last executing test programs: 12m46.936013558s ago: executing program 4 (id=18): sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, 0x0, 0xc94) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x44, 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x24000040) close(0x3) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x40040) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x3}, 0x8) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 12m30.763232761s ago: executing program 32 (id=18): sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, 0x0, 0xc94) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x44, 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x24000040) close(0x3) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x40040) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x3}, 0x8) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 12m26.16764938s ago: executing program 33 (id=21): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0x22, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_emit_ethernet(0x0, 0x0, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) read(r4, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, 0x0) 11m11.555251955s ago: executing program 34 (id=110): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002980)={0x2020, 0x0, 0x0}, 0x2020) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r2 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24058041) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) read$FUSE(r2, &(0x7f00000008c0)={0x2020}, 0xfffffef0) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x4001ffe, 0xa68d7c519dc00fb1, 0xffbc, 0x6, 0x1d45, 0x0, 0x0, 0x0, 0x40}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x12) 10m12.433043175s ago: executing program 35 (id=162): syz_extract_tcp_res(0x0, 0x6, 0x5) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x45, 0x0, &(0x7f0000000100), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) pselect6(0x0, 0x0, &(0x7f0000000880)={0x8, 0x3, 0x5d9, 0x4, 0x468e, 0x8, 0x8, 0xffffffffffffee0f}, &(0x7f00000008c0)={0x9, 0x0, 0x700000000000, 0xd, 0x5, 0x7, 0x4, 0x2}, &(0x7f0000000940), &(0x7f00000009c0)={0x0}) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e21, @loopback}}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004095) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x810) r2 = io_uring_setup(0x1781, &(0x7f0000000140)={0x0, 0x5dda, 0x40, 0x0, 0x268}) socket$kcm(0x10, 0x2, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r3, &(0x7f0000000040), 0x10) close_range(r2, 0xffffffffffffffff, 0x0) 8m46.427088375s ago: executing program 36 (id=251): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_emit_vhci(0x0, 0xd) socket$inet6_icmp(0xa, 0x2, 0x3a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000000)='./file1\x00', 0x810, &(0x7f0000000280)={[{@enospc_debug}, {@nodatacow}, {@enospc_debug}, {@nossd}, {@nodatasum}, {@acl}, {@user_subvol_rm}, {@max_inline={'max_inline', 0x3d, [0x6d, 0x33, 0x38, 0x34, 0x70, 0x36]}}]}, 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) close(0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "a6341a1a379332f5", "1fd33c81cf7995313c09de00fd6ded74", "62266bd8", "1e00040000000100"}, 0x28) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) 7m40.429194555s ago: executing program 37 (id=327): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_clone(0x8202000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregset(0x4205, r2, 0x40c, &(0x7f00000001c0)={0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, 0x0, 0x2008800, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x12, 0xffffffffffffffff, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1, 0xf5}}], 0x48}, 0x0) 5m51.028140875s ago: executing program 4 (id=279): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r2, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x20004000) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, &(0x7f0000000140)) 5m49.592041746s ago: executing program 4 (id=445): syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x6) inotify_init() utime(0x0, 0xfffffffffffffffd) epoll_create1(0x0) r3 = fsopen(&(0x7f00000000c0)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x6) fchdir(r4) syz_mount_image$hfsplus(&(0x7f00000003c0), &(0x7f0000000040)='./file0\x00', 0x201048c, &(0x7f0000000080)=ANY=[], 0xfd, 0x659, &(0x7f0000000400)="$eJzs3c1vHGcdB/DvbNZ2Ni2JmyZtQJVqNRIgLBK/yAVzISCEfKhQVQ6crcRprGzSYrvIrRA179ce+geUg2+ckLhHKhcucOvVRySkXrhgTot2dtbe2GvHTpxdp/18otl5nn3meeb3/GZm12MrmgBfWguTqT9IkYXJN9bb9a3N2ebW5uy9bjnJWJKNpJ6klqT4b6vV+jS5kRQ7wxR71vt8vDz/1mf/2fpXp1avlhTl6If0O5qNaslEkjPV+qTGu/nE4xU7M7yR5Gq1hqEbSdJ6yM///vxOS49Gv95nBxIj8HQVne/NfcaTc9WFXn5Tb3Terg02upO3MewAAAAAYAAubGc768X5YccBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz4qN3ef/V8Xy+f5FsZFMpOg+/3+0aktVPl1ePd7mD55WHAAAAAAAAAAwQK9uZzvrOd+tt4ryb/6vlZVL5etzeS+rWcpKrmU9i1nLWlYynWS8Z6DR9cW1tZXpI/Sc6dtz5hGBjlXrxsnMGwAAAAAAAAC+YH6Thd2//wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGlQJGc6q3K51C2Pp1ZPcjbJaHu7jeSf3fIzqj2vPBh2FAAAADAAF7aznfWc79ZbRXnP/1J5f3w27+V+1rKctTSzlFude+byrr+2tTnb3Nqcvdde9o46dtwwyhHT+d1D/z1fKbdo5HaWy3eu5WbeSTO3Uit7tl2p4klaF/rs5Neft8f+fuWIkd2q1u2Zf9T9rcFeHx53vn0d85cp42VGRnYyMlXF1s7GC90j0/8I/eDzJ9rTdGo7wV7as6c9k3isnJ8rX0fK+fzhoJwPxd5MzPScfS8dnvPkG3/988/uNO/fvXN7dfL0TOlozlTrVvna2J+J2Z5MvPxFzsQ+U2UmLu/UF/Lj/DSTmcibWclyfpHFrGUpE/lRWVqszuei55I/IFM3Hqq9+ahIRqsztHOwjhfTa2Xf81nOT/JObmUpr5f/ZjKd72Quc5nvOcKXDzzC5RblVV874KpvfaVv8Fe/WRUaSf5YrU+Hdl5f6Mlr72fueNnW+85uli4efh30+WysPSqU+teqQnvL3x6lx8DszcR0TyZePDwTfyo/Vlab9++u3Fl892i7u/hRVWhfR78/Vd8S7fPlYvtglbWHz45224t926bLtks7bbV9bZd32jpX6saBV+po9TPc/pFmyraX+7bNlm1Xetr6/bwFwKl37lvnRhv/bvyj8Unjd407jTfO/nDsu2OvjGbkbyPfq0+d+XrtleIv+SS/2r3/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHt/q+x/cXWw2l1b2FFqt1ocHNPUpPHeEbU5Fofs4swHu9KvPJ6di7kMt/K/ValXvFKchnsMLrcpjdE8GG2r3jD7xkYf4oQQMxPW1e+9eX33/g28v31t8e+ntpfvzc3PzU/Nzr89ev73cXJrqvA47SuBp2P3SL6vHfBQ1AAAAAAAAAAAAMAyD+I8Kw54jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8GxbmEz9QYpMT12bate3Nmeb7aVb3t2ynqSWpPhlUnya3EhnyXjPcMVB+/l4ef6tz8Z7x6p3t68d1u9oNqolE0nOVOuTGu9m6k84XrEzw3bCrqbeSRwM2/8DAAD//2bxCDE=") 5m44.184958984s ago: executing program 4 (id=449): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r1 = openat2(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, 0x0, 0x8000) listen(r0, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0xff07}, 0x2000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x8000) 5m41.059482253s ago: executing program 4 (id=453): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x1ffffc54, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40}, 0x94) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuacct.stat\x00', 0x26e1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80, 0x143) getdents64(r4, &(0x7f0000000580)=""/174, 0xff56) 5m38.490150568s ago: executing program 4 (id=458): socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fspick(r2, &(0x7f00000000c0)='.\x00', 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000100)=0x7f, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000640)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) 5m22.986283045s ago: executing program 38 (id=458): socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fspick(r2, &(0x7f00000000c0)='.\x00', 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000100)=0x7f, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000640)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) 5m20.838569217s ago: executing program 6 (id=483): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_clone(0x89e6600, &(0x7f0000000000), 0x0, &(0x7f0000000080), &(0x7f0000000100), 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x3, 0x0, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x4b4d, &(0x7f00000000c0)) 5m10.40000377s ago: executing program 6 (id=500): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) shmctl$IPC_RMID(r3, 0x0) socket(0x10, 0x3, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000040)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100d0000000fbdbdf25210000001800018014000200760000683144c2f09feb852f92d9cb"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x4008800) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x106, 0x2}}, 0x20) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 5m7.998043779s ago: executing program 6 (id=493): eventfd(0xfffffffd) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x8, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) pipe2(&(0x7f0000000000), 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4000003, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r1, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 5m4.890494617s ago: executing program 6 (id=495): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x9f6b4000, @loopback, 0x7ff}, 0x1c) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, 0x0, 0x0) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket(0x2b, 0x80805, 0x401) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', 0x101200, 0x8) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) socket$can_j1939(0x1d, 0x2, 0x7) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000500)=ANY=[@ANYBLOB="61153c00000000006113500000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf630000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ff3d4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf664e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2739670b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc401000000cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386ba3b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be19637302f3b41eae50509fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc5"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) 4m49.469035668s ago: executing program 6 (id=499): r0 = syz_open_procfs(0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x7, 0x3cd980) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000800)=r1) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = fsopen(&(0x7f0000000080)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) link(&(0x7f0000000140)='.\x00', &(0x7f00000001c0)='./file0\x00') fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f0000000140)='ro\x00', &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) 4m45.468995317s ago: executing program 6 (id=505): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x404c804}, 0xc000) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x309380, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_uring_register$IORING_REGISTER_ZCRX_CTRL(0xffffffffffffffff, 0x24, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4018}, 0x40000) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r3) kcmp(0x0, r0, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) 4m29.582533389s ago: executing program 39 (id=505): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x404c804}, 0xc000) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x309380, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_uring_register$IORING_REGISTER_ZCRX_CTRL(0xffffffffffffffff, 0x24, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4018}, 0x40000) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r3) kcmp(0x0, r0, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) 4m20.65682528s ago: executing program 2 (id=532): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8000000000, 0x9, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = socket$inet_tcp(0x2, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x141) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r2 = semget$private(0x0, 0x6, 0x0) semtimedop(r2, &(0x7f00000003c0), 0x0, 0x0) semop(r2, 0x0, 0x0) semctl$IPC_RMID(r2, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB=' \x00\x00\x00/'], 0x20}}, 0x8040) syz_init_net_socket$llc(0x1a, 0x1, 0x0) 4m17.156565237s ago: executing program 2 (id=540): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)={0x14, 0x4, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) socket$kcm(0x21, 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x21}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x34, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, 'n'}]}, @NFTA_BITWISE_XOR={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x108}}, 0x0) getpeername$netlink(r1, &(0x7f0000000340), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4m9.237741256s ago: executing program 2 (id=562): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) rmdir(&(0x7f0000000140)='./cgroup/../file0\x00') sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40000) socket$inet6_udp(0xa, 0x2, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84022, 0x0) ptrace(0x10, 0x0) ptrace$setsig(0x4203, 0x0, 0x5, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x18, r3, 0x321, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) recvmmsg(r4, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x60000000}, {{0x0, 0x0, 0x0}, 0x871}, {{0x0, 0x0, 0x0}, 0x9}], 0x4, 0x20, 0x0) 4m4.995252047s ago: executing program 2 (id=555): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x14) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) syz_emit_ethernet(0x12, &(0x7f0000000240)={@remote, @multicast, @val={@void, {0x8100, 0x2, 0x1, 0x2}}, {@generic={0x4305}}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) 4m2.497810041s ago: executing program 2 (id=559): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r4, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x4}, 0xe) r5 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r5, 0x2, 0x0, &(0x7f0000000080), 0x0) listen(r4, 0x7a) r6 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000000000)={0x10000009}) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) capget(0x0, 0x0) 3m59.682221402s ago: executing program 2 (id=563): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) eventfd2(0x5, 0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f00000000c0)=0x20000, 0x4) getsockopt(r1, 0xffffff80, 0x3, &(0x7f0000000600)=""/131, &(0x7f00000006c0)=0x83) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) socket$kcm(0x10, 0x2, 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000001, 0x12, r1, 0x180000000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x7, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3fc, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x2}, 0x0, 0x0) 3m44.529836773s ago: executing program 40 (id=563): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) eventfd2(0x5, 0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f00000000c0)=0x20000, 0x4) getsockopt(r1, 0xffffff80, 0x3, &(0x7f0000000600)=""/131, &(0x7f00000006c0)=0x83) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) socket$kcm(0x10, 0x2, 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000001, 0x12, r1, 0x180000000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x7, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3fc, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x2}, 0x0, 0x0) 3m35.7929907s ago: executing program 1 (id=594): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket(0x40000000015, 0x5, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x271f, 0x0, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r2, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 3m30.943000531s ago: executing program 1 (id=600): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 3m30.114795258s ago: executing program 1 (id=602): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000240)=0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) fchown(r0, 0x0, 0x0) fchdir(r4) open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r5 = openat(r4, &(0x7f0000000080)='./bus\x00', 0x0, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x1c1002, 0x50) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(r6, r5, 0x0, 0x7fffffff) 3m28.360713486s ago: executing program 1 (id=603): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, 0x0, 0x40000) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0xc0045540, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000100)=0x1) sendmmsg$inet(r0, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) 3m25.90644214s ago: executing program 1 (id=605): r0 = fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') pread64(r5, &(0x7f0000002240)=""/236, 0xec, 0x4eb) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x6a) 3m23.863362023s ago: executing program 1 (id=606): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r2, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x20004000) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, &(0x7f0000000140)) 3m8.526401635s ago: executing program 41 (id=606): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r2, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x20004000) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, &(0x7f0000000140)) 2m30.012387142s ago: executing program 5 (id=650): ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000240)=0x200b8) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x1, 0x0, 0x4}}, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x0, 0x0, 0x38, 0x800, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x64010101, @local, {[@cipso={0x86, 0x6, 0x5}]}}, @time_exceeded={0x80, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @loopback, @loopback}}}}}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x7}, 0x20) migrate_pages(0x0, 0x5, &(0x7f0000000040)=0x9, &(0x7f0000000080)=0x272) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl711\x00', [0x100, 0x80000000, 0x2, 0x10, 0xe, 0x5, 0x79, 0xfffffff8, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x489, 0x4, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0xffffffff, 0xfffffff8]}) getpid() setns(0xffffffffffffffff, 0x24020000) setresgid(0x0, 0xee00, 0x0) syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0) pread64(r0, 0x0, 0x0, 0x2f6) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 2m27.030500952s ago: executing program 5 (id=653): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x1}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000280)={0x339, @time={0x0, 0xffffffff}, 0x6, {0x9, 0x80}, 0x6, 0x0, 0x4}) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$pokeuser(0x6, r3, 0x358, 0xffff8881f5c0a000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={0x30, 0x0, 0x1, 0x70bd28, 0x25dfdc00, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x803, 0x56}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0xc0505350, 0x0) 2m24.566813817s ago: executing program 5 (id=674): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, 0x0, 0x20000000) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0xb0) keyctl$setperm(0x5, r4, 0x1830827) r5 = add_key$user(0x0, &(0x7f0000000440)={'syz', 0x0}, 0x0, 0xfffffffffffffecb, r4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x14, 0x4, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4004) keyctl$dh_compute(0x17, &(0x7f0000000000)={r5, r5, r5}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={'streebog256\x00'}}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x200100, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) 2m21.933560011s ago: executing program 5 (id=661): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x801, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x21514}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x20004080) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000000)=0xb4d5f59234a458bf, 0x4) openat$audio(0xffffff9c, 0x0, 0x48100, 0x0) r3 = socket$kcm(0x21, 0x2, 0xa) modify_ldt$write(0x1, &(0x7f0000000280)={0x5, 0xffffffffffffffff, 0x4000, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x78, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001240)=[{0x10, 0x110, 0x1, "dc"}], 0x10}, 0xc010) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2c, r6, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x2, 0x2}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x2c}, 0x1, 0x40030000000000, 0x0, 0x20040841}, 0x8000) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000140)="be38", 0x2}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="ac1414aaac14140000000b001400000000000000000000000700000007038b01000000"], 0x38}, 0x0) 2m18.695511183s ago: executing program 5 (id=665): r0 = syz_open_procfs(0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x7, 0x3cd980) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000800)=r1) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = fsopen(&(0x7f0000000080)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) link(&(0x7f0000000140)='.\x00', &(0x7f00000001c0)='./file0\x00') fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f0000000140)='ro\x00', &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) 2m13.530317982s ago: executing program 5 (id=671): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x800000, &(0x7f0000000280)={[{@nodelalloc}, {@dioread_lock}, {@init_itable_val={'init_itable', 0x3d, 0x5}}, {@i_version}, {@noload}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14b442, 0x82) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() connect$llc(r0, &(0x7f00000000c0)={0x1a, 0x30d, 0xf7, 0x0, 0x6b, 0x0, @local}, 0x10) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x3fffffffffffd75, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, 0x0, 0x0) sendmmsg(r4, &(0x7f0000002340), 0x0, 0x0) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f0000000140)={0x17c04, r0, 0x6, 0x973f, 0x81, 0x1}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x25) pwrite64(r5, &(0x7f0000000140)='2', 0xfdef, 0xe7c) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) 1m57.772353224s ago: executing program 42 (id=671): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x800000, &(0x7f0000000280)={[{@nodelalloc}, {@dioread_lock}, {@init_itable_val={'init_itable', 0x3d, 0x5}}, {@i_version}, {@noload}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14b442, 0x82) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() connect$llc(r0, &(0x7f00000000c0)={0x1a, 0x30d, 0xf7, 0x0, 0x6b, 0x0, @local}, 0x10) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x3fffffffffffd75, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, 0x0, 0x0) sendmmsg(r4, &(0x7f0000002340), 0x0, 0x0) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f0000000140)={0x17c04, r0, 0x6, 0x973f, 0x81, 0x1}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x25) pwrite64(r5, &(0x7f0000000140)='2', 0xfdef, 0xe7c) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) 1m30.093695695s ago: executing program 7 (id=736): pipe2(&(0x7f0000000140), 0x80800) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x141301, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x2228, 0x1, 0x1, 0x3b5}, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000f, 0x204031, 0xffffffffffffffff, 0x50728000) r1 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) mq_getsetattr(r1, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r1, 0x0, 0x0, 0x6, &(0x7f0000000240)={0x77359400}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x15) add_key$fscrypt_provisioning(0x0, 0x0, 0x0, 0x29, 0xfffffffffffffffe) syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x167, &(0x7f0000000240)="$eJzslbtOAkEUhv+B4aKxoNaGxBsWyjKoMbGh8BEsLSSwInHxwpIohMja+RTyCpaWvgWvYGIssDQxa2bnzDBsr4nJkrDfuWT+OTPFP+f+jZ8D8D0dNlAAGOR/Ce+MgQNYkQUAJzlFEI+Ib1xxPav4TPwk+v3BRd3z3O4vBn+xRxIkQRL8t2CWHj6k8BF52WQ6bJCpmV8TgN1Px3rLHEgjNH0O5ZSbAMq9znXZ7w+22516y225l0JU951dx9kT5bO25zrqyyz5FElLbpGnLlj9jLX9YmxUPfo9Ga+9TnruKfVLq/Pr5F5hGIawONN8NRra5+UVHGMDeQC3AbOqxUiNIzpWDQxpSio8NmMK+aix07jymiMwML1sDG40KhNkTCLspFoI9HEeuVJ9onflINDDj4hFYo04Jk6I+iV7IQUeKXxRVgqALO7qvV63IksqMjVhaqIQ2Fe6BiCfmz+2oPwnAAD//2EYVFA=") 1m26.024941593s ago: executing program 7 (id=739): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket(0x40000000015, 0x5, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x271f, 0x0, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r3, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 1m25.79969054s ago: executing program 8 (id=741): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000000)={0xffb, 0x0, 0x3, 0xe, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r3, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x600202, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f00000003c0)={0x77ef, {{0x2, 0x4e21, @broadcast}}, 0x1, 0x5, [{{0x2, 0x4e20, @private=0xa010100}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x9, @multicast1}}, {{0x2, 0x4e24, @remote}}, {{0x2, 0x4e20, @private=0xa010102}}]}, 0x310) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, &(0x7f0000000340)={0x0, &(0x7f0000000280)="8dfc4011231994e23a02b17b84f3a0652e1bd74eb9473b4da41af5225e45083edfaf7518de943442a3e0a77441292622613bcfdd35cbe31ae0aedd201b6d46269ee68f90c1e2a0cbdedae3e7ff", 0x4d}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file1\x00', 0x3f, 0x186) 1m24.103695913s ago: executing program 7 (id=743): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) r4 = fanotify_init(0xf00, 0x1000) fanotify_mark(r4, 0x105, 0x10000839, r3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, 0x0, 0x2) readv(r4, &(0x7f0000000c40)=[{&(0x7f0000000500)=""/169, 0xffffffa0}], 0x1) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) clock_gettime(0x3, &(0x7f00000000c0)) clock_settime(0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4010) 1m22.750326463s ago: executing program 8 (id=744): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) dup(r0) socket(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$sysfs(0xffffff9c, &(0x7f0000000980)='/sys/kernel/vmcoreinfo', 0x240000, 0xa0) socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r1, 0xfffffffffffffffb, 0x1, 0xfffffffffffffffd}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 1m22.599665275s ago: executing program 7 (id=746): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x14) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r3, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) syz_emit_ethernet(0x12, &(0x7f0000000240)={@remote, @multicast, @val={@void, {0x8100, 0x2, 0x1, 0x2}}, {@generic={0x4305}}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000001c0)={0x0, 0x38, "9dc2913b488782e9fd3157b4b3fa5abd4323cd343e0783cad5b811ceac74db00457ab267bdf688360af18f6a9635844145c7d06ecac22b49"}, &(0x7f0000000400)=0x40) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10005}}, 0x20}, 0x1, 0x0, 0x0, 0x80004}, 0x0) 1m21.503813032s ago: executing program 8 (id=748): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000400)={0x0, 0x595d, 0x1000, 0x20002, 0x1000051, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) r5 = timerfd_create(0x8, 0x80000) timerfd_settime(r5, 0x1, 0x0, 0x0) timerfd_gettime(r5, &(0x7f0000000000)) capset(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x20) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fremovexattr(r6, &(0x7f0000000000)=@known='system.posix_acl_default\x00') fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x259a}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42792000) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r7, 0x0) recvmmsg(r7, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) 1m20.845729818s ago: executing program 8 (id=751): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000080), 0x40002df, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000340)={0x5, {{0x2, 0x0, @multicast1}}, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x26}}}}, 0x108) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c8, 0x110, 0x0, 0x110, 0x110, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x110, 0x0, 0x0, 0x2, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x2, 0x1}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0xd, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x11}, @dev={0xac, 0x14, 0x14, 0x28}, 0xffffff00, 0xffffffff, 0x6, 0x2d, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x4b, 0x5, 0x10, 0xe, 0x3ff, 0x3, 'bond_slave_1\x00', 'hsr0\x00', {}, {0xff}, 0x0, 0x2f6}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x8, 0xd, 0x4, "134604cea4ddbc704c17bc74772190f5070001ebfffdfffffee793000000e000", 0x34324142}) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000400)=@generic={0x0}, 0x18) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x8040) 1m20.744734595s ago: executing program 7 (id=752): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xcabd8245) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) sendmmsg$inet(r2, 0x0, 0x0, 0x4040040) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000200)=0x2, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "5335572af7aa9ec3", "0bb3bbceae3b6d56e33a5c51cbf284c6", "1363cf10", "5c892ebd183c8c13"}, 0x28) recvmsg(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000380)=""/84, 0x54}], 0x1}, 0x20) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(r3, 0x0, 0x0) shmctl$SHM_LOCK(0x0, 0xb) shmctl$IPC_RMID(0x0, 0x0) 1m19.091106795s ago: executing program 8 (id=754): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x42002) write$sndseq(r4, &(0x7f0000000000), 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) 1m19.052036556s ago: executing program 7 (id=755): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket(0x40000000015, 0x5, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x271f, 0x0, &(0x7f00000000c0)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r3, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 1m17.142290762s ago: executing program 8 (id=757): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x19, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000080)={0x220000, 0x0, 0x29}, 0x18) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net\x00') r6 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, 0x0) fstat(r5, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r7, 0x6, 0x1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000280)={{0x0, 0x1}, {0xe}, 0x0, 0x1}) 1m3.432387011s ago: executing program 43 (id=755): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket(0x40000000015, 0x5, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x271f, 0x0, &(0x7f00000000c0)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000007880)=""/102400, 0x19000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r3, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 1m1.687403813s ago: executing program 44 (id=757): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x19, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000080)={0x220000, 0x0, 0x29}, 0x18) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net\x00') r6 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, 0x0) fstat(r5, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r7, 0x6, 0x1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000280)={{0x0, 0x1}, {0xe}, 0x0, 0x1}) 19.368164345s ago: executing program 3 (id=823): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000000)={0xffb, 0x0, 0x3, 0xe, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r3, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f00000003c0)={0x77ef, {{0x2, 0x4e21, @broadcast}}, 0x1, 0x5, [{{0x2, 0x4e20, @private=0xa010100}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x9, @multicast1}}, {{0x2, 0x4e24, @remote}}, {{0x2, 0x4e20, @private=0xa010102}}]}, 0x310) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x48) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, &(0x7f0000000340)={0x0, &(0x7f0000000280)="8dfc4011231994e23a02b17b84f3a0652e1bd74eb9473b4da41af5225e45083edfaf7518de943442a3e0a77441292622613bcfdd35cbe31ae0aedd201b6d46269ee68f90c1e2a0cbdedae3e7ff", 0x4d}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file1\x00', 0x3f, 0x186) 17.566033121s ago: executing program 3 (id=825): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r1 = openat2(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, 0x0, 0x8000) listen(r0, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r3, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) 16.037753665s ago: executing program 3 (id=829): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000011c0)=[@in={0x2, 0x4e22, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r5, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000f00)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) 14.694211463s ago: executing program 3 (id=832): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x400, &(0x7f0000000280), 0x2, 0x786, &(0x7f0000000f80)="$eJzs3c9rHGUfAPDvbLNJ37Tv27zwwms9BQQNlG5Mja2Ch4oHESwU9Gy7bLahZpMt2U1pQkCLCF4EFQ+CXnq2Wm9e/XHVP8C7B2mpmhYjHiQym9102+ymmzSbbdnPByZ5npnZfOc7z8w8T3aG3QD61mj6IxNxOCI+SCIO1ecnEZGtlQYiTq6vt7qyXEinJNbWXvstqa1ze2W5EE2vSR2oVx6LiO/ejTiS2Ry3srg0ky+VivP1+nh19sJ4ZXHp6PnZ/HRxujh3fGJy8tiJZ08c371c//hx6eCND19+6suTf73z/2vvf5/EyThYX9acx24ZjdH6Psmmu/AuL8Vbux2up5JebwA7kp6a+9bP8jicpOWBXm8SANBl6Sh0DQDoM4n+HwD6TON9gNsry4XG1Nt3JPbWzRcjYv96/o37m+tLBur37PbX7oMO307uujOSRMTILsQfjYjPvn7jajpFl+5DArTy9uWIODsyuvn6n2x6ZmG7nu5gndF76hvxf8o+YHTgfr5Jxz/PtRr/ZTbGP9Fi/DPU4tzdibbn/4bM9V0I01Y6/nuh6dm21ab860b21Wv/ro35ssm586Viem37T0SMRXYorU9sEWPs1t+32i1rHv/9/tGbn6fx09931shcHxi6+zVT+Wr+QXJudvNyxOMDrfJPNto/aTP+Pd1hjFeef+/TdsvS/NN8G9Pm/Ltr7UrEky3b/84TbcmWzyeO1w6H8cZB0cJXP38y3C5+c/un0+rK8loScXX3M20tbf/hrfMfSZqf16xsP8YPVw59225Zi/wLjf+F1rU+/geT12vlwfq8S/lqdX4iYjB5dfP8Y3de26g31k/zH3ui9fm/1fGfjk7Odpj/wI1fv9h5/t2V5j+1rfbffuHa6sy+dvE7a//JWmmsPqeT61+nG/gg+w4AAAAAAAAAAAAAAAAAAAAAAAAAOpWJiIORZHIb5Uwml1v/Du//xXCmVK5Uj5wrL8xNRe27skcim2l81OWhps9Dnah/Hn6jfuye+jMR8d+I+HjoX7V6rlAuTfU6eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoO9Dm+/9Tvwz1eusAgK7Z3+sNAAD2nP4fAPqP/h8A+o/+HwD6j/4fAPqP/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAuO33qVDqt/bmyXEjrUxcXF2bKF49OFSszudmFQq5Qnr+Qmy6Xp0vFXKE8e7+/VyqXL0zG3MKl8WqxUh2vLC6dmS0vzFXPnJ/NTxfPFLN7khUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbE9lcWkmXyoV5xUegcJAvdUelu3ZUSHTSGKvgg52K4uHYGd2r9DDixIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAI+SfAAAA///WoyFe") r0 = socket$inet6(0xa, 0x800000000000002, 0x0) ioctl$XFS_IOC_AG_GEOMETRY(r0, 0xc080583d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) fanotify_init(0x3f, 0x0) pipe(&(0x7f0000000380)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f0000000380)="170000000200010000ffbe8c5ee17688a20033000301fcff000002a257fc5ad90200bb6a880000d6c8db000000df018002000000fc0607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf93150334769e106e7db76849d3c98bf79ac2dfc060115003901000000000000ea000000000000000062068f5ee50ce5d4af9477170d283f02ff030000ba000840024f0298e9e90539062a80e605007f71174aa961f3c6", 0xad) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x10}}, 0x0) sendto$inet(r2, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) truncate(&(0x7f0000000940)='./file1\x00', 0x8da6) 12.230188329s ago: executing program 9 (id=834): pipe2(&(0x7f0000000140), 0x80800) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x141301, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x2228, 0x1, 0x1, 0x3b5}, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000f, 0x204031, 0xffffffffffffffff, 0x50728000) r1 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) mq_getsetattr(r1, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r1, &(0x7f0000000500)=""/4096, 0x1000, 0x6, &(0x7f0000000240)={0x77359400}) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x15) add_key$fscrypt_provisioning(0x0, 0x0, 0x0, 0x29, 0xfffffffffffffffe) syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x167, &(0x7f0000000240)="$eJzslbtOAkEUhv+B4aKxoNaGxBsWyjKoMbGh8BEsLSSwInHxwpIohMja+RTyCpaWvgWvYGIssDQxa2bnzDBsr4nJkrDfuWT+OTPFP+f+jZ8D8D0dNlAAGOR/Ce+MgQNYkQUAJzlFEI+Ib1xxPav4TPwk+v3BRd3z3O4vBn+xRxIkQRL8t2CWHj6k8BF52WQ6bJCpmV8TgN1Px3rLHEgjNH0O5ZSbAMq9znXZ7w+22516y225l0JU951dx9kT5bO25zrqyyz5FElLbpGnLlj9jLX9YmxUPfo9Ga+9TnruKfVLq/Pr5F5hGIawONN8NRra5+UVHGMDeQC3AbOqxUiNIzpWDQxpSio8NmMK+aix07jymiMwML1sDG40KhNkTCLspFoI9HEeuVJ9onflINDDj4hFYo04Jk6I+iV7IQUeKXxRVgqALO7qvV63IksqMjVhaqIQ2Fe6BiCfmz+2oPwnAAD//2EYVFA=") 12.104951967s ago: executing program 3 (id=835): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000000)={0xffb, 0x0, 0x3, 0xe, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r3, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f00000003c0)={0x77ef, {{0x2, 0x4e21, @broadcast}}, 0x1, 0x5, [{{0x2, 0x4e20, @private=0xa010100}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x9, @multicast1}}, {{0x2, 0x4e24, @remote}}, {{0x2, 0x4e20, @private=0xa010102}}]}, 0x310) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x48) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, &(0x7f0000000340)={0x0, &(0x7f0000000280)="8dfc4011231994e23a02b17b84f3a0652e1bd74eb9473b4da41af5225e45083edfaf7518de943442a3e0a77441292622613bcfdd35cbe31ae0aedd201b6d46269ee68f90c1e2a0cbdedae3e7ff", 0x4d}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file1\x00', 0x3f, 0x186) 11.950984944s ago: executing program 9 (id=836): socket$nl_route(0x10, 0x3, 0x0) ioctl$BLKRASET(0xffffffffffffffff, 0x1262, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) finit_module(r0, 0x0, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c00)={0x6, 0xf, &(0x7f0000000a00)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x42, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000b00)={0x88, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000b40), &(0x7f0000000b80)=[{0x0, 0x5, 0xc, 0xb}, {0x2, 0x5, 0x0, 0xb}, {0x0, 0x1, 0xb}, {0x1, 0x4, 0x9, 0x2}, {0x5, 0x4, 0x6, 0x3}, {0x2, 0x2, 0xd, 0x2}], 0x10, 0x7}, 0x94) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) set_mempolicy(0x2, &(0x7f0000000400)=0xfffffffffffffff7, 0xb6d) chdir(0x0) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) unlinkat(0xffffffffffffff9c, 0x0, 0x0) epoll_create1(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000025c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x1e}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 10.030625485s ago: executing program 9 (id=838): r0 = socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_genetlink_get_family_id$batadv(0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$nl_route(r1, 0x0, 0x1) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r3, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) bind$phonet(r3, &(0x7f0000000000)={0x23, 0x4, 0x0, 0x48}, 0x10) bind$phonet(0xffffffffffffffff, 0x0, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x14b}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r4, 0x1, 0x1, 0x1, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0xfffffffffffffff6, 0x2) 10.030427654s ago: executing program 3 (id=839): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet(0x2, 0x1, 0x6) prctl$PR_SET_SECUREBITS(0x1c, 0x4) setresuid(0x0, 0xee00, 0xee01) acct(&(0x7f0000000040)='./file0\x00') fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @remote}, {0x1}, 0xc, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x44}}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000025300)=""/102392, 0x18ff8) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x891b, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) shutdown(r0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) open$dir(0x0, 0x200, 0xd9) 9.991314405s ago: executing program 0 (id=840): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x3, 0x9, 0x0, 0x7fff}, 0x20) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r3, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@const={0x6, 0x0, 0x0, 0xa, 0x2}]}, {0x0, [0x30, 0x61, 0x0, 0x0, 0x30]}}, &(0x7f0000000080)=""/250, 0x2b, 0xfa, 0x0, 0xbf}, 0x28) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x7ffff000, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4}, 0x94) 7.245267039s ago: executing program 9 (id=841): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x900, 0x81, 0x28}, 0x50) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x8, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r4}, 0xc) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x18) r5 = syz_open_procfs(0x0, &(0x7f0000001380)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="1400000010000100000000000000ffffff7f000a90000000060a010400000000000000000a0004050900010073797a310000000064000480600001800a000100696e6e65720000005000028008000440000000172c0005800c0001007061796c6f6164001c00028008000340000000920800024000000001"], 0xb8}, 0x1, 0x0, 0x0, 0x8890}, 0x20000000) getdents(r5, &(0x7f0000001000)=""/4085, 0xff5) r6 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0x1000f1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x0, 0x8, 0x400b, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) ioctl$COMEDI_DEVINFO(r6, 0x80b06401, &(0x7f0000000000)) 7.240075528s ago: executing program 0 (id=851): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x3, 0x9, 0x0, 0x7fff}, 0x20) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r3, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0xc040) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@const={0x6, 0x0, 0x0, 0xa, 0x2}]}, {0x0, [0x30, 0x61, 0x0, 0x0, 0x30]}}, &(0x7f0000000080)=""/250, 0x2b, 0xfa, 0x0, 0xbf}, 0x28) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x7ffff000, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4}, 0x94) 6.04606951s ago: executing program 0 (id=842): shmget$private(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x8000000000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x20882, 0x0) writev(r4, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/unix\x00') r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) ioctl$TIOCVHANGUP(r5, 0x5437, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r6, &(0x7f00000001c0)={0x1f, 0x8, 0x0, 0x1, 0x2, 0x6, @remote}, 0x14) 3.350342105s ago: executing program 0 (id=843): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000000)={0xffb, 0x0, 0x3, 0xe, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r3, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f00000003c0)={0x77ef, {{0x2, 0x4e21, @broadcast}}, 0x1, 0x5, [{{0x2, 0x4e20, @private=0xa010100}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x9, @multicast1}}, {{0x2, 0x4e24, @remote}}, {{0x2, 0x4e20, @private=0xa010102}}]}, 0x310) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x48) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, &(0x7f0000000340)={0x0, &(0x7f0000000280)="8dfc4011231994e23a02b17b84f3a0652e1bd74eb9473b4da41af5225e45083edfaf7518de943442a3e0a77441292622613bcfdd35cbe31ae0aedd201b6d46269ee68f90c1e2a0cbdedae3e7ff", 0x4d}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file1\x00', 0x3f, 0x186) 2.481032818s ago: executing program 9 (id=844): connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)=@newlink={0x20, 0x10, 0x503, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20305}}, 0x20}, 0x1, 0x0, 0x0, 0x4040080}, 0x4000) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f00000001c0)={0x1, r3}) openat$full(0xffffff9c, &(0x7f0000000200), 0x248200, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000c40)={0x1, 0x0, [{0x0, 0xf3, &(0x7f00000008c0)=""/243}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) sendmsg$nl_route(r1, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) 1.350138961s ago: executing program 0 (id=846): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) r1 = getpgid(0x0) syz_pidfd_open(r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x100) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2000000002ffff, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r5) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x3c, r6, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x10, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x8fee}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937e, &(0x7f00000019c0)={{0x1, 0x1, 0x1018, r2}, './file1\x00'}) 8.638615ms ago: executing program 9 (id=847): pipe2(&(0x7f0000000140), 0x80800) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x141301, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x2228, 0x1, 0x1, 0x3b5}, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000f, 0x204031, 0xffffffffffffffff, 0x50728000) r1 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) mq_getsetattr(r1, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r1, &(0x7f0000000500)=""/4096, 0x1000, 0x6, &(0x7f0000000240)={0x77359400}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) add_key$fscrypt_provisioning(0x0, 0x0, 0x0, 0x29, 0xfffffffffffffffe) syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x167, &(0x7f0000000240)="$eJzslbtOAkEUhv+B4aKxoNaGxBsWyjKoMbGh8BEsLSSwInHxwpIohMja+RTyCpaWvgWvYGIssDQxa2bnzDBsr4nJkrDfuWT+OTPFP+f+jZ8D8D0dNlAAGOR/Ce+MgQNYkQUAJzlFEI+Ib1xxPav4TPwk+v3BRd3z3O4vBn+xRxIkQRL8t2CWHj6k8BF52WQ6bJCpmV8TgN1Px3rLHEgjNH0O5ZSbAMq9znXZ7w+22516y225l0JU951dx9kT5bO25zrqyyz5FElLbpGnLlj9jLX9YmxUPfo9Ga+9TnruKfVLq/Pr5F5hGIawONN8NRra5+UVHGMDeQC3AbOqxUiNIzpWDQxpSio8NmMK+aix07jymiMwML1sDG40KhNkTCLspFoI9HEeuVJ9onflINDDj4hFYo04Jk6I+iV7IQUeKXxRVgqALO7qvV63IksqMjVhaqIQ2Fe6BiCfmz+2oPwnAAD//2EYVFA=") 0s ago: executing program 0 (id=848): openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xf, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/eem.usb0\x00', 0x1ed) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/eem.usb0/host_addr\x00', 0x0, 0x0) read(r4, &(0x7f00000002c0)=""/128, 0x80) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) kernel console output (not intermixed with test programs): 494.630117][ T5636] Bluetooth: hci5: command tx timeout [ 495.516465][ T3309] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.695920][ T5631] Bluetooth: hci7: command tx timeout [ 498.081486][ T3309] bridge_slave_1: left allmulticast mode [ 498.094668][ T3309] bridge_slave_1: left promiscuous mode [ 498.102162][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.171332][ T3309] bridge_slave_0: left allmulticast mode [ 498.184596][ T3309] bridge_slave_0: left promiscuous mode [ 498.201723][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.775902][ T5631] Bluetooth: hci7: command tx timeout [ 500.857873][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.017831][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.712822][ T3309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 502.233788][ T8417] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 502.954252][ T3309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 503.080864][ T3309] bond0 (unregistering): Released all slaves [ 503.448749][ T8307] wlan0 speed is unknown, defaulting to 1000 [ 503.497844][ T8332] wlan0 speed is unknown, defaulting to 1000 [ 503.510344][ T8125] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.532900][ T8125] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.567233][ T8125] bridge_slave_0: entered allmulticast mode [ 503.615443][ T8125] bridge_slave_0: entered promiscuous mode [ 503.774585][ T8125] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.799887][ T8125] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.809393][ T8125] bridge_slave_1: entered allmulticast mode [ 503.821486][ T8125] bridge_slave_1: entered promiscuous mode [ 504.237659][ T8125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 504.254267][ T13] smbdirect: ib_dev[syz0] removed [ 504.315120][ T8125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 504.384631][ T5782] wlan0 speed is unknown, defaulting to 1000 [ 504.393969][ T5782] syz0: Port: 1 Link DOWN [ 504.772148][ T3309] hsr_slave_0: left promiscuous mode [ 504.787807][ T3309] hsr_slave_1: left promiscuous mode [ 504.810661][ T3309] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 504.823912][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 504.832480][ T3309] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 504.843045][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 504.878489][ T3309] veth1_macvtap: left promiscuous mode [ 504.884155][ T3309] veth0_macvtap: left promiscuous mode [ 504.905965][ T3309] veth1_vlan: left promiscuous mode [ 504.911431][ T3309] veth0_vlan: left promiscuous mode [ 505.870389][ T3309] team0 (unregistering): Port device team_slave_1 removed [ 505.939854][ T3309] team0 (unregistering): Port device team_slave_0 removed [ 506.403098][ T8125] team0: Port device team_slave_0 added [ 506.487983][ T8125] team0: Port device team_slave_1 added [ 506.694356][ T8125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 506.703082][ T8125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.732139][ T8125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 506.799906][ T8125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 506.820264][ T8125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.847999][ T8125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 507.023548][ T8125] hsr_slave_0: entered promiscuous mode [ 507.056235][ T8125] hsr_slave_1: entered promiscuous mode [ 507.062785][ T8125] debugfs: 'hsr0' already exists in 'hsr' [ 507.073570][ T8125] Cannot create hsr debugfs directory [ 507.166097][ T3309] bridge_slave_1: left allmulticast mode [ 507.185640][ T3309] bridge_slave_1: left promiscuous mode [ 507.191577][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.202306][ T3309] bridge_slave_0: left allmulticast mode [ 507.208128][ T3309] bridge_slave_0: left promiscuous mode [ 507.216711][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.251635][ T3309] bridge_slave_1: left allmulticast mode [ 507.260398][ T3309] bridge_slave_1: left promiscuous mode [ 507.266656][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.276993][ T3309] bridge_slave_0: left allmulticast mode [ 507.282717][ T3309] bridge_slave_0: left promiscuous mode [ 507.295909][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.310694][ T3309] bridge_slave_1: left allmulticast mode [ 507.316845][ T3309] bridge_slave_1: left promiscuous mode [ 507.322636][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.333060][ T3309] bridge_slave_0: left allmulticast mode [ 507.338957][ T3309] bridge_slave_0: left promiscuous mode [ 507.348359][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.430084][ T3309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 507.441443][ T3309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.452056][ T3309] bond0 (unregistering): Released all slaves [ 507.525415][ T3309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 507.552698][ T3309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.563776][ T3309] bond0 (unregistering): Released all slaves [ 507.646703][ T3309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 507.678914][ T3309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.689521][ T3309] bond0 (unregistering): Released all slaves [ 507.985014][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 507.999825][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.008409][ T3309] hsr_slave_0: left promiscuous mode [ 508.015997][ T3309] hsr_slave_1: left promiscuous mode [ 508.022140][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 508.030474][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.044297][ T3309] hsr_slave_0: left promiscuous mode [ 508.051822][ T3309] hsr_slave_1: left promiscuous mode [ 508.058560][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 508.068092][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.111500][ T3309] team0 (unregistering): Port device team_slave_1 removed [ 508.130120][ T3309] team0 (unregistering): Port device team_slave_0 removed [ 508.350361][ T3309] team0 (unregistering): Port device team_slave_1 removed [ 508.369906][ T3309] team0 (unregistering): Port device team_slave_0 removed [ 508.698994][ T3309] team0 (unregistering): Port device team_slave_1 removed [ 508.718560][ T3309] team0 (unregistering): Port device team_slave_0 removed [ 508.943843][ T8307] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.952070][ T8307] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.960243][ T8307] bridge_slave_0: entered allmulticast mode [ 508.969088][ T8307] bridge_slave_0: entered promiscuous mode [ 509.021370][ T8307] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.028832][ T8307] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.036228][ T8307] bridge_slave_1: entered allmulticast mode [ 509.043885][ T8307] bridge_slave_1: entered promiscuous mode [ 509.064633][ T8332] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.073069][ T8332] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.081752][ T8332] bridge_slave_0: entered allmulticast mode [ 509.090680][ T8332] bridge_slave_0: entered promiscuous mode [ 509.153306][ T8332] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.163539][ T8332] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.171110][ T8332] bridge_slave_1: entered allmulticast mode [ 509.180290][ T8332] bridge_slave_1: entered promiscuous mode [ 509.216589][ T8307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.301429][ T8307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.379317][ T8332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.428274][ T8332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.478461][ T8307] team0: Port device team_slave_0 added [ 509.543031][ T8332] team0: Port device team_slave_0 added [ 509.552677][ T8307] team0: Port device team_slave_1 added [ 509.622019][ T8332] team0: Port device team_slave_1 added [ 509.736724][ T8307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.743716][ T8307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.798716][ T8307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 509.829286][ T8307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 509.853734][ T8307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.905840][ T8307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 509.954129][ T8332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.966375][ T8332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.996577][ T8332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.088759][ T8332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.095867][ T8332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 510.122268][ T8332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 510.193484][ T8307] hsr_slave_0: entered promiscuous mode [ 510.200769][ T8307] hsr_slave_1: entered promiscuous mode [ 510.207980][ T8307] debugfs: 'hsr0' already exists in 'hsr' [ 510.213889][ T8307] Cannot create hsr debugfs directory [ 510.350374][ T8125] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 510.383085][ T8125] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 510.393374][ T8125] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 510.415920][ T8125] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 510.471657][ T8125] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 510.484217][ T8125] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 510.521993][ T8332] hsr_slave_0: entered promiscuous mode [ 510.536866][ T8332] hsr_slave_1: entered promiscuous mode [ 510.544142][ T8332] debugfs: 'hsr0' already exists in 'hsr' [ 510.550404][ T8332] Cannot create hsr debugfs directory [ 510.556710][ T8125] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 510.572411][ T8125] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 511.215750][ T8125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.251092][ T8125] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.277327][ T3309] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.286912][ T3309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.359281][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.366597][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 512.378460][ T8125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 512.438874][ T8332] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 512.460820][ T8332] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 512.473701][ T8332] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 512.498903][ T8332] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 512.522244][ T8332] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 512.561594][ T8332] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 512.592409][ T8332] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 512.609858][ T8332] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 512.794390][ T8307] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 512.818339][ T8307] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 512.843535][ T8307] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 512.874150][ T8307] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 512.895797][ T8307] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 512.925233][ T8307] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 512.948233][ T8307] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 512.969127][ T8307] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 513.293538][ T8332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 513.320068][ T8125] veth0_vlan: entered promiscuous mode [ 513.372740][ T8125] veth1_vlan: entered promiscuous mode [ 513.388186][ T8332] 8021q: adding VLAN 0 to HW filter on device team0 [ 513.432476][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 513.439685][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 513.469855][ T8307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 513.506993][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.514220][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 513.590283][ T8125] veth0_macvtap: entered promiscuous mode [ 513.608631][ T8307] 8021q: adding VLAN 0 to HW filter on device team0 [ 513.629151][ T8125] veth1_macvtap: entered promiscuous mode [ 513.697533][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 513.704792][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 513.747658][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.754926][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 513.793172][ T8125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 513.861733][ T8125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 514.747705][ T5636] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 514.764410][ T5636] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 514.774898][ T5636] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 514.796155][ T5636] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 514.805202][ T5636] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 515.452448][ T8332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 515.769612][ T8307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 515.889960][ T8332] veth0_vlan: entered promiscuous mode [ 515.931702][ T8332] veth1_vlan: entered promiscuous mode [ 516.266753][ T3309] bridge_slave_1: left allmulticast mode [ 516.281925][ T3309] bridge_slave_1: left promiscuous mode [ 516.290960][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.318414][ T3309] bridge_slave_0: left allmulticast mode [ 516.344594][ T3309] bridge_slave_0: left promiscuous mode [ 516.350834][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.859703][ T3309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 516.866374][ T5636] Bluetooth: hci2: command tx timeout [ 516.884021][ T3309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 516.897039][ T3309] bond0 (unregistering): Released all slaves [ 517.148768][ T3309] hsr_slave_0: left promiscuous mode [ 517.176858][ T3309] hsr_slave_1: left promiscuous mode [ 517.183727][ T3309] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 517.205942][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 517.216214][ T3309] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 517.236783][ T3309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 517.261098][ T3309] veth1_macvtap: left promiscuous mode [ 517.267557][ T3309] veth0_macvtap: left promiscuous mode [ 517.273397][ T3309] veth1_vlan: left promiscuous mode [ 517.282689][ T3309] veth0_vlan: left promiscuous mode [ 517.710902][ T3309] team0 (unregistering): Port device team_slave_1 removed [ 517.734273][ T3309] team0 (unregistering): Port device team_slave_0 removed [ 517.979562][ T8332] veth0_macvtap: entered promiscuous mode [ 518.069585][ T8332] veth1_macvtap: entered promiscuous mode [ 518.228899][ T8332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 518.283492][ T8332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 518.353615][ T341] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.389277][ T341] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.433504][ T341] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.493862][ T341] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.551014][ T8307] veth0_vlan: entered promiscuous mode [ 518.748215][ T8307] veth1_vlan: entered promiscuous mode [ 518.822774][ T8566] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.830131][ T8566] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.837783][ T8566] bridge_slave_0: entered allmulticast mode [ 518.845973][ T8566] bridge_slave_0: entered promiscuous mode [ 518.863301][ T8566] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.872480][ T8566] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.879952][ T8566] bridge_slave_1: entered allmulticast mode [ 518.888997][ T8566] bridge_slave_1: entered promiscuous mode [ 518.902863][ T5954] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 518.922281][ T5954] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 518.934573][ T5636] Bluetooth: hci2: command tx timeout [ 519.008037][ T8566] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 519.045150][ T8566] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 519.099550][ T341] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 519.104286][ T8566] team0: Port device team_slave_0 added [ 519.123936][ T341] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 519.134428][ T8566] team0: Port device team_slave_1 added [ 519.238417][ T8566] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 519.254711][ T8566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.355648][ T8566] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 519.393945][ T8566] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 519.415802][ T8566] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.456030][ T8662] loop1: detected capacity change from 0 to 512 [ 519.484336][ T8662] journal_path: Non-blockdev passed as './file1' [ 519.502025][ T8566] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 520.318657][ T8662] EXT4-fs: error: could not find journal device path [ 521.205150][ T5636] Bluetooth: hci2: command tx timeout [ 522.912473][ T8307] veth0_macvtap: entered promiscuous mode [ 522.924503][ T8307] veth1_macvtap: entered promiscuous mode [ 523.255276][ T5636] Bluetooth: hci2: command tx timeout [ 523.307250][ T8566] hsr_slave_0: entered promiscuous mode [ 523.329280][ T8566] hsr_slave_1: entered promiscuous mode [ 523.336543][ T8566] debugfs: 'hsr0' already exists in 'hsr' [ 523.343300][ T8566] Cannot create hsr debugfs directory [ 523.489424][ T8680] loop0: detected capacity change from 0 to 1024 [ 524.949679][ T8307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 525.205675][ T8695] netdevsim netdevsim6: loading /lib/firmware/. failed with error -22 [ 525.216878][ T8695] netdevsim netdevsim6: Direct firmware load for . failed with error -22 [ 525.225684][ T8695] netdevsim netdevsim6: Falling back to sysfs fallback for: . [ 526.243765][ T8307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 527.534751][ T36] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.575787][ T36] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.666629][ T36] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.707414][ T341] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.268702][ T8725] loop8: detected capacity change from 0 to 1024 [ 529.443566][ T341] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.453489][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.637164][ T8729] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 529.687781][ T8729] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 530.399723][ T341] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.407409][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.244087][ T8737] hfsplus: xattr search failed [ 532.250799][ T8737] hfsplus: unable to mark blocks free: error -4 [ 532.257364][ T8737] hfsplus: can't free extent: start 264, count 1 [ 534.565875][ T8754] loop1: detected capacity change from 0 to 16 [ 537.522833][ T8767] loop4: detected capacity change from 0 to 1024 [ 541.218800][ T8772] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 542.242378][ T8789] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 542.379419][ T8789] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 542.388531][ T8789] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 549.989012][ T8840] overlayfs: missing 'workdir' [ 551.095713][ T8848] evm: overlay not supported [ 551.952121][ T8566] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 552.036137][ T8566] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 552.076986][ T8566] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 552.120798][ T8566] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 552.162447][ T8566] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 553.268267][ T8566] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 553.348496][ T8566] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 553.425072][ T8566] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 553.629124][ T8862] netlink: 'syz.8.467': attribute type 2 has an invalid length. [ 553.637102][ T8862] netlink: 'syz.8.467': attribute type 1 has an invalid length. [ 554.709504][ T8566] 8021q: adding VLAN 0 to HW filter on device bond0 [ 554.756242][ T8566] 8021q: adding VLAN 0 to HW filter on device team0 [ 554.885464][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 554.892716][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 555.084280][ T8876] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 555.598291][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.605524][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.335773][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.342614][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 567.195764][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 567.222515][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 567.246114][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 567.292704][ T5631] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 567.591628][ T5631] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 567.626516][ T8949] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 570.175324][ T5636] Bluetooth: hci3: command tx timeout [ 572.214986][ T5636] Bluetooth: hci3: command tx timeout [ 572.616610][ T8968] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 572.627222][ T8968] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 572.636063][ T8968] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 574.457965][ T5636] Bluetooth: hci3: command tx timeout [ 575.564236][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.187850][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.540393][ T5636] Bluetooth: hci3: command tx timeout [ 576.592243][ T8996] loop8: detected capacity change from 0 to 512 [ 577.384353][ T8996] EXT4-fs: Ignoring removed orlov option [ 577.419003][ T8996] EXT4-fs (loop8): Test dummy encryption mode enabled [ 577.459332][ T8996] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 577.614242][ T8996] EXT4-fs (loop8): 1 truncate cleaned up [ 577.634180][ T8996] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 578.013387][ T9007] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 579.635200][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.879222][ T5631] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 579.905274][ T5631] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 579.919294][ T5631] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 579.929785][ T5631] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 579.938438][ T5631] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 580.181748][ T6468] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 580.361298][ T9020] overlayfs: missing 'workdir' [ 580.992619][ T9024] loop0: detected capacity change from 0 to 128 [ 581.023144][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.240814][ T9024] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 582.054827][ T5631] Bluetooth: hci4: command tx timeout [ 583.572046][ T13] bridge_slave_1: left allmulticast mode [ 583.587198][ T13] bridge_slave_1: left promiscuous mode [ 583.610740][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.762273][ T13] bridge_slave_0: left allmulticast mode [ 583.789965][ T13] bridge_slave_0: left promiscuous mode [ 583.812642][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.136892][ T5631] Bluetooth: hci4: command tx timeout [ 584.264036][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 584.286002][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 584.296857][ T13] bond0 (unregistering): Released all slaves [ 585.130361][ T8929] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.158775][ T8929] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.175465][ T8929] bridge_slave_0: entered allmulticast mode [ 585.210138][ T8929] bridge_slave_0: entered promiscuous mode [ 585.292970][ T13] hsr_slave_0: left promiscuous mode [ 585.326009][ T13] hsr_slave_1: left promiscuous mode [ 585.340353][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 585.384078][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 585.410021][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 585.434764][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 585.488044][ T13] veth1_macvtap: left promiscuous mode [ 585.511309][ T13] veth0_macvtap: left promiscuous mode [ 585.520342][ T13] veth1_vlan: left promiscuous mode [ 585.534670][ T13] veth0_vlan: left promiscuous mode [ 586.220631][ T5631] Bluetooth: hci4: command tx timeout [ 586.534040][ T13] team0 (unregistering): Port device team_slave_1 removed [ 586.589986][ T13] team0 (unregistering): Port device team_slave_0 removed [ 586.886512][ T8929] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.893994][ T8929] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.908652][ T8929] bridge_slave_1: entered allmulticast mode [ 586.920830][ T8929] bridge_slave_1: entered promiscuous mode [ 587.047502][ T8929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 587.081469][ T8929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 587.250897][ T8929] team0: Port device team_slave_0 added [ 587.308953][ T8929] team0: Port device team_slave_1 added [ 587.372106][ T8929] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 587.385546][ T8929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.423782][ T8929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 587.480302][ T8929] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 587.487686][ T8929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.532222][ T8929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 587.727989][ T8929] hsr_slave_0: entered promiscuous mode [ 587.737620][ T8929] hsr_slave_1: entered promiscuous mode [ 587.744421][ T8929] debugfs: 'hsr0' already exists in 'hsr' [ 587.752075][ T8929] Cannot create hsr debugfs directory [ 587.841466][ T9013] bridge0: port 1(bridge_slave_0) entered blocking state [ 587.850623][ T9013] bridge0: port 1(bridge_slave_0) entered disabled state [ 587.860287][ T9013] bridge_slave_0: entered allmulticast mode [ 587.868866][ T9013] bridge_slave_0: entered promiscuous mode [ 587.879746][ T9013] bridge0: port 2(bridge_slave_1) entered blocking state [ 587.887132][ T9013] bridge0: port 2(bridge_slave_1) entered disabled state [ 587.894431][ T9013] bridge_slave_1: entered allmulticast mode [ 587.910172][ T9013] bridge_slave_1: entered promiscuous mode [ 588.035655][ T9013] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 588.054033][ T9013] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 588.162481][ T9013] team0: Port device team_slave_0 added [ 588.172157][ T9013] team0: Port device team_slave_1 added [ 588.294711][ T5631] Bluetooth: hci4: command tx timeout [ 588.319460][ T9013] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 588.328158][ T9013] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.356270][ T9013] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 588.406230][ T9013] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 588.413947][ T9013] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.447753][ T9013] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 588.809716][ T9013] hsr_slave_0: entered promiscuous mode [ 588.817981][ T9013] hsr_slave_1: entered promiscuous mode [ 588.829654][ T9013] debugfs: 'hsr0' already exists in 'hsr' [ 588.836573][ T9013] Cannot create hsr debugfs directory [ 589.193286][ T13] bridge_slave_1: left allmulticast mode [ 589.199287][ T13] bridge_slave_1: left promiscuous mode [ 589.207059][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.217538][ T13] bridge_slave_0: left allmulticast mode [ 589.223222][ T13] bridge_slave_0: left promiscuous mode [ 589.229487][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.401687][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 589.423543][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 589.433982][ T13] bond0 (unregistering): Released all slaves [ 589.713858][ T13] hsr_slave_0: left promiscuous mode [ 589.724936][ T13] hsr_slave_1: left promiscuous mode [ 589.731449][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 589.740558][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 589.956932][ T13] team0 (unregistering): Port device team_slave_1 removed [ 589.975975][ T13] team0 (unregistering): Port device team_slave_0 removed [ 590.468172][ T8929] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 590.491893][ T8929] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 590.505478][ T8929] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 590.520328][ T8929] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 590.528540][ T8929] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 590.540436][ T8929] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 590.549041][ T8929] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 590.561623][ T8929] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 590.762230][ T8929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 590.821406][ T8929] 8021q: adding VLAN 0 to HW filter on device team0 [ 590.838494][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.845683][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.896941][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.904182][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 591.268017][ T9013] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 591.293957][ T9013] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 591.306763][ T9013] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 591.323449][ T9013] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 591.340549][ T9013] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 591.352397][ T9013] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 591.368010][ T9013] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 591.406926][ T9013] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 591.662447][ T9013] 8021q: adding VLAN 0 to HW filter on device bond0 [ 591.703192][ T9013] 8021q: adding VLAN 0 to HW filter on device team0 [ 591.721697][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.728931][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 591.773096][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.780369][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 592.005848][ T8929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 592.139817][ T8929] veth0_vlan: entered promiscuous mode [ 592.162023][ T8929] veth1_vlan: entered promiscuous mode [ 592.198474][ T5281] 8021q: adding VLAN 0 to HW filter on device eth21 [ 592.248911][ T8929] veth0_macvtap: entered promiscuous mode [ 592.272396][ T8929] veth1_macvtap: entered promiscuous mode [ 592.312475][ T8929] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 592.331422][ T8929] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 592.357152][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.367492][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.383589][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.396487][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.602884][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.639792][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.680768][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.689439][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 594.699251][ T9013] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.164424][ T9198] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 595.178558][ T9198] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 595.602593][ T9199] loop2: detected capacity change from 0 to 1024 [ 595.802047][ T30] audit: type=1326 audit(1785171459.756:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.501" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efdf939de99 code=0x0 [ 600.496869][ T9230] netlink: 20 bytes leftover after parsing attributes in process `syz.0.506'. [ 604.250966][ T5281] 8021q: adding VLAN 0 to HW filter on device eth22 [ 605.000146][ T30] audit: type=1804 audit(1785171468.906:10): pid=9259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.516" name="bus" dev="ramfs" ino=26460 res=1 errno=0 [ 605.392364][ T30] audit: type=1804 audit(1785171468.936:11): pid=9259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.516" name="bus" dev="ramfs" ino=26460 res=1 errno=0 [ 606.072737][ T9262] loop1: detected capacity change from 0 to 16 [ 606.144814][ T9262] erofs (device loop1): mounted with root inode @ nid 36. [ 606.886964][ T9260] netlink: 8 bytes leftover after parsing attributes in process `syz.8.515'. [ 611.142861][ T9286] loop1: detected capacity change from 0 to 256 [ 611.434920][ T9013] veth0_vlan: entered promiscuous mode [ 611.572375][ T9294] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 612.352380][ T9013] veth1_vlan: entered promiscuous mode [ 612.965204][ T9013] veth0_macvtap: entered promiscuous mode [ 612.998118][ T9013] veth1_macvtap: entered promiscuous mode [ 613.055579][ T9013] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 613.119056][ T9013] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 613.353297][ T57] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.911552][ T9286] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x5d6de3ec, utbl_chksum : 0xe619d30d) [ 613.938990][ T36] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.980737][ T36] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.031735][ T36] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.164557][ T9304] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 614.174289][ T9304] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 614.183026][ T9304] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 616.210238][ T5636] Bluetooth: hci7: command 0x0406 tx timeout [ 618.435616][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.534284][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 619.051322][ T6048] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 619.120526][ T6048] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 620.280296][ T5636] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 620.308375][ T5636] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 620.320280][ T5636] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 620.382602][ T5636] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 620.445037][ T5636] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 620.785370][ T9346] random: crng reseeded on system resumption [ 621.813545][ T9336] 8021q: adding VLAN 0 to HW filter on device bond1 [ 622.195043][ T9355] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 623.268641][ T5636] Bluetooth: hci2: command tx timeout [ 623.737874][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.747618][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 623.812662][ T9340] bond1: (slave geneve2): Enslaving as a backup interface with an up link [ 623.926186][ T5954] net_ratelimit: 1990 callbacks suppressed [ 623.928941][ T5954] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 624.403434][ T5281] 8021q: adding VLAN 0 to HW filter on device eth23 [ 624.955000][ T7435] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 625.471867][ T5636] Bluetooth: hci2: command tx timeout [ 627.501139][ T5636] Bluetooth: hci2: command tx timeout [ 628.145399][ T9387] netdevsim netdevsim9: loading /lib/firmware/. failed with error -22 [ 628.155636][ T9387] netdevsim netdevsim9: Direct firmware load for . failed with error -22 [ 628.165344][ T9387] netdevsim netdevsim9: Falling back to sysfs fallback for: . [ 629.581057][ T5636] Bluetooth: hci2: command tx timeout [ 630.459297][ T30] audit: type=1804 audit(1785171494.416:12): pid=9400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.545" name="bus" dev="ramfs" ino=27751 res=1 errno=0 [ 630.621687][ T30] audit: type=1804 audit(1785171494.446:13): pid=9400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.545" name="bus" dev="ramfs" ino=27751 res=1 errno=0 [ 632.486229][ T9402] loop1: detected capacity change from 0 to 2048 [ 633.080353][ T57] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.349538][ T9402] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 637.518012][ T9434] loop9: detected capacity change from 0 to 3 [ 638.029998][ T9434] syz.9.551: attempt to access beyond end of device [ 638.029998][ T9434] loop9: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 638.094117][ T57] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.512710][ T9434] SQUASHFS error: Failed to read block 0x0: -5 [ 638.739590][ T9434] unable to read squashfs_super_block [ 639.502423][ T57] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.987946][ T9452] 8021q: adding VLAN 0 to HW filter on device bond1 [ 640.257688][ T9453] 8021q: adding VLAN 0 to HW filter on device bond1 [ 640.369725][ T9454] bond1: (slave geneve2): Enslaving as a backup interface with an up link [ 640.425760][ T96] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 640.669472][ T96] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 641.881288][ T57] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.835135][ T5281] 8021q: adding VLAN 0 to HW filter on device eth24 [ 644.893889][ T9464] bond1: option mode: unable to set because the bond device has slaves [ 644.919787][ T9476] loop8: detected capacity change from 0 to 2048 [ 645.570621][ T9476] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 647.613787][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 647.728674][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 647.735994][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 647.746148][ T9492] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 647.760547][ T9492] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 647.777727][ T9492] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 647.801478][ T9492] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 648.172080][ T9499] openvswitch: netlink: IP tunnel dst address not specified [ 648.886619][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.895224][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.902903][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.910725][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.918487][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.926238][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 648.936184][ T9492] wlan0 speed is unknown, defaulting to 1000 [ 651.439474][ T9514] loop0: detected capacity change from 0 to 3 [ 651.481821][ T9514] syz.0.568: attempt to access beyond end of device [ 651.481821][ T9514] loop0: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 651.575350][ T9515] loop9: detected capacity change from 0 to 1024 [ 651.601556][ T9514] SQUASHFS error: Failed to read block 0x0: -5 [ 651.655023][ T9514] unable to read squashfs_super_block [ 652.418248][ T9506] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 652.972701][ T9526] 8021q: adding VLAN 0 to HW filter on device bond1 [ 653.092257][ T9532] F2FS-fs (loop8): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 653.199806][ T9532] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 653.212716][ T9532] F2FS-fs (loop8): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 653.223248][ T9532] F2FS-fs (loop8): Can't find valid F2FS filesystem in 2th superblock [ 653.790640][ T30] audit: type=1804 audit(1785171517.746:14): pid=9537 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.9.574" name="bus" dev="ramfs" ino=28020 res=1 errno=0 [ 653.901519][ T6048] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 653.966676][ T30] audit: type=1804 audit(1785171517.796:15): pid=9537 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.9.574" name="bus" dev="ramfs" ino=28020 res=1 errno=0 [ 654.071555][ T9527] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 654.795438][ T6048] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 655.273698][ T9539] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 655.412573][ T9541] loop0: detected capacity change from 0 to 40427 [ 655.432335][ T9541] F2FS-fs (loop0): invalid crc value [ 655.548996][ T57] bridge_slave_1: left allmulticast mode [ 655.583965][ T57] bridge_slave_1: left promiscuous mode [ 655.592720][ T9541] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 655.609698][ T9541] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 655.617422][ T9541] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 655.628307][ T9541] F2FS-fs (loop0): Start checkpoint disabled! [ 655.647644][ T9541] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 655.662730][ T9541] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 655.705543][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.297912][ T57] bridge_slave_0: left allmulticast mode [ 656.312911][ T57] bridge_slave_0: left promiscuous mode [ 656.329995][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.782630][ T6048] kworker/u8:16: attempt to access beyond end of device [ 656.782630][ T6048] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 656.851394][ T6048] CPU: 1 UID: 0 PID: 6048 Comm: kworker/u8:16 Tainted: G L syzkaller #0 PREEMPT(full) [ 656.851457][ T6048] Tainted: [L]=SOFTLOCKUP [ 656.851466][ T6048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 656.851485][ T6048] Workqueue: writeback wb_workfn (flush-7:0) [ 656.851534][ T6048] Call Trace: [ 656.851543][ T6048] [ 656.851553][ T6048] dump_stack_lvl+0x100/0x190 [ 656.851588][ T6048] f2fs_stop_checkpoint+0x5e6/0xb30 [ 656.851634][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.851669][ T6048] ? errseq_set+0xe3/0x150 [ 656.851712][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.851752][ T6048] f2fs_write_end_bio+0xf53/0x1340 [ 656.851786][ T6048] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 656.851821][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.851864][ T6048] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 656.851894][ T6048] bio_endio+0x778/0x8e0 [ 656.851931][ T6048] submit_bio_noacct+0x64c/0x1ff0 [ 656.851989][ T6048] f2fs_submit_write_bio+0x133/0x330 [ 656.852036][ T6048] __submit_merged_bio+0x330/0x7b0 [ 656.852065][ T6048] ? rcu_is_watching+0x12/0xc0 [ 656.852111][ T6048] __submit_merged_write_cond+0x3fe/0x510 [ 656.852150][ T6048] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 656.852190][ T6048] ? __pfx___might_resched+0x10/0x10 [ 656.852221][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852254][ T6048] ? folio_clear_dirty_for_io+0x178/0x960 [ 656.852306][ T6048] f2fs_write_cache_pages+0x20e9/0x2630 [ 656.852380][ T6048] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 656.852426][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852460][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852494][ T6048] ? find_held_lock+0x2b/0x80 [ 656.852535][ T6048] ? nr_blockdev_pages+0xde/0x120 [ 656.852576][ T6048] ? nr_blockdev_pages+0xde/0x120 [ 656.852616][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852667][ T6048] ? si_meminfo+0x118/0x230 [ 656.852699][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852733][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852823][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852856][ T6048] ? __lock_acquire+0x49f/0x1a40 [ 656.852890][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.852923][ T6048] ? rcu_is_watching+0x12/0xc0 [ 656.852969][ T6048] f2fs_write_data_pages+0x799/0x16d0 [ 656.853005][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853050][ T6048] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 656.853101][ T6048] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 656.853141][ T6048] do_writepages+0x278/0x600 [ 656.853191][ T6048] ? __pfx_do_writepages+0x10/0x10 [ 656.853239][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853278][ T6048] __writeback_single_inode+0x164/0x1300 [ 656.853316][ T6048] ? find_held_lock+0x2b/0x80 [ 656.853359][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853399][ T6048] ? __pfx___writeback_single_inode+0x10/0x10 [ 656.853437][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853470][ T6048] ? do_raw_spin_unlock+0x145/0x1e0 [ 656.853510][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853550][ T6048] writeback_sb_inodes+0x766/0x1c50 [ 656.853608][ T6048] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 656.853644][ T6048] ? do_raw_spin_lock+0x128/0x260 [ 656.853683][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853769][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853803][ T6048] ? rcu_is_watching+0x12/0xc0 [ 656.853842][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.853876][ T6048] ? queue_io+0x287/0x530 [ 656.853911][ T6048] wb_writeback+0x1c0/0xb50 [ 656.853960][ T6048] ? __pfx_wb_writeback+0x10/0x10 [ 656.854008][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854041][ T6048] ? mark_held_locks+0x40/0x70 [ 656.854072][ T6048] ? _raw_spin_unlock_irq+0x23/0x50 [ 656.854108][ T6048] wb_workfn+0x143/0xc80 [ 656.854150][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854183][ T6048] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 656.854216][ T6048] ? __pfx_wb_workfn+0x10/0x10 [ 656.854257][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854295][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854332][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854365][ T6048] ? rcu_is_watching+0x12/0xc0 [ 656.854416][ T6048] process_one_work+0xa23/0x1940 [ 656.854465][ T6048] ? __pfx_process_one_work+0x10/0x10 [ 656.854501][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854563][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.854619][ T6048] worker_thread+0x5ef/0xe50 [ 656.854676][ T6048] ? __pfx_worker_thread+0x10/0x10 [ 656.854720][ T6048] ? kthread+0x13a/0x450 [ 656.854779][ T6048] ? __pfx_worker_thread+0x10/0x10 [ 656.854816][ T6048] kthread+0x370/0x450 [ 656.854877][ T6048] ? __pfx_kthread+0x10/0x10 [ 656.854945][ T6048] ret_from_fork+0x72b/0xd50 [ 656.855002][ T6048] ? __pfx_ret_from_fork+0x10/0x10 [ 656.855056][ T6048] ? srso_alias_return_thunk+0x5/0xfbef5 [ 656.855104][ T6048] ? __switch_to+0x800/0x10f0 [ 656.855167][ T6048] ? __switch_to_asm+0x39/0x70 [ 656.855262][ T6048] ? __pfx_kthread+0x10/0x10 [ 656.855331][ T6048] ret_from_fork_asm+0x1a/0x30 [ 656.855426][ T6048] [ 659.591748][ T6048] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 661.408268][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 661.457972][ T5631] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 661.481219][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 661.500227][ T5631] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 661.519925][ T5631] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 661.549497][ T57] bond0 (unregistering): Released all slaves [ 661.558748][ T5631] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 661.571191][ T5631] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 661.704428][ T9556] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 662.371815][ T9591] openvswitch: netlink: IP tunnel dst address not specified [ 662.988436][ T9588] loop8: detected capacity change from 0 to 40427 [ 663.040433][ T9588] F2FS-fs (loop8): invalid crc value [ 663.132484][ T9588] F2FS-fs (loop8): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 663.149688][ T9588] F2FS-fs (loop8): f2fs_disable_checkpoint starts, unusable: 0 [ 663.157385][ T9588] F2FS-fs (loop8): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 663.170052][ T9588] F2FS-fs (loop8): Start checkpoint disabled! [ 663.274636][ T9588] F2FS-fs (loop8): f2fs_disable_checkpoint finishes, err:0 [ 663.299415][ T9588] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e6 [ 663.710031][ T5636] Bluetooth: hci0: command tx timeout [ 665.350252][ T13] kworker/u8:1: attempt to access beyond end of device [ 665.350252][ T13] loop8: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 665.433408][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 665.433466][ T13] Tainted: [L]=SOFTLOCKUP [ 665.433478][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 665.433504][ T13] Workqueue: writeback wb_workfn (flush-7:8) [ 665.433567][ T13] Call Trace: [ 665.433579][ T13] [ 665.433593][ T13] dump_stack_lvl+0x100/0x190 [ 665.433639][ T13] f2fs_stop_checkpoint+0x5e6/0xb30 [ 665.433700][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.433746][ T13] ? errseq_set+0xe3/0x150 [ 665.433810][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.433862][ T13] f2fs_write_end_bio+0xf53/0x1340 [ 665.433908][ T13] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 665.433955][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.434011][ T13] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 665.434051][ T13] bio_endio+0x778/0x8e0 [ 665.434101][ T13] submit_bio_noacct+0x64c/0x1ff0 [ 665.434172][ T13] f2fs_submit_write_bio+0x133/0x330 [ 665.434236][ T13] __submit_merged_bio+0x330/0x7b0 [ 665.434275][ T13] ? rcu_is_watching+0x12/0xc0 [ 665.434336][ T13] __submit_merged_write_cond+0x3fe/0x510 [ 665.434391][ T13] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 665.434443][ T13] ? __pfx___might_resched+0x10/0x10 [ 665.434482][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.434524][ T13] ? folio_clear_dirty_for_io+0x178/0x960 [ 665.434593][ T13] f2fs_write_cache_pages+0x20e9/0x2630 [ 665.434667][ T13] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 665.434726][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.434779][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.434824][ T13] ? find_held_lock+0x2b/0x80 [ 665.434880][ T13] ? nr_blockdev_pages+0xde/0x120 [ 665.434939][ T13] ? nr_blockdev_pages+0xde/0x120 [ 665.434993][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435062][ T13] ? si_meminfo+0x118/0x230 [ 665.435107][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435154][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435266][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435311][ T13] ? __lock_acquire+0x49f/0x1a40 [ 665.435355][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435403][ T13] ? rcu_is_watching+0x12/0xc0 [ 665.435465][ T13] f2fs_write_data_pages+0x799/0x16d0 [ 665.435512][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435569][ T13] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 665.435633][ T13] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 665.435683][ T13] do_writepages+0x278/0x600 [ 665.435747][ T13] ? __pfx_do_writepages+0x10/0x10 [ 665.435816][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.435867][ T13] __writeback_single_inode+0x164/0x1300 [ 665.435918][ T13] ? find_held_lock+0x2b/0x80 [ 665.435975][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436023][ T13] ? __pfx___writeback_single_inode+0x10/0x10 [ 665.436073][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436116][ T13] ? do_raw_spin_unlock+0x145/0x1e0 [ 665.436166][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436216][ T13] writeback_sb_inodes+0x766/0x1c50 [ 665.436286][ T13] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 665.436333][ T13] ? do_raw_spin_lock+0x128/0x260 [ 665.436381][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436484][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436528][ T13] ? rcu_is_watching+0x12/0xc0 [ 665.436579][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436622][ T13] ? queue_io+0x287/0x530 [ 665.436666][ T13] wb_writeback+0x1c0/0xb50 [ 665.436727][ T13] ? __pfx_wb_writeback+0x10/0x10 [ 665.436795][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.436839][ T13] ? mark_held_locks+0x40/0x70 [ 665.436878][ T13] ? _raw_spin_unlock_irq+0x23/0x50 [ 665.436924][ T13] wb_workfn+0x143/0xc80 [ 665.436976][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437020][ T13] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 665.437070][ T13] ? __pfx_wb_workfn+0x10/0x10 [ 665.437124][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437172][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437220][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437265][ T13] ? rcu_is_watching+0x12/0xc0 [ 665.437324][ T13] process_one_work+0xa23/0x1940 [ 665.437382][ T13] ? __pfx_process_one_work+0x10/0x10 [ 665.437416][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437477][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437528][ T13] worker_thread+0x5ef/0xe50 [ 665.437583][ T13] ? kthread+0x13a/0x450 [ 665.437637][ T13] ? __pfx_worker_thread+0x10/0x10 [ 665.437669][ T13] kthread+0x370/0x450 [ 665.437726][ T13] ? __pfx_kthread+0x10/0x10 [ 665.437795][ T13] ret_from_fork+0x72b/0xd50 [ 665.437848][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 665.437900][ T13] ? srso_alias_return_thunk+0x5/0xfbef5 [ 665.437944][ T13] ? __switch_to+0x800/0x10f0 [ 665.438002][ T13] ? __switch_to_asm+0x39/0x70 [ 665.438054][ T13] ? __pfx_kthread+0x10/0x10 [ 665.438116][ T13] ret_from_fork_asm+0x1a/0x30 [ 665.438192][ T13] [ 665.951768][ T5636] Bluetooth: hci0: command tx timeout [ 665.977023][ T13] F2FS-fs (loop8): Stopped filesystem due to reason: 3 [ 665.978443][ T9615] bond1: option mode: unable to set because the bond device has slaves [ 666.327203][ T9628] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 666.422581][ T9628] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 666.733777][ T9331] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.792522][ T9331] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.602455][ T9331] bridge_slave_0: entered allmulticast mode [ 667.648580][ T9331] bridge_slave_0: entered promiscuous mode [ 667.677866][ T9331] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.701712][ T9331] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.728176][ T9331] bridge_slave_1: entered allmulticast mode [ 667.806972][ T9331] bridge_slave_1: entered promiscuous mode [ 667.853474][ T9638] bond1: option mode: unable to set because the bond device is up [ 667.984768][ T5636] Bluetooth: hci0: command tx timeout [ 669.843708][ T57] hsr_slave_0: left promiscuous mode [ 669.916181][ T57] hsr_slave_1: left promiscuous mode [ 669.968769][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 670.003576][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 670.084666][ T5636] Bluetooth: hci0: command tx timeout [ 670.268312][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 670.306156][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 671.558691][ T57] veth1_macvtap: left promiscuous mode [ 671.915669][ T57] veth0_macvtap: left promiscuous mode [ 671.933225][ T57] veth1_vlan: left promiscuous mode [ 671.949881][ T57] veth0_vlan: left promiscuous mode [ 672.372395][ T9676] loop0: detected capacity change from 0 to 40427 [ 672.382587][ T9676] F2FS-fs (loop0): invalid crc value [ 672.470502][ T9676] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 672.488856][ T9676] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 672.497608][ T9676] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 672.508520][ T9676] F2FS-fs (loop0): Start checkpoint disabled! [ 672.529909][ T9676] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 672.539801][ T9668] overlayfs: missing 'workdir' [ 672.551842][ T9676] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 673.368793][ T1026] kworker/u8:8: attempt to access beyond end of device [ 673.368793][ T1026] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 673.465390][ T1026] CPU: 0 UID: 0 PID: 1026 Comm: kworker/u8:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 673.465453][ T1026] Tainted: [L]=SOFTLOCKUP [ 673.465466][ T1026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 673.465492][ T1026] Workqueue: writeback wb_workfn (flush-7:0) [ 673.465557][ T1026] Call Trace: [ 673.465569][ T1026] [ 673.465583][ T1026] dump_stack_lvl+0x100/0x190 [ 673.465630][ T1026] f2fs_stop_checkpoint+0x5e6/0xb30 [ 673.465694][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.465738][ T1026] ? errseq_set+0xe3/0x150 [ 673.465797][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.465851][ T1026] f2fs_write_end_bio+0xf53/0x1340 [ 673.465897][ T1026] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 673.465951][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.466008][ T1026] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 673.466048][ T1026] bio_endio+0x778/0x8e0 [ 673.466096][ T1026] submit_bio_noacct+0x64c/0x1ff0 [ 673.466175][ T1026] f2fs_submit_write_bio+0x133/0x330 [ 673.466239][ T1026] __submit_merged_bio+0x330/0x7b0 [ 673.466278][ T1026] ? rcu_is_watching+0x12/0xc0 [ 673.466353][ T1026] __submit_merged_write_cond+0x3fe/0x510 [ 673.466405][ T1026] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 673.466460][ T1026] ? __pfx___might_resched+0x10/0x10 [ 673.466501][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.466547][ T1026] ? folio_clear_dirty_for_io+0x178/0x960 [ 673.466623][ T1026] f2fs_write_cache_pages+0x20e9/0x2630 [ 673.466699][ T1026] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 673.466773][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.466815][ T1026] ? __lock_acquire+0x49f/0x1a40 [ 673.466879][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.466947][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467036][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467083][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467126][ T1026] ? rcu_is_watching+0x12/0xc0 [ 673.467188][ T1026] f2fs_write_data_pages+0x799/0x16d0 [ 673.467239][ T1026] ? __lock_acquire+0x49f/0x1a40 [ 673.467303][ T1026] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 673.467370][ T1026] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 673.467424][ T1026] do_writepages+0x278/0x600 [ 673.467494][ T1026] ? __pfx_do_writepages+0x10/0x10 [ 673.467557][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467610][ T1026] __writeback_single_inode+0x164/0x1300 [ 673.467661][ T1026] ? find_held_lock+0x2b/0x80 [ 673.467721][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467770][ T1026] ? __pfx___writeback_single_inode+0x10/0x10 [ 673.467820][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467865][ T1026] ? do_raw_spin_unlock+0x145/0x1e0 [ 673.467917][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.467967][ T1026] writeback_sb_inodes+0x766/0x1c50 [ 673.468041][ T1026] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 673.468092][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468212][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468256][ T1026] ? rcu_is_watching+0x12/0xc0 [ 673.468320][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468366][ T1026] ? queue_io+0x287/0x530 [ 673.468412][ T1026] wb_writeback+0x1c0/0xb50 [ 673.468473][ T1026] ? __pfx_wb_writeback+0x10/0x10 [ 673.468536][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468579][ T1026] ? mark_held_locks+0x40/0x70 [ 673.468620][ T1026] ? _raw_spin_unlock_irq+0x23/0x50 [ 673.468666][ T1026] wb_workfn+0x143/0xc80 [ 673.468721][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468764][ T1026] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 673.468807][ T1026] ? __pfx_wb_workfn+0x10/0x10 [ 673.468862][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468907][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468953][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.468995][ T1026] ? rcu_is_watching+0x12/0xc0 [ 673.469057][ T1026] process_one_work+0xa23/0x1940 [ 673.469120][ T1026] ? __pfx_process_one_work+0x10/0x10 [ 673.469154][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.469216][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.469268][ T1026] worker_thread+0x5ef/0xe50 [ 673.469333][ T1026] ? __pfx_worker_thread+0x10/0x10 [ 673.469371][ T1026] ? kthread+0x13a/0x450 [ 673.469423][ T1026] ? __pfx_worker_thread+0x10/0x10 [ 673.469456][ T1026] kthread+0x370/0x450 [ 673.469510][ T1026] ? __pfx_kthread+0x10/0x10 [ 673.469570][ T1026] ret_from_fork+0x72b/0xd50 [ 673.469622][ T1026] ? __pfx_ret_from_fork+0x10/0x10 [ 673.469672][ T1026] ? srso_alias_return_thunk+0x5/0xfbef5 [ 673.469715][ T1026] ? __switch_to+0x800/0x10f0 [ 673.469774][ T1026] ? __switch_to_asm+0x39/0x70 [ 673.469825][ T1026] ? __pfx_kthread+0x10/0x10 [ 673.469887][ T1026] ret_from_fork_asm+0x1a/0x30 [ 673.469965][ T1026] [ 673.968317][ T1026] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 674.336267][ T9696] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 674.349036][ T9696] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 675.010397][ T30] audit: type=1804 audit(1785171538.966:16): pid=9693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.602" name="bus" dev="ramfs" ino=27232 res=1 errno=0 [ 675.120470][ T30] audit: type=1804 audit(1785171539.006:17): pid=9693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.602" name="bus" dev="ramfs" ino=27232 res=1 errno=0 [ 676.070957][ T9704] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 677.624894][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 677.722045][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 677.766918][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 677.842389][ T5631] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 677.845707][ T57] team0 (unregistering): Port device team_slave_1 removed [ 677.891919][ T5631] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 678.065409][ T57] team0 (unregistering): Port device team_slave_0 removed [ 680.102925][ T5636] Bluetooth: hci3: command tx timeout [ 680.449851][ T9684] bond1: option mode: unable to set because the bond device is up [ 680.591644][ T9688] bond1: (slave geneve2): Enslaving as a backup interface with an up link [ 680.622030][ T5862] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 680.753144][ T9723] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 680.765544][ T9723] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 680.920136][ T7435] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 681.335696][ T9577] wlan0 speed is unknown, defaulting to 1000 [ 683.094569][ T5636] Bluetooth: hci3: command tx timeout [ 685.176924][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.210374][ T5636] Bluetooth: hci3: command tx timeout [ 685.221386][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.738374][ T9747] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 685.750784][ T9747] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 687.274310][ T5636] Bluetooth: hci3: command tx timeout [ 687.737225][ T30] audit: type=1800 audit(1785171551.416:18): pid=9764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.615" name="host_addr" dev="configfs" ino=28401 res=0 errno=0 [ 691.338513][ T5931] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.728061][ T9791] overlayfs: missing 'workdir' [ 693.745987][ T5931] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 694.114426][ T9709] wlan0 speed is unknown, defaulting to 1000 [ 694.432106][ T9807] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 695.549841][ T5931] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.819886][ T9821] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 696.829001][ T9824] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 697.184132][ T5931] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.431774][ T5631] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 697.446392][ T5631] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 697.457334][ T5631] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 697.473579][ T5631] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 697.495477][ T5631] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 699.068481][ T9577] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.081115][ T9577] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.100310][ T9577] bridge_slave_0: entered allmulticast mode [ 699.201011][ T9577] bridge_slave_0: entered promiscuous mode [ 699.403646][ T9577] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.418031][ T9577] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.468064][ T9577] bridge_slave_1: entered allmulticast mode [ 699.486980][ T9577] bridge_slave_1: entered promiscuous mode [ 699.575813][ T5631] Bluetooth: hci2: command tx timeout [ 700.208641][ T9577] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 701.800035][ T5636] Bluetooth: hci2: command tx timeout [ 702.535127][ T9577] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 703.490103][ T9876] overlayfs: missing 'workdir' [ 703.814641][ T9866] Bluetooth: hci2: command tx timeout [ 703.821221][ T5628] Bluetooth: hci4: command 0x0406 tx timeout [ 703.960048][ T9577] team0: Port device team_slave_0 added [ 704.017406][ T9577] team0: Port device team_slave_1 added [ 704.148262][ T9882] loop8: detected capacity change from 0 to 2048 [ 704.478414][ T9882] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 705.867179][ T9886] EXT4-fs error (device loop8): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 705.920430][ T5631] Bluetooth: hci2: command tx timeout [ 706.300159][ T9577] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 706.384024][ T9577] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 706.481715][ T9577] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 706.509351][ T9577] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 706.529186][ T9577] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 706.582469][ T9897] EXT4-fs error (device loop8) in ext4_setattr:6172: error 28 [ 706.617562][ T9577] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 707.075945][ T6468] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 707.793830][ T5931] bridge_slave_1: left allmulticast mode [ 707.832696][ T5931] bridge_slave_1: left promiscuous mode [ 707.855488][ T5931] bridge0: port 2(bridge_slave_1) entered disabled state [ 707.879084][ T5931] bridge_slave_0: left allmulticast mode [ 707.896148][ T5931] bridge_slave_0: left promiscuous mode [ 707.902110][ T5931] bridge0: port 1(bridge_slave_0) entered disabled state [ 708.184300][ T5931] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 708.197326][ T5931] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 708.244374][ T5931] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 708.262717][ T5931] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 708.273978][ T5931] bond0 (unregistering): Released all slaves [ 708.290367][ T5931] bond1 (unregistering): Released all slaves [ 708.470388][ T9577] hsr_slave_0: entered promiscuous mode [ 708.480656][ T9577] hsr_slave_1: entered promiscuous mode [ 708.509715][ T9577] debugfs: 'hsr0' already exists in 'hsr' [ 708.541177][ T9577] Cannot create hsr debugfs directory [ 708.559037][ T9832] wlan0 speed is unknown, defaulting to 1000 [ 708.603319][ T9709] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.627280][ T9709] bridge0: port 1(bridge_slave_0) entered disabled state [ 708.638543][ T9709] bridge_slave_0: entered allmulticast mode [ 708.648319][ T9709] bridge_slave_0: entered promiscuous mode [ 708.664019][ T9709] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.672129][ T9709] bridge0: port 2(bridge_slave_1) entered disabled state [ 708.679996][ T9709] bridge_slave_1: entered allmulticast mode [ 708.691069][ T9709] bridge_slave_1: entered promiscuous mode [ 708.890334][ T9709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 708.969644][ T9709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 709.101443][ T9709] team0: Port device team_slave_0 added [ 709.135705][ T9709] team0: Port device team_slave_1 added [ 709.149758][ T5931] hsr_slave_0: left promiscuous mode [ 709.157801][ T5931] hsr_slave_1: left promiscuous mode [ 709.164267][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 709.173087][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 709.182191][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 709.191419][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 709.208705][ T5931] veth1_macvtap: left promiscuous mode [ 709.214304][ T5931] veth0_macvtap: left promiscuous mode [ 709.461047][ T5931] team0 (unregistering): Port device team_slave_1 removed [ 709.480287][ T5931] team0 (unregistering): Port device team_slave_0 removed [ 709.686511][ T9709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 709.693546][ T9709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 709.721213][ T9709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 709.753859][ T9709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 709.763299][ T9709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 709.811840][ T9709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 710.024696][ T9709] hsr_slave_0: entered promiscuous mode [ 710.031698][ T9709] hsr_slave_1: entered promiscuous mode [ 710.038760][ T9709] debugfs: 'hsr0' already exists in 'hsr' [ 710.044939][ T9709] Cannot create hsr debugfs directory [ 710.806101][ T5931] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.063149][ T5931] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.303287][ T5931] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.332965][ T9832] bridge0: port 1(bridge_slave_0) entered blocking state [ 711.345609][ T9832] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.376759][ T9832] bridge_slave_0: entered allmulticast mode [ 711.385423][ T9832] bridge_slave_0: entered promiscuous mode [ 711.401226][ T9832] bridge0: port 2(bridge_slave_1) entered blocking state [ 711.408843][ T9832] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.417328][ T9832] bridge_slave_1: entered allmulticast mode [ 711.425426][ T9832] bridge_slave_1: entered promiscuous mode [ 711.481770][ T5931] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.559233][ T9832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 711.625276][ T9832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 711.719901][ T9832] team0: Port device team_slave_0 added [ 711.773651][ T9832] team0: Port device team_slave_1 added [ 711.932718][ T9832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 711.955067][ T9832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 712.000059][ T9832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 712.014745][ T9577] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 712.031397][ T9577] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 712.048292][ T9832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 712.077680][ T9832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 712.104737][ T9832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 712.164175][ T9577] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 712.182028][ T9577] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 712.304838][ T5931] bridge_slave_1: left allmulticast mode [ 712.310741][ T5931] bridge_slave_1: left promiscuous mode [ 712.318650][ T5931] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.329969][ T5931] bridge_slave_0: left allmulticast mode [ 712.336049][ T5931] bridge_slave_0: left promiscuous mode [ 712.342468][ T5931] bridge0: port 1(bridge_slave_0) entered disabled state [ 712.362715][ T5931] bridge_slave_1: left allmulticast mode [ 712.369418][ T5931] bridge_slave_1: left promiscuous mode [ 712.376032][ T5931] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.386178][ T5931] bridge_slave_0: left allmulticast mode [ 712.391887][ T5931] bridge_slave_0: left promiscuous mode [ 712.398754][ T5931] bridge0: port 1(bridge_slave_0) entered disabled state [ 712.589977][ T5931] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 712.598985][ T5931] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 712.637153][ T5931] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 712.656277][ T5931] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 712.667418][ T5931] bond0 (unregistering): Released all slaves [ 712.680611][ T5931] bond1 (unregistering): Released all slaves [ 712.764388][ T5931] bond0 (unregistering): Released all slaves [ 712.778231][ T9577] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 712.790529][ T9577] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 712.801149][ T9577] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 712.814278][ T9577] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 713.225220][ T9832] hsr_slave_0: entered promiscuous mode [ 713.232133][ T9832] hsr_slave_1: entered promiscuous mode [ 713.238958][ T9832] debugfs: 'hsr0' already exists in 'hsr' [ 713.245273][ T9832] Cannot create hsr debugfs directory [ 713.632423][ T5931] hsr_slave_0: left promiscuous mode [ 713.640083][ T5931] hsr_slave_1: left promiscuous mode [ 713.646999][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 713.655916][ T5931] batadv0: mtu less than device minimum [ 713.670041][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.683493][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.695671][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.707414][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.719189][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.731130][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.743075][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.755324][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.767224][ T5931] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 713.792888][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 713.801161][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 713.833423][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 713.842142][ T5931] batman_adv: batadv0: Interface deactivated: dummy0 [ 713.849083][ T5931] batman_adv: batadv0: Removing interface: dummy0 [ 713.860525][ T5931] veth1_macvtap: left promiscuous mode [ 713.866181][ T5931] veth0_macvtap: left promiscuous mode [ 713.872153][ T5931] veth1_vlan: left promiscuous mode [ 713.877725][ T5931] veth0_vlan: left promiscuous mode [ 714.176949][ T5931] team0 (unregistering): Port device team_slave_1 removed [ 714.196172][ T5931] team0 (unregistering): Port device team_slave_0 removed [ 714.817328][ T9577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 714.841910][ T9577] 8021q: adding VLAN 0 to HW filter on device team0 [ 714.885536][ T5974] bridge0: port 1(bridge_slave_0) entered blocking state [ 714.892755][ T5974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 714.917328][ T6047] bridge0: port 2(bridge_slave_1) entered blocking state [ 714.924662][ T6047] bridge0: port 2(bridge_slave_1) entered forwarding state [ 715.072786][ T9709] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 715.093985][ T9709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 715.102896][ T9709] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 715.113004][ T9709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 715.121885][ T9709] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 715.133199][ T9709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 715.175664][ T9709] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 715.209219][ T9709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 715.618638][ T5931] IPVS: stop unused estimator thread 0... [ 715.771512][ T9709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 715.888300][ T9709] 8021q: adding VLAN 0 to HW filter on device team0 [ 715.917144][ T5862] bridge0: port 1(bridge_slave_0) entered blocking state [ 715.924393][ T5862] bridge0: port 1(bridge_slave_0) entered forwarding state [ 715.972499][ T5954] bridge0: port 2(bridge_slave_1) entered blocking state [ 715.979867][ T5954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 716.370469][ T9577] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 716.592868][ T9832] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 716.608323][ T9832] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 716.622487][ T9832] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 716.646537][ T9832] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 716.671788][ T9832] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 716.721582][ T9832] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 716.743866][ T9832] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 716.769458][ T9832] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 717.173298][ T9832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 717.269506][ T9577] veth0_vlan: entered promiscuous mode [ 717.293260][ T9832] 8021q: adding VLAN 0 to HW filter on device team0 [ 717.339443][ T6047] bridge0: port 1(bridge_slave_0) entered blocking state [ 717.346758][ T6047] bridge0: port 1(bridge_slave_0) entered forwarding state [ 717.380083][ T6047] bridge0: port 2(bridge_slave_1) entered blocking state [ 717.387368][ T6047] bridge0: port 2(bridge_slave_1) entered forwarding state [ 717.405310][ T9577] veth1_vlan: entered promiscuous mode [ 717.428992][ T9709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 717.600937][ T9577] veth0_macvtap: entered promiscuous mode [ 717.635494][ T9577] veth1_macvtap: entered promiscuous mode [ 717.743910][ T9709] veth0_vlan: entered promiscuous mode [ 717.774992][ T9577] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 717.821831][ T9577] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 717.863981][ T9709] veth1_vlan: entered promiscuous mode [ 717.910525][ T5974] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.937013][ T5974] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.949194][ T5974] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.020234][ T5974] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.158675][ T9709] veth0_macvtap: entered promiscuous mode [ 718.230497][ T9709] veth1_macvtap: entered promiscuous mode [ 718.329368][ T7435] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 718.350739][ T7435] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 718.380202][ T9709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 718.426754][ T9709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 718.469861][ T5862] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.479247][ T7435] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 718.499544][ T7435] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 718.517121][ T5862] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.529417][ T5862] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.551487][ T5862] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.063265][ T5931] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.148592][ T5931] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 720.336559][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 720.397731][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 720.724786][T10086] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 720.735371][T10086] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 720.744087][T10086] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 721.686267][ T9832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 721.979487][T10094] loop9: detected capacity change from 0 to 32768 [ 721.989672][ T5631] Bluetooth: hci4: connection err: -111 [ 722.028340][T10094] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop9 (7:9) scanned by syz.9.656 (10094) [ 722.315919][T10094] BTRFS info (device loop9): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 723.033501][T10094] BTRFS info (device loop9): using crc32c checksum algorithm [ 724.501778][T10096] loop0: detected capacity change from 0 to 2048 [ 724.545527][ T30] audit: type=1326 audit(1785171588.506:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 724.593835][T10094] BTRFS info (device loop9): setting nodatasum [ 724.600341][T10094] BTRFS info (device loop9): setting nodatacow [ 724.606624][T10094] BTRFS info (device loop9): turning on async discard [ 724.614641][T10094] BTRFS info (device loop9): enabling free space tree [ 724.621459][T10094] BTRFS info (device loop9): max_inline set to 0 [ 724.629488][ T30] audit: type=1326 audit(1785171588.506:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 724.655508][ T30] audit: type=1326 audit(1785171588.536:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 724.681984][ T30] audit: type=1326 audit(1785171588.536:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 724.712569][ T30] audit: type=1326 audit(1785171588.536:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 724.808094][T10096] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 724.862434][ T9013] BTRFS info (device loop9): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 724.974652][ T30] audit: type=1326 audit(1785171588.536:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 725.148332][ T30] audit: type=1326 audit(1785171588.536:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 725.346075][ T30] audit: type=1326 audit(1785171588.536:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 725.862561][ T30] audit: type=1326 audit(1785171588.536:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 725.935232][T10120] 8021q: adding VLAN 0 to HW filter on device bond1 [ 726.068339][ T30] audit: type=1326 audit(1785171588.536:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10092 comm="syz.3.524" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffb6b19de99 code=0x7ffc0000 [ 728.466901][T10126] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 728.496548][ T5974] net_ratelimit: 30 callbacks suppressed [ 728.496578][ T5974] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 730.562481][ T1012] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 732.867827][T10152] overlayfs: missing 'workdir' [ 736.018123][ T9832] veth0_vlan: entered promiscuous mode [ 736.703373][ T9832] veth1_vlan: entered promiscuous mode [ 736.908944][ T9832] veth0_macvtap: entered promiscuous mode [ 736.943148][ T9832] veth1_macvtap: entered promiscuous mode [ 737.010691][ T9832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 737.050733][ T9832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 737.149629][ T5954] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.188770][ T5954] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.507752][ T5954] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.522909][ T5954] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.874016][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 738.899302][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 738.988706][ T5931] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 739.015025][ T5931] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 740.481181][T10200] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 740.500774][T10200] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 742.596280][T10215] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 742.605216][T10215] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 742.614402][T10215] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 744.267275][T10228] openvswitch: netlink: IP tunnel dst address not specified [ 745.405740][T10235] bond1: option mode: unable to set because the bond device has slaves [ 746.742680][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.749237][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.228221][T10261] overlayfs: missing 'workdir' [ 753.260931][T10270] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 753.272569][T10270] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 754.161368][T10254] netlink: 24 bytes leftover after parsing attributes in process `syz.8.670'. [ 754.446943][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 754.447052][ T30] audit: type=1804 audit(1785171618.406:60): pid=10275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.679" name="bus" dev="ramfs" ino=31530 res=1 errno=0 [ 754.492410][T10254] netlink: 4 bytes leftover after parsing attributes in process `syz.8.670'. [ 754.595885][ T30] audit: type=1804 audit(1785171618.436:61): pid=10275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.679" name="bus" dev="ramfs" ino=31530 res=1 errno=0 [ 756.618021][T10284] loop8: detected capacity change from 0 to 1024 [ 759.204071][T10291] overlay: Unknown parameter '/' [ 759.319807][T10300] overlayfs: overlapping lowerdir path [ 760.473028][T10315] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 761.772148][T10319] bond1: option mode: unable to set because the bond device has slaves [ 761.824408][T10304] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(9) [ 761.831185][T10304] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 761.872705][T10304] vhci_hcd vhci_hcd.0: Device attached [ 761.957889][T10320] vhci_hcd: connection closed [ 761.995454][ T5931] vhci_hcd vhci_hcd.8: stop threads [ 762.017407][T10317] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 762.049267][ T5931] vhci_hcd vhci_hcd.8: release socket [ 763.838964][ T5931] vhci_hcd vhci_hcd.8: disconnect device [ 765.871960][T10351] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 765.885265][T10351] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 766.880215][T10362] bond1: option mode: unable to set because the bond device has slaves [ 767.259897][T10367] binder: 10358:10367 ioctl c0306201 0 returned -14 [ 769.083991][T10377] futex_wake_op: syz.0.700 tries to shift op by 144; fix this program [ 769.964707][ T5628] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 769.979660][ T5628] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 769.990539][ T5628] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 770.000441][ T5628] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 770.010628][ T5628] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 772.156949][ T5628] Bluetooth: hci1: command tx timeout [ 772.335204][T10394] bond1: option mode: unable to set because the bond device has slaves [ 772.854718][T10404] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 772.867334][T10404] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 774.222938][ T5628] Bluetooth: hci1: command tx timeout [ 775.410613][T10408] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 775.425078][T10408] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 775.618109][ T36] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 776.169705][T10432] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 776.179721][T10432] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 776.188417][T10432] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 776.446334][ T5628] Bluetooth: hci1: command tx timeout [ 777.286764][ T36] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.827318][T10443] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 777.848348][ T36] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.892962][T10443] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 777.922804][T10443] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 778.847233][ T5628] Bluetooth: hci1: command tx timeout [ 778.904136][T10452] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 779.685368][T10448] bond1: option mode: unable to set because the bond device has slaves [ 780.697243][T10382] wlan0 speed is unknown, defaulting to 1000 [ 781.410024][ T36] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.036264][T10479] loop0: detected capacity change from 0 to 3 [ 784.115634][T10479] syz.0.730: attempt to access beyond end of device [ 784.115634][T10479] loop0: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 784.367856][T10487] loop9: detected capacity change from 0 to 128 [ 784.425711][T10479] SQUASHFS error: Failed to read block 0x0: -5 [ 784.484155][T10487] qnx6: block size(2066842815) > page size(4096) not supported by filesystem [ 784.493815][T10487] qnx6: unable to set blocksize [ 784.585059][T10479] unable to read squashfs_super_block [ 784.655150][T10486] binder: 10482:10486 ioctl c0306201 0 returned -14 [ 785.512744][T10498] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 785.524783][T10498] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 788.414367][T10512] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 788.426996][T10512] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 789.643657][ T36] bridge_slave_1: left allmulticast mode [ 789.681163][ T36] bridge_slave_1: left promiscuous mode [ 790.293340][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 790.786808][ T36] bridge_slave_0: left allmulticast mode [ 790.821944][ T36] bridge_slave_0: left promiscuous mode [ 790.841508][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 791.990738][T10540] netlink: 12 bytes leftover after parsing attributes in process `syz.9.733'. [ 792.304834][ T5627] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 792.465623][ T5627] usb 10-1: Using ep0 maxpacket: 32 [ 792.490135][ T5627] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 792.518049][ T5627] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 792.539450][ T5627] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 792.560335][ T5627] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 792.577315][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 792.589324][ T5627] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 792.602639][ T5627] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 792.624997][ T5627] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 792.638419][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 792.647887][ T5627] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.659568][ T36] bond0 (unregistering): Released all slaves [ 792.681117][T10527] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 792.770667][ T5627] usb 10-1: config 0 descriptor?? [ 792.821151][T10554] bond1: option mode: unable to set because the bond device has slaves [ 793.133930][ T5627] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 793.363672][ T5627] usb 10-1: USB disconnect, device number 2 [ 793.455492][ T5627] usblp0: removed [ 793.564176][ T36] hsr_slave_0: left promiscuous mode [ 793.570954][ T36] hsr_slave_1: left promiscuous mode [ 793.577883][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 793.586356][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 793.596649][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 793.604228][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 793.630545][ T36] veth1_macvtap: left promiscuous mode [ 793.637739][ T36] veth0_macvtap: left promiscuous mode [ 793.643447][ T36] veth1_vlan: left promiscuous mode [ 793.650084][ T36] veth0_vlan: left promiscuous mode [ 793.993975][ T36] team0 (unregistering): Port device team_slave_1 removed [ 794.104796][ T36] team0 (unregistering): Port device team_slave_0 removed [ 798.779105][T10604] xt_TPROXY: Can be used only with -p tcp or -p udp [ 800.736229][T10616] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 800.782197][T10613] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 801.875851][T10382] bridge0: port 1(bridge_slave_0) entered blocking state [ 801.890825][T10382] bridge0: port 1(bridge_slave_0) entered disabled state [ 801.903787][T10382] bridge_slave_0: entered allmulticast mode [ 802.209781][T10382] bridge_slave_0: entered promiscuous mode [ 802.472740][T10584] bond1: option mode: unable to set because the bond device has slaves [ 802.649867][T10628] 8021q: adding VLAN 0 to HW filter on device bond1 [ 802.722627][T10382] bridge0: port 2(bridge_slave_1) entered blocking state [ 802.765871][T10382] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.797662][T10382] bridge_slave_1: entered allmulticast mode [ 802.821864][T10382] bridge_slave_1: entered promiscuous mode [ 803.067615][T10630] bond1: (slave geneve2): Enslaving as a backup interface with an up link [ 803.261145][ T341] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 803.434961][T10382] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 803.446027][ T1012] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 803.580866][T10382] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 805.022057][ T5628] Bluetooth: hci3: command 0x0406 tx timeout [ 805.039413][T10382] team0: Port device team_slave_0 added [ 805.080538][T10382] team0: Port device team_slave_1 added [ 805.888852][T10663] trusted_key: encrypted_key: insufficient parameters specified [ 807.281382][T10665] loop0: detected capacity change from 0 to 3 [ 807.333253][T10665] syz.0.753: attempt to access beyond end of device [ 807.333253][T10665] loop0: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 807.522401][T10670] hub 8-0:1.0: USB hub found [ 807.529204][T10670] hub 8-0:1.0: 1 port detected [ 808.289862][T10665] SQUASHFS error: Failed to read block 0x0: -5 [ 808.343040][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.366364][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.374926][T10382] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 808.399065][T10665] unable to read squashfs_super_block [ 808.407923][T10382] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 808.498179][T10382] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 808.827145][T10677] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 808.839582][T10677] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 809.587097][T10382] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 809.647625][T10382] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 809.769929][T10382] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 810.723763][T10685] 8021q: adding VLAN 0 to HW filter on device bond1 [ 815.376058][T10382] hsr_slave_0: entered promiscuous mode [ 815.433791][T10382] hsr_slave_1: entered promiscuous mode [ 815.670163][T10382] debugfs: 'hsr0' already exists in 'hsr' [ 815.706240][T10382] Cannot create hsr debugfs directory [ 816.199991][T10718] loop9: detected capacity change from 0 to 1024 [ 816.454611][ T5628] Bluetooth: hci1: command 0x0405 tx timeout [ 818.710348][T10722] loop3: detected capacity change from 0 to 1764 [ 820.374765][ T5631] Bluetooth: hci2: command 0x0406 tx timeout [ 820.418110][T10722] iso9660: Corrupted directory entry in block 14 of inode 1920 [ 821.544623][ T5782] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 821.807753][ T5782] usb 10-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 821.892386][ T5782] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.945454][ T5782] usb 10-1: Product: syz [ 821.983224][ T5782] usb 10-1: Manufacturer: syz [ 822.025834][ T5782] usb 10-1: SerialNumber: syz [ 822.368835][T10733] loop3: detected capacity change from 0 to 3 [ 822.438888][T10733] syz.3.770: attempt to access beyond end of device [ 822.438888][T10733] loop3: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 822.551631][T10733] SQUASHFS error: Failed to read block 0x0: -5 [ 822.620049][T10733] unable to read squashfs_super_block [ 822.951298][ T5631] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 822.978323][ T5631] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 822.996752][ T5631] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 823.017181][ T5631] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 823.027127][ T5782] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 823.059622][ T5631] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 823.079527][ T5782] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 823.347737][ T5782] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 823.719242][ T5782] lan78xx 10-1:1.0: probe with driver lan78xx failed with error -32 [ 823.827482][ T5628] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 823.856642][ T5628] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 823.870476][ T5628] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 823.884060][ T5628] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 823.900718][ T5628] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 825.429305][ T5628] Bluetooth: hci0: command tx timeout [ 825.582414][ T5782] usb 10-1: USB disconnect, device number 3 [ 826.009280][ T5631] Bluetooth: hci5: command tx timeout [ 827.977649][ T5631] Bluetooth: hci0: command tx timeout [ 828.710583][ T5631] Bluetooth: hci5: command tx timeout [ 829.064443][T10777] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 829.838243][T10781] bond1: option mode: unable to set because the bond device has slaves [ 830.306493][ T5628] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 830.331101][ T5628] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 830.360988][ T5628] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 830.392745][ T5628] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 830.440768][ T5628] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 830.456080][ T5628] Bluetooth: hci0: command tx timeout [ 830.521999][T10795] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 830.531416][T10795] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 830.540272][T10795] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 830.854756][ T5628] Bluetooth: hci5: command tx timeout [ 832.540692][ T5628] Bluetooth: hci2: command tx timeout [ 832.548098][ T5628] Bluetooth: hci0: command tx timeout [ 832.947311][ T5631] Bluetooth: hci5: command tx timeout [ 834.642415][ T5631] Bluetooth: hci2: command tx timeout [ 835.419196][ T5862] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.858560][T10832] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 835.870871][T10832] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 835.889737][T10832] overlayfs: failed to resolve './bus': -2 [ 836.695083][ T5631] Bluetooth: hci2: command tx timeout [ 838.777447][ T5631] Bluetooth: hci2: command tx timeout [ 841.020382][ T5862] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.981137][T10885] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 844.991330][T10885] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 845.001947][T10885] overlayfs: failed to resolve './bus': -2 [ 845.032973][ T5862] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 845.733573][T10736] wlan0 speed is unknown, defaulting to 1000 [ 846.152087][ T5862] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 847.321039][T10748] wlan0 speed is unknown, defaulting to 1000 [ 848.332813][T10791] wlan0 speed is unknown, defaulting to 1000 [ 853.554569][T10944] bond1: option mode: unable to set because the bond device is up [ 853.661275][T10946] bond1: (slave geneve2): Enslaving as a backup interface with an up link [ 853.688360][ T5931] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 853.855181][ T5931] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 854.225644][T10957] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 856.983292][ T5862] bridge_slave_1: left allmulticast mode [ 857.027698][ T5862] bridge_slave_1: left promiscuous mode [ 857.063398][ T5862] bridge0: port 2(bridge_slave_1) entered disabled state [ 857.152856][ T5862] bridge_slave_0: left allmulticast mode [ 857.199600][ T5862] bridge_slave_0: left promiscuous mode [ 857.685781][ T5862] bridge0: port 1(bridge_slave_0) entered disabled state [ 857.898087][T10985] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 857.908248][T10985] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 859.454700][T10999] No source specified [ 862.226433][ T5862] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 863.190155][ T5862] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 863.495651][T11028] loop9: detected capacity change from 0 to 256 [ 863.591202][T11028] exFAT-fs (loop9): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 863.661780][ T5862] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 863.711380][ T5862] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 863.734058][ T5862] bond0 (unregistering): Released all slaves [ 863.808672][ T5862] bond1 (unregistering): Released all slaves [ 864.734727][T11031] bond1: option mode: unable to set because the bond device has slaves [ 865.705796][T11050] exFAT-fs (loop9): valid_size(562949953421322) is greater than size(10) [ 865.814855][ T30] audit: type=1800 audit(1785171729.676:62): pid=11050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.819" name="file1" dev="loop9" ino=1048745 res=0 errno=0 [ 866.126755][T11054] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 866.137302][T11054] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 869.498963][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.507016][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 869.711724][T11101] loop3: detected capacity change from 0 to 2048 [ 869.866710][T11101] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 869.897208][T10736] bridge0: port 1(bridge_slave_0) entered blocking state [ 869.951001][T10736] bridge0: port 1(bridge_slave_0) entered disabled state [ 869.971738][T10736] bridge_slave_0: entered allmulticast mode [ 869.999226][T10736] bridge_slave_0: entered promiscuous mode [ 870.352119][T11107] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 870.414179][T11107] EXT4-fs error (device loop3) in ext4_setattr:6172: error 28 [ 870.860483][T10736] bridge0: port 2(bridge_slave_1) entered blocking state [ 871.074731][T10736] bridge0: port 2(bridge_slave_1) entered disabled state [ 871.085416][T10736] bridge_slave_1: entered allmulticast mode [ 871.093273][T10736] bridge_slave_1: entered promiscuous mode [ 871.172906][T11114] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 871.184593][T11114] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 871.928696][T10748] bridge0: port 1(bridge_slave_0) entered blocking state [ 871.951380][T10748] bridge0: port 1(bridge_slave_0) entered disabled state [ 871.997704][T10748] bridge_slave_0: entered allmulticast mode [ 872.007715][T11117] loop9: detected capacity change from 0 to 3 [ 872.020448][T11117] syz.9.834: attempt to access beyond end of device [ 872.020448][T11117] loop9: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 872.036785][T11117] SQUASHFS error: Failed to read block 0x0: -5 [ 872.043831][T11117] unable to read squashfs_super_block [ 872.081910][ T9709] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 872.099077][T10748] bridge_slave_0: entered promiscuous mode [ 872.196495][T11119] Invalid ELF header magic: != ELF [ 872.857757][T11122] loop0: detected capacity change from 0 to 3 [ 872.869362][T10736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 872.939631][T11122] syz.0.845: attempt to access beyond end of device [ 872.939631][T11122] loop0: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 872.976146][T11122] SQUASHFS error: Failed to read block 0x0: -5 [ 872.993357][ T5862] hsr_slave_0: left promiscuous mode [ 872.999064][T11122] unable to read squashfs_super_block [ 873.007536][ T5862] hsr_slave_1: left promiscuous mode [ 873.033716][ T5862] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 873.054910][ T5862] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 873.073888][ T5862] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 873.092812][ T5862] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 873.124348][ T5862] veth1_macvtap: left promiscuous mode [ 873.132643][ T5862] veth0_macvtap: left promiscuous mode [ 873.138473][ T5862] veth1_vlan: left promiscuous mode [ 873.143938][ T5862] veth0_vlan: left promiscuous mode [ 873.284263][T11128] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 873.298334][T11128] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 875.318551][T11139] process 'syz.3.839' launched './file0' with NULL argv: empty string added [ 876.928879][ T5862] team0 (unregistering): Port device team_slave_1 removed [ 876.970230][ T5862] team0 (unregistering): Port device team_slave_0 removed [ 882.002490][T11162] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 882.014822][T11162] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 882.689046][ T9866] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 882.701666][ T9866] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 882.711235][ T9866] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 882.726179][ T9866] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 882.738506][ T9866] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 882.774873][ T9866] Bluetooth: hci2: command 0x0405 tx timeout [ 884.032499][T10748] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.068971][T10748] bridge0: port 2(bridge_slave_1) entered disabled state [ 884.097182][T10748] bridge_slave_1: entered allmulticast mode [ 884.128831][T10748] bridge_slave_1: entered promiscuous mode [ 884.176416][T10736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 884.209624][T11174] loop9: detected capacity change from 0 to 3 [ 884.221132][T11174] syz.9.847: attempt to access beyond end of device [ 884.221132][T11174] loop9: rw=2048, sector=0, nr_sectors = 8 limit=3 [ 884.235344][T11174] SQUASHFS error: Failed to read block 0x0: -5 [ 884.369418][ T5628] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 884.394147][ T5628] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 884.405579][ T5628] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 884.415572][ T5628] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 884.428512][ T5628] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 884.516087][T11174] unable to read squashfs_super_block [ 884.520410][T10791] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.571596][T10791] bridge0: port 1(bridge_slave_0) entered disabled state [ 884.990381][ T5631] Bluetooth: hci1: command tx timeout [ 885.119538][ T30] audit: type=1800 audit(1785171748.586:63): pid=11180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.848" name="host_addr" dev="configfs" ino=34252 res=0 errno=0 [ 885.312742][T10791] bridge_slave_0: entered allmulticast mode [ 885.358847][T10791] bridge_slave_0: entered promiscuous mode [ 885.409281][T10791] bridge0: port 2(bridge_slave_1) entered blocking state [ 885.496346][T10791] bridge0: port 2(bridge_slave_1) entered disabled state [ 885.527940][T10791] bridge_slave_1: entered allmulticast mode [ 885.550302][T10791] bridge_slave_1: entered promiscuous mode [ 885.764041][T10791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 885.836132][T10791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 886.051906][T10791] team0: Port device team_slave_0 added [ 886.104884][T10791] team0: Port device team_slave_1 added [ 886.316553][T10791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 886.334780][T10791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 886.415828][T10791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 886.619121][ T5631] Bluetooth: hci6: command tx timeout [ 886.732851][T10791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 886.740057][T10791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 886.766285][T10791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 886.901568][ T5974] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.954375][T11163] wlan0 speed is unknown, defaulting to 1000 [ 887.015133][ T5631] Bluetooth: hci1: command tx timeout [ 887.093687][T10791] hsr_slave_0: entered promiscuous mode [ 887.119982][T10791] hsr_slave_1: entered promiscuous mode [ 887.136873][T10791] debugfs: 'hsr0' already exists in 'hsr' [ 887.147315][T10791] Cannot create hsr debugfs directory [ 887.201221][ T5974] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 887.388830][ T5974] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 887.455974][T11176] wlan0 speed is unknown, defaulting to 1000 [ 887.509325][ T5974] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.463915][ T5974] bridge_slave_1: left allmulticast mode [ 888.470113][ T5974] bridge_slave_1: left promiscuous mode [ 888.476124][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.487663][ T5974] bridge_slave_0: left allmulticast mode [ 888.493433][ T5974] bridge_slave_0: left promiscuous mode [ 888.500646][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.520087][ T5974] bridge_slave_1: left allmulticast mode [ 888.526653][ T5974] bridge_slave_1: left promiscuous mode [ 888.532605][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.558894][ T5974] bridge_slave_0: left allmulticast mode [ 888.565343][ T5974] bridge_slave_0: left promiscuous mode [ 888.571195][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.695116][ T5631] Bluetooth: hci6: command tx timeout [ 888.842256][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 888.864862][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 888.901302][ T5974] bond0 (unregistering): Released all slaves [ 888.979155][ T5974] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 888.988671][ T5974] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 889.077602][ T5628] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 889.096091][ T9866] Bluetooth: hci1: command tx timeout [ 889.112420][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 889.123986][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 889.133215][ T5628] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 889.141450][ T5628] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 889.191199][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 889.205009][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 889.219451][ T5974] bond0 (unregistering): Released all slaves [ 889.235470][ T5974] bond1 (unregistering): Released all slaves [ 889.688591][T11163] bridge0: port 1(bridge_slave_0) entered blocking state [ 889.711576][T11163] bridge0: port 1(bridge_slave_0) entered disabled state [ 889.735422][T11163] bridge_slave_0: entered allmulticast mode [ 889.754386][T11163] bridge_slave_0: entered promiscuous mode [ 889.855305][T11163] bridge0: port 2(bridge_slave_1) entered blocking state [ 889.878888][T11163] bridge0: port 2(bridge_slave_1) entered disabled state [ 889.911393][T11163] bridge_slave_1: entered allmulticast mode [ 889.926463][T11163] bridge_slave_1: entered promiscuous mode [ 889.956538][ T5631] ================================================================== [ 889.964750][ T5631] BUG: KASAN: slab-use-after-free in l2cap_disconn_ind+0xd7/0xf0 [ 889.972529][ T5631] Read of size 1 at addr ffff88807b5f5a78 by task kworker/u9:4/5631 [ 889.980537][ T5631] [ 889.982943][ T5631] CPU: 1 UID: 0 PID: 5631 Comm: kworker/u9:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 889.982999][ T5631] Tainted: [L]=SOFTLOCKUP [ 889.983012][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 889.983038][ T5631] Workqueue: hci2 hci_conn_timeout [ 889.983097][ T5631] Call Trace: [ 889.983108][ T5631] [ 889.983122][ T5631] dump_stack_lvl+0x100/0x190 [ 889.983163][ T5631] print_report+0x13d/0x4b0 [ 889.983222][ T5631] ? srso_alias_return_thunk+0x5/0xfbef5 [ 889.983266][ T5631] ? __virt_addr_valid+0x239/0x430 [ 889.983320][ T5631] ? l2cap_disconn_ind+0xd7/0xf0 [ 889.983366][ T5631] kasan_report+0xdf/0x1c0 [ 889.983406][ T5631] ? l2cap_disconn_ind+0xd7/0xf0 [ 889.983455][ T5631] l2cap_disconn_ind+0xd7/0xf0 [ 889.983500][ T5631] hci_conn_timeout+0x1dc/0x230 [ 889.983553][ T5631] process_one_work+0xa23/0x1940 [ 889.983596][ T5631] ? __pfx_process_one_work+0x10/0x10 [ 889.983628][ T5631] ? srso_alias_return_thunk+0x5/0xfbef5 [ 889.983680][ T5631] ? srso_alias_return_thunk+0x5/0xfbef5 [ 889.983728][ T5631] worker_thread+0x5ef/0xe50 [ 889.983771][ T5631] ? kthread+0x13a/0x450 [ 889.983827][ T5631] ? __pfx_worker_thread+0x10/0x10 [ 889.983859][ T5631] kthread+0x370/0x450 [ 889.983912][ T5631] ? __pfx_kthread+0x10/0x10 [ 889.983969][ T5631] ret_from_fork+0x72b/0xd50 [ 889.984018][ T5631] ? __pfx_ret_from_fork+0x10/0x10 [ 889.984066][ T5631] ? srso_alias_return_thunk+0x5/0xfbef5 [ 889.984110][ T5631] ? __switch_to+0x800/0x10f0 [ 889.984168][ T5631] ? __switch_to_asm+0x39/0x70 [ 889.984218][ T5631] ? __pfx_kthread+0x10/0x10 [ 889.984275][ T5631] ret_from_fork_asm+0x1a/0x30 [ 889.984346][ T5631] [ 889.984359][ T5631] [ 890.148581][ T5631] Allocated by task 11153: [ 890.152994][ T5631] kasan_save_stack+0x30/0x50 [ 890.157707][ T5631] kasan_save_track+0x14/0x30 [ 890.162421][ T5631] __kasan_kmalloc+0xaa/0xb0 [ 890.167045][ T5631] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 890.172439][ T5631] l2cap_conn_add.part.0+0x60/0xb00 [ 890.177677][ T5631] l2cap_chan_connect+0x1435/0x1f90 [ 890.182898][ T5631] l2cap_sock_connect+0x37a/0x770 [ 890.187952][ T5631] kernel_connect+0x107/0x160 [ 890.192680][ T5631] rfcomm_dlc_open+0x838/0xac0 [ 890.197470][ T5631] rfcomm_sock_connect+0x42c/0x690 [ 890.202611][ T5631] __sys_connect_file+0x141/0x1a0 [ 890.207656][ T5631] __sys_connect+0x141/0x170 [ 890.212268][ T5631] __x64_sys_connect+0x72/0xb0 [ 890.217073][ T5631] do_syscall_64+0x115/0x870 [ 890.221684][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.227674][ T5631] [ 890.229988][ T5631] Freed by task 3205: [ 890.233967][ T5631] kasan_save_stack+0x30/0x50 [ 890.238673][ T5631] kasan_save_track+0x14/0x30 [ 890.243381][ T5631] kasan_save_free_info+0x3b/0x70 [ 890.248423][ T5631] __kasan_slab_free+0x5f/0x80 [ 890.253197][ T5631] kfree+0x22b/0x6c0 [ 890.257118][ T5631] l2cap_chan_put+0x35a/0x3f0 [ 890.261827][ T5631] l2cap_sock_release+0x1db/0x280 [ 890.266886][ T5631] sock_release+0x91/0x1c0 [ 890.271310][ T5631] rfcomm_session_del.isra.0+0x16b/0x250 [ 890.276956][ T5631] rfcomm_run+0x6dc/0x5580 [ 890.281391][ T5631] kthread+0x370/0x450 [ 890.285508][ T5631] ret_from_fork+0x72b/0xd50 [ 890.290115][ T5631] ret_from_fork_asm+0x1a/0x30 [ 890.294915][ T5631] [ 890.297234][ T5631] The buggy address belongs to the object at ffff88807b5f5800 [ 890.297234][ T5631] which belongs to the cache kmalloc-1k of size 1024 [ 890.311304][ T5631] The buggy address is located 632 bytes inside of [ 890.311304][ T5631] freed 1024-byte region [ffff88807b5f5800, ffff88807b5f5c00) [ 890.325213][ T5631] [ 890.327570][ T5631] The buggy address belongs to the physical page: [ 890.333974][ T5631] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b5f0 [ 890.342782][ T5631] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 890.351299][ T5631] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 890.358854][ T5631] page_type: f5(slab) [ 890.362879][ T5631] raw: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 890.371479][ T5631] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 890.380085][ T5631] head: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 890.388772][ T5631] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 890.397466][ T5631] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 890.406547][ T5631] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 890.415216][ T5631] page dumped because: kasan: bad access detected [ 890.421624][ T5631] page_owner tracks the page as allocated [ 890.427330][ T5631] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 341, tgid 341 (kworker/u8:6), ts 742325943136, free_ts 742295273916 [ 890.449502][ T5631] post_alloc_hook+0xfd/0x120 [ 890.454217][ T5631] get_page_from_freelist+0xf48/0x3530 [ 890.459708][ T5631] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 890.465636][ T5631] new_slab+0xa2/0x640 [ 890.469725][ T5631] refill_objects+0xe3/0x410 [ 890.474336][ T5631] __pcs_replace_empty_main+0x376/0x680 [ 890.479908][ T5631] __kmalloc_noprof+0x66d/0x820 [ 890.484789][ T5631] ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 890.490696][ T5631] ieee80211_inform_bss+0x159/0x1170 [ 890.496011][ T5631] cfg80211_inform_single_bss_data+0x898/0x1dc0 [ 890.502283][ T5631] cfg80211_inform_bss_data+0x230/0x3b60 [ 890.507953][ T5631] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 890.514056][ T5631] ieee80211_bss_info_update+0x310/0xab0 [ 890.519725][ T5631] ieee80211_ibss_rx_queued_mgmt+0xe04/0x1c70 [ 890.526091][ T5631] ieee80211_iface_work+0xa9a/0x1070 [ 890.531441][ T5631] cfg80211_wiphy_work+0x2b7/0x550 [ 890.536628][ T5631] page last free pid 9832 tgid 9832 stack trace: [ 890.542989][ T5631] __free_frozen_pages+0x79f/0x1090 [ 890.548211][ T5631] qlist_free_all+0x47/0xf0 [ 890.552747][ T5631] kasan_quarantine_reduce+0x1a0/0x1f0 [ 890.558235][ T5631] __kasan_slab_alloc+0x69/0x90 [ 890.563104][ T5631] __kvmalloc_node_noprof+0x2eb/0x970 [ 890.568509][ T5631] xt_alloc_table_info+0x44/0xa0 [ 890.573478][ T5631] do_ip6t_set_ctl+0x611/0xd00 [ 890.578265][ T5631] nf_setsockopt+0x8d/0xf0 [ 890.582708][ T5631] ipv6_setsockopt+0x135/0x170 [ 890.587497][ T5631] tcp_setsockopt+0xa7/0x100 [ 890.592119][ T5631] do_sock_setsockopt+0xf3/0x1d0 [ 890.597092][ T5631] __sys_setsockopt+0x195/0x220 [ 890.601974][ T5631] __x64_sys_setsockopt+0xbd/0x160 [ 890.607163][ T5631] do_syscall_64+0x115/0x870 [ 890.611775][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.617686][ T5631] [ 890.620000][ T5631] Memory state around the buggy address: [ 890.625637][ T5631] ffff88807b5f5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 890.633712][ T5631] ffff88807b5f5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 890.641784][ T5631] >ffff88807b5f5a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 890.649851][ T5631] ^ SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 890.657840][ T5631] ffff88807b5f5a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 890.665962][ T5631] ffff88807b5f5b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 890.674054][ T5631] ================================================================== [ 890.685897][ T5631] Disabling lock debugging due to kernel taint [ 890.774591][ T5628] Bluetooth: hci6: command tx timeout [ 891.185684][ T5628] Bluetooth: hci1: command tx timeout [ 891.254732][ T5628] Bluetooth: hci0: command tx timeout [ 891.368098][ T5974] hsr_slave_0: left promiscuous mode [ 891.424205][ T5974] hsr_slave_1: left promiscuous mode [ 891.446171][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 891.486757][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 891.594931][ T5974] hsr_slave_0: left promiscuous mode [ 891.627944][ T5974] hsr_slave_1: left promiscuous mode [ 891.637169][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 891.654966][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 891.679064][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 891.717314][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 891.775884][ T5974] veth1_macvtap: left promiscuous mode [ 891.781460][ T5974] veth0_macvtap: left promiscuous mode [ 891.787197][ T5974] veth1_vlan: left promiscuous mode [ 891.815325][ T5974] veth0_vlan: left promiscuous mode [ 892.044150][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 892.067437][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 892.248611][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 892.261511][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 893.071117][ T5974] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.105458][ T5974] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.153678][ T5974] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.215503][ T5974] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.326807][ T5974] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.341560][ T5281] 8021q: adding VLAN 0 to HW filter on device eth23 [ 893.369152][ T5974] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.435762][ T5974] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.510355][ T5974] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.630593][ T5974] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.678447][ T5974] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.743654][ T5974] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.800931][ T5974] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.883427][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 894.202642][ T5974] bridge_slave_1: left allmulticast mode [ 894.211067][ T5974] bridge_slave_1: left promiscuous mode [ 894.217179][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.225908][ T5974] bridge_slave_0: left allmulticast mode [ 894.231770][ T5974] bridge_slave_0: left promiscuous mode [ 894.239077][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.251946][ T5974] bridge_slave_1: left allmulticast mode [ 894.257990][ T5974] bridge_slave_1: left promiscuous mode [ 894.263727][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.273463][ T5974] bridge_slave_0: left allmulticast mode [ 894.279220][ T5974] bridge_slave_0: left promiscuous mode [ 894.285896][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.298546][ T5974] bridge_slave_1: left allmulticast mode [ 894.304208][ T5974] bridge_slave_1: left promiscuous mode [ 894.310558][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.319201][ T5974] bridge_slave_0: left allmulticast mode [ 894.324888][ T5974] bridge_slave_0: left promiscuous mode [ 894.330581][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.343355][ T5974] bridge_slave_1: left allmulticast mode [ 894.349244][ T5974] bridge_slave_1: left promiscuous mode [ 894.355237][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.363934][ T5974] bridge_slave_0: left allmulticast mode [ 894.369760][ T5974] bridge_slave_0: left promiscuous mode [ 894.376060][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.388668][ T5974] bridge_slave_1: left allmulticast mode [ 894.394337][ T5974] bridge_slave_1: left promiscuous mode [ 894.400194][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.408478][ T5974] bridge_slave_0: left allmulticast mode [ 894.414120][ T5974] bridge_slave_0: left promiscuous mode [ 894.420323][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.430034][ T5974] bridge_slave_1: left allmulticast mode [ 894.436163][ T5974] bridge_slave_1: left promiscuous mode [ 894.441885][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.450391][ T5974] bridge_slave_0: left allmulticast mode [ 894.456861][ T5974] bridge_slave_0: left promiscuous mode [ 894.462605][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.472478][ T5974] bridge_slave_1: left allmulticast mode [ 894.478612][ T5974] bridge_slave_1: left promiscuous mode [ 894.484354][ T5974] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.494172][ T5974] bridge_slave_0: left allmulticast mode [ 894.500288][ T5974] bridge_slave_0: left promiscuous mode [ 894.506388][ T5974] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.608238][ T5974] bond0 (unregistering): Released all slaves [ 894.639123][ T5974] bond0 (unregistering): Released all slaves [ 894.654336][ T5974] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 894.690807][ T5974] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 894.700191][ T5974] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 894.722285][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 894.732657][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 894.742591][ T5974] bond0 (unregistering): Released all slaves [ 894.752124][ T5974] bond1 (unregistering): Released all slaves [ 894.790794][ T5974] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 894.803557][ T5974] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 894.823034][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 894.833969][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 894.844248][ T5974] bond0 (unregistering): Released all slaves [ 894.853464][ T5974] bond1 (unregistering): Released all slaves [ 894.892877][ T5974] bond1 (unregistering): (slave geneve2): Removing an active aggregator [ 894.901855][ T5974] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 894.921891][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 894.933236][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 894.944440][ T5974] bond0 (unregistering): Released all slaves [ 894.955802][ T5974] bond1 (unregistering): Released all slaves [ 894.991748][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 895.004939][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 895.016632][ T5974] bond0 (unregistering): Released all slaves [ 895.044536][ T5974] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 895.056418][ T5974] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 895.066753][ T5974] bond0 (unregistering): Released all slaves [ 895.097433][ T5974] bond0 (unregistering): Released all slaves [ 895.109056][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 895.442860][T10872] smbdirect: ib_dev[syz0] removed [ 895.466914][ T5775] wlan0 speed is unknown, defaulting to 1000 [ 895.481101][ T5775] infiniband syz0: ib_query_port failed (-19) [ 895.565826][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3 [ 895.762018][ T5974] hsr_slave_0: left promiscuous mode [ 895.768614][ T5974] hsr_slave_1: left promiscuous mode [ 895.774461][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 895.781911][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 895.790284][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 895.800659][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.815775][ T5974] hsr_slave_0: left promiscuous mode [ 895.821660][ T5974] hsr_slave_1: left promiscuous mode [ 895.828017][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 895.835468][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 895.843272][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 895.852867][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.863696][ T5974] hsr_slave_0: left promiscuous mode [ 895.870201][ T5974] hsr_slave_1: left promiscuous mode [ 895.876459][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 895.883865][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 895.892249][ T5974] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 895.903619][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.915408][ T5974] hsr_slave_0: left promiscuous mode [ 895.921260][ T5974] hsr_slave_1: left promiscuous mode [ 895.928280][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 895.936146][ T5974] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.956793][ T5974] veth1_macvtap: left promiscuous mode [ 895.962332][ T5974] veth0_macvtap: left promiscuous mode [ 895.968721][ T5974] veth1_vlan: left promiscuous mode [ 895.974020][ T5974] veth0_vlan: left promiscuous mode [ 895.981521][ T5974] veth1_macvtap: left promiscuous mode [ 895.987602][ T5974] veth0_macvtap: left promiscuous mode [ 895.993163][ T5974] veth1_vlan: left promiscuous mode [ 895.998473][ T5974] veth0_vlan: left promiscuous mode [ 896.004910][ T5974] veth1_macvtap: left promiscuous mode [ 896.010448][ T5974] veth0_macvtap: left promiscuous mode [ 896.016372][ T5974] veth1_vlan: left promiscuous mode [ 896.021660][ T5974] veth0_vlan: left promiscuous mode [ 896.321929][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 896.334445][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 896.467454][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 896.480509][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 896.635851][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 896.648244][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 896.778635][ T5974] team0 (unregistering): Port device team_slave_1 removed [ 896.804554][ T5974] team0 (unregistering): Port device team_slave_0 removed [ 896.960527][ T5281] 8021q: adding VLAN 0 to HW filter on device eth4 [ 898.802863][ T5281] 8021q: adding VLAN 0 to HW filter on device eth7 [ 899.129639][ T5281] 8021q: adding VLAN 0 to HW filter on device eth8