6568] ceph_get_tree+0x1ca/0x1800 [ 124.855814][ T6568] ? bpf_lsm_capable+0x9/0x10 [ 124.860551][ T6568] ? security_capable+0x89/0xb0 [ 124.865485][ T6568] vfs_get_tree+0x8c/0x280 [ 124.869949][ T6568] vfs_cmd_create+0xe3/0x230 [ 124.874583][ T6568] __se_sys_fsconfig+0x70a/0x850 [ 124.879567][ T6568] ? __x64_sys_fsconfig+0xc0/0xc0 [ 124.884650][ T6568] ? lockdep_hardirqs_on+0x98/0x150 [ 124.889898][ T6568] ? __x64_sys_fsconfig+0x20/0xc0 [ 124.895001][ T6568] do_syscall_64+0x55/0xb0 [ 124.899473][ T6568] ? clear_bhb_loop+0x40/0x90 [ 124.904194][ T6568] ? clear_bhb_loop+0x40/0x90 [ 124.908915][ T6568] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 124.914980][ T6568] RIP: 0033:0x7f2dae59e159 [ 124.919509][ T6568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.939151][ T6568] RSP: 002b:00007f2daf531028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 124.947605][ T6568] RAX: ffffffffffffffda RBX: 00007f2dae825fa0 RCX: 00007f2dae59e159 [ 124.955624][ T6568] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 124.963625][ T6568] RBP: 00007f2dae635024 R08: 0000000000000000 R09: 0000000000000000 [ 124.971625][ T6568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.979623][ T6568] R13: 00007f2dae826038 R14: 00007f2dae825fa0 R15: 00007ffcb0159498 [ 124.987643][ T6568] [ 125.021759][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 125.078662][ T5774] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #11: comm syz-executor: invalid size [ 125.388802][ T6581] netlink: 12 bytes leftover after parsing attributes in process `syz.2.226'. [ 125.885652][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 125.908675][ T3464] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.032435][ T8] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 126.043661][ T3464] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.085532][ T6596] netlink: 4 bytes leftover after parsing attributes in process `syz.1.234'. [ 126.191492][ T3464] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.220940][ T8] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 126.243623][ T8] usb 3-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 126.281050][ T8] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 126.298152][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.316491][ T8] usb 3-1: Product: syz [ 126.321157][ T8] usb 3-1: Manufacturer: syz [ 126.325847][ T8] usb 3-1: SerialNumber: syz [ 126.331894][ T3464] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.364590][ T8] usb-storage 3-1:1.0: USB Mass Storage device detected [ 126.386244][ T8] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 126.396291][ T8] scsi host1: usb-storage 3-1:1.0 [ 126.744196][ T3464] tipc: Left network mode [ 126.763880][ T27] usb 3-1: USB disconnect, device number 2 [ 127.262932][ T5085] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 127.288627][ T5085] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 127.318268][ T5085] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 127.333362][ T5085] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 127.342826][ T5085] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 127.351054][ T5085] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 128.098656][ T6618] chnl_net:caif_netlink_parms(): no params data found [ 128.576206][ T3464] hsr_slave_0: left promiscuous mode [ 128.608984][ T3464] hsr_slave_1: left promiscuous mode [ 128.908203][ T3464] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.943481][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 129.089542][ T3464] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 129.097079][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 129.129471][ T3464] bridge_slave_1: left allmulticast mode [ 129.135217][ T3464] bridge_slave_1: left promiscuous mode [ 129.144321][ T6644] loop2: detected capacity change from 0 to 32768 [ 129.152929][ T3464] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.208559][ T3464] bridge_slave_0: left allmulticast mode [ 129.230269][ T3464] bridge_slave_0: left promiscuous mode [ 129.254622][ T3464] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.300008][ T6644] JBD2: Ignoring recovery information on journal [ 129.408065][ T5785] Bluetooth: hci3: command tx timeout [ 129.430603][ T3464] veth1_macvtap: left promiscuous mode [ 129.436386][ T3464] veth0_macvtap: left promiscuous mode [ 129.456860][ T3464] veth1_vlan: left promiscuous mode [ 129.462370][ T3464] veth0_vlan: left promiscuous mode [ 129.490806][ T6644] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 129.942032][ T6679] fuse: Bad value for 'fd' [ 130.091310][ T5818] IPVS: starting estimator thread 0... [ 130.188341][ T6681] IPVS: using max 16 ests per chain, 38400 per kthread [ 130.235004][ T6644] syz.2.247 (6644) used greatest stack depth: 17784 bytes left [ 130.395796][ T6182] ocfs2: Unmounting device (7,2) on (node local) [ 130.746842][ T6695] loop2: detected capacity change from 0 to 512 [ 130.774672][ T6695] ext4: Unknown parameter 'dont_hash' [ 131.145479][ T3464] team0 (unregistering): Port device team_slave_1 removed [ 131.194931][ T3464] team0 (unregistering): Port device team_slave_0 removed [ 131.243266][ T3464] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 131.294839][ T3464] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 131.489988][ T5785] Bluetooth: hci3: command tx timeout [ 131.656585][ T3464] bond0 (unregistering): Released all slaves [ 131.764303][ T6618] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.772750][ T6618] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.780546][ T6618] bridge_slave_0: entered allmulticast mode [ 131.787669][ T6618] bridge_slave_0: entered promiscuous mode [ 131.813019][ T6686] netlink: 'syz.3.257': attribute type 13 has an invalid length. [ 131.913354][ T6618] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.929666][ T6618] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.936984][ T6618] bridge_slave_1: entered allmulticast mode [ 131.946221][ T6618] bridge_slave_1: entered promiscuous mode [ 132.013880][ T6618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 132.049717][ T6618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 132.103319][ T6618] team0: Port device team_slave_0 added [ 132.113614][ T6618] team0: Port device team_slave_1 added [ 132.144814][ T6618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 132.158430][ T6618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 132.184937][ T6618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 132.209846][ T6618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 132.216985][ T6618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 132.266427][ T6618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 132.340571][ T6618] hsr_slave_0: entered promiscuous mode [ 132.372927][ T6618] hsr_slave_1: entered promiscuous mode [ 132.418087][ T6618] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 132.425758][ T6618] Cannot create hsr debugfs directory [ 132.451413][ T6700] netlink: 'syz.3.261': attribute type 1 has an invalid length. [ 132.533079][ T6700] 8021q: adding VLAN 0 to HW filter on device bond1 [ 132.604375][ T6708] vlan2: entered allmulticast mode [ 132.638169][ T6708] bond1: entered allmulticast mode [ 132.786329][ T6700] bond1: (slave geneve2): making interface the new active one [ 132.811965][ T6700] geneve2: entered allmulticast mode [ 132.838093][ T6700] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 133.178956][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.185761][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.226588][ T6725] netlink: 12 bytes leftover after parsing attributes in process `syz.3.265'. [ 133.508366][ T6618] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 133.552628][ T6618] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 133.570033][ T5785] Bluetooth: hci3: command tx timeout [ 133.607575][ T6618] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 133.633609][ T6618] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 133.833186][ T6618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.872410][ T6618] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.896735][ T3509] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.904070][ T3509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.946752][ T3509] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.954124][ T3509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.462939][ T6618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.113625][ T6618] veth0_vlan: entered promiscuous mode [ 135.133210][ T6618] veth1_vlan: entered promiscuous mode [ 135.199268][ T6618] veth0_macvtap: entered promiscuous mode [ 135.211102][ T6618] veth1_macvtap: entered promiscuous mode [ 135.235506][ T6618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 135.246181][ T6618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 135.263315][ T6618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 135.274423][ T6618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 135.289409][ T6618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 135.305199][ T6618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 135.319565][ T6618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 135.346155][ T6618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 135.356943][ T6618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 135.373450][ T6618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 135.384256][ T6618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 135.396359][ T6618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 135.414716][ T6618] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.423804][ T6618] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.433290][ T6618] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.447031][ T6618] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.559340][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 135.568360][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 135.630510][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 135.639938][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 135.658500][ T5785] Bluetooth: hci3: command tx timeout [ 135.865447][ T6785] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.262440][ T8] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 136.561173][ T5780] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 137.009464][ T6790] ceph: No mds server is up or the cluster is laggy [ 137.079040][ T8] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 141.114656][ T28] audit: type=1326 audit(1788426508.699:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6886 comm="syz.4.300" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fae91b9e159 code=0x0 [ 141.148102][ T6889] loop2: detected capacity change from 0 to 128 [ 141.209927][ T6889] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 141.287577][ T6889] ext4 filesystem being mounted at /27/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 141.457966][ T6889] syz.2.301 (pid 6889) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 141.483638][ T6899] fuse: Bad value for 'fd' [ 141.514059][ T6889] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 141.625517][ T6182] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 142.328131][ T5818] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 142.545352][ T5818] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 142.574037][ T5818] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 142.594651][ T5818] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.631012][ T5818] usb 5-1: config 0 descriptor?? [ 142.885226][ T5818] usbhid 5-1:0.0: can't add hid device: -71 [ 142.895426][ T5818] usbhid: probe of 5-1:0.0 failed with error -71 [ 142.932972][ T6936] overlayfs: failed to clone lowerpath [ 142.938558][ T5818] usb 5-1: USB disconnect, device number 2 [ 142.976198][ T6936] overlayfs: failed to clone lowerpath [ 143.124566][ T6939] loop2: detected capacity change from 0 to 128 [ 143.248506][ T6939] netlink: 36 bytes leftover after parsing attributes in process `syz.2.305'. [ 143.542557][ T5818] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 143.679126][ T6953] fuse: Bad value for 'fd' [ 143.683218][ T6949] overlayfs: failed to clone upperpath [ 143.738736][ T5818] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.760659][ T5818] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 143.783411][ T5818] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.802791][ T5818] usb 5-1: config 0 descriptor?? [ 144.114354][ T28] audit: type=1800 audit(1788426511.699:6): pid=6965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.311" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 144.660140][ T5818] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 144.683659][ T5818] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input6 [ 145.002648][ T6990] loop2: detected capacity change from 0 to 256 [ 145.087364][ T6990] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 145.239591][ T8] usb 5-1: USB disconnect, device number 3 [ 145.245591][ C0] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 145.295805][ T6990] bio_check_eod: 6 callbacks suppressed [ 145.295823][ T6990] syz.2.318: attempt to access beyond end of device [ 145.295823][ T6990] loop2: rw=524288, sector=280, nr_sectors = 128 limit=256 [ 145.399518][ T6990] syz.2.318: attempt to access beyond end of device [ 145.399518][ T6990] loop2: rw=524288, sector=408, nr_sectors = 256 limit=256 [ 145.440952][ T6990] syz.2.318: attempt to access beyond end of device [ 145.440952][ T6990] loop2: rw=0, sector=280, nr_sectors = 8 limit=256 [ 145.485076][ T28] audit: type=1800 audit(1788426513.069:7): pid=6990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.318" name="file1" dev="loop2" ino=1048604 res=0 errno=0 [ 145.658543][ T6990] loop2: detected capacity change from 256 to 64 [ 145.689188][ T6990] loop2: [ 146.586578][ T3509] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.777018][ T3509] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.001406][ T3509] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.206304][ T3509] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.271747][ T7032] netlink: 12 bytes leftover after parsing attributes in process `syz.4.338'. [ 147.495452][ T7036] loop4: detected capacity change from 0 to 2048 [ 147.558285][ T6165] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 147.925869][ T5085] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 147.938904][ T5085] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 147.949430][ T5085] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 147.959954][ T5085] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 147.978104][ T5085] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 147.986468][ T5085] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 149.235705][ T7077] overlayfs: failed to clone upperpath [ 150.035207][ T7043] chnl_net:caif_netlink_parms(): no params data found [ 150.048029][ T5085] Bluetooth: hci1: command tx timeout [ 150.182279][ T7108] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 150.384915][ T7114] binder: 7113:7114 ioctl 4018620d 0 returned -22 [ 150.504374][ T7117] fuse: Bad value for 'fd' [ 150.554225][ T7043] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.565089][ T7043] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.575277][ T7043] bridge_slave_0: entered allmulticast mode [ 150.595706][ T7043] bridge_slave_0: entered promiscuous mode [ 150.687463][ T7043] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.703707][ T7043] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.726681][ T7043] bridge_slave_1: entered allmulticast mode [ 150.756786][ T7043] bridge_slave_1: entered promiscuous mode [ 150.916515][ T7043] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.967160][ T7043] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 151.284297][ T7043] team0: Port device team_slave_0 added [ 151.324397][ T7043] team0: Port device team_slave_1 added [ 151.409779][ T3509] hsr_slave_0: left promiscuous mode [ 151.425476][ T3509] hsr_slave_1: left promiscuous mode [ 151.433579][ T3509] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 151.457997][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 151.480129][ T3509] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 151.504246][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 151.528505][ T3509] bridge_slave_1: left allmulticast mode [ 151.534346][ T3509] bridge_slave_1: left promiscuous mode [ 151.541973][ T3509] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.589972][ T3509] bridge_slave_0: left allmulticast mode [ 151.595710][ T3509] bridge_slave_0: left promiscuous mode [ 151.619068][ T3509] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.718091][ T5815] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 151.727348][ T3509] veth1_macvtap: left promiscuous mode [ 151.735078][ T3509] veth0_macvtap: left promiscuous mode [ 151.741173][ T3509] veth1_vlan: left promiscuous mode [ 151.746563][ T3509] veth0_vlan: left promiscuous mode [ 151.910270][ T5815] usb 5-1: Using ep0 maxpacket: 16 [ 151.949011][ T5815] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 151.963836][ T5815] usb 5-1: config 0 interface 0 has no altsetting 0 [ 151.989938][ T5815] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 152.000149][ T5815] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.010553][ T5815] usb 5-1: Product: syz [ 152.028113][ T5815] usb 5-1: Manufacturer: syz [ 152.032884][ T5815] usb 5-1: SerialNumber: syz [ 152.051838][ T5815] usb 5-1: config 0 descriptor?? [ 152.128048][ T5085] Bluetooth: hci1: command tx timeout [ 152.312255][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 152.361741][ T5815] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input7 [ 152.434643][ T5815] imon:send_packet: packet tx failed (-71) [ 152.458134][ T5815] imon 5-1:0.0: panel buttons/knobs setup failed [ 152.628049][ T5815] rc_core: IR keymap rc-imon-pad not found [ 152.643456][ T5815] Registered IR keymap rc-empty [ 152.658722][ T5815] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 152.679155][ T5815] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 152.710138][ T5815] imon:send_packet: packet tx failed (-71) [ 152.743130][ T5815] imon 5-1:0.0: remote input dev register failed [ 152.758464][ T5815] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 152.869934][ T5815] imon 5-1:0.0: unable to initialize intf0, err 0 [ 152.876464][ T5815] imon:imon_probe: failed to initialize context! [ 152.890203][ T5815] imon 5-1:0.0: unable to register, err -19 [ 152.958412][ T5815] usb 5-1: USB disconnect, device number 4 [ 152.998414][ T7160] ip_tables: iptables: counters copy to user failed while replacing table [ 153.116220][ T7162] overlayfs: failed to clone upperpath [ 153.145567][ T7162] overlayfs: failed to clone upperpath [ 153.388026][ T5815] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 153.527658][ T3509] team0 (unregistering): Port device team_slave_1 removed [ 153.571381][ T5815] usb 5-1: Using ep0 maxpacket: 16 [ 153.593173][ T5815] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 153.616083][ T5815] usb 5-1: config 0 interface 0 has no altsetting 0 [ 153.627025][ T5815] usb 5-1: string descriptor 0 read error: -22 [ 153.635103][ T5815] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 153.645860][ T5815] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.669637][ T3509] team0 (unregistering): Port device team_slave_0 removed [ 153.694844][ T5815] usb 5-1: config 0 descriptor?? [ 153.729062][ T5815] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input9 [ 153.793108][ T3509] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 153.980252][ T3509] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 154.208136][ T5085] Bluetooth: hci1: command tx timeout [ 154.240802][ T5815] rc_core: IR keymap rc-imon-pad not found [ 154.248165][ T5815] Registered IR keymap rc-empty [ 154.253994][ T5815] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 154.266629][ T5815] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 154.312148][ T5815] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 154.345955][ T5815] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input10 [ 154.393136][ T5815] imon 5-1:0.0: iMON device (15c2:0041, intf0) on usb<5:5> initialized [ 154.787361][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 154.807355][ T5815] usb 5-1: USB disconnect, device number 5 [ 154.923072][ T3509] bond0 (unregistering): Released all slaves [ 155.166460][ T7043] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.188049][ T7043] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.244842][ T7043] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.296590][ T7043] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.305629][ T7043] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.398235][ T7043] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.586750][ T7043] hsr_slave_0: entered promiscuous mode [ 155.678998][ T7043] hsr_slave_1: entered promiscuous mode [ 156.291944][ T5085] Bluetooth: hci1: command tx timeout [ 158.486515][ T7043] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 158.532954][ T7043] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 158.578690][ T7043] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 158.607764][ T7043] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 158.751713][ T28] audit: type=1326 audit(1788426532.342:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7bb5f9e159 code=0x7ffc0000 [ 158.844504][ T28] audit: type=1326 audit(1788426532.362:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7bb5f9e159 code=0x7ffc0000 [ 158.925630][ T7043] 8021q: adding VLAN 0 to HW filter on device bond0 [ 158.934519][ T28] audit: type=1326 audit(1788426532.372:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f7bb5f9e159 code=0x7ffc0000 [ 159.004699][ T7043] 8021q: adding VLAN 0 to HW filter on device team0 [ 159.022551][ T28] audit: type=1326 audit(1788426532.372:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7bb5f9dec2 code=0x7ffc0000 [ 159.063445][ T3509] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.071298][ T3509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.117391][ T3509] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.124694][ T3509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 159.144140][ T28] audit: type=1326 audit(1788426532.372:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f7bb5f5e98e code=0x7ffc0000 [ 159.214894][ T28] audit: type=1326 audit(1788426532.362:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7bb5f9e159 code=0x7ffc0000 [ 159.279003][ T7270] syzkaller0: entered promiscuous mode [ 159.288698][ T7270] syzkaller0: entered allmulticast mode [ 159.319144][ T28] audit: type=1326 audit(1788426532.422:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7bb5f9e159 code=0x7ffc0000 [ 159.414327][ T28] audit: type=1326 audit(1788426532.422:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f7bb5f9df87 code=0x7ffc0000 [ 159.496862][ T28] audit: type=1326 audit(1788426532.422:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7bb5f5e98e code=0x7ffc0000 [ 159.581183][ T28] audit: type=1326 audit(1788426532.422:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7263 comm="syz.3.393" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f7bb5f5e98e code=0x7ffc0000 [ 159.910149][ T7043] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.043149][ T7043] veth0_vlan: entered promiscuous mode [ 160.083424][ T7043] veth1_vlan: entered promiscuous mode [ 160.173436][ T7043] veth0_macvtap: entered promiscuous mode [ 160.199785][ T7043] veth1_macvtap: entered promiscuous mode [ 160.269065][ T7043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.303073][ T7043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.317339][ T7043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.337937][ T7043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.353211][ T7043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.385818][ T7043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.436906][ T7043] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 160.473833][ T7043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.484856][ T7043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.495320][ T7043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.515960][ T7043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.540952][ T7043] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 160.579247][ T7043] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.590848][ T7043] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.600669][ T7043] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.609914][ T7043] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.877514][ T3464] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 160.905771][ T3464] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.002020][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 161.025614][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.294940][ T7313] loop2: detected capacity change from 0 to 1024 [ 161.801343][ T7313] hfsplus: b-tree write err: -5, ino 8 [ 161.891654][ T7319] hfsplus: b-tree write err: -5, ino 8 [ 162.130253][ T3491] hfsplus: b-tree write err: -5, ino 8 [ 162.459007][ T7336] netlink: 'syz.3.406': attribute type 10 has an invalid length. [ 162.501514][ T7336] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.510861][ T7336] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.607708][ T7336] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.615193][ T7336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.624024][ T7336] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.631345][ T7336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.693572][ T7336] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 162.767032][ T7340] netlink: 4 bytes leftover after parsing attributes in process `syz.3.406'. [ 162.788063][ T7340] bridge_slave_1: left allmulticast mode [ 162.803501][ T7340] bridge_slave_1: left promiscuous mode [ 162.822561][ T7340] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.858855][ T7340] bridge_slave_0: left allmulticast mode [ 162.868381][ T7340] bridge_slave_0: left promiscuous mode [ 162.874508][ T7340] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.980873][ T7340] bond0: (slave bridge0): Releasing backup interface [ 165.064258][ T5840] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 165.289298][ T5840] usb 3-1: Using ep0 maxpacket: 16 [ 165.295755][ T7376] netlink: 'syz.1.414': attribute type 13 has an invalid length. [ 165.340223][ T5840] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 165.390391][ T5840] usb 3-1: config 0 has no interface number 0 [ 165.437493][ T5840] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 165.507993][ T5840] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 165.581404][ T5840] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 165.630449][ T5840] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.651095][ T5840] usb 3-1: Product: syz [ 165.655581][ T5840] usb 3-1: Manufacturer: syz [ 165.729841][ T5840] usb 3-1: SerialNumber: syz [ 165.773927][ T5840] usb 3-1: config 0 descriptor?? [ 165.814197][ T7370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 165.844576][ T7370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 166.089743][ T7370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 166.105248][ T7370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 166.305870][ T7375] loop4: detected capacity change from 0 to 32768 [ 166.336737][ T5840] asix 3-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 166.425159][ T7375] JBD2: Ignoring recovery information on journal [ 166.564251][ T7375] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 168.198982][ T5840] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 168.222924][ T5840] asix: probe of 3-1:0.34 failed with error -71 [ 168.251622][ T5840] usb 3-1: USB disconnect, device number 3 [ 168.433819][ T6618] ocfs2: Unmounting device (7,4) on (node local) [ 168.614048][ T7418] netlink: 24 bytes leftover after parsing attributes in process `syz.1.422'. [ 168.907190][ T7418] syz.1.422 (7418) used greatest stack depth: 16968 bytes left [ 169.188070][ T5840] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 169.382688][ T5840] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 169.404648][ T5840] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 169.441994][ T5840] usb 3-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 169.463072][ T5840] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.474166][ T5840] usb 3-1: Product: syz [ 169.481226][ T5840] usb 3-1: Manufacturer: syz [ 169.486095][ T5840] usb 3-1: SerialNumber: syz [ 169.520235][ T5840] ums-sddr09 3-1:1.0: USB Mass Storage device detected [ 169.536307][ T5840] ums-sddr09 3-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 169.536307][ T5840] Please send a copy of this message to and [ 170.032195][ T5840] ums-sddr09: probe of 3-1:1.0 failed with error -5 [ 170.069187][ T5840] usb 3-1: USB disconnect, device number 4 [ 170.808913][ T7474] loop2: detected capacity change from 0 to 512 [ 170.841545][ T7463] loop4: detected capacity change from 0 to 32768 [ 170.855771][ T7474] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 170.886051][ T7463] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.433 (7463) [ 170.999073][ T7474] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 171.064142][ T7463] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 171.110747][ T7474] EXT4-fs (loop2): 1 truncate cleaned up [ 171.133660][ T7463] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 171.138597][ T7474] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 171.167117][ T7463] BTRFS info (device loop4): disabling tree log [ 171.210964][ T7463] BTRFS info (device loop4): using free space tree [ 171.539153][ T7463] BTRFS info (device loop4): enabling ssd optimizations [ 171.560491][ T7463] BTRFS info (device loop4): auto enabling async discard [ 171.795272][ T7043] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 172.367458][ T62] BTRFS info (device loop4): qgroup scan completed (inconsistency flag cleared) [ 172.752646][ T7524] loop2: detected capacity change from 0 to 64 [ 173.916914][ T7531] loop2: detected capacity change from 0 to 512 [ 174.049316][ T7531] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 174.342621][ T7531] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5940: Out of memory [ 174.381831][ T6618] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 174.393147][ T7531] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #18: comm syz.2.441: mark_inode_dirty error [ 174.496522][ T7043] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 176.545655][ T7610] loop2: detected capacity change from 0 to 256 [ 179.218200][ T23] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 179.431631][ T23] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 179.470725][ T23] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 179.500364][ T23] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 179.517561][ T23] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 179.542466][ T23] usb 3-1: SerialNumber: syz [ 179.811600][ T23] usb 3-1: 0:2 : does not exist [ 179.912402][ T23] usb 3-1: USB disconnect, device number 5 [ 180.083087][ T6165] udevd[6165]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 180.479317][ T7682] syz.4.476: attempt to access beyond end of device [ 180.479317][ T7682] nbd4: rw=0, sector=16, nr_sectors = 1 limit=0 [ 180.493427][ T7682] qnx6: unable to read the first superblock [ 180.501274][ T7682] syz.4.476: attempt to access beyond end of device [ 180.501274][ T7682] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 180.515367][ T7682] qnx6: unable to read the first superblock [ 180.521549][ T7682] qnx6: unable to read the first superblock [ 183.851075][ T7752] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 184.498133][ T7774] netlink: 'syz.1.502': attribute type 10 has an invalid length. [ 184.613141][ T7774] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 184.643040][ T7774] team0: Failed to send options change via netlink (err -105) [ 184.678463][ T7774] team0: Port device netdevsim0 added [ 185.994393][ T7803] file system registered [ 186.052129][ T7803] ffs_data_put(): freeing [ 186.131667][ T6618] ffs_data_put(): freeing [ 186.333359][ T7817] overlayfs: fs on './bus' does not support file handles, falling back to index=off,nfs_export=off. [ 186.363608][ T7817] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 186.758695][ T7827] lo: Caught tx_queue_len zero misconfig [ 186.773793][ T7827] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 186.828492][ T7828] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 187.010501][ T7791] mount: server not responding, timed out [ 188.094818][ T7854] 9pnet_fd: p9_fd_create_unix (7854): problem connecting socket: éq‰Y’3aK: -111 [ 188.168089][ T5840] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 188.367657][ T5840] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 188.392760][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.408437][ T5840] usb 5-1: Product: syz [ 188.413415][ T5840] usb 5-1: Manufacturer: syz [ 188.422015][ T5840] usb 5-1: SerialNumber: syz [ 188.439364][ T5840] usb 5-1: config 0 descriptor?? [ 188.677778][ T5840] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 188.836216][ T7864] syzkaller0: entered promiscuous mode [ 188.846066][ T7864] syzkaller0: entered allmulticast mode [ 188.882683][ T7864] tipc: Started in network mode [ 188.903639][ T7864] tipc: Node identity 8e8e87af5979, cluster identity 4711 [ 188.933217][ T7864] tipc: Enabled bearer , priority 0 [ 188.978052][ T7863] tipc: Resetting bearer [ 189.170856][ T7863] tipc: Disabling bearer [ 189.379734][ T7868] overlayfs: failed to clone upperpath [ 189.842875][ T7874] lo: Caught tx_queue_len zero misconfig [ 189.849052][ T7874] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 191.223485][ T5840] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 191.237978][ T5840] usb 5-1: USB disconnect, device number 6 [ 192.433713][ T7902] ceph: No mds server is up or the cluster is laggy [ 192.497997][ T7904] ceph: No mds server is up or the cluster is laggy [ 192.861253][ T7919] netlink: 28 bytes leftover after parsing attributes in process `syz.2.546'. [ 193.116271][ T7926] netlink: 24 bytes leftover after parsing attributes in process `syz.4.550'. [ 194.926954][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.058097][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.319238][ T7947] loop4: detected capacity change from 0 to 256 [ 195.474610][ T7947] exFAT-fs (loop4): failed to load upcase table (idx : 0x00012153, chksum : 0x555ffa9e, utbl_chksum : 0xe619d30d) [ 196.360775][ T7952] netlink: 256 bytes leftover after parsing attributes in process `syz.2.556'. [ 196.411694][ T7952] unsupported nlmsg_type 40 [ 196.457268][ T7956] overlayfs: failed to clone upperpath [ 197.668991][ T5840] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 197.867992][ T5840] usb 3-1: Using ep0 maxpacket: 16 [ 197.881762][ T5840] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 197.907013][ T5840] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.915767][ T5840] usb 3-1: Product: syz [ 197.925434][ T5840] usb 3-1: Manufacturer: syz [ 197.935573][ T5840] usb 3-1: SerialNumber: syz [ 197.946889][ T5840] usb 3-1: config 0 descriptor?? [ 197.959835][ T5840] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 197.980917][ T5840] usb 3-1: Detected FT-X [ 198.279632][ T5840] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 199.406552][ T8004] netlink: 256 bytes leftover after parsing attributes in process `syz.3.571'. [ 199.549481][ T5840] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 199.679338][ T5840] usb 3-1: USB disconnect, device number 6 [ 199.757122][ T5840] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 199.787041][ T5840] ftdi_sio 3-1:0.0: device disconnected [ 201.056933][ T8034] netlink: 20 bytes leftover after parsing attributes in process `syz.1.583'. [ 201.251306][ T5085] Bluetooth: hci3: command tx timeout [ 202.471724][ T8061] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 203.397476][ T8077] Zero length message leads to an empty skb [ 203.979932][ T8086] netlink: 8 bytes leftover after parsing attributes in process `syz.3.597'. [ 205.691653][ T8101] netlink: 8 bytes leftover after parsing attributes in process `syz.1.601'. [ 205.700671][ T8101] netlink: 24 bytes leftover after parsing attributes in process `syz.1.601'. [ 207.595218][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 207.601996][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 209.477362][ T8164] event trace: Could not enable event p1 [ 210.534148][ T59] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.797524][ T59] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.006636][ T59] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.177632][ T59] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.530976][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 211.548521][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 211.557760][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 211.566294][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 211.587768][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 211.597233][ T5782] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 212.203192][ T8205] chnl_net:caif_netlink_parms(): no params data found [ 212.487802][ T8205] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.495205][ T8205] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.503511][ T8205] bridge_slave_0: entered allmulticast mode [ 212.511993][ T8205] bridge_slave_0: entered promiscuous mode [ 212.521490][ T8205] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.531896][ T8205] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.540024][ T8205] bridge_slave_1: entered allmulticast mode [ 212.548862][ T8205] bridge_slave_1: entered promiscuous mode [ 212.623484][ T8205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.639726][ T8205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.705516][ T8205] team0: Port device team_slave_0 added [ 212.744406][ T59] hsr_slave_0: left promiscuous mode [ 212.751361][ T59] hsr_slave_1: left promiscuous mode [ 212.760300][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 212.768671][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 212.777105][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 212.785295][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 212.794874][ T59] bridge_slave_1: left allmulticast mode [ 212.800705][ T59] bridge_slave_1: left promiscuous mode [ 212.806515][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.817407][ T59] bridge_slave_0: left allmulticast mode [ 212.823604][ T59] bridge_slave_0: left promiscuous mode [ 212.830195][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.863301][ T59] veth1_macvtap: left promiscuous mode [ 212.870686][ T59] veth0_macvtap: left promiscuous mode [ 212.876381][ T59] veth1_vlan: left promiscuous mode [ 212.881808][ T59] veth0_vlan: left promiscuous mode [ 213.654320][ T59] team0 (unregistering): Port device team_slave_1 removed [ 213.715456][ T59] team0 (unregistering): Port device team_slave_0 removed [ 213.736455][ T5782] Bluetooth: hci3: command tx timeout [ 213.782937][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 213.839796][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 214.284434][ T59] bond0 (unregistering): Released all slaves [ 214.406293][ T8205] team0: Port device team_slave_1 added [ 214.443087][ T8205] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.450775][ T8205] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.479268][ T8205] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.496861][ T8205] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.504414][ T8205] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.540535][ T8205] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.634850][ T8205] hsr_slave_0: entered promiscuous mode [ 214.642356][ T8205] hsr_slave_1: entered promiscuous mode [ 214.649668][ T8205] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 214.657295][ T8205] Cannot create hsr debugfs directory [ 215.442987][ T8205] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 215.456401][ T8205] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 215.469082][ T8205] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 215.480692][ T8205] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 215.625480][ T8205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.662439][ T8205] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.680530][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.687915][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.710798][ T4265] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.718055][ T4265] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.808219][ T5782] Bluetooth: hci3: command tx timeout [ 216.123651][ T8205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 216.537862][ T8205] veth0_vlan: entered promiscuous mode [ 216.564146][ T8205] veth1_vlan: entered promiscuous mode [ 216.634969][ T8205] veth0_macvtap: entered promiscuous mode [ 216.653008][ T8205] veth1_macvtap: entered promiscuous mode [ 216.680004][ T8205] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 216.690878][ T8205] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 216.701666][ T8205] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 216.713292][ T8205] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 216.723923][ T8205] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 216.734832][ T8205] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 216.746561][ T8205] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 216.763587][ T8205] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 216.778104][ T8205] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 216.788605][ T8205] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 216.799170][ T8205] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 216.811101][ T8205] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 216.828704][ T8205] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.837756][ T8205] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.846926][ T8205] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.859714][ T8205] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.961778][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 216.971858][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.004816][ T4265] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 217.018486][ T4265] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 217.170095][ T8282] overlayfs: failed to clone upperpath [ 217.341311][ T28] kauditd_printk_skb: 28 callbacks suppressed [ 217.341328][ T28] audit: type=1326 audit(1788426590.932:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.424149][ T8293] overlayfs: failed to clone upperpath [ 217.438585][ T28] audit: type=1326 audit(1788426590.932:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.505111][ T28] audit: type=1326 audit(1788426590.932:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.572732][ T28] audit: type=1326 audit(1788426590.932:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.688012][ T28] audit: type=1326 audit(1788426590.932:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.725593][ T8300] overlayfs: failed to clone upperpath [ 217.742584][ T28] audit: type=1326 audit(1788426590.932:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.816654][ T28] audit: type=1326 audit(1788426590.932:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.886539][ T28] audit: type=1326 audit(1788426590.932:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 217.893003][ T5782] Bluetooth: hci3: command tx timeout [ 218.031870][ T28] audit: type=1326 audit(1788426590.932:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 218.186620][ T28] audit: type=1326 audit(1788426590.942:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.1.638" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f3863b9e159 code=0x7ffc0000 [ 219.189399][ T8315] batadv_slave_0: Caught tx_queue_len zero misconfig [ 220.097958][ T5782] Bluetooth: hci3: command tx timeout [ 220.266410][ T8323] loop2: detected capacity change from 0 to 256 [ 220.317266][ T8323] exFAT-fs (loop2): failed to load upcase table (idx : 0x00012c80, chksum : 0x8ff561f5, utbl_chksum : 0xe619d30d) [ 221.209959][ T8344] loop4: detected capacity change from 0 to 8 [ 221.348537][ T8344] SQUASHFS error: lzo decompression failed, data probably corrupt [ 221.389617][ T8344] SQUASHFS error: Failed to read block 0x0: -5 [ 221.408693][ T8344] SQUASHFS error: lzo decompression failed, data probably corrupt [ 221.424447][ T8344] SQUASHFS error: Failed to read block 0x0: -5 [ 221.939321][ T8358] netlink: 'syz.3.660': attribute type 1 has an invalid length. [ 222.960542][ T8363] macvlan2: entered promiscuous mode [ 222.966729][ T8363] macvlan2: entered allmulticast mode [ 223.189141][ T8363] bond2: entered promiscuous mode [ 223.195250][ T8363] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 223.242088][ T8363] bond2: left promiscuous mode [ 224.668164][ T23] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 224.877944][ T23] usb 5-1: Using ep0 maxpacket: 16 [ 224.893109][ T23] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 224.912690][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.933089][ T23] usb 5-1: Product: syz [ 224.937349][ T23] usb 5-1: Manufacturer: syz [ 224.951440][ T23] usb 5-1: SerialNumber: syz [ 224.969167][ T23] usb 5-1: config 0 descriptor?? [ 224.985842][ T23] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 225.000800][ T23] usb 5-1: Detected FT-X [ 225.189047][ T8393] loop2: detected capacity change from 0 to 32768 [ 225.199236][ T23] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 225.237395][ T8393] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.670 (8393) [ 225.303289][ T8393] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 225.337693][ T8393] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 225.358698][ T8393] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 225.383366][ T8393] BTRFS info (device loop2): use zstd compression, level 3 [ 225.408168][ T8393] BTRFS info (device loop2): using free space tree [ 225.525445][ T8393] BTRFS info (device loop2): enabling ssd optimizations [ 225.571990][ T8393] BTRFS info (device loop2): auto enabling async discard [ 225.628396][ T23] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 225.774653][ T28] kauditd_printk_skb: 54 callbacks suppressed [ 225.774670][ T28] audit: type=1800 audit(1788426599.362:110): pid=8393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.670" name="bus" dev="loop2" ino=263 res=0 errno=0 [ 225.890796][ T28] audit: type=1800 audit(1788426599.412:111): pid=8393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.670" name="bus" dev="loop2" ino=263 res=0 errno=0 [ 225.942327][ T23] usb 5-1: USB disconnect, device number 7 [ 226.004514][ T23] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 226.042928][ T23] ftdi_sio 5-1:0.0: device disconnected [ 226.338769][ T7043] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 226.757174][ T8445] netlink: 'syz.2.673': attribute type 10 has an invalid length. [ 226.859122][ T8445] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 226.898201][ T8445] team0: Failed to send options change via netlink (err -105) [ 226.938030][ T8445] team0: Port device netdevsim0 added [ 226.979480][ T8451] ffs_data_put(): freeing [ 227.024649][ T8451] ffs_data_put(): freeing [ 227.207967][ T23] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 227.259633][ T8455] syz_tun: entered allmulticast mode [ 227.491576][ T23] usb 5-1: Using ep0 maxpacket: 16 [ 227.524701][ T23] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 227.578120][ T23] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.716597][ T23] usb 5-1: config 0 descriptor?? [ 227.794826][ T23] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 228.952850][ T23] gspca_sonixj: reg_r err -110 [ 228.983817][ T23] sonixj: probe of 5-1:0.0 failed with error -110 [ 229.537594][ T8491] loop2: detected capacity change from 0 to 512 [ 229.550147][ T8491] EXT4-fs: Ignoring removed nomblk_io_submit option [ 229.578943][ T8491] ext4: Unknown parameter 'fsname' [ 230.554341][ T5818] usb 5-1: USB disconnect, device number 8 [ 232.177862][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 234.922400][ T8520] tipc: Started in network mode [ 234.979411][ T8520] tipc: Node identity 2000004, cluster identity 4711 [ 235.010754][ T8520] tipc: Node number set to 33554436 [ 236.758003][ T5818] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 238.465201][ T5818] usb 5-1: Using ep0 maxpacket: 32 [ 238.485729][ T5818] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 238.528012][ T5818] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 238.574899][ T5818] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.637418][ T5818] usb 5-1: config 0 descriptor?? [ 238.700481][ T5818] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 239.257674][ T8579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.308375][ T8579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 240.297122][ T5780] libceph: connect (1)[c::]:6789 error -101 [ 240.310226][ T5780] libceph: mon0 (1)[c::]:6789 connect error [ 240.346275][ T8587] ceph: No mds server is up or the cluster is laggy [ 240.813071][ T8608] tipc: Cannot configure node identity twice [ 242.258674][ T23] usb 5-1: USB disconnect, device number 9 [ 244.035467][ T8644] netlink: 'syz.4.719': attribute type 10 has an invalid length. [ 244.063771][ T8644] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.071835][ T8644] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.145763][ T8644] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.153115][ T8644] bridge0: port 2(bridge_slave_1) entered forwarding state [ 244.160749][ T8644] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.168030][ T8644] bridge0: port 1(bridge_slave_0) entered forwarding state [ 244.266914][ T8644] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 244.287083][ T8646] netlink: 4 bytes leftover after parsing attributes in process `syz.4.719'. [ 244.297128][ T8646] bridge_slave_1: left allmulticast mode [ 244.304932][ T8646] bridge_slave_1: left promiscuous mode [ 244.316950][ T8646] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.365082][ T8646] bridge_slave_0: left allmulticast mode [ 244.428715][ T8646] bridge_slave_0: left promiscuous mode [ 244.434608][ T8646] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.744151][ T8646] bond0: (slave bridge0): Releasing backup interface [ 245.568337][ T8660] ªªªªªª: renamed from vlan0 (while UP) [ 245.945589][ T8673] IPv6: NLM_F_CREATE should be specified when creating new route [ 246.465407][ T8675] syz_tun: entered allmulticast mode [ 246.499376][ T8672] syz_tun: left allmulticast mode [ 247.268385][ T8693] netlink: 'syz.1.730': attribute type 1 has an invalid length. [ 247.744539][ T8698] bond3: (slave veth0_to_bond): making interface the new active one [ 247.826683][ T8698] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 247.881803][ T8701] tipc: Started in network mode [ 247.898025][ T8701] tipc: Node identity 76a0d5778d74, cluster identity 4711 [ 247.940683][ T8701] tipc: Enabled bearer , priority 0 [ 247.981570][ T8705] syzkaller0: entered promiscuous mode [ 248.015739][ T8705] syzkaller0: entered allmulticast mode [ 248.111088][ T8708] tipc: Resetting bearer [ 248.154472][ T8693] macvlan2: entered promiscuous mode [ 248.181310][ T8693] macvlan2: entered allmulticast mode [ 248.212511][ T8693] bond3: entered promiscuous mode [ 248.239928][ T8693] veth0_to_bond: entered promiscuous mode [ 248.271495][ T8693] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 248.316712][ T8693] bond3: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 248.438865][ T8693] bond3: left promiscuous mode [ 248.443742][ T8693] veth0_to_bond: left promiscuous mode [ 248.585205][ T8694] tipc: Resetting bearer [ 248.725363][ T8694] tipc: Disabling bearer [ 250.237072][ T8724] FAULT_INJECTION: forcing a failure. [ 250.237072][ T8724] name failslab, interval 1, probability 0, space 0, times 0 [ 250.250189][ T8724] CPU: 0 PID: 8724 Comm: syz.2.737 Not tainted syzkaller #0 [ 250.257527][ T8724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 250.267631][ T8724] Call Trace: [ 250.270960][ T8724] [ 250.273935][ T8724] dump_stack_lvl+0x18c/0x250 [ 250.278682][ T8724] ? show_regs_print_info+0x20/0x20 [ 250.283939][ T8724] ? load_image+0x420/0x420 [ 250.288493][ T8724] ? __might_sleep+0xe0/0xe0 [ 250.293132][ T8724] ? __lock_acquire+0x7d80/0x7d80 [ 250.298210][ T8724] should_fail_ex+0x394/0x4c0 [ 250.302946][ T8724] should_failslab+0x9/0x20 [ 250.307501][ T8724] slab_pre_alloc_hook+0x59/0x300 [ 250.312584][ T8724] ? nfs_alloc_fhandle+0x4a/0x90 [ 250.317589][ T8724] __kmem_cache_alloc_node+0x53/0x250 [ 250.323050][ T8724] ? nfs_alloc_fhandle+0x4a/0x90 [ 250.328042][ T8724] kmalloc_trace+0x2a/0xe0 [ 250.332516][ T8724] nfs_alloc_fhandle+0x4a/0x90 [ 250.337339][ T8724] nfs_init_fs_context+0x69/0xf60 [ 250.342417][ T8724] alloc_fs_context+0x618/0x7a0 [ 250.347330][ T8724] __se_sys_fsopen+0xa0/0x2c0 [ 250.352063][ T8724] do_syscall_64+0x55/0xb0 [ 250.356525][ T8724] ? clear_bhb_loop+0x40/0x90 [ 250.361247][ T8724] ? clear_bhb_loop+0x40/0x90 [ 250.365997][ T8724] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 250.371942][ T8724] RIP: 0033:0x7efd1859e159 [ 250.376403][ T8724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 250.396057][ T8724] RSP: 002b:00007efd19487028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 250.404527][ T8724] RAX: ffffffffffffffda RBX: 00007efd18825fa0 RCX: 00007efd1859e159 [ 250.412544][ T8724] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 250.421441][ T8724] RBP: 00007efd18635024 R08: 0000000000000000 R09: 0000000000000000 [ 250.429479][ T8724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 250.437527][ T8724] R13: 00007efd18826038 R14: 00007efd18825fa0 R15: 00007ffd52465ba8 [ 250.445922][ T8724] [ 254.263807][ T8769] netlink: 'syz.1.748': attribute type 10 has an invalid length. [ 254.288566][ T8769] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.296586][ T8769] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.372210][ T8769] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.379556][ T8769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.387188][ T8769] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.394441][ T8769] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.444726][ T8769] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 254.467329][ T8773] netlink: 4 bytes leftover after parsing attributes in process `syz.1.748'. [ 254.501432][ T8773] bridge_slave_1: left allmulticast mode [ 254.507190][ T8773] bridge_slave_1: left promiscuous mode [ 254.534977][ T8773] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.775172][ T8773] bridge_slave_0: left allmulticast mode [ 254.781785][ T8773] bridge_slave_0: left promiscuous mode [ 254.787717][ T8773] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.284818][ T8773] bond0: (slave bridge0): Releasing backup interface [ 256.807048][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.813718][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.842302][ T8787] ceph: No mds server is up or the cluster is laggy [ 256.851271][ T5840] libceph: connect (1)[c::]:6789 error -101 [ 256.888550][ T5840] libceph: mon0 (1)[c::]:6789 connect error [ 256.959665][ T8796] loop4: detected capacity change from 0 to 2048 [ 257.050881][ T8796] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 258.954727][ T8831] netlink: 'syz.4.757': attribute type 1 has an invalid length. [ 259.158671][ T8831] macvlan2: entered promiscuous mode [ 259.195031][ T8831] macvlan2: entered allmulticast mode [ 261.443477][ T8844] loop0: detected capacity change from 0 to 128 [ 262.548449][ T8847] ceph: No mds server is up or the cluster is laggy [ 262.555485][ T5816] libceph: connect (1)[c::]:6789 error -101 [ 262.578325][ T5816] libceph: mon0 (1)[c::]:6789 connect error [ 264.289321][ T8870] netlink: 8 bytes leftover after parsing attributes in process `syz.2.768'. [ 267.486371][ T8897] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 276.667973][ T5780] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 276.933959][ T5780] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 276.960432][ T5780] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 276.984245][ T5780] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 276.993878][ T5780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.012323][ T5780] usb 3-1: config 0 descriptor?? [ 278.217979][ T5780] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 278.672296][ T8987] syz_tun (unregistering): left allmulticast mode [ 283.145532][ T5780] usb 3-1: USB disconnect, device number 7 [ 283.353551][ T9008] loop2: detected capacity change from 0 to 256 [ 283.388538][ T9008] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 283.419035][ T9008] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 283.473091][ T9008] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 283.527674][ T9008] exFAT-fs (loop2): failed to load alloc-bitmap [ 283.547095][ T9008] exFAT-fs (loop2): failed to recognize exfat type [ 283.787939][ T5780] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 283.999775][ T5780] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 284.013114][ T5780] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 284.024127][ T5780] usb 5-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 284.036999][ T5780] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.052471][ T5780] usb 5-1: config 0 descriptor?? [ 284.486000][ T5780] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 284.516134][ T5780] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 284.524959][ T5780] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 284.536926][ T5780] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 284.546866][ T5780] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 284.574156][ T9021] loop5: detected capacity change from 0 to 7 [ 284.612868][ T5780] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.4-1/input0 [ 284.667938][ T9021] Dev loop5: unable to read RDB block 7 [ 284.676216][ T9021] loop5: AHDI p1 p3 p4 [ 284.684661][ T9021] loop5: partition table partially beyond EOD, truncated [ 284.694205][ T9021] loop5: p1 size 100663296 extends beyond EOD, truncated [ 284.710311][ T9021] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 284.728668][ T5780] playstation 0003:054C:0DF2.0001: Failed to retrieve feature with reportID 9: -32 [ 284.795132][ T5780] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense pairing info: -32 [ 284.851774][ T9026] Dev loop5: unable to read RDB block 7 [ 284.867568][ T5780] playstation 0003:054C:0DF2.0001: Failed to get MAC address from DualSense [ 284.897952][ T9026] loop5: AHDI p1 p3 p4 [ 284.915264][ T5780] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 284.936301][ T9026] loop5: partition table partially beyond EOD, truncated [ 284.946644][ T5780] playstation: probe of 0003:054C:0DF2.0001 failed with error -32 [ 284.991145][ T9026] loop5: p1 size 100663296 extends beyond EOD, truncated [ 285.033362][ T9026] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 285.281384][ T9004] udevd[9004]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 285.291934][ T9006] udevd[9006]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 286.576532][ T5840] usb 5-1: USB disconnect, device number 10 [ 288.043654][ T9056] netlink: 'syz.1.813': attribute type 1 has an invalid length. [ 289.167541][ T9060] veth5: entered allmulticast mode [ 289.183532][ T9060] bond4: (slave veth5): Enslaving as an active interface with a down link [ 289.549708][ T9068] loop2: detected capacity change from 0 to 4096 [ 289.683226][ T9068] ntfs3: loop2: Different NTFS sector size (4096) and media sector size (512). [ 289.807543][ T9056] bond3: (slave veth0_to_bond): Releasing active interface [ 289.961025][ T9068] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 289.979476][ T9068] ntfs3: loop2: Failed to initialize $Extend/$Reparse. [ 290.015160][ T9056] bond4: (slave veth0_to_bond): making interface the new active one [ 290.055462][ T9056] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 293.471987][ T9076] syzkaller0: entered promiscuous mode [ 293.491225][ T9076] syzkaller0: entered allmulticast mode [ 293.554612][ T9076] tipc: Enabled bearer , priority 0 [ 293.589364][ T9074] tipc: Resetting bearer [ 293.740171][ T9074] tipc: Disabling bearer [ 296.952808][ T9118] netlink: 'syz.1.832': attribute type 13 has an invalid length. [ 296.971598][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.832'. [ 297.018104][ T9118] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 306.603409][ T9184] bond_slave_0: entered promiscuous mode [ 306.609804][ T9184] bond_slave_1: entered promiscuous mode [ 306.639595][ T9184] netlink: 8 bytes leftover after parsing attributes in process `syz.2.853'. [ 306.672563][ T9184] bond_slave_0: left promiscuous mode [ 306.678210][ T9184] bond_slave_1: left promiscuous mode [ 309.727932][ T5780] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 312.377857][ T5780] usb 3-1: device not accepting address 8, error -71 [ 312.615446][ T9224] sch_tbf: burst 1520 is lower than device lo mtu (65550) ! [ 313.345839][ T9231] netlink: 'syz.4.864': attribute type 1 has an invalid length. [ 313.359952][ T9221] loop2: detected capacity change from 0 to 8192 [ 313.486322][ T9231] 8021q: adding VLAN 0 to HW filter on device bond1 [ 313.609412][ T9233] vlan2: entered allmulticast mode [ 313.614638][ T9233] veth0_to_bond: entered allmulticast mode [ 313.676286][ T9233] bond1: (slave vlan2): Opening slave failed [ 313.778310][ T9235] tipc: Enabling of bearer rejected, failed to enable media [ 315.176687][ T9257] 9pnet_fd: Insufficient options for proto=fd [ 315.220652][ T9257] Bluetooth: MGMT ver 1.22 [ 315.468819][ T9269] syzkaller0: entered promiscuous mode [ 315.484774][ T9269] syzkaller0: entered allmulticast mode [ 317.870066][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.876524][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.037899][ T5840] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 318.244441][ T5840] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 318.267858][ T5840] usb 5-1: config 1 has no interface number 0 [ 318.277397][ T5840] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 318.302268][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.318280][ T5840] usb 5-1: Product: syz [ 318.322540][ T5840] usb 5-1: Manufacturer: syz [ 318.327181][ T5840] usb 5-1: SerialNumber: syz [ 318.412016][ T9285] loop2: detected capacity change from 0 to 32768 [ 318.621373][ T9285] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 318.871911][ T5840] usb 5-1: 3:1 : does not exist [ 318.953621][ T5840] usb 5-1: 3:2 : does not exist [ 319.335640][ T5840] usb 5-1: USB disconnect, device number 11 [ 319.401397][ T9285] XFS (loop2): Ending clean mount [ 319.428433][ T9004] udevd[9004]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 319.505950][ T9285] XFS (loop2): Quotacheck needed: Please wait. [ 319.646858][ T9285] XFS (loop2): Quotacheck: Done. [ 319.713385][ T9285] jffs2: notice: (9285) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 320.483602][ T7043] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 320.537337][ T9327] socket: no more sockets [ 321.112075][ T9343] syzkaller0: entered promiscuous mode [ 321.117687][ T9343] syzkaller0: entered allmulticast mode [ 321.461376][ T9355] loop4: detected capacity change from 0 to 512 [ 321.494653][ T9355] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 321.690418][ T9355] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 321.739855][ T9355] ext4 filesystem being mounted at /52/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 324.334627][ T8205] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.008577][ T9388] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 327.016363][ T9388] udc dummy_udc.0: failed to start g1: -19 [ 327.054968][ T9388] UDC core: g1: couldn't find an available UDC or it's busy [ 328.723968][ T9401] jffs2: notice: (9401) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 331.057897][ T9411] syzkaller0: entered promiscuous mode [ 331.063470][ T9411] syzkaller0: entered allmulticast mode [ 336.654283][ T9464] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 9 (only 8 groups) [ 337.188117][ T9473] sch_tbf: burst 1520 is lower than device lo mtu (65550) ! [ 337.396669][ T9475] loop4: detected capacity change from 0 to 512 [ 339.625098][ T9475] EXT4-fs (loop4): Test dummy encryption mode enabled [ 339.632177][ T9475] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 339.661104][ T9475] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 339.686672][ T9475] EXT4-fs error (device loop4): ext4_orphan_get:1434: comm syz.4.937: bad orphan inode 131083 [ 339.725325][ T9475] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 340.474707][ T8205] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.509839][ T9521] loop2: detected capacity change from 0 to 8192 [ 343.567943][ T9521] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 345.557987][ T9538] binder: 9536:9538 ioctl 4018620d 0 returned -22 [ 346.658054][ T9541] netlink: 24 bytes leftover after parsing attributes in process `syz.1.950'. [ 357.568206][ T27] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 358.358622][ T27] usb 3-1: Using ep0 maxpacket: 8 [ 358.370483][ T27] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 358.388806][ T9618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.971'. [ 358.421961][ T27] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 358.433593][ T9617] syzkaller0: entered promiscuous mode [ 358.435493][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.458164][ T9617] syzkaller0: entered allmulticast mode [ 358.465883][ T27] usb 3-1: Product: syz [ 358.470910][ T27] usb 3-1: Manufacturer: syz [ 358.475679][ T27] usb 3-1: SerialNumber: syz [ 358.491382][ T27] usb 3-1: config 0 descriptor?? [ 358.508800][ T9617] netlink: 4 bytes leftover after parsing attributes in process `syz.4.972'. [ 358.535160][ T27] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 358.777811][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 358.957819][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.067810][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.217821][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.237805][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 359.377815][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.597819][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.677830][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.777811][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 359.959334][ T27] gspca_zc3xx: reg_w_i err -110 [ 362.247928][ T27] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 362.254359][ T27] gspca_zc3xx: probe of 3-1:0.0 failed with error -110 [ 362.322241][ T27] usb 3-1: USB disconnect, device number 10 [ 370.578925][ T9676] netlink: 'syz.2.982': attribute type 13 has an invalid length. [ 373.804286][ T9715] netlink: 'syz.2.996': attribute type 1 has an invalid length. [ 373.830136][ T9715] netlink: 84 bytes leftover after parsing attributes in process `syz.2.996'. [ 378.945383][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.952369][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.487983][ T9742] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2499 [ 382.600689][ T9738] syz.2.1000 (9738): drop_caches: 2 [ 382.866239][ T9757] netlink: 'syz.2.1010': attribute type 1 has an invalid length. [ 382.933488][ T9757] 8021q: adding VLAN 0 to HW filter on device bond1 [ 383.080131][ T9759] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 384.480152][ T9774] o2cb: This node has not been configured. [ 384.498037][ T9774] o2cb: Cluster check failed. Fix errors before retrying. [ 384.516848][ T9774] (syz.2.1012,9774,1):user_dlm_register:674 ERROR: status = -22 [ 384.540495][ T9774] (syz.2.1012,9774,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "domain1" [ 387.604875][ T9803] loop4: detected capacity change from 0 to 256 [ 390.886028][ T9823] veth1: Caught tx_queue_len zero misconfig [ 396.671686][ T9840] syzkaller0: entered promiscuous mode [ 396.677372][ T9840] syzkaller0: entered allmulticast mode [ 404.019490][ T9876] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 405.768467][ T9895] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 409.249991][ T9918] syzkaller0: entered promiscuous mode [ 409.256008][ T5840] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 409.274907][ T9918] syzkaller0: entered allmulticast mode [ 409.458048][ T5840] usb 5-1: Using ep0 maxpacket: 32 [ 409.545025][ T5840] usb 5-1: unable to get BOS descriptor or descriptor too short [ 409.571738][ T5840] usb 5-1: no configurations [ 409.576441][ T5840] usb 5-1: can't read configurations, error -22 [ 409.634991][ T9930] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1051'. [ 411.982208][ T9949] netlink: 'syz.1.1050': attribute type 4 has an invalid length. [ 412.109636][ T9949] netlink: 'syz.1.1050': attribute type 4 has an invalid length. [ 419.132451][ T9991] tipc: Enabled bearer , priority 0 [ 419.154425][ T9988] loop2: detected capacity change from 0 to 8192 [ 419.193546][ T9990] tipc: Resetting bearer [ 419.252029][ T9988] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 419.298363][ T9989] tipc: Resetting bearer [ 419.556580][ T9989] tipc: Disabling bearer [ 421.127007][T10006] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 421.136698][T10006] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 421.145787][T10006] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 421.154914][T10006] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 423.035132][T10006] team0: Port device vxlan0 added [ 424.272315][T10017] loop2: detected capacity change from 0 to 64 [ 425.277523][T10025] SET target dimension over the limit! [ 427.487022][T10045] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 427.494108][T10045] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 427.516711][T10045] vhci_hcd vhci_hcd.0: Device attached [ 427.718159][ T5835] vhci_hcd: vhci_device speed not set [ 427.796330][T10056] tipc: Enabling of bearer rejected, failed to enable media [ 427.810503][ T5835] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 427.828183][ T27] usb 5-1: new low-speed USB device number 14 using dummy_hcd [ 428.009865][ T27] usb 5-1: config 0 has no interfaces? [ 428.016109][ T27] usb 5-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 428.045929][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.070635][ T27] usb 5-1: config 0 descriptor?? [ 428.307220][T10046] vhci_hcd: unknown pdu 2 [ 428.316140][ T27] usb 5-1: USB disconnect, device number 14 [ 428.763714][T10073] overlayfs: failed to resolve './bus': -2 [ 429.319718][ T49] vhci_hcd: stop threads [ 429.326437][ T49] vhci_hcd: release socket [ 429.335579][ T49] vhci_hcd: disconnect device [ 429.367864][ T5835] vhci_hcd: vhci_device speed not set [ 429.831749][T10081] loop4: detected capacity change from 0 to 512 [ 429.949503][T10081] EXT4-fs (loop4): Test dummy encryption mode enabled [ 429.958333][T10081] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 430.969057][T10081] EXT4-fs (loop4): 1 truncate cleaned up [ 431.000533][T10081] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 433.648346][ T8205] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 436.429136][ T27] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 436.690091][ T27] usb 3-1: Using ep0 maxpacket: 8 [ 436.755289][ T27] usb 3-1: unable to get BOS descriptor or descriptor too short [ 437.017226][ T27] usb 3-1: config 4 interface 0 has no altsetting 0 [ 437.068494][ T27] usb 3-1: string descriptor 0 read error: -22 [ 437.083530][ T27] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 437.138173][ T27] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 437.177081][ T27] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 437.190668][T10111] syzkaller0: entered promiscuous mode [ 437.197119][T10111] syzkaller0: entered allmulticast mode [ 437.248795][ T27] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 437.286494][ T27] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 437.303503][ T27] usb 3-1: media controller created [ 437.364624][ T27] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 437.382235][T10105] usb 3-1: dvb_usb_au6610: wlen=0, aborting [ 437.412311][T10105] usb 3-1: dvb_usb_au6610: wlen=4100, aborting [ 437.603623][ T27] zl10353_read_register: readreg error (reg=127, ret==0) [ 438.163761][ T27] usb 3-1: USB disconnect, device number 11 [ 440.374676][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.382565][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.456846][T10135] geneve0: entered promiscuous mode [ 443.609503][T10155] tipc: Enabling of bearer rejected, failed to enable media [ 444.291612][ T5435] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.589741][ T5435] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.617818][ T5435] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.627816][ T5435] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.710538][T10203] ªªªªªª: renamed from vlan0 (while UP) [ 454.120130][T10223] overlayfs: missing 'workdir' [ 454.762994][ T28] audit: type=1804 audit(1788426831.344:112): pid=10231 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1126" name="/newroot/161/file1" dev="fuse" ino=1 res=1 errno=0 [ 455.271836][T10236] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1127'. [ 459.816907][T10266] [ 459.819333][T10266] ====================================================== [ 459.826390][T10266] WARNING: possible circular locking dependency detected [ 459.833473][T10266] syzkaller #0 Not tainted [ 459.837928][T10266] ------------------------------------------------------ [ 459.844987][T10266] syz.4.1134/10266 is trying to acquire lock: [ 459.851151][T10266] ffffffff8ddf70b0 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: uvcg_streaming_header_allow_link+0x71/0x4a0 [ 459.863391][T10266] [ 459.863391][T10266] but task is already holding lock: [ 459.870905][T10266] ffff888076bdf400 (&sb->s_type->i_mutex_key#25){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 459.881409][T10266] [ 459.881409][T10266] which lock already depends on the new lock. [ 459.881409][T10266] [ 459.891868][T10266] [ 459.891868][T10266] the existing dependency chain (in reverse order) is: [ 459.900932][T10266] [ 459.900932][T10266] -> #2 (&sb->s_type->i_mutex_key#25){++++}-{3:3}: [ 459.909692][T10266] down_write+0x97/0x200 [ 459.914562][T10266] configfs_depend_item_unlocked+0x157/0x430 [ 459.921119][T10266] usbg_make_tpg+0x1f7/0x580 [ 459.926430][T10266] target_fabric_make_tpg+0xa4/0x6d0 [ 459.932304][T10266] configfs_mkdir+0x515/0x9e0 [ 459.937569][T10266] vfs_mkdir+0x2a5/0x470 [ 459.942406][T10266] do_mkdirat+0x1dc/0x450 [ 459.947302][T10266] __x64_sys_mkdir+0x6e/0x80 [ 459.952471][T10266] do_syscall_64+0x55/0xb0 [ 459.957466][T10266] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 459.963933][T10266] [ 459.963933][T10266] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 459.971638][T10266] __mutex_lock+0x135/0xc80 [ 459.976716][T10266] tcm_set_name+0x2a/0x90 [ 459.981638][T10266] function_make+0x199/0x350 [ 459.986807][T10266] configfs_mkdir+0x515/0x9e0 [ 459.992065][T10266] vfs_mkdir+0x2a5/0x470 [ 459.996893][T10266] do_mkdirat+0x1dc/0x450 [ 460.001808][T10266] __x64_sys_mkdir+0x6e/0x80 [ 460.006985][T10266] do_syscall_64+0x55/0xb0 [ 460.011978][T10266] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 460.018468][T10266] [ 460.018468][T10266] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 460.026790][T10266] __lock_acquire+0x37ef/0x7d80 [ 460.032228][T10266] lock_acquire+0x19e/0x420 [ 460.037395][T10266] __mutex_lock+0x135/0xc80 [ 460.042509][T10266] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 460.049256][T10266] configfs_symlink+0x5a5/0xfe0 [ 460.054788][T10266] vfs_symlink+0x138/0x2b0 [ 460.060034][T10266] do_symlinkat+0x1ba/0x400 [ 460.065205][T10266] __x64_sys_symlinkat+0x99/0xb0 [ 460.070725][T10266] do_syscall_64+0x55/0xb0 [ 460.075744][T10266] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 460.082229][T10266] [ 460.082229][T10266] other info that might help us debug this: [ 460.082229][T10266] [ 460.092525][T10266] Chain exists of: [ 460.092525][T10266] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#25 [ 460.092525][T10266] [ 460.107297][T10266] Possible unsafe locking scenario: [ 460.107297][T10266] [ 460.114793][T10266] CPU0 CPU1 [ 460.120200][T10266] ---- ---- [ 460.125612][T10266] lock(&sb->s_type->i_mutex_key#25); [ 460.131221][T10266] lock(&opts->dep_lock); [ 460.138212][T10266] lock(&sb->s_type->i_mutex_key#25); [ 460.146272][T10266] lock(gadget_subsys.su_mutex); [ 460.151351][T10266] [ 460.151351][T10266] *** DEADLOCK *** [ 460.151351][T10266] [ 460.159538][T10266] 2 locks held by syz.4.1134/10266: [ 460.164775][T10266] #0: ffff888018350418 (sb_writers#19){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 460.174303][T10266] #1: ffff888076bdf400 (&sb->s_type->i_mutex_key#25){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 460.185185][T10266] [ 460.185185][T10266] stack backtrace: [ 460.191123][T10266] CPU: 1 PID: 10266 Comm: syz.4.1134 Not tainted syzkaller #0 [ 460.198656][T10266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 460.208786][T10266] Call Trace: [ 460.212136][T10266] [ 460.215210][T10266] dump_stack_lvl+0x18c/0x250 [ 460.219958][T10266] ? load_image+0x420/0x420 [ 460.224542][T10266] ? show_regs_print_info+0x20/0x20 [ 460.229951][T10266] ? print_circular_bug+0x12b/0x1a0 [ 460.235267][T10266] check_noncircular+0x2fc/0x400 [ 460.240312][T10266] ? print_deadlock_bug+0x5d0/0x5d0 [ 460.245704][T10266] ? lockdep_lock+0xf5/0x230 [ 460.250364][T10266] ? _find_first_zero_bit+0xd6/0x100 [ 460.255988][T10266] __lock_acquire+0x37ef/0x7d80 [ 460.260920][T10266] ? __lock_acquire+0x1336/0x7d80 [ 460.266047][T10266] ? verify_lock_unused+0x140/0x140 [ 460.271335][T10266] lock_acquire+0x19e/0x420 [ 460.275910][T10266] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 460.282627][T10266] ? __might_sleep+0xe0/0xe0 [ 460.287464][T10266] ? read_lock_is_recursive+0x20/0x20 [ 460.292916][T10266] __mutex_lock+0x135/0xc80 [ 460.297508][T10266] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 460.303955][T10266] ? __might_sleep+0xe0/0xe0 [ 460.308624][T10266] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 460.315029][T10266] ? read_lock_is_recursive+0x20/0x20 [ 460.320609][T10266] ? mutex_lock_nested+0x20/0x20 [ 460.325820][T10266] ? configfs_symlink+0x469/0xfe0 [ 460.331058][T10266] ? make_vfsuid+0x67/0xb0 [ 460.335563][T10266] ? generic_permission+0x1ed/0x590 [ 460.340842][T10266] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 460.347135][T10266] ? inode_permission+0xf3/0x480 [ 460.352149][T10266] ? bpf_lsm_inode_permission+0x9/0x10 [ 460.357877][T10266] ? security_inode_permission+0xb0/0xf0 [ 460.363801][T10266] configfs_symlink+0x5a5/0xfe0 [ 460.368725][T10266] ? from_kgid+0x153/0x6a0 [ 460.373393][T10266] ? generic_permission+0x1ed/0x590 [ 460.378671][T10266] ? detach_groups+0x370/0x370 [ 460.383497][T10266] ? inode_permission+0xf3/0x480 [ 460.388491][T10266] ? bpf_lsm_inode_symlink+0x9/0x10 [ 460.393739][T10266] ? security_inode_symlink+0xb6/0x100 [ 460.399265][T10266] vfs_symlink+0x138/0x2b0 [ 460.403746][T10266] do_symlinkat+0x1ba/0x400 [ 460.408396][T10266] ? vfs_symlink+0x2b0/0x2b0 [ 460.413081][T10266] __x64_sys_symlinkat+0x99/0xb0 [ 460.418084][T10266] do_syscall_64+0x55/0xb0 [ 460.422569][T10266] ? clear_bhb_loop+0x40/0x90 [ 460.427324][T10266] ? clear_bhb_loop+0x40/0x90 [ 460.432083][T10266] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 460.438138][T10266] RIP: 0033:0x7f17ec79e159 [ 460.442605][T10266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 460.462274][T10266] RSP: 002b:00007f17ed62c028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 460.470750][T10266] RAX: ffffffffffffffda RBX: 00007f17eca25fa0 RCX: 00007f17ec79e159 [ 460.478872][T10266] RDX: 00002000000003c0 RSI: ffffffffffffff9c RDI: 0000200000000380 [ 460.486914][T10266] RBP: 00007f17ec835024 R08: 0000000000000000 R09: 0000000000000000 [ 460.494937][T10266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 460.502963][T10266] R13: 00007f17eca26038 R14: 00007f17eca25fa0 R15: 00007ffd344bf6f8 [ 460.511012][T10266] [ 461.642526][T10274] warning: `syz.1.1135' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211